====================================================== WARNING: possible circular locking dependency detected 4.16.0-rc2+ #328 Not tainted ------------------------------------------------------ syz-executor1/25317 is trying to acquire lock: (&mm->mmap_sem){++++}, at: [<0000000061ad3269>] __might_fault+0xe0/0x1d0 mm/memory.c:4570 but task is already holding lock: (ashmem_mutex){+.+.}, at: [<00000000ea65b450>] ashmem_pin_unpin drivers/staging/android/ashmem.c:705 [inline] (ashmem_mutex){+.+.}, at: [<00000000ea65b450>] ashmem_ioctl+0x3db/0x11b0 drivers/staging/android/ashmem.c:782 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (ashmem_mutex){+.+.}: __mutex_lock_common kernel/locking/mutex.c:756 [inline] __mutex_lock+0x16f/0x1a80 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 ashmem_mmap+0x53/0x410 drivers/staging/android/ashmem.c:362 call_mmap include/linux/fs.h:1786 [inline] mmap_region+0xa99/0x15a0 mm/mmap.c:1705 do_mmap+0x6c0/0xe00 mm/mmap.c:1483 do_mmap_pgoff include/linux/mm.h:2223 [inline] vm_mmap_pgoff+0x1de/0x280 mm/util.c:355 SYSC_mmap_pgoff mm/mmap.c:1533 [inline] SyS_mmap_pgoff+0x462/0x5f0 mm/mmap.c:1491 SYSC_mmap arch/x86/kernel/sys_x86_64.c:100 [inline] SyS_mmap+0x16/0x20 arch/x86/kernel/sys_x86_64.c:91 do_syscall_64+0x280/0x940 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 -> #0 (&mm->mmap_sem){++++}: lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3920 __might_fault+0x13a/0x1d0 mm/memory.c:4571 _copy_from_user+0x2c/0x110 lib/usercopy.c:10 copy_from_user include/linux/uaccess.h:147 [inline] ashmem_pin_unpin drivers/staging/android/ashmem.c:710 [inline] ashmem_ioctl+0x438/0x11b0 drivers/staging/android/ashmem.c:782 vfs_ioctl fs/ioctl.c:46 [inline] do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:686 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692 do_syscall_64+0x280/0x940 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(ashmem_mutex); lock(&mm->mmap_sem); lock(ashmem_mutex); lock(&mm->mmap_sem); *** DEADLOCK *** 1 lock held by syz-executor1/25317: #0: (ashmem_mutex){+.+.}, at: [<00000000ea65b450>] ashmem_pin_unpin drivers/staging/android/ashmem.c:705 [inline] #0: (ashmem_mutex){+.+.}, at: [<00000000ea65b450>] ashmem_ioctl+0x3db/0x11b0 drivers/staging/android/ashmem.c:782 stack backtrace: CPU: 1 PID: 25317 Comm: syz-executor1 Not tainted 4.16.0-rc2+ #328 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x24d lib/dump_stack.c:53 print_circular_bug.isra.38+0x2cd/0x2dc kernel/locking/lockdep.c:1223 check_prev_add kernel/locking/lockdep.c:1863 [inline] check_prevs_add kernel/locking/lockdep.c:1976 [inline] validate_chain kernel/locking/lockdep.c:2417 [inline] __lock_acquire+0x30a8/0x3e00 kernel/locking/lockdep.c:3431 lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3920 __might_fault+0x13a/0x1d0 mm/memory.c:4571 _copy_from_user+0x2c/0x110 lib/usercopy.c:10 copy_from_user include/linux/uaccess.h:147 [inline] ashmem_pin_unpin drivers/staging/android/ashmem.c:710 [inline] ashmem_ioctl+0x438/0x11b0 drivers/staging/android/ashmem.c:782 vfs_ioctl fs/ioctl.c:46 [inline] do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:686 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692 do_syscall_64+0x280/0x940 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x453de9 RSP: 002b:00007f8d67303c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f8d673046d4 RCX: 0000000000453de9 RDX: 0000000000000000 RSI: 0000000000007709 RDI: 0000000000000013 RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 000000000000017a R14: 00000000006f2410 R15: 0000000000000000 device eql entered promiscuous mode device bond0 entered promiscuous mode QAT: Invalid ioctl x86/PAT: syz-executor5:25668 map pfn RAM range req write-combining for [mem 0x19bd80000-0x19bd83fff], got write-back x86/PAT: syz-executor5:25676 map pfn RAM range req write-combining for [mem 0x19bd80000-0x19bd83fff], got write-back QAT: Invalid ioctl bridge: RTM_NEWNEIGH with invalid state 0x0 netlink: 'syz-executor2': attribute type 3 has an invalid length. netlink: 'syz-executor2': attribute type 3 has an invalid length. xt_connbytes: Forcing CT accounting to be enabled kauditd_printk_skb: 743 callbacks suppressed audit: type=1400 audit(1519567993.055:13489): avc: denied { map } for pid=25981 comm="modprobe" path="/bin/kmod" dev="sda1" ino=1440 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 audit: type=1400 audit(1519567993.087:13490): avc: denied { net_admin } for pid=4270 comm="syz-executor7" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519567993.087:13491): avc: denied { map } for pid=25981 comm="modprobe" path="/etc/ld.so.cache" dev="sda1" ino=2503 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 audit: type=1400 audit(1519567993.120:13492): avc: denied { net_raw } for pid=25975 comm="syz-executor3" capability=13 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519567993.120:13493): avc: denied { map } for pid=25963 comm="syz-executor6" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=73591 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:hugetlbfs_t:s0 tclass=file permissive=1 audit: type=1400 audit(1519567993.120:13494): avc: denied { map } for pid=25986 comm="modprobe" path="/bin/kmod" dev="sda1" ino=1440 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 audit: type=1400 audit(1519567993.143:13495): avc: denied { net_admin } for pid=25982 comm="syz-executor0" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519567993.251:13497): avc: denied { net_admin } for pid=20342 comm="syz-executor0" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519567993.251:13496): avc: denied { net_admin } for pid=4271 comm="syz-executor3" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519567993.636:13498): avc: denied { dac_read_search } for pid=25994 comm="syz-executor4" capability=2 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 device syz2 entered promiscuous mode encrypted_key: insufficient parameters specified encrypted_key: insufficient parameters specified PPPIOCDETACH file->f_count=2 device eql entered promiscuous mode kernel msg: ebtables bug: please report to author: bad policy kernel msg: ebtables bug: please report to author: bad policy xt_l2tp: invalid flags combination: 0 xt_l2tp: invalid flags combination: 0 binder: 26408:26412 transaction failed 29189/-22, size 32-8 line 2848 binder: 26408:26412 transaction failed 29189/-22, size 32-8 line 2848 binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29189 QAT: Invalid ioctl QAT: Invalid ioctl Trying to set illegal importance in message Trying to set illegal importance in message FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 1 CPU: 0 PID: 26606 Comm: syz-executor6 Not tainted 4.16.0-rc2+ #328 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x24d lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:422 [inline] slab_alloc mm/slab.c:3365 [inline] kmem_cache_alloc+0x47/0x760 mm/slab.c:3539 ptlock_alloc+0x24/0x70 mm/memory.c:4728 ptlock_init include/linux/mm.h:1796 [inline] pgtable_page_ctor include/linux/mm.h:1830 [inline] pte_alloc_one+0x59/0x100 arch/x86/mm/pgtable.c:32 __do_huge_pmd_anonymous_page mm/huge_memory.c:564 [inline] do_huge_pmd_anonymous_page+0x551/0x1b00 mm/huge_memory.c:728 create_huge_pmd mm/memory.c:3870 [inline] __handle_mm_fault+0x18d7/0x3b60 mm/memory.c:4074 handle_mm_fault+0x44a/0xb00 mm/memory.c:4140 __do_page_fault+0x5c9/0xc90 arch/x86/mm/fault.c:1426 do_page_fault+0xee/0x730 arch/x86/mm/fault.c:1501 page_fault+0x62/0x90 arch/x86/entry/entry_64.S:1122 RIP: 0010:__put_user_4+0x1c/0x30 arch/x86/lib/putuser.S:68 RSP: 0018:ffff8801aeddfd08 EFLAGS: 00010293 RAX: 0000000000000015 RBX: 00007fffffffeffd RCX: 0000000020001ff8 RDX: 000000000000009f RSI: ffffc900044e2000 RDI: 0000000000000282 RBP: ffff8801aeddfe00 R08: 0000000000000000 R09: 1ffff10035dbbf7e R10: ffff8801aeddfbb8 R11: ffff8801ca2dd3c8 R12: 1ffff10035dbbfa7 R13: 0000000000000015 R14: 0000000000000005 R15: 0000000000000016 do_syscall_64+0x280/0x940 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x453de9 RSP: 002b:00007f3b406f6c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000035 RAX: ffffffffffffffda RBX: 00007f3b406f76d4 RCX: 0000000000453de9 RDX: 0000000000000000 RSI: 0000000000000005 RDI: 000000000000001e RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000020001ff8 R11: 0000000000000246 R12: 0000000000000014 R13: 00000000000005f1 R14: 00000000006f8f38 R15: 0000000000000000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 26626 Comm: syz-executor6 Not tainted 4.16.0-rc2+ #328 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x24d lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:422 [inline] slab_alloc mm/slab.c:3365 [inline] kmem_cache_alloc+0x47/0x760 mm/slab.c:3539 kmem_cache_zalloc include/linux/slab.h:691 [inline] ebitmap_cpy+0xce/0x260 security/selinux/ss/ebitmap.c:60 mls_context_cpy security/selinux/ss/context.h:51 [inline] mls_compute_sid+0x555/0x930 security/selinux/ss/mls.c:556 security_compute_sid+0x8df/0x18f0 security/selinux/ss/services.c:1725 security_transition_sid+0x75/0x90 security/selinux/ss/services.c:1764 socket_sockcreate_sid security/selinux/hooks.c:4335 [inline] selinux_socket_create+0x3cf/0x740 security/selinux/hooks.c:4368 security_socket_create+0x83/0xc0 security/security.c:1338 __sock_create+0xf7/0x850 net/socket.c:1240 sock_create net/socket.c:1325 [inline] SYSC_socketpair net/socket.c:1409 [inline] SyS_socketpair+0x1c0/0x6f0 net/socket.c:1366 do_syscall_64+0x280/0x940 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x453de9 RSP: 002b:00007f3b406f6c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000035 RAX: ffffffffffffffda RBX: 00007f3b406f76d4 RCX: 0000000000453de9 RDX: 0000000000000000 RSI: 0000000000000005 RDI: 000000000000001e RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000020001ff8 R11: 0000000000000246 R12: 0000000000000014 R13: 00000000000005f1 R14: 00000000006f8f38 R15: 0000000000000001 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 26662 Comm: syz-executor1 Not tainted 4.16.0-rc2+ #328 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x24d lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:422 [inline] slab_alloc_node mm/slab.c:3286 [inline] kmem_cache_alloc_node_trace+0x5a/0x760 mm/slab.c:3648 __do_kmalloc_node mm/slab.c:3668 [inline] __kmalloc_node+0x33/0x70 mm/slab.c:3676 kmalloc_node include/linux/slab.h:554 [inline] kvmalloc_node+0x99/0xd0 mm/util.c:419 kvmalloc include/linux/mm.h:541 [inline] seq_buf_alloc fs/seq_file.c:29 [inline] seq_read+0x7fc/0x1410 fs/seq_file.c:208 proc_reg_read+0xe8/0x160 fs/proc/inode.c:218 __vfs_read+0xef/0xa00 fs/read_write.c:411 vfs_read+0x11e/0x350 fs/read_write.c:447 SYSC_pread64 fs/read_write.c:611 [inline] SyS_pread64+0x15b/0x190 fs/read_write.c:598 do_syscall_64+0x280/0x940 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x453de9 RSP: 002b:00007f8d672e2c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000011 RAX: ffffffffffffffda RBX: 00007f8d672e36d4 RCX: 0000000000453de9 RDX: 00000000000000dd RSI: 0000000020000180 RDI: 0000000000000014 RBP: 000000000072bf58 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000015 R13: 0000000000000448 R14: 00000000006f6760 R15: 0000000000000000 program syz-executor0 is using a deprecated SCSI ioctl, please convert it to SG_IO kauditd_printk_skb: 630 callbacks suppressed audit: type=1400 audit(1519567998.057:14129): avc: denied { net_admin } for pid=4280 comm="syz-executor5" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519567998.077:14130): avc: denied { net_admin } for pid=4280 comm="syz-executor5" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 audit: type=1400 audit(1519567998.078:14131): avc: denied { write } for pid=26761 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 audit: type=1400 audit(1519567998.112:14132): avc: denied { net_admin } for pid=19053 comm="syz-executor2" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 CPU: 0 PID: 26785 Comm: syz-executor4 Not tainted 4.16.0-rc2+ #328 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x24d lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:422 [inline] slab_alloc mm/slab.c:3365 [inline] kmem_cache_alloc+0x47/0x760 mm/slab.c:3539 kmem_cache_zalloc include/linux/slab.h:691 [inline] avc_alloc_node+0x27/0x4d0 security/selinux/avc.c:549 avc_insert security/selinux/avc.c:668 [inline] avc_compute_av+0x22a/0x710 security/selinux/avc.c:974 avc_has_perm_noaudit security/selinux/avc.c:1110 [inline] avc_has_perm+0x4be/0x680 security/selinux/avc.c:1144 sock_has_perm+0x299/0x420 security/selinux/hooks.c:4352 selinux_socket_sendmsg+0x36/0x40 security/selinux/hooks.c:4607 security_socket_sendmsg+0x7d/0xb0 security/security.c:1370 sock_sendmsg+0x43/0x110 net/socket.c:637 ___sys_sendmsg+0x320/0x8b0 net/socket.c:2046 __sys_sendmmsg+0x1ee/0x620 net/socket.c:2136 SYSC_sendmmsg net/socket.c:2167 [inline] SyS_sendmmsg+0x35/0x60 net/socket.c:2162 do_syscall_64+0x280/0x940 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x453de9 RSP: 002b:00007f64bfbeac68 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00007f64bfbeb6d4 RCX: 0000000000453de9 RDX: 0000000000000001 RSI: 0000000020001c00 RDI: 0000000000000014 RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000017 R13: 00000000000004a1 R14: 00000000006f6fb8 R15: 0000000000000000 audit: type=1400 audit(1519567998.148:14133): avc: denied { net_admin } for pid=4279 comm="syz-executor6" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519567998.556:14134): avc: denied { net_admin } for pid=4270 comm="syz-executor7" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519567998.562:14135): avc: denied { net_admin } for pid=20342 comm="syz-executor0" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519567998.621:14136): avc: denied { net_admin } for pid=4279 comm="syz-executor6" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519567998.628:14137): avc: denied { dac_override } for pid=26794 comm="syz-executor1" capability=1 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519567998.630:14138): avc: denied { map } for pid=26798 comm="modprobe" path="/bin/kmod" dev="sda1" ino=1440 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 QAT: Invalid ioctl QAT: Invalid ioctl sock: sock_set_timeout: `syz-executor2' (pid 26894) tries to set negative timeout sock: sock_set_timeout: `syz-executor2' (pid 26904) tries to set negative timeout kernel msg: ebtables bug: please report to author: target size too small kernel msg: ebtables bug: please report to author: target size too small ieee80211 phy6: Selected rate control algorithm 'minstrel_ht' ieee80211 phy7: Selected rate control algorithm 'minstrel_ht'