[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 21.013645] random: sshd: uninitialized urandom read (32 bytes read, 34 bits of entropy available) [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 25.359479] random: sshd: uninitialized urandom read (32 bytes read, 39 bits of entropy available) [ 25.812888] random: sshd: uninitialized urandom read (32 bytes read, 40 bits of entropy available) [ 26.718021] random: sshd: uninitialized urandom read (32 bytes read, 105 bits of entropy available) [ 26.887078] random: sshd: uninitialized urandom read (32 bytes read, 111 bits of entropy available) Warning: Permanently added '10.128.0.28' (ECDSA) to the list of known hosts. [ 32.287026] random: sshd: uninitialized urandom read (32 bytes read, 118 bits of entropy available) executing program [ 32.377597] [ 32.379247] ====================================================== [ 32.385529] [ INFO: possible circular locking dependency detected ] [ 32.391903] 4.4.120-gd63fdf6 #28 Not tainted [ 32.396277] ------------------------------------------------------- [ 32.402646] syzkaller189315/3770 is trying to acquire lock: [ 32.408326] (&mm->mmap_sem){++++++}, at: [] __might_fault+0xe4/0x1d0 [ 32.416908] [ 32.416908] but task is already holding lock: [ 32.422842] (ashmem_mutex){+.+.+.}, at: [] ashmem_ioctl+0x367/0xfa0 [ 32.431327] [ 32.431327] which lock already depends on the new lock. [ 32.431327] [ 32.439608] [ 32.439608] the existing dependency chain (in reverse order) is: [ 32.447202] -> #1 (ashmem_mutex){+.+.+.}: [ 32.451954] [] lock_acquire+0x15e/0x460 [ 32.458189] [] mutex_lock_nested+0xbb/0x850 [ 32.464769] [] ashmem_mmap+0x53/0x400 [ 32.470826] [] mmap_region+0x94f/0x1250 [ 32.477058] [] do_mmap+0x4fd/0x9d0 [ 32.482847] [] vm_mmap_pgoff+0x16e/0x1c0 [ 32.489163] [] SyS_mmap_pgoff+0x33f/0x560 [ 32.495564] [] SyS_mmap+0x16/0x20 [ 32.501272] [] entry_SYSCALL_64_fastpath+0x1c/0x98 [ 32.508454] -> #0 (&mm->mmap_sem){++++++}: [ 32.513285] [] __lock_acquire+0x371f/0x4b50 [ 32.519868] [] lock_acquire+0x15e/0x460 [ 32.526091] [] __might_fault+0x14a/0x1d0 [ 32.532403] [] ashmem_ioctl+0x3b4/0xfa0 [ 32.538631] [] do_vfs_ioctl+0x7aa/0xee0 [ 32.544856] [] SyS_ioctl+0x8f/0xc0 [ 32.550648] [] entry_SYSCALL_64_fastpath+0x1c/0x98 [ 32.557830] [ 32.557830] other info that might help us debug this: [ 32.557830] [ 32.565936] Possible unsafe locking scenario: [ 32.565936] [ 32.571961] CPU0 CPU1 [ 32.576593] ---- ---- [ 32.581230] lock(ashmem_mutex); [ 32.584885] lock(&mm->mmap_sem); [ 32.591136] lock(ashmem_mutex); [ 32.597299] lock(&mm->mmap_sem); [ 32.601039] [ 32.601039] *** DEADLOCK *** [ 32.601039] [ 32.607063] 1 lock held by syzkaller189315/3770: [ 32.611782] #0: (ashmem_mutex){+.+.+.}, at: [] ashmem_ioctl+0x367/0xfa0 [ 32.620815] [ 32.620815] stack backtrace: [ 32.625278] CPU: 0 PID: 3770 Comm: syzkaller189315 Not tainted 4.4.120-gd63fdf6 #28 [ 32.633035] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 32.642362] 0000000000000000 8a43c127d87c79ec ffff8801d8dc79b8 ffffffff81d0408d [ 32.650324] ffffffff851a0010 ffffffff851a0010 ffffffff851be100 ffff8801c626b8f8 [ 32.658286] ffff8801c626b000 ffff8801d8dc7a00 ffffffff81233ba1 ffff8801c626b8f8 [ 32.666270] Call Trace: [ 32.668828] [] dump_stack+0xc1/0x124 [ 32.674163] [] print_circular_bug+0x271/0x310 [ 32.680274] [] __lock_acquire+0x371f/0x4b50 [ 32.686212] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 32.693198] [] ? mark_held_locks+0xaf/0x100 [ 32.699144] [] ? __lock_is_held+0xa1/0xf0 [ 32.704911] [] lock_acquire+0x15e/0x460 [ 32.710893] [] ? __might_fault+0xe4/0x1d0 [ 32.716659] [] __might_fault+0x14a/0x1d0 [ 32.722347] [] ? __might_fault+0xe4/0x1d0 [ 32.728121] [] ashmem_ioctl+0x3b4/0xfa0 [ 32.733713] [] ? mmap_region+0x3f9/0x1250 [ 32.739486] [] ? ashmem_shrink_scan+0x390/0x390 [ 32.745773] [] ? vm_mmap_pgoff+0x180/0x1c0 [ 32.751626] [] ? ashmem_shrink_scan+0x390/0x390 [ 32.757912] [] do_vfs_ioctl+0x7aa/0xee0 [ 32.763503] [] ? ioctl_preallocate+0x1f0/0x1f0 [ 32.769700] [] ? fput+0x20/0x150 [ 32.774684] [] ? SyS_mmap_pgoff+