[....] Starting enhanced syslogd: rsyslogd[ 15.988542] audit: type=1400 audit(1565711557.042:4): avc: denied { syslog } for pid=1924 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Starting mcstransd: [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.63' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 39.975404] [ 39.977070] ====================================================== [ 39.984098] [ INFO: possible circular locking dependency detected ] [ 39.991060] 4.4.174+ #4 Not tainted [ 39.994691] ------------------------------------------------------- [ 40.001100] syz-executor290/2085 is trying to acquire lock: [ 40.006810] (&pipe->mutex/1){+.+.+.}, at: [] pipe_lock+0x63/0x80 [ 40.015423] [ 40.015423] but task is already holding lock: [ 40.021383] (sb_writers#4){.+.+.+}, at: [] SyS_splice+0xf2d/0x13a0 [ 40.030006] [ 40.030006] which lock already depends on the new lock. [ 40.030006] [ 40.038316] [ 40.038316] the existing dependency chain (in reverse order) is: [ 40.045935] -> #5 (sb_writers#4){.+.+.+}: [ 40.050917] [] lock_acquire+0x15e/0x450 [ 40.057208] [] __sb_start_write+0x1af/0x310 [ 40.063829] [] ext4_lazyinit_thread+0x1e4/0x7b0 [ 40.070916] [] kthread+0x273/0x310 [ 40.076792] [] ret_from_fork+0x55/0x80 [ 40.083048] -> #4 (&eli->li_list_mtx){+.+...}: [ 40.088595] [] lock_acquire+0x15e/0x450 [ 40.094871] [] mutex_lock_nested+0xc1/0xb80 [ 40.101496] [] ext4_register_li_request+0x2fd/0x7d0 [ 40.108953] [] ext4_remount+0x1366/0x1b90 [ 40.115487] [] do_remount_sb2+0x41b/0x7a0 [ 40.121947] [] do_mount+0xfdb/0x2a40 [ 40.128072] [] SyS_mount+0x130/0x1d0 [ 40.134344] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 40.141626] -> #3 (&ext4_li_mtx){+.+.+.}: [ 40.146569] [] lock_acquire+0x15e/0x450 [ 40.152855] [] mutex_lock_nested+0xc1/0xb80 [ 40.159720] [] ext4_register_li_request+0x89/0x7d0 [ 40.166961] [] ext4_remount+0x1366/0x1b90 [ 40.173509] [] do_remount_sb2+0x41b/0x7a0 [ 40.180003] [] do_mount+0xfdb/0x2a40 [ 40.186023] [] SyS_mount+0x130/0x1d0 [ 40.192388] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 40.199724] -> #2 (&type->s_umount_key#34){++++++}: [ 40.205696] [] lock_acquire+0x15e/0x450 [ 40.212094] [] down_read+0x42/0x60 [ 40.218117] [] iterate_supers+0xe1/0x250 [ 40.224658] [] selinux_complete_init+0x2f/0x31 [ 40.231604] [] security_load_policy+0x69d/0x9c0 [ 40.238691] [] sel_write_load+0x175/0xf90 [ 40.245433] [] __vfs_write+0x116/0x3d0 [ 40.251844] [] vfs_write+0x182/0x4e0 [ 40.257870] [] SyS_write+0xdc/0x1c0 [ 40.264216] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 40.271613] -> #1 (sel_mutex){+.+.+.}: [ 40.276420] [] lock_acquire+0x15e/0x450 [ 40.282728] [] mutex_lock_nested+0xc1/0xb80 [ 40.289701] [] sel_commit_bools_write+0x89/0x260 [ 40.296856] [] __vfs_write+0x116/0x3d0 [ 40.303262] [] __kernel_write+0x112/0x370 [ 40.309839] [] write_pipe_buf+0x15d/0x1f0 [ 40.316372] [] __splice_from_pipe+0x37e/0x7a0 [ 40.323257] [] splice_from_pipe+0x108/0x170 [ 40.330145] [] default_file_splice_write+0x3c/0x80 [ 40.337400] [] SyS_splice+0xd71/0x13a0 [ 40.343869] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 40.351158] -> #0 (&pipe->mutex/1){+.+.+.}: [ 40.356309] [] __lock_acquire+0x37d6/0x4f50 [ 40.363046] [] lock_acquire+0x15e/0x450 [ 40.369481] [] mutex_lock_nested+0xc1/0xb80 [ 40.376244] [] pipe_lock+0x63/0x80 [ 40.382138] [] iter_file_splice_write+0x179/0xb30 [ 40.389396] [] SyS_splice+0xd71/0x13a0 [ 40.395760] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 40.403725] [ 40.403725] other info that might help us debug this: [ 40.403725] [ 40.411867] Chain exists of: &pipe->mutex/1 --> &eli->li_list_mtx --> sb_writers#4 [ 40.421498] Possible unsafe locking scenario: [ 40.421498] [ 40.429213] CPU0 CPU1 [ 40.435127] ---- ---- [ 40.440433] lock(sb_writers#4); [ 40.444479] lock(&eli->li_list_mtx); [ 40.451533] lock(sb_writers#4); [ 40.458022] lock(&pipe->mutex/1); [ 40.462081] [ 40.462081] *** DEADLOCK *** [ 40.462081] [ 40.468879] 1 lock held by syz-executor290/2085: [ 40.473833] #0: (sb_writers#4){.+.+.+}, at: [] SyS_splice+0xf2d/0x13a0 [ 40.483224] [ 40.483224] stack backtrace: [ 40.487757] CPU: 0 PID: 2085 Comm: syz-executor290 Not tainted 4.4.174+ #4 [ 40.495011] 0000000000000000 3e6e76746fdc743e ffff8800b64078b0 ffffffff81aad1a1 [ 40.503750] ffffffff84057a80 ffff8800b722df00 ffffffff83abd2b0 ffffffff83abc380 [ 40.511824] ffffffff83ac8080 ffff8800b6407900 ffffffff813abcda ffffffff83e1ee80 [ 40.520427] Call Trace: [ 40.523098] [] dump_stack+0xc1/0x120 [ 40.529484] [] print_circular_bug.cold+0x2f7/0x44e [ 40.536326] [] __lock_acquire+0x37d6/0x4f50 [ 40.542912] [] ? depot_save_stack+0x1c3/0x5f0 [ 40.549263] [] ? trace_hardirqs_on+0x10/0x10 [ 40.555778] [] ? kasan_kmalloc.part.0+0x62/0xf0 [ 40.562297] [] ? kasan_kmalloc+0xb7/0xd0 [ 40.568230] [] ? __kmalloc+0x141/0x330 [ 40.573837] [] ? iter_file_splice_write+0x15c/0xb30 [ 40.580732] [] ? SyS_splice+0xd71/0x13a0 [ 40.586568] [] ? drop_futex_key_refs.isra.0+0x5e/0xf0 [ 40.593566] [] lock_acquire+0x15e/0x450 [ 40.599246] [] ? pipe_lock+0x63/0x80 [ 40.604833] [] ? pipe_lock+0x63/0x80 [ 40.611338] [] mutex_lock_nested+0xc1/0xb80 [ 40.617514] [] ? pipe_lock+0x63/0x80 [ 40.623216] [] ? check_preemption_disabled+0x3c/0x200 [ 40.630342] [] ? mutex_trylock+0x500/0x500 [ 40.636237] [] ? kasan_unpoison_shadow+0x35/0x50 [ 40.643088] [] ? kasan_kmalloc+0xb7/0xd0 [ 40.648992] [] pipe_lock+0x63/0x80 [ 40.654711] [] iter_file_splice_write+0x179/0xb30 [ 40.661585] [] ? trace_hardirqs_on+0x10/0x10 [ 40.667876] [] ? check_preemption_disabled+0x3c/0x200 [ 40.674936] [] ? vmsplice_to_user+0x1e0/0x1e0 [ 40.681121] [] ? check_preemption_disabled+0x3c/0x200 [ 40.688046] [] ? check_preemption_disabled+0x3c/0x200 [ 40.695103] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 40.702061] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 40.709044] [] ? __sb_start_write+0x14f/0x310 [ 40.715427] [] ? vmsplice_to_user+0x1e0/0x1e0 [ 40.721752] [] SyS_splice+0xd71/0x13a0 executing program [ 40.727543] [] ? compat_SyS_vmsplice+0x160/0x160 [ 40.734020] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 40.740643] [] entry_SYSCALL_64_fastpath+0x1e/0x9a executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program