INIT: Id "2" respawning too fast: disabled for 5 minutes INIT: Id "4" respawning too fast: disabled for 5 minutes INIT: Id "3" respawning too fast: disabled for 5 minutes INIT: Id "5" respawning too fast: disabled for 5 minutes INIT: Id "6" respawning too fast: disabled for 5 minutes [ 112.316578] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.6' (ECDSA) to the list of known hosts. [ 117.787108] random: sshd: uninitialized urandom read (32 bytes read) [ 117.878917] audit: type=1400 audit(1541441347.367:7): avc: denied { map } for pid=1826 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=1426 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2018/11/05 18:09:07 parsed 1 programs [ 118.409035] audit: type=1400 audit(1541441347.897:8): avc: denied { map } for pid=1826 comm="syz-execprog" path="/sys/kernel/debug/kcov" dev="debugfs" ino=4999 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 [ 118.850262] random: cc1: uninitialized urandom read (8 bytes read) 2018/11/05 18:09:09 executed programs: 0 [ 120.061289] audit: type=1400 audit(1541441349.547:9): avc: denied { map } for pid=1826 comm="syz-execprog" path="/root/syzkaller-shm593282881" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 2018/11/05 18:09:15 executed programs: 6 [ 125.895508] audit: type=1400 audit(1541441355.387:10): avc: denied { map } for pid=4395 comm="syz-executor1" path=2F6D656D66643A6D696D655F74797065202864656C6574656429 dev="tmpfs" ino=9633 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:tmpfs_t:s0 tclass=file permissive=1 2018/11/05 18:09:20 executed programs: 451 2018/11/05 18:09:25 executed programs: 1046 [ 140.793288] audit: type=1400 audit(1541441370.287:11): avc: denied { map } for pid=10554 comm="syz-executor1" path="/dev/ashmem" dev="devtmpfs" ino=1082 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=chr_file permissive=1 [ 140.816844] 2018/11/05 18:09:30 executed programs: 1655 [ 140.816847] ====================================================== [ 140.816848] WARNING: possible circular locking dependency detected [ 140.816852] 4.14.78+ #28 Not tainted [ 140.816853] ------------------------------------------------------ [ 140.816856] syz-executor1/10558 is trying to acquire lock: [ 140.816858] (&sb->s_type->i_mutex_key#10){+.+.}, at: [] shmem_fallocate+0x149/0xb20 [ 140.816877] [ 140.816877] but task is already holding lock: [ 140.816878] (ashmem_mutex){+.+.}, at: [] ashmem_shrink_scan+0x52/0x4e0 [ 140.816889] [ 140.816889] which lock already depends on the new lock. [ 140.816889] [ 140.816891] [ 140.816891] the existing dependency chain (in reverse order) is: [ 140.816892] [ 140.816892] -> #2 (ashmem_mutex){+.+.}: [ 140.816903] __mutex_lock+0xf5/0x1480 [ 140.816907] ashmem_mmap+0x4c/0x430 [ 140.816914] mmap_region+0x836/0xfb0 [ 140.816918] do_mmap+0x551/0xb80 [ 140.816924] vm_mmap_pgoff+0x180/0x1d0 [ 140.816929] SyS_mmap_pgoff+0xf8/0x1a0 [ 140.816935] do_syscall_64+0x19b/0x4b0 [ 140.816941] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 140.816942] [ 140.816942] -> #1 (&mm->mmap_sem){++++}: [ 140.816950] down_read+0x37/0xa0 [ 140.816956] __do_page_fault+0x868/0xb60 [ 140.816961] page_fault+0x22/0x50 [ 140.816967] iov_iter_fault_in_readable+0x177/0x370 [ 140.816972] generic_perform_write+0x166/0x430 [ 140.816977] __generic_file_write_iter+0x345/0x540 [ 140.816982] generic_file_write_iter+0x36f/0x650 [ 140.816986] __vfs_write+0x417/0x5c0 [ 140.816990] vfs_write+0x17f/0x4d0 [ 140.816994] SyS_write+0xc2/0x1a0 [ 140.816998] do_syscall_64+0x19b/0x4b0 [ 140.817003] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 140.817004] [ 140.817004] -> #0 (&sb->s_type->i_mutex_key#10){+.+.}: [ 140.817015] lock_acquire+0x10f/0x380 [ 140.817019] down_write+0x34/0x90 [ 140.817024] shmem_fallocate+0x149/0xb20 [ 140.817028] ashmem_shrink_scan+0x1b6/0x4e0 [ 140.817032] ashmem_ioctl+0x2cc/0xe20 [ 140.817038] do_vfs_ioctl+0x1a0/0x1030 [ 140.817043] SyS_ioctl+0x7e/0xb0 [ 140.817047] do_syscall_64+0x19b/0x4b0 [ 140.817052] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 140.817053] [ 140.817053] other info that might help us debug this: [ 140.817053] [ 140.817054] Chain exists of: [ 140.817054] &sb->s_type->i_mutex_key#10 --> &mm->mmap_sem --> ashmem_mutex [ 140.817054] [ 140.817063] Possible unsafe locking scenario: [ 140.817063] [ 140.817064] CPU0 CPU1 [ 140.817066] ---- ---- [ 140.817066] lock(ashmem_mutex); [ 140.817070] lock(&mm->mmap_sem); [ 140.817073] lock(ashmem_mutex); [ 140.817076] lock(&sb->s_type->i_mutex_key#10); [ 140.817081] [ 140.817081] *** DEADLOCK *** [ 140.817081] [ 140.817084] 1 lock held by syz-executor1/10558: [ 140.817085] #0: (ashmem_mutex){+.+.}, at: [] ashmem_shrink_scan+0x52/0x4e0 [ 140.817095] [ 140.817095] stack backtrace: [ 140.817100] CPU: 0 PID: 10558 Comm: syz-executor1 Not tainted 4.14.78+ #28 [ 140.817102] Call Trace: [ 140.817120] dump_stack+0xb9/0x11b [ 140.817134] print_circular_bug.isra.18.cold.43+0x2d3/0x40c [ 140.817139] ? save_trace+0xd6/0x250 [ 140.817146] __lock_acquire+0x2ff9/0x4320 [ 140.817156] ? trace_hardirqs_on+0x10/0x10 [ 140.817161] ? __lock_acquire+0x619/0x4320 [ 140.817167] ? _raw_spin_unlock_irq+0x35/0x50 [ 140.817174] ? finish_task_switch+0x1e7/0x590 [ 140.817179] ? finish_task_switch+0x1be/0x590 [ 140.817187] ? trace_hardirqs_on+0x10/0x10 [ 140.817194] ? __sched_text_start+0x8/0x8 [ 140.817201] lock_acquire+0x10f/0x380 [ 140.817207] ? shmem_fallocate+0x149/0xb20 [ 140.817214] down_write+0x34/0x90 [ 140.817219] ? shmem_fallocate+0x149/0xb20 [ 140.817224] shmem_fallocate+0x149/0xb20 [ 140.817233] ? avc_has_perm_noaudit+0x17c/0x300 [ 140.817240] ? shmem_setattr+0x790/0x790 [ 140.817247] ? avc_has_perm_noaudit+0x1a3/0x300 [ 140.817254] ? avc_has_extended_perms+0xd50/0xd50 [ 140.817260] ? wake_up_q+0xed/0x150 [ 140.817269] ? lock_acquire+0x10f/0x380 [ 140.817274] ? ashmem_shrink_scan+0x52/0x4e0 [ 140.817281] ? mutex_trylock+0x15c/0x1a0 [ 140.817287] ashmem_shrink_scan+0x1b6/0x4e0 [ 140.817295] ashmem_ioctl+0x2cc/0xe20 [ 140.817300] ? trace_hardirqs_on+0x10/0x10 [ 140.817306] ? trace_hardirqs_on+0x10/0x10 [ 140.817311] ? ashmem_shrink_scan+0x4e0/0x4e0 [ 140.817317] ? trace_hardirqs_on+0x10/0x10 [ 140.817325] ? ashmem_shrink_scan+0x4e0/0x4e0 [ 140.817331] do_vfs_ioctl+0x1a0/0x1030 [ 140.817339] ? ioctl_preallocate+0x1d0/0x1d0 [ 140.817346] ? selinux_parse_skb.constprop.42+0x1a90/0x1a90 [ 140.817351] ? save_trace+0x3a/0x250 [ 140.817356] ? lock_acquire+0x10f/0x380 [ 140.817363] ? check_preemption_disabled+0x34/0x160 [ 140.817369] ? assoc_array_gc+0x10fb/0x1120 [ 140.817377] ? __fget+0x22b/0x3a0 [ 140.817384] ? security_file_ioctl+0x7c/0xb0 [ 140.817390] SyS_ioctl+0x7e/0xb0 [ 140.817396] ? do_vfs_ioctl+0x1030/0x1030 [ 140.817401] do_syscall_64+0x19b/0x4b0 [ 140.817409] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 140.817413] RIP: 0033:0x457569 [ 140.817416] RSP: 002b:00007f6f997b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 140.817422] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457569 [ 140.817426] RDX: 0000000000000000 RSI: 000000000000770a RDI: 0000000000000003 [ 140.817429] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 140.817432] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6f997b46d4 [ 140.817435] R13: 00000000004be7a0 R14: 00000000004ce690 R15: 00000000ffffffff 2018/11/05 18:09:35 executed programs: 2468 2018/11/05 18:09:40 executed programs: 3331