[....] Starting OpenBSD Secure Shell server: sshd[ 10.259264] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 28.319736] random: sshd: uninitialized urandom read (32 bytes read) [ 28.708808] audit: type=1400 audit(1547466338.647:6): avc: denied { map } for pid=1761 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 28.770191] random: sshd: uninitialized urandom read (32 bytes read) [ 29.216515] random: sshd: uninitialized urandom read (32 bytes read) [ 29.359675] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.12' (ECDSA) to the list of known hosts. [ 34.939165] random: sshd: uninitialized urandom read (32 bytes read) executing program [ 35.025528] audit: type=1400 audit(1547466344.967:7): avc: denied { map } for pid=1779 comm="syz-executor260" path="/root/syz-executor260775650" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 35.080348] [ 35.081970] ====================================================== [ 35.088308] WARNING: possible circular locking dependency detected [ 35.094626] 4.14.93+ #6 Not tainted [ 35.098272] ------------------------------------------------------ [ 35.104582] syz-executor260/1781 is trying to acquire lock: [ 35.110265] (&pipe->mutex/1){+.+.}, at: [] fifo_open+0x156/0x9b0 [ 35.118170] [ 35.118170] but task is already holding lock: [ 35.124115] (&sig->cred_guard_mutex){+.+.}, at: [] prepare_bprm_creds+0x51/0x110 [ 35.133450] [ 35.133450] which lock already depends on the new lock. [ 35.133450] [ 35.141918] [ 35.141918] the existing dependency chain (in reverse order) is: [ 35.149511] [ 35.149511] -> #1 (&sig->cred_guard_mutex){+.+.}: [ 35.156289] [ 35.156289] -> #0 (&pipe->mutex/1){+.+.}: [ 35.163085] [ 35.163085] other info that might help us debug this: [ 35.163085] [ 35.171380] Possible unsafe locking scenario: [ 35.171380] [ 35.177506] CPU0 CPU1 [ 35.182297] ---- ---- [ 35.187038] lock(&sig->cred_guard_mutex); [ 35.191340] lock(&pipe->mutex/1); [ 35.197463] lock(&sig->cred_guard_mutex); [ 35.204273] lock(&pipe->mutex/1); [ 35.207871] [ 35.207871] *** DEADLOCK *** [ 35.207871] [ 35.213901] 1 lock held by syz-executor260/1781: [ 35.218628] #0: (&sig->cred_guard_mutex){+.+.}, at: [] prepare_bprm_creds+0x51/0x110 [ 35.228352] [ 35.228352] stack backtrace: [ 35.232850] CPU: 1 PID: 1781 Comm: syz-executor260 Not tainted 4.14.93+ #6 [ 35.239830] Call Trace: [ 35.242510] dump_stack+0xb9/0x10e [ 35.246030] print_circular_bug.isra.0.cold+0x2dc/0x425 [ 35.251522] ? __lock_acquire+0x2d83/0x3fa0 [ 35.255823] ? trace_hardirqs_on+0x10/0x10 [ 35.260030] ? _raw_spin_unlock_irqrestore+0x41/0x70 [ 35.265107] ? __lock_acquire+0x56a/0x3fa0 [ 35.269317] ? do_filp_open+0x1a1/0x280 [ 35.273264] ? lock_acquire+0x10f/0x380 [ 35.277211] ? fifo_open+0x156/0x9b0 [ 35.280909] ? fifo_open+0x156/0x9b0 [ 35.284739] ? __mutex_lock+0xf7/0x1430 [ 35.288687] ? fifo_open+0x156/0x9b0 [ 35.292374] ? fifo_open+0x156/0x9b0 [ 35.296186] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 35.301623] ? fifo_open+0x284/0x9b0 [ 35.305309] ? lock_downgrade+0x5d0/0x5d0 [ 35.309542] ? lock_acquire+0x10f/0x380 [ 35.313488] ? fifo_open+0x243/0x9b0 [ 35.317225] ? debug_mutex_init+0x28/0x53 [ 35.321358] ? fifo_open+0x156/0x9b0 [ 35.325045] ? fifo_open+0x156/0x9b0 [ 35.328727] ? do_dentry_open+0x41b/0xd60 [ 35.332843] ? pipe_release+0x240/0x240 [ 35.336788] ? vfs_open+0x105/0x230 [ 35.340391] ? path_openat+0xb6b/0x2b70 [ 35.344337] ? path_mountpoint+0x9a0/0x9a0 [ 35.348686] ? kasan_kmalloc.part.0+0xa6/0xd0 [ 35.353159] ? kasan_kmalloc.part.0+0x4f/0xd0 [ 35.357771] ? kmemdup+0x23/0x50 [ 35.361110] ? selinux_cred_prepare+0x3e/0x90 [ 35.365580] ? do_filp_open+0x1a1/0x280 [ 35.369525] ? prepare_bprm_creds+0x66/0x110 [ 35.373905] ? may_open_dev+0xe0/0xe0 [ 35.377701] ? rcu_lockdep_current_cpu_online+0xed/0x140 [ 35.383135] ? rcu_read_lock_sched_held+0x10a/0x130 [ 35.388135] ? do_open_execat+0xf7/0x5c0 [ 35.392171] ? setup_arg_pages+0x710/0x710 [ 35.396376] ? do_execveat_common.isra.0+0x674/0x1c30 [ 35.401536] ? lock_acquire+0x10f/0x380 [ 35.405646] ? do_execveat_common.isra.0+0x422/0x1c30 [ 35.410956] ? check_preemption_disabled+0x35/0x1f0 [ 35.415947] ? do_execveat_common.isra.0+0x6b3/0x1c30 [ 35.421181] ? prepare_bprm_creds+0x110/0x110 [ 35.425705] ? getname_flags+0x22e/0x550 [ 35.429753] ? SyS_exec