[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 21.929545] random: sshd: uninitialized urandom read (32 bytes read, 36 bits of entropy available) [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 25.948062] random: sshd: uninitialized urandom read (32 bytes read, 40 bits of entropy available) [ 26.398082] random: sshd: uninitialized urandom read (32 bytes read, 42 bits of entropy available) [ 27.358022] random: sshd: uninitialized urandom read (32 bytes read, 100 bits of entropy available) [ 27.526997] random: sshd: uninitialized urandom read (32 bytes read, 104 bits of entropy available) Warning: Permanently added '10.128.0.37' (ECDSA) to the list of known hosts. [ 32.942227] random: sshd: uninitialized urandom read (32 bytes read, 109 bits of entropy available) 2018/03/24 17:08:55 parsed 1 programs 2018/03/24 17:08:55 executed programs: 0 [ 33.306451] IPVS: Creating netns size=2552 id=1 [ 33.336958] [ 33.338591] ====================================================== [ 33.344877] [ INFO: possible circular locking dependency detected ] [ 33.351251] 4.4.120-gd63fdf6 #29 Not tainted [ 33.355624] ------------------------------------------------------- [ 33.362006] syz-executor0/3815 is trying to acquire lock: [ 33.367519] (&mm->mmap_sem){++++++}, at: [] __might_fault+0xe4/0x1d0 [ 33.376115] [ 33.376115] but task is already holding lock: [ 33.382055] (ashmem_mutex){+.+.+.}, at: [] ashmem_ioctl+0x367/0xfa0 [ 33.390542] [ 33.390542] which lock already depends on the new lock. [ 33.390542] [ 33.398825] [ 33.398825] the existing dependency chain (in reverse order) is: [ 33.406412] -> #1 (ashmem_mutex){+.+.+.}: [ 33.411176] [] lock_acquire+0x15e/0x460 [ 33.417408] [] mutex_lock_nested+0xbb/0x850 [ 33.423995] [] ashmem_mmap+0x53/0x400 [ 33.430050] [] mmap_region+0x94f/0x1250 [ 33.436284] [] do_mmap+0x4fd/0x9d0 [ 33.442078] [] vm_mmap_pgoff+0x16e/0x1c0 [ 33.448408] [] SyS_mmap_pgoff+0x33f/0x560 [ 33.454829] [] do_fast_syscall_32+0x321/0x8a0 [ 33.461591] [] sysenter_flags_fixed+0xd/0x17 [ 33.468288] -> #0 (&mm->mmap_sem){++++++}: [ 33.473140] [] __lock_acquire+0x371f/0x4b50 [ 33.479725] [] lock_acquire+0x15e/0x460 [ 33.485951] [] __might_fault+0x14a/0x1d0 [ 33.492275] [] ashmem_ioctl+0x3b4/0xfa0 [ 33.498503] [] compat_ashmem_ioctl+0x3e/0x50 [ 33.505168] [] compat_SyS_ioctl+0x28a/0x2540 [ 33.511840] [] do_fast_syscall_32+0x321/0x8a0 [ 33.518599] [] sysenter_flags_fixed+0xd/0x17 [ 33.525262] [ 33.525262] other info that might help us debug this: [ 33.525262] [ 33.533371] Possible unsafe locking scenario: [ 33.533371] [ 33.539399] CPU0 CPU1 [ 33.544032] ---- ---- [ 33.548667] lock(ashmem_mutex); [ 33.552318] lock(&mm->mmap_sem); [ 33.558572] lock(ashmem_mutex); [ 33.564742] lock(&mm->mmap_sem); [ 33.568487] [ 33.568487] *** DEADLOCK *** [ 33.568487] [ 33.574513] 1 lock held by syz-executor0/3815: [ 33.579058] #0: (ashmem_mutex){+.+.+.}, at: [] ashmem_ioctl+0x367/0xfa0 [ 33.588111] [ 33.588111] stack backtrace: [ 33.592575] CPU: 1 PID: 3815 Comm: syz-executor0 Not tainted 4.4.120-gd63fdf6 #29 [ 33.600172] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 33.609496] 0000000000000000 49ca5203de44b746 ffff8800ab2f78a8 ffffffff81d0408d [ 33.617463] ffffffff851a0010 ffffffff851a0010 ffffffff851beb20 ffff8800bac638f8 [ 33.625432] ffff8800bac63000 ffff8800ab2f78f0 ffffffff81233ba1 ffff8800bac638f8 [ 33.633400] Call Trace: [ 33.635961] [] dump_stack+0xc1/0x124 [ 33.641300] [] print_circular_bug+0x271/0x310 [ 33.647415] [] __lock_acquire+0x371f/0x4b50 [ 33.653470] [] ? avc_has_extended_perms+0xe2/0xf30 [ 33.660017] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 33.666995] [] ? mark_held_locks+0xaf/0x100 [ 33.672937] [] ? __lock_is_held+0xa1/0xf0 [ 33.678717] [] lock_acquire+0x15e/0x460 [ 33.684326] [] ? __might_fault+0xe4/0x1d0 [ 33.690104] [] __might_fault+0x14a/0x1d0 [ 33.695781] [] ? __might_fault+0xe4/0x1d0 [ 33.701549] [] ashmem_ioctl+0x3b4/0xfa0 [ 33.707144] [] ? selinux_file_ioctl+0x363/0x570 [ 33.713429] [] ? selinux_capable+0x30/0x30 [ 33.719280] [] ? ashmem_shrink_scan+0x390/0x390 [ 33.725586] [] ? vma_set_page_prot+0x10b/0x150 [ 33.731785] [] ? exit_robust_list+0x240/0x240 [ 33.737899] [] compat_ashmem_ioctl+0x3e/0x50 [ 33.743931] [] compat_SyS_ioctl+0x28a/0x2540 [ 33.749958] [] ? vm_mmap_pgoff+0x180/0x1c0 [ 33.755811] [] ? ashmem_ioctl+0xfa0/0xfa0 [ 33.761587] [] ? compat_SyS_ppoll+0x420/0x420 [ 33.767708] [] ? vm_mmap_pgoff+0xdf/0x1c0 [ 33.773480] [] ? compat_SyS_futex+0x1f9/0x2a0 [ 33.779600] [] ? compat_SyS_get_robust_list+0x300/0x300 [ 33.786585] [