[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 19.646214] random: sshd: uninitialized urandom read (32 bytes read, 32 bits of entropy available) [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 21.219915] random: sshd: uninitialized urandom read (32 bytes read, 35 bits of entropy available) [ 21.490611] random: sshd: uninitialized urandom read (32 bytes read, 35 bits of entropy available) [ 22.459770] random: sshd: uninitialized urandom read (32 bytes read, 109 bits of entropy available) [ 22.634991] random: sshd: uninitialized urandom read (32 bytes read, 115 bits of entropy available) Warning: Permanently added '10.128.0.45' (ECDSA) to the list of known hosts. [ 28.039679] random: sshd: uninitialized urandom read (32 bytes read, 124 bits of entropy available) executing program [ 28.133221] [ 28.134862] ====================================================== [ 28.141147] [ INFO: possible circular locking dependency detected ] [ 28.147524] 4.4.118-g5f7f76a #25 Not tainted [ 28.151904] ------------------------------------------------------- [ 28.158276] syzkaller204116/3737 is trying to acquire lock: [ 28.163989] (&mm->mmap_sem){++++++}, at: [] __might_fault+0xe4/0x1d0 [ 28.172583] [ 28.172583] but task is already holding lock: [ 28.178524] (ashmem_mutex){+.+.+.}, at: [] ashmem_ioctl+0x367/0xfa0 [ 28.187031] [ 28.187031] which lock already depends on the new lock. [ 28.187031] [ 28.195314] [ 28.195314] the existing dependency chain (in reverse order) is: [ 28.202901] -> #1 (ashmem_mutex){+.+.+.}: [ 28.207675] [] lock_acquire+0x15e/0x460 [ 28.213909] [] mutex_lock_nested+0xbb/0x850 [ 28.220490] [] ashmem_mmap+0x53/0x400 [ 28.226546] [] mmap_region+0x94f/0x1250 [ 28.232781] [] do_mmap+0x4fd/0x9d0 [ 28.238578] [] vm_mmap_pgoff+0x16e/0x1c0 [ 28.244901] [] SyS_mmap_pgoff+0x33f/0x560 [ 28.251307] [] do_fast_syscall_32+0x321/0x8a0 [ 28.258063] [] sysenter_flags_fixed+0xd/0x17 [ 28.264729] -> #0 (&mm->mmap_sem){++++++}: [ 28.269568] [] __lock_acquire+0x371f/0x4b50 [ 28.276152] [] lock_acquire+0x15e/0x460 [ 28.282387] [] __might_fault+0x14a/0x1d0 [ 28.288710] [] ashmem_ioctl+0x3b4/0xfa0 [ 28.294942] [] compat_ashmem_ioctl+0x3e/0x50 [ 28.301703] [] compat_SyS_ioctl+0x28a/0x2540 [ 28.308372] [] do_fast_syscall_32+0x321/0x8a0 [ 28.315142] [] sysenter_flags_fixed+0xd/0x17 [ 28.321810] [ 28.321810] other info that might help us debug this: [ 28.321810] [ 28.329931] Possible unsafe locking scenario: [ 28.329931] [ 28.335957] CPU0 CPU1 [ 28.340593] ---- ---- [ 28.345228] lock(ashmem_mutex); [ 28.348881] lock(&mm->mmap_sem); [ 28.355143] lock(ashmem_mutex); [ 28.361315] lock(&mm->mmap_sem); [ 28.365062] [ 28.365062] *** DEADLOCK *** [ 28.365062] [ 28.371092] 1 lock held by syzkaller204116/3737: [ 28.375812] #0: (ashmem_mutex){+.+.+.}, at: [] ashmem_ioctl+0x367/0xfa0 [ 28.384856] [ 28.384856] stack backtrace: [ 28.389321] CPU: 1 PID: 3737 Comm: syzkaller204116 Not tainted 4.4.118-g5f7f76a #25 [ 28.397081] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 28.406402] 0000000000000000 a5b83d9404d34006 ffff8801d96678a8 ffffffff81d0402d [ 28.414368] ffffffff8519fe60 ffffffff8519fe60 ffffffff851bdda0 ffff8800ad4750f8 [ 28.422336] ffff8800ad474800 ffff8801d96678f0 ffffffff81233ba1 ffff8800ad4750f8 [ 28.430298] Call Trace: [ 28.432858] [] dump_stack+0xc1/0x124 [ 28.438199] [] print_circular_bug+0x271/0x310 [ 28.444311] [] __lock_acquire+0x371f/0x4b50 [ 28.450258] [] ? avc_has_extended_perms+0xe2/0xf30 [ 28.456806] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 28.463785] [] ? mark_held_locks+0xaf/0x100 [ 28.469723] [] ? __lock_is_held+0xa1/0xf0 [ 28.475487] [] lock_acquire+0x15e/0x460 [ 28.481077] [] ? __might_fault+0xe4/0x1d0 [ 28.486844] [] __might_fault+0x14a/0x1d0 [ 28.492519] [] ? __might_fault+0xe4/0x1d0 [ 28.498282] [] ashmem_ioctl+0x3b4/0xfa0 [ 28.503881] [] ? selinux_file_ioctl+0x363/0x570 [ 28.510168] [] ? vma_link+0xe4/0x170 [ 28.515499] [] ? selinux_capable+0x30/0x30 [ 28.521351] [] ? ashmem_shrink_scan+0x390/0x390 [ 28.527639] [] ? vma_set_page_prot+0x10b/0x150 [ 28.533845] [] ? mmap_region+0x3f9/0x1250 [ 28.539611] [] compat_ashmem_ioctl+0x3e/0x50 [ 28.545640] [] compat_SyS_ioctl+0x28a/0x2540 [ 28.551666] [] ? vm_mmap_pgoff+0x180/0x1c0 [ 28.557515] [] ? ashmem_ioctl+0xfa0/0xfa0 [ 28.563282] [] ? compat_SyS_ppoll+0x420/0x420 [ 28.569396] [] ? vm_mmap_pgoff+0xdf/0x1c0 [ 28.575164] [] ? vma_is_stack_for_task+0xa0/0xa0 [ 28.581535] [] ? fput