[....] Starting enhanced syslogd: rsyslogd[ 13.318717] audit: type=1400 audit(1540681754.415:4): avc: denied { syslog } for pid=1919 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Starting mcstransd: [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.84' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 39.744933] [ 39.746581] ====================================================== [ 39.752890] [ INFO: possible circular locking dependency detected ] [ 39.759273] 4.4.162+ #7 Not tainted [ 39.762883] ------------------------------------------------------- [ 39.769275] syz-executor929/2081 is trying to acquire lock: [ 39.774960] (sel_mutex){+.+.+.}, at: [] sel_commit_bools_write+0x87/0x250 [ 39.784042] [ 39.784042] but task is already holding lock: [ 39.789988] (&pipe->mutex/1){+.+.+.}, at: [] pipe_lock+0x5e/0x70 [ 39.798403] [ 39.798403] which lock already depends on the new lock. [ 39.798403] [ 39.806695] [ 39.806695] the existing dependency chain (in reverse order) is: [ 39.814291] -> #7 (&pipe->mutex/1){+.+.+.}: [ 39.819403] [] lock_acquire+0x15e/0x450 [ 39.825652] [] mutex_lock_nested+0xbb/0x8d0 [ 39.832249] [] fifo_open+0x15c/0x9e0 [ 39.838238] [] do_dentry_open+0x38d/0xbd0 [ 39.844662] [] vfs_open+0x12a/0x210 [ 39.850562] [] path_openat+0x50c/0x39a0 [ 39.856819] [] do_filp_open+0x197/0x270 [ 39.863065] [] do_open_execat+0x10f/0x6f0 [ 39.869488] [] do_execveat_common.isra.14+0x6a1/0x1f00 [ 39.877042] [] compat_SyS_execve+0x48/0x60 [ 39.883556] [] do_fast_syscall_32+0x31e/0xa80 [ 39.890331] [] sysenter_flags_fixed+0xd/0x1a [ 39.897012] -> #6 (&sig->cred_guard_mutex){+.+.+.}: [ 39.902707] [] lock_acquire+0x15e/0x450 [ 39.908958] [] mutex_lock_killable_nested+0xcc/0xa10 [ 39.916333] [] lock_trace+0x44/0xc0 [ 39.922233] [] proc_pid_syscall+0xa9/0x260 [ 39.928739] [] proc_single_show+0xfd/0x170 [ 39.935242] [] seq_read+0x4b6/0x12b0 [ 39.941241] [] __vfs_read+0x11c/0x3d0 [ 39.947310] [] vfs_read+0x130/0x360 [ 39.953440] [] SyS_read+0xd9/0x1c0 [ 39.959252] [] do_fast_syscall_32+0x31e/0xa80 [ 39.966020] [] sysenter_flags_fixed+0xd/0x1a [ 39.972711] -> #5 (&p->lock){+.+.+.}: [ 39.977144] [] lock_acquire+0x15e/0x450 [ 39.983405] [] mutex_lock_nested+0xbb/0x8d0 [ 39.990002] [] seq_read+0xdd/0x12b0 [ 39.995899] [] do_loop_readv_writev+0x148/0x1e0 [ 40.002839] [] do_readv_writev+0x581/0x6f0 [ 40.009376] [] vfs_readv+0x78/0xb0 [ 40.015188] [] default_file_splice_read+0x50f/0x8f0 [ 40.022603] [] do_splice_to+0xf7/0x140 [ 40.028764] [] splice_direct_to_actor+0x242/0x830 [ 40.035873] [] do_splice_direct+0x1a3/0x270 [ 40.042478] [] do_sendfile+0x4e4/0xb80 [ 40.048675] [] compat_SyS_sendfile+0xd1/0x160 [ 40.055444] [] do_fast_syscall_32+0x31e/0xa80 [ 40.062212] [] sysenter_flags_fixed+0xd/0x1a [ 40.068889] -> #4 (sb_writers#4){.+.+.+}: [ 40.073795] [] lock_acquire+0x15e/0x450 [ 40.080042] [] __sb_start_write+0x1ae/0x310 [ 40.086654] [] ext4_lazyinit_thread+0x1a7/0x750 [ 40.093611] [] kthread+0x268/0x300 [ 40.099433] [] ret_from_fork+0x55/0x80 [ 40.105606] -> #3 (&eli->li_list_mtx){+.+...}: [ 40.110843] [] lock_acquire+0x15e/0x450 [ 40.117084] [] mutex_lock_nested+0xbb/0x8d0 [ 40.123674] [] ext4_register_li_request+0x304/0x7a0 [ 40.130962] [] ext4_remount+0x1368/0x1bb0 [ 40.137391] [] do_remount_sb2+0x428/0x7d0 [ 40.143807] [] do_mount+0x101e/0x2a10 [ 40.149897] [] SyS_mount+0x191/0x1c0 [ 40.155874] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 40.163074] -> #2 (&ext4_li_mtx){+.+.+.}: [ 40.167875] [] lock_acquire+0x15e/0x450 [ 40.174115] [] mutex_lock_nested+0xbb/0x8d0 [ 40.180704] [] ext4_register_li_request+0x87/0x7a0 [ 40.187902] [] ext4_remount+0x1368/0x1bb0 [ 40.194318] [] do_remount_sb2+0x428/0x7d0 [ 40.200738] [] do_mount+0x101e/0x2a10 [ 40.206812] [] SyS_mount+0x191/0x1c0 [ 40.212803] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 40.220006] -> #1 (&type->s_umount_key#34){++++++}: [ 40.225798] [] lock_acquire+0x15e/0x450 [ 40.232042] [] down_read+0x42/0x60 [ 40.237862] [] iterate_supers+0xe1/0x260 [ 40.244198] [] selinux_complete_init+0x2f/0x31 [ 40.251075] [] security_load_policy+0x886/0x9b0 [ 40.258019] [] sel_write_load+0x191/0xfc0 [ 40.264438] [] __vfs_write+0x11c/0x3e0 [ 40.270613] [] vfs_write+0x17e/0x4e0 [ 40.276602] [] SyS_write+0xd9/0x1c0 [ 40.282501] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 40.289710] -> #0 (sel_mutex){+.+.+.}: [ 40.294247] [] __lock_acquire+0x3e6c/0x5f10 [ 40.300841] [] lock_acquire+0x15e/0x450 [ 40.307089] [] mutex_lock_nested+0xbb/0x8d0 [ 40.313681] [] sel_commit_bools_write+0x87/0x250 [ 40.320706] [] __vfs_write+0x11c/0x3e0 [ 40.326860] [] __kernel_write+0x10a/0x350 [ 40.333275] [] write_pipe_buf+0x15d/0x1f0 [ 40.339692] [] __splice_from_pipe+0x364/0x790 [ 40.346454] [] splice_from_pipe+0xf9/0x170 [ 40.352969] [] default_file_splice_write+0x3c/0x80 [ 40.360183] [] SyS_splice+0xde1/0x1430 [ 40.366341] [] do_fast_syscall_32+0x31e/0xa80 [ 40.373105] [] sysenter_flags_fixed+0xd/0x1a [ 40.379795] [ 40.379795] other info that might help us debug this: [ 40.379795] [ 40.387915] Chain exists of: sel_mutex --> &sig->cred_guard_mutex --> &pipe->mutex/1 [ 40.397067] Possible unsafe locking scenario: [ 40.397067] [ 40.403097] CPU0 CPU1 [ 40.407737] ---- ---- [ 40.412376] lock(&pipe->mutex/1); [ 40.416335] lock(&sig->cred_guard_mutex); [ 40.423404] lock(&pipe->mutex/1); [ 40.429887] lock(sel_mutex); [ 40.433318] [ 40.433318] *** DEADLOCK *** [ 40.433318] [ 40.439357] 2 locks held by syz-executor929/2081: [ 40.444169] #0: (sb_writers#3){.+.+.+}, at: [] SyS_splice+0xfaa/0x1430 [ 40.453308] #1: (&pipe->mutex/1){+.+.+.}, at: [] pipe_lock+0x5e/0x70 [ 40.462249] [ 40.462249] stack backtrace: [ 40.466722] CPU: 0 PID: 2081 Comm: syz-executor929 Not tainted 4.4.162+ #7 [ 40.473720] 0000000000000000 050a88a0a4a86d06 ffff8801d428f588 ffffffff81a994bd [ 40.481739] ffffffff83aae820 ffffffff83ab5270 ffffffff83ab09e0 ffff8801d5f25050 [ 40.489730] ffff8801d5f24740 ffff8801d428f5d0 ffffffff813a834a 0000000000000002 [ 40.497741] Call Trace: [ 40.500310] [] dump_stack+0xc1/0x124 [ 40.505652] [] print_circular_bug.cold.34+0x2f7/0x432 [ 40.512475] [] __lock_acquire+0x3e6c/0x5f10 [ 40.518425] [] ? trace_hardirqs_on+0x10/0x10 [ 40.524460] [] lock_acquire+0x15e/0x450 [ 40.530060] [] ? sel_commit_bools_write+0x87/0x250 [ 40.536615] [] ? sel_commit_bools_write+0x87/0x250 [ 40.543170] [] mutex_lock_nested+0xbb/0x8d0 [ 40.549121] [] ? sel_commit_bools_write+0x87/0x250 [ 40.555677] [] ? __kernel_text_address+0x6b/0xa0 [ 40.562059] [] ? print_context_stack+0x4e/0xe0 [ 40.568267] [] ? mutex_trylock+0x3e0/0x3e0 [ 40.574141] [] ? dump_trace+0x184/0x360 [ 40.579742] [] sel_commit_bools_write+0x87/0x250 [ 40.586136] [] ? sel_read_mls+0xc0/0xc0 [ 40.591738] [] ? add_lock_to_list.isra.8.constprop.24+0x149/0x280 [ 40.599596] [] __vfs_write+0x11c/0x3e0 [ 40.605107] [] ? sel_read_mls+0xc0/0xc0 [ 40.610710] [] ? __vfs_read+0x3d0/0x3d0 [ 40.616320] [] ? trace_hardirqs_on+0x10/0x10 [ 40.622362] [] __kernel_write+0x10a/0x350 [ 40.628143] [] write_pipe_buf+0x15d/0x1f0 [ 40.633938] [] ? do_splice_direct+0x270/0x270 [ 40.640067] [] ? splice_from_pipe_next.part.3+0x248/0x310 [ 40.647237] [] __splice_from_pipe+0x364/0x790 [ 40.653364] [] ? do_splice_direct+0x270/0x270 [ 40.659489] [] splice_from_pipe+0xf9/0x170 [ 40.665355] [] ? do_splice_direct+0x270/0x270 [ 40.671477] [] ? splice_shrink_spd+0x60/0x60 [ 40.677530] [] default_file_splice_write+0x3c/0x80 [ 40.684094] [] ? generic_splice_sendpage+0x50/0x50 [ 40.690650] [] SyS_splice+0xde1/0x1430 [ 40.696179] [] ? compat_SyS_futex+0x1e1/0x2f0 [ 40.702304] [] ? vfs_write+0x2e6/0x4e0 [ 40.707822] [] ? compat_SyS_vmsplice+0x160/0x160 [ 40.714233] [] ? do_fast_syscall_32+0xdb/0xa80 [ 40.720443] [] ? compat_SyS_vmsplice+0x160/0x160 [ 40.726834] [] do_fast_syscall_32+0x31e/0xa80 [ 40.732965] [] sysenter_flags_fixed+0xd/0x1a executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program