[....] Starting OpenBSD Secure Shell server: sshd[ 19.159923] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 22.656405] random: sshd: uninitialized urandom read (32 bytes read) [ 22.927640] random: sshd: uninitialized urandom read (32 bytes read) [ 23.470498] sshd (4300) used greatest stack depth: 16920 bytes left [ 23.492565] random: sshd: uninitialized urandom read (32 bytes read) [ 23.662966] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.14' (ECDSA) to the list of known hosts. [ 29.188220] random: sshd: uninitialized urandom read (32 bytes read) executing program [ 29.284941] [ 29.286615] ====================================================== [ 29.292910] WARNING: possible circular locking dependency detected [ 29.299208] 4.18.0+ #187 Not tainted [ 29.302924] ------------------------------------------------------ [ 29.309237] syz-executor101/4313 is trying to acquire lock: [ 29.314942] (____ptrval____) (sb_writers#3){.+.+}, at: vfs_fallocate+0x5be/0x8d0 [ 29.322477] [ 29.322477] but task is already holding lock: [ 29.328426] (____ptrval____) (ashmem_mutex){+.+.}, at: ashmem_shrink_scan+0xb4/0x580 [ 29.336300] [ 29.336300] which lock already depends on the new lock. [ 29.336300] [ 29.344598] [ 29.344598] the existing dependency chain (in reverse order) is: [ 29.352200] [ 29.352200] -> #3 (ashmem_mutex){+.+.}: [ 29.357649] __mutex_lock+0x17f/0x18a0 [ 29.362061] mutex_lock_nested+0x16/0x20 [ 29.366626] ashmem_mmap+0x53/0x4a0 [ 29.370771] mmap_region+0xe39/0x1b50 [ 29.375075] do_mmap+0xa06/0x1320 [ 29.379062] vm_mmap_pgoff+0x213/0x2c0 [ 29.383452] ksys_mmap_pgoff+0x4da/0x660 [ 29.388025] __x64_sys_mmap+0xe9/0x1b0 [ 29.392418] do_syscall_64+0x1b9/0x820 [ 29.396826] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 29.402513] [ 29.402513] -> #2 (&mm->mmap_sem){++++}: [ 29.408044] __might_fault+0x155/0x1e0 [ 29.412436] _copy_to_user+0x30/0x110 [ 29.416739] filldir+0x1ea/0x3a0 [ 29.420606] dcache_readdir+0x13a/0x620 [ 29.425087] iterate_dir+0x4b0/0x5d0 [ 29.429318] __x64_sys_getdents+0x29f/0x510 [ 29.434148] do_syscall_64+0x1b9/0x820 [ 29.438556] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 29.444259] [ 29.444259] -> #1 (&sb->s_type->i_mutex_key#10){++++}: [ 29.451006] down_write+0x8f/0x130 [ 29.455052] generic_file_write_iter+0xed/0x870 [ 29.460335] __vfs_write+0x6c6/0x9f0 [ 29.464550] vfs_write+0x1f8/0x560 [ 29.468611] kernel_write+0xab/0x120 [ 29.472827] fork_usermode_blob+0x11c/0x1b0 [ 29.477654] load_umh+0x2b/0xbd [ 29.481441] do_one_initcall+0x127/0x913 [ 29.486004] kernel_init_freeable+0x49b/0x58e [ 29.491017] kernel_init+0x11/0x1b3 [ 29.495174] ret_from_fork+0x3a/0x50 [ 29.499403] [ 29.499403] -> #0 (sb_writers#3){.+.+}: [ 29.504878] lock_acquire+0x1e4/0x540 [ 29.509197] __sb_start_write+0x1e9/0x300 [ 29.513858] vfs_fallocate+0x5be/0x8d0 [ 29.518251] ashmem_shrink_scan+0x1f9/0x580 [ 29.523076] ashmem_ioctl+0x3dd/0x13c0 [ 29.527470] do_vfs_ioctl+0x1de/0x1720 [ 29.531861] ksys_ioctl+0xa9/0xd0 [ 29.535814] __x64_sys_ioctl+0x73/0xb0 [ 29.540229] do_syscall_64+0x1b9/0x820 [ 29.544623] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 29.550315] [ 29.550315] other info that might help us debug this: [ 29.550315] [ 29.558439] Chain exists of: [ 29.558439] sb_writers#3 --> &mm->mmap_sem --> ashmem_mutex [ 29.558439] [ 29.568659] Possible unsafe locking scenario: [ 29.568659] [ 29.574726] CPU0 CPU1 [ 29.579383] ---- ---- [ 29.584025] lock(ashmem_mutex); [ 29.587459] lock(&mm->mmap_sem); [ 29.593496] lock(ashmem_mutex); [ 29.599444] lock(sb_writers#3); [ 29.602891] [ 29.602891] *** DEADLOCK *** [ 29.602891] [ 29.608931] 1 lock held by syz-executor101/4313: [ 29.613660] #0: (____ptrval____) (ashmem_mutex){+.+.}, at: ashmem_shrink_scan+0xb4/0x580 [ 29.621984] [ 29.621984] stack backtrace: [ 29.626473] CPU: 0 PID: 4313 Comm: syz-executor101 Not tainted 4.18.0+ #187 [ 29.633549] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 29.642882] Call Trace: [ 29.645459] dump_stack+0x1c9/0x2b4 [ 29.649087] ? dump_stack_print_info.cold.2+0x52/0x52 [ 29.654277] ? vprintk_func+0x81/0xe7 [ 29.658060] print_circular_bug.isra.36.cold.57+0x1bd/0x27d [ 29.663754] ? save_trace+0xe0/0x290 [ 29.667450] __lock_acquire+0x3449/0x5020 [ 29.671597] ? trace_hardirqs_on+0x10/0x10 [ 29.675814] ? lock_downgrade+0x8f0/0x8f0 [ 29.679961] ? mark_held_locks+0xc9/0x160 [ 29.684092] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 29.688665] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 29.693751] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 29.698777] ? trace_hardirqs_on+0xd/0x10 [ 29.702926] ? depot_save_stack+0x291/0x470 [ 29.707235] ? save_stack+0xa9/0xd0 [ 29.710844] ? save_stack+0x43/0xd0 [ 29.714452] ? graph_lock+0x170/0x170 [ 29.718257] ? range_alloc+0xa8/0x560 [ 29.722042] ? ashmem_ioctl+0x10ec/0x13c0 [ 29.726175] ? do_vfs_ioctl+0x1de/0x1720 [ 29.730216] ? ksys_ioctl+0xa9/0xd0 [ 29.733823] ? __x64_sys_ioctl+0x73/0xb0 [ 29.737866] ? graph_lock+0x170/0x170 [ 29.741653] ? find_held_lock+0x36/0x1c0 [ 29.745698] ? find_held_lock+0x36/0x1c0 [ 29.749755] lock_acquire+0x1e4/0x540 [ 29.753539] ? vfs_fallocate+0x5be/0x8d0 [ 29.757585] ? lock_release+0xa30/0xa30 [ 29.761544] ? check_same_owner+0x340/0x340 [ 29.765855] ? rcu_note_context_switch+0x730/0x730 [ 29.770778] __sb_start_write+0x1e9/0x300 [ 29.774927] ? vfs_fallocate+0x5be/0x8d0 [ 29.778984] ? shmem_setattr+0xda0/0xda0 [ 29.783027] vfs_fallocate+0x5be/0x8d0 [ 29.786915] ashmem_shrink_scan+0x1f9/0x580 [ 29.791221] ? cap_capable+0x1f9/0x260 [ 29.795108] ? range_alloc+0x560/0x560 [ 29.798995] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 29.804520] ? ns_capable_common+0x13f/0x170 [ 29.808939] ashmem_ioctl+0x3dd/0x13c0 [ 29.812810] ? ashmem_release+0x190/0x190 [ 29.816942] ? find_held_lock+0x36/0x1c0 [ 29.820988] ? ashmem_release+0x190/0x190 [ 29.825133] do_vfs_ioctl+0x1de/0x1720 [ 29.829037] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 29.834585] ? ioctl_preallocate+0x300/0x300 [ 29.838997] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 29.844517] ? __fget_light+0x2f7/0x440 [ 29.848484] ? __handle_mm_fault+0x4460/0x4460 [ 29.853276] ? fget_raw+0x20/0x20 [ 29.856712] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 29.862234] ? __do_page_fault+0x449/0xe50 [ 29.866451] ? mm_fault_error+0x380/0x380 [ 29.870584] ? security_file_ioctl+0x94/0xc0 [ 29.874976] ksys_ioctl+0xa9/0xd0 [ 29.878426] __x64_sys_ioctl+0x73/0xb0 [ 29.882316] do_syscall_64+0x1b9/0x820 [ 29.886205] ? syscall_return_slowpath+0x5e0/0x5e0 [ 29.891122] ? syscall_return_slowpath+0x31d/0x5e0 [ 29.896040] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 29.901400] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 29.906281] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 29.911463] RIP: 0033:0x440099 [ 29.914630] Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 29.933724] RSP: 002b:00007ffe0b216298 EFLAGS: