[....] Starting OpenBSD Secure Shell server: sshd[ 10.635665] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 28.245797] random: sshd: uninitialized urandom read (32 bytes read) [ 28.766409] audit: type=1400 audit(1551543004.743:6): avc: denied { map } for pid=1760 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 28.806413] random: sshd: uninitialized urandom read (32 bytes read) [ 29.256436] random: sshd: uninitialized urandom read (32 bytes read) [ 29.401864] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.83' (ECDSA) to the list of known hosts. [ 34.932258] random: sshd: uninitialized urandom read (32 bytes read) [ 35.017807] audit: type=1400 audit(1551543010.993:7): avc: denied { map } for pid=1778 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=1426 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2019/03/02 16:10:11 parsed 1 programs [ 35.732610] audit: type=1400 audit(1551543011.713:8): avc: denied { map } for pid=1778 comm="syz-execprog" path="/sys/kernel/debug/kcov" dev="debugfs" ino=5005 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 [ 36.455793] random: cc1: uninitialized urandom read (8 bytes read) 2019/03/02 16:10:14 executed programs: 0 [ 38.190172] audit: type=1400 audit(1551543014.163:9): avc: denied { map } for pid=1778 comm="syz-execprog" path="/root/syzkaller-shm688637181" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 [ 40.970876] [ 40.972553] ====================================================== [ 40.978845] WARNING: possible circular locking dependency detected [ 40.985151] 4.14.104+ #22 Not tainted [ 40.988919] ------------------------------------------------------ [ 40.995209] syz-executor.2/2730 is trying to acquire lock: [ 41.000816] (pmus_lock){+.+.}, at: [] perf_swevent_init+0x123/0x4e0 [ 41.008856] [ 41.008856] but task is already holding lock: [ 41.014796] (&cpuctx_mutex/1){+.+.}, at: [] perf_event_ctx_lock_nested+0x14d/0x2c0 [ 41.024130] [ 41.024130] which lock already depends on the new lock. [ 41.024130] [ 41.032419] [ 41.032419] the existing dependency chain (in reverse order) is: [ 41.040010] [ 41.040010] -> #2 (&cpuctx_mutex/1){+.+.}: [ 41.045721] [ 41.045721] -> #1 (&cpuctx_mutex){+.+.}: [ 41.051234] [ 41.051234] -> #0 (pmus_lock){+.+.}: [ 41.056399] [ 41.056399] other info that might help us debug this: [ 41.056399] [ 41.064513] Chain exists of: [ 41.064513] pmus_lock --> &cpuctx_mutex --> &cpuctx_mutex/1 [ 41.064513] [ 41.074728] Possible unsafe locking scenario: [ 41.074728] [ 41.080767] CPU0 CPU1 [ 41.085418] ---- ---- [ 41.090061] lock(&cpuctx_mutex/1); [ 41.093752] lock(&cpuctx_mutex); [ 41.099807] lock(&cpuctx_mutex/1); [ 41.106014] lock(pmus_lock); [ 41.109178] [ 41.109178] *** DEADLOCK *** [ 41.109178] [ 41.115236] 2 locks held by syz-executor.2/2730: [ 41.119991] #0: (&pmus_srcu){....}, at: [] perf_event_alloc.part.0+0xadd/0x1e70 [ 41.129157] #1: (&cpuctx_mutex/1){+.+.}, at: [] perf_event_ctx_lock_nested+0x14d/0x2c0 [ 41.138995] [ 41.138995] stack backtrace: [ 41.143466] CPU: 0 PID: 2730 Comm: syz-executor.2 Not tainted 4.14.104+ #22 [ 41.150549] Call Trace: [ 41.153111] dump_stack+0xb9/0x10e [ 41.156636] print_circular_bug.isra.0.cold+0x2dc/0x425 [ 41.161980] ? __lock_acquire+0x2d83/0x3fa0 [ 41.166292] ? __lock_acquire+0x56a/0x3fa0 [ 41.170533] ? trace_hardirqs_on+0x10/0x10 [ 41.174746] ? __lock_acquire+0x56a/0x3fa0 [ 41.178961] ? try_to_wake_up+0x7cc/0x12a0 [ 41.183190] ? lock_acquire+0x10f/0x380 [ 41.187144] ? perf_swevent_init+0x123/0x4e0 [ 41.191531] ? perf_swevent_init+0x123/0x4e0 [ 41.195927] ? __mutex_lock+0xf7/0x1430 [ 41.199872] ? perf_swevent_init+0x123/0x4e0 [ 41.204253] ? __mutex_lock+0x6aa/0x1430 [ 41.208304] ? perf_swevent_init+0x123/0x4e0 [ 41.212705] ? perf_event_ctx_lock_nested+0x14d/0x2c0 [ 41.217884] ? __mutex_unlock_slowpath+0x285/0x7d0 [ 41.222794] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 41.228228] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 41.233653] ? perf_event_ctx_lock_nested+0x117/0x2c0 [ 41.238814] ? lock_downgrade+0x5d0/0x5d0 [ 41.242951] ? lock_acquire+0x10f/0x380 [ 41.246929] ? perf_event_ctx_lock_nested+0x39/0x2c0 [ 41.252111] ? perf_swevent_init+0x123/0x4e0 [ 41.256524] ? perf_swevent_init+0x123/0x4e0 [ 41.260921] ? perf_event_ctx_lock_nested+0x14d/0x2c0 [ 41.266085] ? perf_event_ctx_lock_nested+0x247/0x2c0 [ 41.271266] ? perf_try_init_event+0xe5/0x200 [ 41.275736] ? perf_event_alloc.part.0+0xcc5/0x1e70 [ 41.280762] ? SyS_perf_event_open+0x6eb/0x2520 [ 41.285424] ? perf_bp_event+0x1a0/0x1a0 [ 41.289457] ? nsecs_to_jiffies+0x30/0x30 [ 41.293597] ? do_clock_gettime+0xd0/0xd0 [ 41.297724] ? do_syscall_64+0x43/0x4b0 [ 41.301688] ? perf_bp_event+0x1a0/0x1a0 [ 41.305730] ? do_syscall_64+0x19b/0x4b0 [ 41.309802] ? entry_SYSCALL_64_after_hwframe+0x42/0xb7 2019/03/02 16:10:19 executed programs: 55 2019/03/02 16:10:24 executed programs: 163