[....] Starting enhanced syslogd: rsyslogd[ 13.933902] audit: type=1400 audit(1540698653.046:4): avc: denied { syslog } for pid=1920 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Starting mcstransd: [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.31' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 45.056838] [ 45.058504] ====================================================== [ 45.064812] [ INFO: possible circular locking dependency detected ] [ 45.071213] 4.4.162+ #7 Not tainted [ 45.071215] ------------------------------------------------------- [ 45.071219] syz-executor844/2084 is trying to acquire lock: [ 45.071237] (sel_mutex){+.+.+.}, at: [] sel_commit_bools_write+0x87/0x250 [ 45.071243] [ 45.071243] but task is already holding lock: [ 45.071255] (&pipe->mutex/1){+.+.+.}, at: [] pipe_lock+0x5e/0x70 [ 45.071256] [ 45.071256] which lock already depends on the new lock. [ 45.071256] [ 45.071258] [ 45.071258] the existing dependency chain (in reverse order) is: [ 45.071265] [ 45.071265] -> #7 (&pipe->mutex/1){+.+.+.}: [ 45.071275] [] lock_acquire+0x15e/0x450 [ 45.071284] [] mutex_lock_nested+0xbb/0x8d0 [ 45.071292] [] fifo_open+0x15c/0x9e0 [ 45.071301] [] do_dentry_open+0x38d/0xbd0 [ 45.071309] [] vfs_open+0x12a/0x210 [ 45.071317] [] path_openat+0x50c/0x39a0 [ 45.071324] [] do_filp_open+0x197/0x270 [ 45.071333] [] do_open_execat+0x10f/0x6f0 [ 45.071341] [] do_execveat_common.isra.14+0x6a1/0x1f00 [ 45.071348] [] compat_SyS_execve+0x48/0x60 executing program [ 45.071358] [] do_fast_syscall_32+0x31e/0xa80 [ 45.071366] [] sysenter_flags_fixed+0xd/0x1a [ 45.071372] [ 45.071372] -> #6 (&sig->cred_guard_mutex){+.+.+.}: [ 45.071380] [] lock_acquire+0x15e/0x450 [ 45.071388] [] mutex_lock_killable_nested+0xcc/0xa10 [ 45.071397] [] lock_trace+0x44/0xc0 [ 45.071406] [] proc_pid_personality+0x1c/0xc0 [ 45.071413] [] proc_single_show+0xfd/0x170 [ 45.071422] [] traverse+0x363/0x920 [ 45.071428] [] seq_read+0xd05/0x12b0 [ 45.071436] [] do_loop_readv_writev+0x148/0x1e0 [ 45.071456] [] compat_do_readv_writev+0x583/0x6f0 [ 45.071463] [] compat_readv+0xde/0x150 [ 45.071470] [] __compat_sys_preadv64+0x144/0x170 [ 45.071478] [] compat_SyS_preadv+0x38/0x50 [ 45.071487] [] do_fast_syscall_32+0x31e/0xa80 [ 45.071494] [] sysenter_flags_fixed+0xd/0x1a [ 45.071500] [ 45.071500] -> #5 (&p->lock){+.+.+.}: [ 45.071508] [] lock_acquire+0x15e/0x450 [ 45.071516] [] mutex_lock_nested+0xbb/0x8d0 [ 45.071523] [] seq_read+0xdd/0x12b0 [ 45.071531] [] proc_reg_read+0xfd/0x180 [ 45.071538] [] do_loop_readv_writev+0x148/0x1e0 [ 45.071546] [] do_readv_writev+0x581/0x6f0 [ 45.071553] [] vfs_readv+0x78/0xb0 [ 45.071561] [] default_file_splice_read+0x50f/0x8f0 [ 45.071568] [] do_splice_to+0xf7/0x140 [ 45.071575] [] splice_direct_to_actor+0x242/0x830 [ 45.071583] [] do_splice_direct+0x1a3/0x270 [ 45.071590] [] do_sendfile+0x4e4/0xb80 [ 45.071598] [] compat_SyS_sendfile+0xd1/0x160 [ 45.071606] [] do_fast_syscall_32+0x31e/0xa80 [ 45.071613] [] sysenter_flags_fixed+0xd/0x1a [ 45.071621] [ 45.071621] -> #4 (sb_writers#4){.+.+.+}: [ 45.071629] [] lock_acquire+0x15e/0x450 [ 45.071636] [] __sb_start_write+0x1ae/0x310 [ 45.071644] [] ext4_lazyinit_thread+0x1a7/0x750 [ 45.071653] [] kthread+0x268/0x300 [ 45.071660] [] ret_from_fork+0x55/0x80 [ 45.071666] [ 45.071666] -> #3 (&eli->li_list_mtx){+.+...}: [ 45.071673] [] lock_acquire+0x15e/0x450 [ 45.071681] [] mutex_lock_nested+0xbb/0x8d0 [ 45.071689] [] ext4_register_li_request+0x304/0x7a0 [ 45.071697] [] ext4_remount+0x1368/0x1bb0 [ 45.071712] [] do_remount_sb2+0x428/0x7d0 [ 45.071719] [] do_mount+0x101e/0x2a10 [ 45.071726] [] SyS_mount+0x191/0x1c0 executing program [ 45.071735] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 45.071741] [ 45.071741] -> #2 (&ext4_li_mtx){+.+.+.}: [ 45.071748] [] lock_acquire+0x15e/0x450 [ 45.071756] [] mutex_lock_nested+0xbb/0x8d0 [ 45.071764] [] ext4_register_li_request+0x87/0x7a0 [ 45.071772] [] ext4_remount+0x1368/0x1bb0 [ 45.071780] [] do_remount_sb2+0x428/0x7d0 [ 45.071798] [] do_mount+0x101e/0x2a10 [ 45.071806] [] SyS_mount+0x191/0x1c0 [ 45.071814] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 45.071822] [ 45.071822] -> #1 (&type->s_umount_key#34){++++++}: [ 45.071830] [] lock_acquire+0x15e/0x450 [ 45.071838] [] down_read+0x42/0x60 [ 45.071846] [] iterate_supers+0xe1/0x260 [ 45.071854] [] selinux_complete_init+0x2f/0x31 [ 45.071863] [] security_load_policy+0x886/0x9b0 [ 45.071870] [] sel_write_load+0x191/0xfc0 [ 45.071877] [] __vfs_write+0x11c/0x3e0 [ 45.071885] [] vfs_write+0x17e/0x4e0 [ 45.071892] [] SyS_write+0xd9/0x1c0 [ 45.071901] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 45.071907] [ 45.071907] -> #0 (sel_mutex){+.+.+.}: [ 45.071915] [] __lock_acquire+0x3e6c/0x5f10 [ 45.071923] [] lock_acquire+0x15e/0x450 [ 45.071931] [] mutex_lock_nested+0xbb/0x8d0 [ 45.071938] [] sel_commit_bools_write+0x87/0x250 [ 45.071945] [] __vfs_write+0x11c/0x3e0 [ 45.071952] [] __kernel_write+0x10a/0x350 [ 45.071960] [] write_pipe_buf+0x15d/0x1f0 [ 45.071967] [] __splice_from_pipe+0x364/0x790 [ 45.071975] [] splice_from_pipe+0xf9/0x170 [ 45.071996] [] default_file_splice_write+0x3c/0x80 [ 45.072003] [] SyS_splice+0xde1/0x1430 [ 45.072011] [] do_fast_syscall_32+0x31e/0xa80 [ 45.072019] [] sysenter_flags_fixed+0xd/0x1a [ 45.072020] [ 45.072020] other info that might help us debug this: [ 45.072020] [ 45.072030] Chain exists of: [ 45.072030] sel_mutex --> &sig->cred_guard_mutex --> &pipe->mutex/1 [ 45.072030] [ 45.072032] Possible unsafe locking scenario: [ 45.072032] [ 45.072033] CPU0 CPU1 executing program [ 45.072035] ---- ---- [ 45.072040] lock(&pipe->mutex/1); [ 45.072044] lock(&sig->cred_guard_mutex); [ 45.072049] lock(&pipe->mutex/1); [ 45.072052] lock(sel_mutex); [ 45.072054] [ 45.072054] *** DEADLOCK *** [ 45.072054] [ 45.072057] 2 locks held by syz-executor844/2084: [ 45.072071] #0: (sb_writers#3){.+.+.+}, at: [] SyS_splice+0xfaa/0x1430 [ 45.072083] #1: (&pipe->mutex/1){+.+.+.}, at: [] pipe_lock+0x5e/0x70 [ 45.072085] [ 45.072085] stack backtrace: [ 45.072091] CPU: 0 PID: 2084 Comm: syz-executor844 Not tainted 4.4.162+ #7 [ 45.072100] 0000000000000000 1ec056ad9ec89c63 ffff8800b6107588 ffffffff81a994bd [ 45.072109] ffffffff83aae670 ffffffff83ab50c0 ffffffff83ab0830 ffff8800b7196810 [ 45.072117] ffff8800b7195f00 ffff8800b61075d0 ffffffff813a834a 0000000000000002 [ 45.072119] Call Trace: [ 45.072127] [] dump_stack+0xc1/0x124 [ 45.072136] [] print_circular_bug.cold.34+0x2f7/0x432 [ 45.072156] [] __lock_acquire+0x3e6c/0x5f10 [ 45.072163] [] ? trace_hardirqs_on+0x10/0x10 [ 45.072170] [] ? put_prev_entity+0x27ac/0x3a30 [ 45.072178] [] lock_acquire+0x15e/0x450 [ 45.072184] [] ? sel_commit_bools_write+0x87/0x250 [ 45.072191] [] ? sel_commit_bools_write+0x87/0x250 [ 45.072198] [] mutex_lock_nested+0xbb/0x8d0 [ 45.072204] [] ? sel_commit_bools_write+0x87/0x250 [ 45.072212] [] ? __kernel_text_address+0x6b/0xa0 [ 45.072220] [] ? print_context_stack+0x4e/0xe0 [ 45.072227] [] ? mutex_trylock+0x3e0/0x3e0 [ 45.072234] [] ? dump_trace+0x184/0x360 [ 45.072241] [] sel_commit_bools_write+0x87/0x250 [ 45.072247] [] ? sel_read_mls+0xc0/0xc0 [ 45.072255] [] ? add_lock_to_list.isra.8.constprop.24+0x149/0x280 [ 45.072261] [] __vfs_write+0x11c/0x3e0 [ 45.072267] [] ? sel_read_mls+0xc0/0xc0 [ 45.072274] [] ? __vfs_read+0x3d0/0x3d0 [ 45.072281] [] ? trace_hardirqs_on+0x10/0x10 [ 45.072290] [] ? drop_futex_key_refs.isra.2+0x5e/0xf0 [ 45.072298] [] ? futex_wake+0x153/0x460 [ 45.072305] [] __kernel_write+0x10a/0x350 [ 45.072312] [] write_pipe_buf+0x15d/0x1f0 [ 45.072319] [] ? do_splice_direct+0x270/0x270 [ 45.072326] [] ? splice_from_pipe_next.part.3+0x248/0x310 executing program [ 45.072333] [] __splice_from_pipe+0x364/0x790 [ 45.072339] [] ? do_splice_direct+0x270/0x270 [ 45.072347] [] splice_from_pipe+0xf9/0x170 [ 45.072353] [] ? do_splice_direct+0x270/0x270 [ 45.072360] [] ? splice_shrink_spd+0x60/0x60 [ 45.072368] [] default_file_splice_write+0x3c/0x80 [ 45.072375] [] ? generic_splice_sendpage+0x50/0x50 [ 45.072381] [] SyS_splice+0xde1/0x1430 [ 45.072389] [] ? compat_SyS_futex+0x1e1/0x2f0 [ 45.072396] [] ? vfs_write+0x2e6/0x4e0 [ 45.072403] [] ? compat_SyS_vmsplice+0x160/0x160 [ 45.072411] [] ? do_fast_syscall_32+0xdb/0xa80 [ 45.072418] [] ? compat_SyS_vmsplice+0x160/0x160 [ 45.072426] [] do_fast_syscall_32+0x31e/0xa80 [ 45.072433] [] sysenter_flags_fixed+0xd/0x1a executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program