Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 21.395004] random: sshd: uninitialized urandom read (32 bytes read, 34 bits of entropy available) [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 25.766272] random: sshd: uninitialized urandom read (32 bytes read, 40 bits of entropy available) [ 26.112316] random: sshd: uninitialized urandom read (32 bytes read, 42 bits of entropy available) [ 27.087344] random: nonblocking pool is initialized Warning: Permanently added '10.128.10.7' (ECDSA) to the list of known hosts. 2018/03/15 13:02:21 parsed 1 programs 2018/03/15 13:02:21 executed programs: 0 [ 33.123532] IPVS: Creating netns size=2552 id=1 [ 33.154498] [ 33.156140] ====================================================== [ 33.162430] [ INFO: possible circular locking dependency detected ] [ 33.168808] 4.4.120-gd63fdf6 #29 Not tainted [ 33.173182] ------------------------------------------------------- [ 33.179553] syz-executor0/3813 is trying to acquire lock: [ 33.185056] (&mm->mmap_sem){++++++}, at: [] __might_fault+0xe4/0x1d0 [ 33.193650] [ 33.193650] but task is already holding lock: [ 33.199590] (ashmem_mutex){+.+.+.}, at: [] ashmem_ioctl+0x367/0xfa0 [ 33.208085] [ 33.208085] which lock already depends on the new lock. [ 33.208085] [ 33.216366] [ 33.216366] the existing dependency chain (in reverse order) is: [ 33.224214] -> #1 (ashmem_mutex){+.+.+.}: [ 33.228976] [] lock_acquire+0x15e/0x460 [ 33.235211] [] mutex_lock_nested+0xbb/0x850 [ 33.241800] [] ashmem_mmap+0x53/0x400 [ 33.247861] [] mmap_region+0x94f/0x1250 [ 33.254098] [] do_mmap+0x4fd/0x9d0 [ 33.259895] [] vm_mmap_pgoff+0x16e/0x1c0 [ 33.266223] [] SyS_mmap_pgoff+0x33f/0x560 [ 33.272628] [] do_fast_syscall_32+0x321/0x8a0 [ 33.279380] [] sysenter_flags_fixed+0xd/0x17 [ 33.286071] -> #0 (&mm->mmap_sem){++++++}: [ 33.290912] [] __lock_acquire+0x371f/0x4b50 [ 33.297491] [] lock_acquire+0x15e/0x460 [ 33.303722] [] __might_fault+0x14a/0x1d0 [ 33.310039] [] ashmem_ioctl+0x3b4/0xfa0 [ 33.316277] [] compat_ashmem_ioctl+0x3e/0x50 [ 33.322945] [] compat_SyS_ioctl+0x28a/0x2540 [ 33.329613] [] do_fast_syscall_32+0x321/0x8a0 [ 33.336367] [] sysenter_flags_fixed+0xd/0x17 [ 33.343034] [ 33.343034] other info that might help us debug this: [ 33.343034] [ 33.351144] Possible unsafe locking scenario: [ 33.351144] [ 33.357172] CPU0 CPU1 [ 33.361806] ---- ---- [ 33.366441] lock(ashmem_mutex); [ 33.370096] lock(&mm->mmap_sem); [ 33.376351] lock(ashmem_mutex); [ 33.382520] lock(&mm->mmap_sem); [ 33.386254] [ 33.386254] *** DEADLOCK *** [ 33.386254] [ 33.392281] 1 lock held by syz-executor0/3813: [ 33.396832] #0: (ashmem_mutex){+.+.+.}, at: [] ashmem_ioctl+0x367/0xfa0 [ 33.405887] [ 33.405887] stack backtrace: [ 33.410354] CPU: 1 PID: 3813 Comm: syz-executor0 Not tainted 4.4.120-gd63fdf6 #29 [ 33.417942] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 33.427266] 0000000000000000 0bc16f964297075f ffff8801d8f1f8a8 ffffffff81d0408d [ 33.435244] ffffffff8519fe60 ffffffff8519fe60 ffffffff851bf390 ffff8800ab3db8f8 [ 33.443223] ffff8800ab3db000 ffff8801d8f1f8f0 ffffffff81233ba1 ffff8800ab3db8f8 [ 33.451191] Call Trace: [ 33.453751] [] dump_stack+0xc1/0x124 [ 33.459099] [] print_circular_bug+0x271/0x310 [ 33.465213] [] __lock_acquire+0x371f/0x4b50 [ 33.471153] [] ? avc_has_extended_perms+0xe2/0xf30 [ 33.477709] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 33.484705] [] ? mark_held_locks+0xaf/0x100 [ 33.490649] [] ? __lock_is_held+0xa1/0xf0 [ 33.496422] [] lock_acquire+0x15e/0x460 [ 33.502016] [] ? __might_fault+0xe4/0x1d0 [ 33.507786] [] __might_fault+0x14a/0x1d0 [ 33.513468] [] ? __might_fault+0xe4/0x1d0 [ 33.519244] [] ashmem_ioctl+0x3b4/0xfa0 [ 33.524837] [] ? selinux_file_ioctl+0x363/0x570 [ 33.531123] [] ? selinux_capable+0x30/0x30 [ 33.536983] [] ? ashmem_shrink_scan+0x390/0x390 [ 33.543277] [] ? vma_set_page_prot+0x10b/0x150 [ 33.549479] [] ? exit_robust_list+0x240/0x240 [ 33.555591] [] compat_ashmem_ioctl+0x3e/0x50 [ 33.561642] [] compat_SyS_ioctl+0x28a/0x2540 [ 33.567680] [] ? vm_mmap_pgoff+0x180/0x1c0 [ 33.573536] [] ? ashmem_ioctl+0xfa0/0xfa0 [ 33.579306] [] ? compat_SyS_ppoll+0x420/0x420 [ 33.585421] [] ? vm_mmap_pgoff+0xdf/0x1c0 [ 33.591190] [] ? compat_SyS_futex+0x1f9/0x2a0 [ 33.597308] [] ? compat_SyS_get_robust_list+0x300/0x300 [ 33.604299] [