====================================================== WARNING: possible circular locking dependency detected 4.16.0-rc2+ #328 Not tainted ------------------------------------------------------ syz-executor0/24808 is trying to acquire lock: (&mm->mmap_sem){++++}, at: [<0000000072598463>] __might_fault+0xe0/0x1d0 mm/memory.c:4570 but task is already holding lock: (ashmem_mutex){+.+.}, at: [<00000000b1de98e4>] ashmem_pin_unpin drivers/staging/android/ashmem.c:705 [inline] (ashmem_mutex){+.+.}, at: [<00000000b1de98e4>] ashmem_ioctl+0x3db/0x11b0 drivers/staging/android/ashmem.c:782 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (ashmem_mutex){+.+.}: __mutex_lock_common kernel/locking/mutex.c:756 [inline] __mutex_lock+0x16f/0x1a80 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 ashmem_mmap+0x53/0x410 drivers/staging/android/ashmem.c:362 call_mmap include/linux/fs.h:1786 [inline] mmap_region+0xa99/0x15a0 mm/mmap.c:1705 do_mmap+0x6c0/0xe00 mm/mmap.c:1483 do_mmap_pgoff include/linux/mm.h:2223 [inline] vm_mmap_pgoff+0x1de/0x280 mm/util.c:355 SYSC_mmap_pgoff mm/mmap.c:1533 [inline] SyS_mmap_pgoff+0x462/0x5f0 mm/mmap.c:1491 SYSC_mmap arch/x86/kernel/sys_x86_64.c:100 [inline] SyS_mmap+0x16/0x20 arch/x86/kernel/sys_x86_64.c:91 do_syscall_64+0x280/0x940 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 -> #0 (&mm->mmap_sem){++++}: lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3920 __might_fault+0x13a/0x1d0 mm/memory.c:4571 _copy_from_user+0x2c/0x110 lib/usercopy.c:10 copy_from_user include/linux/uaccess.h:147 [inline] ashmem_pin_unpin drivers/staging/android/ashmem.c:710 [inline] ashmem_ioctl+0x438/0x11b0 drivers/staging/android/ashmem.c:782 vfs_ioctl fs/ioctl.c:46 [inline] do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:686 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692 do_syscall_64+0x280/0x940 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(ashmem_mutex); lock(&mm->mmap_sem); lock(ashmem_mutex); lock(&mm->mmap_sem); *** DEADLOCK *** 1 lock held by syz-executor0/24808: #0: (ashmem_mutex){+.+.}, at: [<00000000b1de98e4>] ashmem_pin_unpin drivers/staging/android/ashmem.c:705 [inline] #0: (ashmem_mutex){+.+.}, at: [<00000000b1de98e4>] ashmem_ioctl+0x3db/0x11b0 drivers/staging/android/ashmem.c:782 stack backtrace: CPU: 0 PID: 24808 Comm: syz-executor0 Not tainted 4.16.0-rc2+ #328 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x24d lib/dump_stack.c:53 print_circular_bug.isra.38+0x2cd/0x2dc kernel/locking/lockdep.c:1223 check_prev_add kernel/locking/lockdep.c:1863 [inline] check_prevs_add kernel/locking/lockdep.c:1976 [inline] validate_chain kernel/locking/lockdep.c:2417 [inline] __lock_acquire+0x30a8/0x3e00 kernel/locking/lockdep.c:3431 lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3920 __might_fault+0x13a/0x1d0 mm/memory.c:4571 _copy_from_user+0x2c/0x110 lib/usercopy.c:10 copy_from_user include/linux/uaccess.h:147 [inline] ashmem_pin_unpin drivers/staging/android/ashmem.c:710 [inline] ashmem_ioctl+0x438/0x11b0 drivers/staging/android/ashmem.c:782 vfs_ioctl fs/ioctl.c:46 [inline] do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:686 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692 do_syscall_64+0x280/0x940 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x453de9 RSP: 002b:00007f7680c9fc68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f7680ca06d4 RCX: 0000000000453de9 RDX: 0000000000000000 RSI: 0000000000007709 RDI: 0000000000000013 RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 000000000000017a R14: 00000000006f2410 R15: 0000000000000000 QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl can: request_module (can-proto-0) failed. can: request_module (can-proto-0) failed. ieee80211 phy2: Selected rate control algorithm 'minstrel_ht' SELinux: unrecognized netlink message: protocol=9 nlmsg_type=21 sclass=netlink_audit_socket pig=25204 comm=syz-executor4 SELinux: unrecognized netlink message: protocol=9 nlmsg_type=21 sclass=netlink_audit_socket pig=25207 comm=syz-executor4 binder: 25321:25330 transaction failed 29189/-22, size 0-0 line 2848 binder: 25321:25343 transaction failed 29189/-22, size 0-0 line 2848 ipt_REJECT: TCP_RESET invalid for non-tcp binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29189 ipt_REJECT: TCP_RESET invalid for non-tcp SELinux: unknown mount option SELinux: unknown mount option x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not security x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not security kauditd_printk_skb: 864 callbacks suppressed audit: type=1400 audit(1519569356.141:6998): avc: denied { net_admin } for pid=25648 comm="syz-executor1" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519569356.141:6999): avc: denied { net_raw } for pid=25649 comm="syz-executor7" capability=13 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519569356.172:7000): avc: denied { dac_read_search } for pid=25659 comm="syz-executor0" capability=2 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519569356.172:7001): avc: denied { dac_read_search } for pid=25659 comm="syz-executor0" capability=2 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519569356.172:7002): avc: denied { dac_read_search } for pid=25659 comm="syz-executor0" capability=2 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519569356.172:7003): avc: denied { dac_read_search } for pid=25659 comm="syz-executor0" capability=2 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519569356.196:7004): avc: denied { net_admin } for pid=25653 comm="syz-executor4" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519569356.196:7005): avc: denied { net_admin } for pid=11498 comm="syz-executor4" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519569356.246:7006): avc: denied { net_admin } for pid=4282 comm="syz-executor5" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519569356.272:7007): avc: denied { net_admin } for pid=4286 comm="syz-executor1" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 binder: 25722:25725 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 binder: 25722:25725 BC_FREE_BUFFER u00000000207f9000 no match binder: 25722:25725 DecRefs 0 refcount change on invalid ref 2 ret -22 binder: 25722:25742 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 binder: 25722:25742 BC_FREE_BUFFER u00000000207f9000 no match binder: 25722:25742 DecRefs 0 refcount change on invalid ref 2 ret -22 QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 26028 Comm: syz-executor1 Not tainted 4.16.0-rc2+ #328 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x24d lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:422 [inline] slab_alloc mm/slab.c:3365 [inline] kmem_cache_alloc+0x47/0x760 mm/slab.c:3539 kmem_cache_zalloc include/linux/slab.h:691 [inline] avc_alloc_node+0x27/0x4d0 security/selinux/avc.c:549 avc_insert security/selinux/avc.c:668 [inline] avc_compute_av+0x22a/0x710 security/selinux/avc.c:974 avc_has_perm_noaudit+0x3ee/0x520 security/selinux/avc.c:1110 cred_has_capability+0x18c/0x3d0 security/selinux/hooks.c:1743 selinux_capable+0x36/0x40 security/selinux/hooks.c:2239 security_capable+0x82/0xc0 security/security.c:278 ns_capable_common+0x11a/0x160 kernel/capability.c:375 ns_capable+0x22/0x30 kernel/capability.c:397 arp_ioctl+0x14e/0x9d0 net/ipv4/arp.c:1186 inet_ioctl+0x207/0x310 net/ipv4/af_inet.c:898 sock_do_ioctl+0xef/0x390 net/socket.c:958 sock_ioctl+0x36b/0x610 net/socket.c:1081 vfs_ioctl fs/ioctl.c:46 [inline] do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:686 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692 do_syscall_64+0x280/0x940 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x453de9 RSP: 002b:00007fb1dbcaac68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fb1dbcab6d4 RCX: 0000000000453de9 RDX: 0000000020000700 RSI: 0000000000008955 RDI: 0000000000000013 RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000014 R13: 000000000000037d R14: 00000000006f5458 R15: 0000000000000000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 26038 Comm: syz-executor1 Not tainted 4.16.0-rc2+ #328 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ieee80211 phy3: Selected rate control algorithm 'minstrel_ht' Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x24d lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 ieee80211 phy4: Selected rate control algorithm 'minstrel_ht' should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:422 [inline] slab_alloc mm/slab.c:3365 [inline] kmem_cache_alloc+0x47/0x760 mm/slab.c:3539 kmem_cache_zalloc include/linux/slab.h:691 [inline] avc_alloc_node+0x27/0x4d0 security/selinux/avc.c:549 avc_insert security/selinux/avc.c:668 [inline] avc_compute_av+0x22a/0x710 security/selinux/avc.c:974 avc_has_perm_noaudit+0x3ee/0x520 security/selinux/avc.c:1110 cred_has_capability+0x18c/0x3d0 security/selinux/hooks.c:1743 selinux_capable+0x36/0x40 security/selinux/hooks.c:2239 security_capable+0x82/0xc0 security/security.c:278 ns_capable_common+0x11a/0x160 kernel/capability.c:375 ns_capable+0x22/0x30 kernel/capability.c:397 arp_ioctl+0x14e/0x9d0 net/ipv4/arp.c:1186 inet_ioctl+0x207/0x310 net/ipv4/af_inet.c:898 sock_do_ioctl+0xef/0x390 net/socket.c:958 sock_ioctl+0x36b/0x610 net/socket.c:1081 vfs_ioctl fs/ioctl.c:46 [inline] do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:686 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692 do_syscall_64+0x280/0x940 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x453de9 RSP: 002b:00007fb1dbcaac68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fb1dbcab6d4 RCX: 0000000000453de9 RDX: 0000000020000700 RSI: 0000000000008955 RDI: 0000000000000013 RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000014 R13: 000000000000037d R14: 00000000006f5458 R15: 0000000000000001 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 26158 Comm: syz-executor0 Not tainted 4.16.0-rc2+ #328 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x24d lib/dump_stack.c:53 fail_dump lib/fault-inject.c:51 [inline] should_fail+0x8c0/0xa40 lib/fault-inject.c:149 should_failslab+0xec/0x120 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:422 [inline] slab_alloc mm/slab.c:3365 [inline] kmem_cache_alloc+0x47/0x760 mm/slab.c:3539 kmem_cache_zalloc include/linux/slab.h:691 [inline] avc_alloc_node+0x27/0x4d0 security/selinux/avc.c:549 avc_insert security/selinux/avc.c:668 [inline] avc_compute_av+0x22a/0x710 security/selinux/avc.c:974 avc_has_perm_noaudit+0x3ee/0x520 security/selinux/avc.c:1110 cred_has_capability+0x18c/0x3d0 security/selinux/hooks.c:1743 selinux_capable+0x36/0x40 security/selinux/hooks.c:2239 security_capable+0x82/0xc0 security/security.c:278 ns_capable_common+0x11a/0x160 kernel/capability.c:375 ns_capable+0x22/0x30 kernel/capability.c:397 ipcperms+0x20e/0x340 ipc/util.c:504 msgctl_stat+0xc1/0x640 ipc/msg.c:502 SYSC_msgctl+0x1f0/0x290 ipc/msg.c:562 SyS_msgctl+0x24/0x30 ipc/msg.c:536 do_syscall_64+0x280/0x940 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x453de9 RSP: 002b:00007f7680c9fc68 EFLAGS: 00000246 ORIG_RAX: 0000000000000047 RAX: ffffffffffffffda RBX: 00007f7680ca06d4 RCX: 0000000000453de9 RDX: 0000000020000040 RSI: 0000000000000002 RDI: 0000000000110020 RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000014 R13: 00000000000003ec R14: 00000000006f5ec0 R15: 0000000000000000 ptrace attach of "/root/syz-executor4"[11498] was attempted by "/root/syz-executor4"[26178] binder: 26499:26505 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 binder: 26499:26505 unknown command 536907575 binder: 26499:26505 ioctl c0306201 20008fd0 returned -22 kauditd_printk_skb: 846 callbacks suppressed audit: type=1400 audit(1519569361.141:7855): avc: denied { net_admin } for pid=4277 comm="syz-executor3" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519569361.141:7854): avc: denied { net_admin } for pid=4284 comm="syz-executor2" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519569361.148:7856): avc: denied { ipc_owner } for pid=26579 comm="syz-executor0" capability=15 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519569361.148:7857): avc: denied { net_admin } for pid=4277 comm="syz-executor3" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519569361.148:7858): avc: denied { map } for pid=26583 comm="modprobe" path="/etc/ld.so.cache" dev="sda1" ino=2503 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 audit: type=1400 audit(1519569361.148:7859): avc: denied { ipc_owner } for pid=26579 comm="syz-executor0" capability=15 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519569361.148:7860): avc: denied { net_admin } for pid=4286 comm="syz-executor1" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519569361.198:7861): avc: denied { net_admin } for pid=4275 comm="syz-executor7" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519569361.198:7862): avc: denied { net_admin } for pid=4275 comm="syz-executor7" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1519569361.198:7863): avc: denied { map } for pid=26587 comm="modprobe" path="/bin/kmod" dev="sda1" ino=1440 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 netlink: 'syz-executor6': attribute type 20 has an invalid length.