[....] Starting enhanced syslogd: rsyslogd[ 14.463446] audit: type=1400 audit(1546948037.365:4): avc: denied { syslog } for pid=1918 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.55' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 30.681900] [ 30.683594] ====================================================== [ 30.689910] [ INFO: possible circular locking dependency detected ] [ 30.696320] 4.4.169+ #2 Not tainted [ 30.699918] ------------------------------------------------------- [ 30.706313] syz-executor051/2072 is trying to acquire lock: [ 30.711998] (&pipe->mutex/1){+.+.+.}, at: [] fifo_open+0x15d/0xa00 [ 30.720590] [ 30.720590] but task is already holding lock: [ 30.726555] (&sig->cred_guard_mutex){+.+.+.}, at: [] prepare_bprm_creds+0x55/0x120 [ 30.736413] [ 30.736413] which lock already depends on the new lock. [ 30.736413] [ 30.744702] [ 30.744702] the existing dependency chain (in reverse order) is: [ 30.752303] -> #1 (&sig->cred_guard_mutex){+.+.+.}: [ 30.758050] [] lock_acquire+0x15e/0x450 [ 30.764315] [] mutex_lock_interruptible_nested+0xd2/0xce0 [ 30.772133] [] proc_pid_attr_write+0x1a8/0x2a0 [ 30.779107] [] __vfs_write+0x116/0x3d0 [ 30.785272] [] __kernel_write+0x112/0x370 [ 30.791702] [] write_pipe_buf+0x15d/0x1f0 [ 30.798127] [] __splice_from_pipe+0x37e/0x7a0 [ 30.805025] [] splice_from_pipe+0x108/0x170 [ 30.811632] [] default_file_splice_write+0x3c/0x80 [ 30.818832] [] SyS_splice+0xd71/0x13a0 [ 30.825109] [] do_fast_syscall_32+0x32d/0xa90 [ 30.832021] [] sysenter_flags_fixed+0xd/0x1a [ 30.838833] -> #0 (&pipe->mutex/1){+.+.+.}: [ 30.843943] [] __lock_acquire+0x37d6/0x4f50 [ 30.850669] [] lock_acquire+0x15e/0x450 [ 30.856914] [] mutex_lock_nested+0xc1/0xb80 [ 30.863602] [] fifo_open+0x15d/0xa00 [ 30.869704] [] do_dentry_open+0x38f/0xbd0 [ 30.876224] [] vfs_open+0x10b/0x210 [ 30.882238] [] path_openat+0x136f/0x4470 [ 30.888561] [] do_filp_open+0x1a1/0x270 [ 30.894840] [] do_open_execat+0x10c/0x6e0 [ 30.901269] [] do_execveat_common.isra.0+0x6f6/0x1e90 [ 30.908728] [] compat_SyS_execve+0x48/0x60 [ 30.915229] [] do_fast_syscall_32+0x32d/0xa90 [ 30.921999] [] sysenter_flags_fixed+0xd/0x1a [ 30.928756] [ 30.928756] other info that might help us debug this: [ 30.928756] [ 30.936874] Possible unsafe locking scenario: [ 30.936874] [ 30.942900] CPU0 CPU1 [ 30.947533] ---- ---- [ 30.952167] lock(&sig->cred_guard_mutex); [ 30.956713] lock(&pipe->mutex/1); [ 30.963194] lock(&sig->cred_guard_mutex); [ 30.970399] lock(&pipe->mutex/1); [ 30.974375] [ 30.974375] *** DEADLOCK *** [ 30.974375] [ 30.980408] 1 lock held by syz-executor051/2072: [ 30.985134] #0: (&sig->cred_guard_mutex){+.+.+.}, at: [] prepare_bprm_creds+0x55/0x120 [ 30.995653] [ 30.995653] stack backtrace: [ 31.000142] CPU: 0 PID: 2072 Comm: syz-executor051 Not tainted 4.4.169+ #2 [ 31.007126] 0000000000000000 936fa879a4a4cf30 ffff8801cf25f4c0 ffffffff81aab9c1 [ 31.015294] ffffffff84055ac0 ffff8800b70f4740 ffffffff83abb460 ffffffff83ab4500 [ 31.023307] ffffffff83abb460 ffff8801cf25f510 ffffffff813abaf4 ffff8801cf25f5f0 [ 31.031344] Call Trace: [ 31.033904] [] dump_stack+0xc1/0x120 [ 31.039241] [] print_circular_bug.cold+0x2f7/0x44e [ 31.045813] [] __lock_acquire+0x37d6/0x4f50 [ 31.051905] [] ? trace_hardirqs_on+0x10/0x10 [ 31.058014] [] ? do_filp_open+0x1a1/0x270 [ 31.063808] [] ? do_execveat_common.isra.0+0x6f6/0x1e90 [ 31.070794] [] ? compat_SyS_execve+0x48/0x60 [ 31.076909] [] ? do_fast_syscall_32+0x32d/0xa90 [ 31.083309] [] ? sysenter_flags_fixed+0xd/0x1a [ 31.089646] [] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 31.096613] [] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 31.103343] [] lock_acquire+0x15e/0x450 [ 31.108943] [] ? fifo_open+0x15d/0xa00 [ 31.114757] [] ? fifo_open+0x15d/0xa00 [ 31.120292] [] mutex_lock_nested+0xc1/0xb80 [ 31.126266] [] ? fifo_open+0x15d/0xa00 [ 31.131780] [] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 31.138510] [] ? mutex_trylock+0x500/0x500 [ 31.144376] [] ? fifo_open+0x24d/0xa00 [ 31.149891] [] ? fifo_open+0x28c/0xa00 [ 31.155471] [] fifo_open+0x15d/0xa00 [ 31.160834] [] do_dentry_open+0x38f/0xbd0 [ 31.166606] [] ? __inode_permission2+0x9e/0x250 [ 31.172898] [] ? pipe_release+0x250/0x250 [ 31.178671] [] vfs_open+0x10b/0x210 [ 31.183920] [] ? may_open.isra.0+0xe7/0x210 [ 31.189933] [] path_openat+0x136f/0x4470 [ 31.195632] [] ? depot_save_stack+0x1c3/0x5f0 [ 31.201762] [] ? may_open.isra.0+0x210/0x210 [ 31.207799] [] ? kmemdup+0x27/0x60 [ 31.212985] [] ? selinux_cred_prepare+0x43/0xa0 [ 31.219315] [] ? security_prepare_creds+0x83/0xc0 [ 31.225791] [] ? prepare_creds+0x228/0x2b0 [ 31.231650] [] ? prepare_exec_creds+0x12/0xf0 [ 31.237869] [] ? do_execveat_common.isra.0+0x2d6/0x1e90 [ 31.244871] [] ? do_fast_syscall_32+0x32d/0xa90 [ 31.251212] [] ? kasan_kmalloc+0xb7/0xd0 [ 31.256942] [] ? kasan_slab_alloc+0xf/0x20 [ 31.262940] [] ? kmem_cache_alloc+0xdc/0x2c0 [ 31.268976] [] ? prepare_creds+0x28/0x2b0 [ 31.274820] [] ? prepare_exec_creds+0x12/0xf0 [ 31.280948] [] do_filp_open+0x1a1/0x270 [ 31.286654] [] ? save_stack_trace+0x26/0x50 [ 31.292609] [] ? user_path_mountpoint_at+0x50/0x50 [ 31.299168] [] ? compat_SyS_execve+0x48/0x60 [ 31.305274] [] ? do_fast_syscall_32+0x32d/0xa90 [ 31.311575] [] ? sysenter_flags_fixed+0xd/0x1a [ 31.317796] [] ? __lock_acquire+0xa4f/0x4f50 [ 31.323834] [] ? trace_hardirqs_on+0x10/0x10 [ 31.329880] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 31.336823] [] do_open_execat+0x10c/0x6e0 [ 31.342603] [] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 31.349360] [] ? setup_arg_pages+0x7b0/0x7b0 [ 31.355394] [] ? do_execveat_common.isra.0+0x6b8/0x1e90 [ 31.362447] [] do_execveat_common.isra.0+0x6f6/0x1e90 [ 31.369435] [] ? do_execveat_common.isra.0+0x422/0x1e90 [ 31.376502] [] ? __check_object_size+0x222/0x332 [ 31.382959] [