[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [ 9.578329] random: sshd: uninitialized urandom read (32 bytes read) [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 20.911694] random: crng init done Warning: Permanently added '10.128.0.126' (ECDSA) to the list of known hosts. 2018/09/21 23:43:48 parsed 1 programs 2018/09/21 23:43:50 executed programs: 0 [ 35.197908] audit: type=1400 audit(1537573430.102:5): avc: denied { sys_admin } for pid=2063 comm="syz-executor2" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 35.220178] audit: type=1400 audit(1537573430.102:6): avc: denied { net_admin } for pid=2069 comm="syz-executor4" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 37.980074] audit: type=1400 audit(1537573432.892:7): avc: denied { sys_chroot } for pid=2073 comm="syz-executor3" capability=18 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 38.027587] audit: type=1400 audit(1537573432.932:8): avc: denied { associate } for pid=2073 comm="syz-executor3" name="syz3" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1 [ 38.112746] audit: type=1400 audit(1537573433.022:9): avc: denied { dac_override } for pid=3626 comm="syz-executor2" capability=1 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 38.205804] [ 38.207466] ====================================================== [ 38.213774] [ INFO: possible circular locking dependency detected ] [ 38.220170] 4.9.128+ #93 Not tainted [ 38.223870] ------------------------------------------------------- [ 38.230276] syz-executor2/3633 is trying to acquire lock: [ 38.235799] (&sig->cred_guard_mutex){+.+.+.}, at: [] do_io_accounting+0x1fb/0x7e0 [ 38.245474] but task is already holding lock: [ 38.250128] (&p->lock){+.+.+.}, at: [] seq_read+0xdd/0x12d0 [ 38.257906] which lock already depends on the new lock. [ 38.257906] [ 38.264917] [ 38.264917] the existing dependency chain (in reverse order) is: [ 38.272555] -> #2 (&p->lock){+.+.+.}: [ 38.277061] lock_acquire+0x130/0x3e0 [ 38.281378] mutex_lock_nested+0xc0/0x870 [ 38.286044] seq_read+0xdd/0x12d0 [ 38.290012] proc_reg_read+0xfd/0x180 [ 38.294323] do_loop_readv_writev.part.1+0xd5/0x280 [ 38.299834] do_readv_writev+0x56e/0x7b0 [ 38.304407] vfs_readv+0x84/0xc0 [ 38.308276] default_file_splice_read+0x44b/0x7e0 [ 38.313627] do_splice_to+0x10c/0x170 [ 38.317938] SyS_splice+0x10d2/0x14d0 [ 38.322257] do_syscall_64+0x19f/0x480 [ 38.326657] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 38.332282] -> #1 (&pipe->mutex/1){+.+.+.}: [ 38.337409] lock_acquire+0x130/0x3e0 [ 38.341721] mutex_lock_nested+0xc0/0x870 [ 38.346379] fifo_open+0x15c/0x9e0 [ 38.350418] do_dentry_open+0x3ef/0xc90 [ 38.354889] vfs_open+0x11c/0x210 [ 38.358850] path_openat+0x542/0x2790 [ 38.363150] do_filp_open+0x197/0x270 [ 38.367464] do_open_execat+0x10f/0x640 [ 38.371963] do_execveat_common.isra.15+0x687/0x1f80 [ 38.377589] SyS_execve+0x42/0x50 [ 38.381561] do_syscall_64+0x19f/0x480 [ 38.385961] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 38.391570] -> #0 (&sig->cred_guard_mutex){+.+.+.}: [ 38.397218] __lock_acquire+0x3189/0x4a10 [ 38.401861] lock_acquire+0x130/0x3e0 [ 38.406169] mutex_lock_killable_nested+0xcc/0x960 [ 38.411618] do_io_accounting+0x1fb/0x7e0 [ 38.416292] proc_tgid_io_accounting+0x22/0x30 [ 38.421386] proc_single_show+0xfd/0x170 [ 38.425965] seq_read+0x4b6/0x12d0 [ 38.430013] __vfs_read+0x115/0x560 [ 38.434144] vfs_read+0x124/0x390 [ 38.438096] SyS_pread64+0x145/0x170 [ 38.442319] do_syscall_64+0x19f/0x480 [ 38.446716] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 38.452314] [ 38.452314] other info that might help us debug this: [ 38.452314] [ 38.460430] Chain exists of: &sig->cred_guard_mutex --> &pipe->mutex/1 --> &p->lock [ 38.469576] Possible unsafe locking scenario: [ 38.469576] [ 38.475633] CPU0 CPU1 [ 38.480273] ---- ---- [ 38.484924] lock(&p->lock); [ 38.488239] lock(&pipe->mutex/1); [ 38.494718] lock(&p->lock); [ 38.500543] lock(&sig->cred_guard_mutex); [ 38.505067] [ 38.505067] *** DEADLOCK *** [ 38.505067] [ 38.511096] 1 lock held by syz-executor2/3633: [ 38.515680] #0: (&p->lock){+.+.+.}, at: [] seq_read+0xdd/0x12d0 [ 38.523967] [ 38.523967] stack backtrace: [ 38.528435] CPU: 0 PID: 3633 Comm: syz-executor2 Not tainted 4.9.128+ #93 [ 38.535334] ffff8801d300f648 ffffffff81af2469 ffffffff83aa7d80 ffffffff83aa2ad0 [ 38.543322] ffffffff83aa1180 ffff8801d3dd08d0 ffff8801d3dd0000 ffff8801d300f690 [ 38.551324] ffffffff813e79ed 0000000000000001 00000000d3dd08b0 0000000000000001 [ 38.559311] Call Trace: [ 38.561890] [] dump_stack+0xc1/0x128 [ 38.567230] [] print_circular_bug.cold.36+0x2f7/0x432 [ 38.574058] [] __lock_acquire+0x3189/0x4a10 [ 38.580015] [] ? check_preemption_disabled+0x3b/0x170 [ 38.586832] [] ? trace_hardirqs_on+0x10/0x10 [ 38.592868] [] ? _raw_spin_unlock_irqrestore+0x5a/0x70 [ 38.599784] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 38.606609] [] lock_acquire+0x130/0x3e0 [ 38.612216] [] ? do_io_accounting+0x1fb/0x7e0 [ 38.618351] [] mutex_lock_killable_nested+0xcc/0x960 [ 38.625090] [] ? do_io_accounting+0x1fb/0x7e0 [ 38.631215] [] ? mark_wake_futex+0x120/0x120 [ 38.637246] [] ? _raw_spin_unlock_irqrestore+0x5a/0x70 [ 38.644144] [] ? do_io_accounting+0x1fb/0x7e0 [ 38.650262] [] ? _mutex_lock_nest_lock+0x870/0x870 [ 38.656825] [] ? trace_hardirqs_on+0x10/0x10 [ 38.662868] [] do_io_accounting+0x1fb/0x7e0 [ 38.668840] [] ? proc_uid_map_open+0x30/0x30 [ 38.674882] [] ? check_preemption_disabled+0x3b/0x170 [ 38.681699] [] ? get_pid_task+0x9b/0x140 [ 38.687383] [] proc_tgid_io_accounting+0x22/0x30 [ 38.693761] [] proc_single_show+0xfd/0x170 [ 38.699629] [] seq_read+0x4b6/0x12d0 [ 38.705001] [] ? seq_lseek+0x3c0/0x3c0 [ 38.710519] [] ? trace_hardirqs_on+0x10/0x10 [ 38.716552] [] ? fsnotify+0x114/0x1100 [ 38.722063] [] ? _raw_spin_unlock_irqrestore+0x45/0x70 [ 38.728982] [] __vfs_read+0x115/0x560 [ 38.734408] [] ? seq_lseek+0x3c0/0x3c0 [ 38.739934] [] ? clone_verify_area+0x220/0x220 [ 38.746140] [] ? __fsnotify_inode_delete+0x30/0x30 [ 38.752695] [] ? __fsnotify_update_child_dentry_flags.part.0+0x300/0x300 [ 38.761161] [] ? avc_policy_seqno+0x9/0x20 [ 38.767042] [] ? selinux_file_permission+0x82/0x470 [ 38.773699] [] ? security_file_permission+0x8f/0x1e0 [ 38.780443] [] ? rw_verify_area+0xe5/0x2a0 [ 38.786333] [] vfs_read+0x124/0x390 [ 38.791581] [] SyS_pread64+0x145/0x170 [ 38.797088] [] ? SyS_write+0x1c0/0x1c0 [ 38.802601] [] ? __close_fd+0x15d/0x230 [ 38.808199] [] ? do_syscall_64+0x48/0x480 [ 38.813975] [] ? SyS_write+0x1c0/0x1c0 [ 38.819505] [] do_syscall_64+0x19f/0x480 [ 38.825215] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb 2018/09/21 23:43:55 executed programs: 141