syzbot

random: sshd: uninitialized urandom read (32 bytes read)
audit: type=1400 audit(1553570534.297:7): avc:  denied  { map } for  pid=1769 comm="syz-executor677" path="/root/syz-executor677385038" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
======================================================
WARNING: possible circular locking dependency detected
4.14.108+ #37 Not tainted
------------------------------------------------------
syz-executor677/1773 is trying to acquire lock:
 (&p->lock){+.+.}, at: [<ffffffff9bfcf95d>] seq_read+0xcd/0x1180 fs/seq_file.c:165

but task is already holding lock:
 (&pipe->mutex/1){+.+.}, at: [<ffffffff9bf71cd8>] pipe_lock_nested fs/pipe.c:67 [inline]
 (&pipe->mutex/1){+.+.}, at: [<ffffffff9bf71cd8>] pipe_lock+0x58/0x70 fs/pipe.c:75

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (&pipe->mutex/1){+.+.}:

-> #1 (&sig->cred_guard_mutex){+.+.}:

-> #0 (&p->lock){+.+.}:

other info that might help us debug this:

Chain exists of:
  &p->lock --> &sig->cred_guard_mutex --> &pipe->mutex/1

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&pipe->mutex/1);
                               lock(&sig->cred_guard_mutex);
                               lock(&pipe->mutex/1);
  lock(&p->lock);

 *** DEADLOCK ***

1 lock held by syz-executor677/1773:
 #0:  (&pipe->mutex/1){+.+.}, at: [<ffffffff9bf71cd8>] pipe_lock_nested fs/pipe.c:67 [inline]
 #0:  (&pipe->mutex/1){+.+.}, at: [<ffffffff9bf71cd8>] pipe_lock+0x58/0x70 fs/pipe.c:75

stack backtrace:
CPU: 1 PID: 1773 Comm: syz-executor677 Not tainted 4.14.108+ #37
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xb9/0x10e lib/dump_stack.c:53
 print_circular_bug.isra.0.cold+0x2dc/0x425 kernel/locking/lockdep.c:1258