[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 20.482368] random: sshd: uninitialized urandom read (32 bytes read, 33 bits of entropy available) [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [ 20.916357] random: sshd: uninitialized urandom read (32 bytes read, 33 bits of entropy available) [ 21.144484] random: sshd: uninitialized urandom read (32 bytes read, 35 bits of entropy available) Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 22.046559] random: sshd: uninitialized urandom read (32 bytes read, 100 bits of entropy available) [ 22.222749] random: sshd: uninitialized urandom read (32 bytes read, 105 bits of entropy available) Warning: Permanently added '10.128.0.39' (ECDSA) to the list of known hosts. [ 27.654644] random: sshd: uninitialized urandom read (32 bytes read, 112 bits of entropy available) executing program [ 27.745386] [ 27.747036] ====================================================== [ 27.753317] [ INFO: possible circular locking dependency detected ] [ 27.759690] 4.4.120-gd63fdf6 #28 Not tainted [ 27.764061] ------------------------------------------------------- [ 27.770430] syzkaller197184/3764 is trying to acquire lock: [ 27.776110] (&mm->mmap_sem){++++++}, at: [] __might_fault+0xe4/0x1d0 [ 27.784680] [ 27.784680] but task is already holding lock: [ 27.790633] (ashmem_mutex){+.+.+.}, at: [] ashmem_ioctl+0x367/0xfa0 [ 27.799129] [ 27.799129] which lock already depends on the new lock. [ 27.799129] [ 27.807410] [ 27.807410] the existing dependency chain (in reverse order) is: [ 27.814997] -> #1 (ashmem_mutex){+.+.+.}: [ 27.819743] [] lock_acquire+0x15e/0x460 [ 27.825974] [] mutex_lock_nested+0xbb/0x850 [ 27.832549] [] ashmem_mmap+0x53/0x400 [ 27.838599] [] mmap_region+0x94f/0x1250 [ 27.844832] [] do_mmap+0x4fd/0x9d0 [ 27.850627] [] vm_mmap_pgoff+0x16e/0x1c0 [ 27.856941] [] SyS_mmap_pgoff+0x33f/0x560 [ 27.863345] [] SyS_mmap+0x16/0x20 [ 27.869051] [] entry_SYSCALL_64_fastpath+0x1c/0x98 [ 27.876237] -> #0 (&mm->mmap_sem){++++++}: [ 27.881079] [] __lock_acquire+0x371f/0x4b50 [ 27.887652] [] lock_acquire+0x15e/0x460 [ 27.893880] [] __might_fault+0x14a/0x1d0 [ 27.900196] [] ashmem_ioctl+0x3b4/0xfa0 [ 27.906427] [] do_vfs_ioctl+0x7aa/0xee0 [ 27.912656] [] SyS_ioctl+0x8f/0xc0 [ 27.918456] [] entry_SYSCALL_64_fastpath+0x1c/0x98 [ 27.925654] [ 27.925654] other info that might help us debug this: [ 27.925654] [ 27.933760] Possible unsafe locking scenario: [ 27.933760] [ 27.939781] CPU0 CPU1 [ 27.944413] ---- ---- [ 27.949044] lock(ashmem_mutex); [ 27.952693] lock(&mm->mmap_sem); [ 27.958947] lock(ashmem_mutex); [ 27.965136] lock(&mm->mmap_sem); [ 27.968869] [ 27.968869] *** DEADLOCK *** [ 27.968869] [ 27.974893] 1 lock held by syzkaller197184/3764: [ 27.979615] #0: (ashmem_mutex){+.+.+.}, at: [] ashmem_ioctl+0x367/0xfa0 [ 27.988647] [ 27.988647] stack backtrace: [ 27.993109] CPU: 0 PID: 3764 Comm: syzkaller197184 Not tainted 4.4.120-gd63fdf6 #28 [ 28.000867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 28.010188] 0000000000000000 8e4cef726090cc5a ffff8801d26cf9b8 ffffffff81d0408d [ 28.018148] ffffffff851a0010 ffffffff851a0010 ffffffff851bdbf0 ffff8800aa87b8f8 [ 28.026107] ffff8800aa87b000 ffff8801d26cfa00 ffffffff81233ba1 ffff8800aa87b8f8 [ 28.034065] Call Trace: [ 28.036620] [] dump_stack+0xc1/0x124 [ 28.041949] [] print_circular_bug+0x271/0x310 [ 28.048061] [] __lock_acquire+0x371f/0x4b50 [ 28.053999] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 28.060980] [] ? mark_held_locks+0xaf/0x100 [ 28.066926] [] ? __lock_is_held+0xa1/0xf0 [ 28.072689] [] lock_acquire+0x15e/0x460 [ 28.078280] [] ? __might_fault+0xe4/0x1d0 [ 28.084042] [] __might_fault+0x14a/0x1d0 [ 28.089718] [] ? __might_fault+0xe4/0x1d0 [ 28.095481] [] ashmem_ioctl+0x3b4/0xfa0 [ 28.101075] [] ? mmap_region+0x3f9/0x1250 [ 28.106838] [] ? ashmem_shrink_scan+0x390/0x390 [ 28.113124] [] ? vm_mmap_pgoff+0x180/0x1c0 [ 28.118981] [] ? ashmem_shrink_scan+0x390/0x390 [ 28.125265] [] do_vfs_ioctl+0x7aa/0xee0 [ 28.130854] [] ? ioctl_preallocate+0x1f0/0x1f0 [ 28.137052] [] ? fput+0x20/0x150 [ 28.142035] [] ? SyS_mmap_pgoff+0xd8/0