[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 23.850905] random: sshd: uninitialized urandom read (32 bytes read) [ 24.392862] audit: type=1400 audit(1555596547.873:6): avc: denied { map } for pid=1768 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 24.472624] random: sshd: uninitialized urandom read (32 bytes read) [ 25.091128] random: sshd: uninitialized urandom read (32 bytes read) [ 25.308091] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.210' (ECDSA) to the list of known hosts. [ 30.891131] random: sshd: uninitialized urandom read (32 bytes read) executing program [ 30.988216] audit: type=1400 audit(1555596554.463:7): avc: denied { map } for pid=1780 comm="syz-executor904" path="/root/syz-executor904675339" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 30.991980] dl_rq->running_bw > dl_rq->this_bw [ 31.014506] ------------[ cut here ]------------ [ 31.024019] WARNING: CPU: 0 PID: 1781 at kernel/sched/deadline.c:125 switched_from_dl.cold+0x5b/0x62 [ 31.033281] Kernel panic - not syncing: panic_on_warn set ... [ 31.033281] [ 31.040660] CPU: 0 PID: 1781 Comm: syz-executor904 Not tainted 4.14.112+ #56 [ 31.048165] Call Trace: [ 31.050763] dump_stack+0xb9/0x10e [ 31.054474] panic+0x1d9/0x3c2 [ 31.057743] ? add_taint.cold+0x16/0x16 [ 31.061717] ? switched_from_dl.cold+0x5b/0x62 [ 31.066291] ? __probe_kernel_read+0x163/0x1c0 [ 31.070964] ? switched_from_dl.cold+0x5b/0x62 [ 31.075636] __warn.cold+0x2f/0x3b [ 31.079171] ? console_unlock+0x4b1/0xc60 [ 31.083341] ? switched_from_dl.cold+0x5b/0x62 [ 31.087927] ? report_bug+0x20a/0x248 [ 31.091723] ? do_error_trap+0x1bf/0x2d0 [ 31.095777] ? math_error+0x2d0/0x2d0 [ 31.099575] ? vprintk_emit+0xd5/0x330 [ 31.103460] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 31.108326] ? invalid_op+0x18/0x40 [ 31.111953] ? switched_from_dl.cold+0x5b/0x62 [ 31.116533] ? __sched_setscheduler+0x992/0x2780 [ 31.121284] ? cpu_cgroup_fork+0x120/0x120 [ 31.125511] ? lock_acquire+0x10f/0x380 [ 31.129559] ? _sched_setscheduler+0x113/0x1b0 [ 31.134148] ? __sched_setscheduler+0x2780/0x2780 [ 31.138982] ? __might_fault+0xd4/0x1b0 [ 31.142963] ? rcu_is_watching+0x11/0xb0 [ 31.147150] ? do_sched_setscheduler+0xe8/0x1f0 [ 31.151819] ? sched_setscheduler+0x10/0x10 [ 31.156773] ? SyS_setpgid+0x6a0/0x6a0 [ 31.160693] ? do_syscall_64+0x43/0x4b0 [ 31.165193] ? idle_task+0x70/0x70 [ 31.168816] ? SyS_sched_setscheduler+0xd/0x20 [ 31.173394] ? do_syscall_64+0x19b/0x4b0 [ 31.177816] ? entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 31.183444] [ 31.183449] ====================================================== [ 31.183452] WARNING: possible circular locking dependency detected [ 31.183454] 4.14.112+ #56 Not tainted [ 31.183457] ------------------------------------------------------ [ 31.183459] syz-executor904/1781 is trying to acquire lock: [ 31.183461] ((console_sem).lock){-...}, at: [< (ptrval)>] down_trylock+0xe/0x60 [ 31.183468] [ 31.183470] but task is already holding lock: [ 31.183472] (&rq->lock){-.-.}, at: [< (ptrval)>] task_rq_lock+0xc8/0x330 [ 31.183479] [ 31.183481] which lock already depends on the new lock. [ 31.183483] [ 31.183484] [ 31.183487] the existing dependency chain (in reverse order) is: [ 31.183488] [ 31.183489] -> #2 (&rq->lock){-.-.}: [ 31.183496] [ 31.183497] -> #1 (&p->pi_lock){-.-.}: [ 31.183504] [ 31.183505] -> #0 ((console_sem).lock){-...}: [ 31.183512] [ 31.183533] other info that might help us debug this: [ 31.183535] [ 31.183536] Chain exists of: [ 31.183537] (console_sem).lock --> &p->pi_lock --> &rq->lock [ 31.183547] [ 31.183549] Possible unsafe locking scenario: [ 31.183551] [ 31.183553] CPU0 CPU1 [ 31.183555] ---- ---- [ 31.183556] lock(&rq->lock); [ 31.183561] lock(&p->pi_lock); [ 31.183566] lock(&rq->lock); [ 31.183570] lock((console_sem).lock); [ 31.183575] [ 31.183577] *** DEADLOCK *** [ 31.183578] [ 31.183580] 3 locks held by syz-executor904/1781: [ 31.183582] #0: (rcu_read_lock){....}, at: [< (ptrval)>] do_sched_setscheduler+0x87/0x1f0 [ 31.183590] #1: (&p->pi_lock){-.-.}, at: [< (ptrval)>] task_rq_lock+0x6a/0x330 [ 31.183598] #2: (&rq->lock){-.-.}, at: [< (ptrval)>] task_rq_lock+0xc8/0x330 [ 31.183605] [ 31.183607] stack backtrace: [ 31.183610] CPU: 0 PID: 1781 Comm: syz-executor904 Not tainted 4.14.112+ #56 [ 31.183612] Call Trace: [ 31.183614] dump_stack+0xb9/0x10e [ 31.183616] print_circular_bug.isra.0.cold+0x2dc/0x425 [ 31.183618] ? __lock_acquire+0x2d83/0x3fa0 [ 31.183621] ? trace_hardirqs_on+0x10/0x10 [ 31.183623] ? trace_hardirqs_on+0x10/0x10 [ 31.183625] ? check_preemption_disabled+0x35/0x1f0 [ 31.183627] ? lock_acquire+0x10f/0x380 [ 31.183629] ? down_trylock+0xe/0x60 [ 31.183631] ? vprintk_emit+0xa4/0x330 [ 31.183634] ? _raw_spin_lock_irqsave+0x42/0x60 [ 31.183636] ? down_trylock+0xe/0x60 [ 31.183638] ? down_trylock+0xe/0x60 [ 31.183640] ? vprintk_emit+0x11a/0x330 [ 31.183642] ? __down_trylock_console_sem+0x33/0xd0 [ 31.183644] ? console_trylock+0x14/0x70 [ 31.183646] ? vprintk_emit+0x11a/0x330 [ 31.183648] ? vprintk_func+0x58/0x152 [ 31.183650] ? printk+0xba/0xed [ 31.183652] ? show_regs_print_info+0x5b/0x5b [ 31.183654] ? sched_dl_overflow+0x1a1/0xc80 [ 31.183657] ? switched_from_dl.cold+0x5b/0x62 [ 31.183659] ? __sched_setscheduler+0x992/0x2780 [ 31.183661] ? cpu_cgroup_fork+0x120/0x120 [ 31.183663] ? lock_acquire+0x10f/0x380 [ 31.183665] ? _sched_setscheduler+0x113/0x1b0 [ 31.183668] ? __sched_setscheduler+0x2780/0x2780 [ 31.183670] ? __might_fault+0xd4/0x1b0 [ 31.183672] ? rcu_is_watching+0x11/0xb0 [ 31.183674] ? do_sched_setscheduler+0xe8/0x1f0 [ 31.183676] ? sched_setscheduler+0x10/0x10 [ 31.183678] ? SyS_setpgid+0x6a0/0x6a0 [ 31.183680] ? do_syscall_64+0x43/0x4b0 [ 31.183682] ? idle_task+0x70/0x70 [ 31.183684] ? SyS_sched_setscheduler+0xd/0x20 [ 31.183686] ? do_syscall_64+0x19b/0x4b0 [ 31.183688] ? entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 32.294190] Shutting down cpus with NMI [ 32.649040] Kernel Offset: 0x23c00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 32.660611] Rebooting in 86400 seconds..