[....] Starting enhanced syslogd: rsyslogd[   13.307588] audit: type=1400 audit(1565713564.057:4): avc:  denied  { syslog } for  pid=1920 comm="rsyslogd" capability=34  scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1
[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
Starting mcstransd: 
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added '10.128.1.4' (ECDSA) to the list of known hosts.
executing program
syzkaller login: [   39.062507] 
[   39.064152] ======================================================
[   39.070549] [ INFO: possible circular locking dependency detected ]
[   39.076945] 4.4.174+ #17 Not tainted
[   39.080635] -------------------------------------------------------
[   39.087168] syz-executor814/2081 is trying to acquire lock:
[   39.093228]  (&pipe->mutex/1){+.+.+.}, at: [<ffffffff814af8b3>] pipe_lock+0x63/0x80
[   39.101672] 
[   39.101672] but task is already holding lock:
[   39.107634]  (sb_writers#4){.+.+.+}, at: [<ffffffff81537eed>] SyS_splice+0xf2d/0x13a0
[   39.116524] 
[   39.116524] which lock already depends on the new lock.
[   39.116524] 
[   39.125000] 
[   39.125000] the existing dependency chain (in reverse order) is:
[   39.132622] 
-> #5 (sb_writers#4){.+.+.+}:
[   39.137565]        [<ffffffff81205f6e>] lock_acquire+0x15e/0x450
[   39.143966]        [<ffffffff8149ea2f>] __sb_start_write+0x1af/0x310
[   39.150580]        [<ffffffff816c3af4>] ext4_lazyinit_thread+0x1e4/0x7b0
[   39.157757]        [<ffffffff811342c3>] kthread+0x273/0x310
[   39.163674]        [<ffffffff82718fc5>] ret_from_fork+0x55/0x80
[   39.170048] 
-> #4 (&eli->li_list_mtx){+.+...}:
[   39.175283]        [<ffffffff81205f6e>] lock_acquire+0x15e/0x450
[   39.181849]        [<ffffffff8270c191>] mutex_lock_nested+0xc1/0xb80
[   39.188527]        [<ffffffff816cdacd>] ext4_register_li_request+0x2fd/0x7d0
[   39.195830]        [<ffffffff816cf306>] ext4_remount+0x1366/0x1b90
[   39.202313]        [<ffffffff814a1ccb>] do_remount_sb2+0x41b/0x7a0
[   39.216224]        [<ffffffff815028ab>] do_mount+0xfdb/0x2a40
[   39.222221]        [<ffffffff81504d00>] SyS_mount+0x130/0x1d0
[   39.228215]        [<ffffffff82718ba1>] entry_SYSCALL_64_fastpath+0x1e/0x9a
[   39.235429] 
-> #3 (&ext4_li_mtx){+.+.+.}:
[   39.240226]        [<ffffffff81205f6e>] lock_acquire+0x15e/0x450
[   39.246482]        [<ffffffff8270c191>] mutex_lock_nested+0xc1/0xb80
[   39.253327]        [<ffffffff816cd859>] ext4_register_li_request+0x89/0x7d0
[   39.260643]        [<ffffffff816cf306>] ext4_remount+0x1366/0x1b90
[   39.267249]        [<ffffffff814a1ccb>] do_remount_sb2+0x41b/0x7a0
[   39.273772]        [<ffffffff815028ab>] do_mount+0xfdb/0x2a40
[   39.279765]        [<ffffffff81504d00>] SyS_mount+0x130/0x1d0
[   39.285815]        [<ffffffff82718ba1>] entry_SYSCALL_64_fastpath+0x1e/0x9a
[   39.293019] 
-> #2 (&type->s_umount_key#34){++++++}:
[   39.299118]        [<ffffffff81205f6e>] lock_acquire+0x15e/0x450
[   39.306395]        [<ffffffff827139a2>] down_read+0x42/0x60
[   39.312304]        [<ffffffff814a1411>] iterate_supers+0xe1/0x250
[   39.318642]        [<ffffffff819b19f7>] selinux_complete_init+0x2f/0x31
[   39.325615]        [<ffffffff819a353d>] security_load_policy+0x69d/0x9c0
[   39.332680]        [<ffffffff81979e55>] sel_write_load+0x175/0xf90
[   39.339222]        [<ffffffff81496916>] __vfs_write+0x116/0x3d0
[   39.345467]        [<ffffffff81498612>] vfs_write+0x182/0x4e0
[   39.351463]        [<ffffffff8149ac4c>] SyS_write+0xdc/0x1c0
[   39.357650]        [<ffffffff82718ba1>] entry_SYSCALL_64_fastpath+0x1e/0x9a
[   39.365010] 
-> #1 (sel_mutex){+.+.+.}:
[   39.369544]        [<ffffffff81205f6e>] lock_acquire+0x15e/0x450
[   39.375810]        [<ffffffff8270c191>] mutex_lock_nested+0xc1/0xb80
[   39.382487]        [<ffffffff81977a39>] sel_commit_bools_write+0x89/0x260
[   39.389545]        [<ffffffff81496916>] __vfs_write+0x116/0x3d0
[   39.395831]        [<ffffffff81496ce2>] __kernel_write+0x112/0x370
[   39.402676]        [<ffffffff81532e6d>] write_pipe_buf+0x15d/0x1f0
[   39.409108]        [<ffffffff81533b6e>] __splice_from_pipe+0x37e/0x7a0
[   39.415882]        [<ffffffff81536be8>] splice_from_pipe+0x108/0x170
[   39.422610]        [<ffffffff81536cdc>] default_file_splice_write+0x3c/0x80
[   39.429844]        [<ffffffff81537d31>] SyS_splice+0xd71/0x13a0
[   39.436195]        [<ffffffff8100603d>] do_fast_syscall_32+0x32d/0xa90
[   39.443397]        [<ffffffff8271a350>] sysenter_flags_fixed+0xd/0x1a
[   39.450381] 
-> #0 (&pipe->mutex/1){+.+.+.}:
[   39.455539]        [<ffffffff81202d86>] __lock_acquire+0x37d6/0x4f50
[   39.462247]        [<ffffffff81205f6e>] lock_acquire+0x15e/0x450
[   39.468522]        [<ffffffff8270c191>] mutex_lock_nested+0xc1/0xb80
[   39.475718]        [<ffffffff814af8b3>] pipe_lock+0x63/0x80
[   39.482497]        [<ffffffff815342e9>] iter_file_splice_write+0x179/0xb30
[   39.489624]        [<ffffffff81537d31>] SyS_splice+0xd71/0x13a0
[   39.495895]        [<ffffffff8100603d>] do_fast_syscall_32+0x32d/0xa90
[   39.502730]        [<ffffffff8271a350>] sysenter_flags_fixed+0xd/0x1a
[   39.509428] 
[   39.509428] other info that might help us debug this:
[   39.509428] 
[   39.517898] Chain exists of:
  &pipe->mutex/1 --> &eli->li_list_mtx --> sb_writers#4

[   39.527204]  Possible unsafe locking scenario:
[   39.527204] 
[   39.533411]        CPU0                    CPU1
[   39.538128]        ----                    ----
[   39.542777]   lock(sb_writers#4);
[   39.546700]                                lock(&eli->li_list_mtx);
[   39.553422]                                lock(sb_writers#4);
[   39.559931]   lock(&pipe->mutex/1);
[   39.564102] 
[   39.564102]  *** DEADLOCK ***
[   39.564102] 
[   39.570146] 1 lock held by syz-executor814/2081:
[   39.574880]  #0:  (sb_writers#4){.+.+.+}, at: [<ffffffff81537eed>] SyS_splice+0xf2d/0x13a0
[   39.584102] 
[   39.584102] stack backtrace:
[   39.588694] CPU: 0 PID: 2081 Comm: syz-executor814 Not tainted 4.4.174+ #17
[   39.595773]  0000000000000000 f232eeee74267ec1 ffff8800b648f840 ffffffff81aad1a1
[   39.603793]  ffffffff84057a80 ffff8801d4cc97c0 ffffffff83abcf50 ffffffff83abc020
[   39.611933]  ffffffff83ac7d20 ffff8800b648f890 ffffffff813abcda ffffffff83e1ee00
[   39.620058] Call Trace:
[   39.622738]  [<ffffffff81aad1a1>] dump_stack+0xc1/0x120
[   39.628170]  [<ffffffff813abcda>] print_circular_bug.cold+0x2f7/0x44e
[   39.634748]  [<ffffffff81202d86>] __lock_acquire+0x37d6/0x4f50
[   39.640711]  [<ffffffff82718015>] ? _raw_spin_unlock_irqrestore+0x45/0x70
[   39.647745]  [<ffffffff811ff5b0>] ? trace_hardirqs_on+0x10/0x10
[   39.653892]  [<ffffffff8102e3c6>] ? save_stack_trace+0x26/0x50
[   39.659855]  [<ffffffff81484197>] ? kasan_kmalloc+0xb7/0xd0
[   39.665760]  [<ffffffff81480521>] ? __kmalloc+0x141/0x330
[   39.671284]  [<ffffffff815342cc>] ? iter_file_splice_write+0x15c/0xb30
[   39.677945]  [<ffffffff81537d31>] ? SyS_splice+0xd71/0x13a0
[   39.683700]  [<ffffffff8100603d>] ? do_fast_syscall_32+0x32d/0xa90
[   39.690215]  [<ffffffff81291dad>] ? futex_wait+0x47d/0x600
[   39.695848]  [<ffffffff81205f6e>] lock_acquire+0x15e/0x450
[   39.701469]  [<ffffffff814af8b3>] ? pipe_lock+0x63/0x80
[   39.706829]  [<ffffffff814af8b3>] ? pipe_lock+0x63/0x80
[   39.712748]  [<ffffffff8270c191>] mutex_lock_nested+0xc1/0xb80
[   39.719276]  [<ffffffff814af8b3>] ? pipe_lock+0x63/0x80
[   39.726437]  [<ffffffff81b0abec>] ? check_preemption_disabled+0x3c/0x200
[   39.733455]  [<ffffffff81b0abec>] ? check_preemption_disabled+0x3c/0x200
[   39.740559]  [<ffffffff8270c0d0>] ? mutex_trylock+0x500/0x500
[   39.746433]  [<ffffffff81484025>] ? kasan_unpoison_shadow+0x35/0x50
[   39.753151]  [<ffffffff81484197>] ? kasan_kmalloc+0xb7/0xd0
[   39.758851]  [<ffffffff814af8b3>] pipe_lock+0x63/0x80
[   39.764033]  [<ffffffff815342e9>] iter_file_splice_write+0x179/0xb30
[   39.770629]  [<ffffffff811ff5b0>] ? trace_hardirqs_on+0x10/0x10
[   39.776773]  [<ffffffff81b0abec>] ? check_preemption_disabled+0x3c/0x200
[   39.783941]  [<ffffffff81534170>] ? vmsplice_to_user+0x1e0/0x1e0
[   39.790467]  [<ffffffff81b0abec>] ? check_preemption_disabled+0x3c/0x200
[   39.797293]  [<ffffffff81b0abec>] ? check_preemption_disabled+0x3c/0x200
[   39.804244]  [<ffffffff8123a98b>] ? rcu_read_lock_sched_held+0x10b/0x130
[   39.811207]  [<ffffffff8123b043>] ? rcu_sync_lockdep_assert+0x73/0xb0
[   39.817889]  [<ffffffff8149e9cf>] ? __sb_start_write+0x14f/0x310
[   39.824193]  [<ffffffff81534170>] ? vmsplice_to_user+0x1e0/0x1e0
[   39.830546]  [<ffffffff81537d31>] SyS_splice+0xd71/0x13a0
[   39.836263]  [<ffffffff81536fc0>] ? compat_SyS_vmsplice+0x160/0x160
[   39.843341]  [<ffffffff814940e0>] ? SyS_chdir+0x1e0/0x1e0
[   39.849381]  [<ffffffff81005de6>] ? do_fast_syscall_32+0xd6/0xa90
[   39.855591]  [<ffffffff81536fc0>] ? compat_SyS_vmsplice+0x160/0x160
executing program
[   39.861974]  [<ffffffff8100603d>] do_fast_syscall_32+0x32d/0xa90
[   39.868377]  [<ffffffff8271a350>] sysenter_flags_fixed+0xd/0x1a
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program