binder: binder_mmap: 6342 20000000-20004000 bad vm_flags failed -1 audit_printk_skb: 15 callbacks suppressed binder: 6342:6349 ioctl c0306201 20000440 returned -14 ====================================================== [ INFO: possible circular locking dependency detected ] 4.4.162+ #7 Not tainted ------------------------------------------------------- syz-executor0/6353 is trying to acquire lock: (rtnl_mutex){+.+.+.}, at: [ 172.238581] audit: type=1400 audit(1540913062.230:89): avc: denied { set_context_mgr } for pid=6342 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 binder: binder_mmap: 6342 20000000-20004000 bad vm_flags failed -1 [] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70 binder_alloc: binder_alloc_mmap_handler: 6342 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 6342:6345 ioctl 40046207 0 returned -16 binder: 6342:6349 ioctl c0306201 20000440 returned -14 but task is already holding lock: (sk_lock-AF_INET6){+.+.+.}, at: [] lock_sock include/net/sock.h:1493 [inline] (sk_lock-AF_INET6){+.+.+.}, at: [] do_ipv6_setsockopt.isra.4+0x252/0x2d50 net/ipv6/ipv6_sockglue.c:166 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: [] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592 [] lock_sock_nested+0xc6/0x120 net/core/sock.c:2459 [] lock_sock include/net/sock.h:1493 [inline] [] do_ipv6_setsockopt.isra.4+0x1d2/0x2d50 net/ipv6/ipv6_sockglue.c:166 [] ipv6_setsockopt+0x97/0x130 net/ipv6/ipv6_sockglue.c:904 [] compat_mc_setsockopt+0x278/0x6e0 net/compat.c:627 [] compat_ipv6_setsockopt+0x126/0x1d0 net/ipv6/ipv6_sockglue.c:932 [] inet_csk_compat_setsockopt+0x97/0x120 net/ipv4/inet_connection_sock.c:914 [] compat_tcp_setsockopt+0x3d/0x70 net/ipv4/tcp.c:2654 [] compat_sock_common_setsockopt+0xb4/0x150 net/core/sock.c:2670 [] C_SYSC_setsockopt net/compat.c:385 [inline] [] compat_SyS_setsockopt+0x169/0x700 net/compat.c:368 [] do_syscall_32_irqs_on arch/x86/entry/common.c:396 [inline] [] do_fast_syscall_32+0x31e/0xa80 arch/x86/entry/common.c:463 [] sysenter_flags_fixed+0xd/0x1a [] check_prev_add kernel/locking/lockdep.c:1853 [inline] [] check_prevs_add kernel/locking/lockdep.c:1958 [inline] [] validate_chain kernel/locking/lockdep.c:2144 [inline] [] __lock_acquire+0x3e6c/0x5f10 kernel/locking/lockdep.c:3213 [] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592 [] __mutex_lock_common kernel/locking/mutex.c:521 [inline] [] mutex_lock_nested+0xbb/0x8d0 kernel/locking/mutex.c:621 [] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70 [] ipv6_sock_mc_close+0x10e/0x350 net/ipv6/mcast.c:288 [] do_ipv6_setsockopt.isra.4+0xd07/0x2d50 net/ipv6/ipv6_sockglue.c:202 [] compat_ipv6_setsockopt+0xe9/0x1d0 net/ipv6/ipv6_sockglue.c:935 [] compat_udpv6_setsockopt+0x4a/0x90 net/ipv6/udp.c:1446 [] compat_sock_common_setsockopt+0xb4/0x150 net/core/sock.c:2670 [] C_SYSC_setsockopt net/compat.c:385 [inline] [] compat_SyS_setsockopt+0x169/0x700 net/compat.c:368 [] do_syscall_32_irqs_on arch/x86/entry/common.c:396 [inline] [] do_fast_syscall_32+0x31e/0xa80 arch/x86/entry/common.c:463 [] sysenter_flags_fixed+0xd/0x1a other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(sk_lock-AF_INET6); lock(rtnl_mutex); lock(sk_lock-AF_INET6); lock(rtnl_mutex); *** DEADLOCK *** 1 lock held by syz-executor0/6353: #0: (sk_lock-AF_INET6){+.+.+.}, at: [] lock_sock include/net/sock.h:1493 [inline] #0: (sk_lock-AF_INET6){+.+.+.}, at: [] do_ipv6_setsockopt.isra.4+0x252/0x2d50 net/ipv6/ipv6_sockglue.c:166 stack backtrace: CPU: 1 PID: 6353 Comm: syz-executor0 Not tainted 4.4.162+ #7 0000000000000000 e64723457a230670 ffff8801c13ef538 ffffffff81a994bd ffffffff83a85b10 ffffffff83ac48d0 ffffffff83a85b10 ffff8800b24067e8 ffff8800b2405f00 ffff8801c13ef580 ffffffff813a834a 0000000000000001 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x124 lib/dump_stack.c:51 [] print_circular_bug.cold.34+0x2f7/0x432 kernel/locking/lockdep.c:1226 [] check_prev_add kernel/locking/lockdep.c:1853 [inline] [] check_prevs_add kernel/locking/lockdep.c:1958 [inline] [] validate_chain kernel/locking/lockdep.c:2144 [inline] [] __lock_acquire+0x3e6c/0x5f10 kernel/locking/lockdep.c:3213 [] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592 [] __mutex_lock_common kernel/locking/mutex.c:521 [inline] [] mutex_lock_nested+0xbb/0x8d0 kernel/locking/mutex.c:621 [] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70 [] ipv6_sock_mc_close+0x10e/0x350 net/ipv6/mcast.c:288 [] do_ipv6_setsockopt.isra.4+0xd07/0x2d50 net/ipv6/ipv6_sockglue.c:202 [] compat_ipv6_setsockopt+0xe9/0x1d0 net/ipv6/ipv6_sockglue.c:935 [] compat_udpv6_setsockopt+0x4a/0x90 net/ipv6/udp.c:1446 [] compat_sock_common_setsockopt+0xb4/0x150 net/core/sock.c:2670 [] C_SYSC_setsockopt net/compat.c:385 [inline] [] compat_SyS_setsockopt+0x169/0x700 net/compat.c:368 [] do_syscall_32_irqs_on arch/x86/entry/common.c:396 [inline] [] do_fast_syscall_32+0x31e/0xa80 arch/x86/entry/common.c:463 [] sysenter_flags_fixed+0xd/0x1a binder: binder_mmap: 6366 20000000-20004000 bad vm_flags failed -1 audit: type=1400 audit(1540913063.210:90): avc: denied { set_context_mgr } for pid=6366 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 binder: 6366:6381 ioctl c0306201 20000440 returned -14 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket audit: type=1400 audit(1540913064.950:91): avc: denied { set_context_mgr } for pid=6416 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 binder: 6416:6428 unknown command 8388864 binder: 6416:6428 ioctl c0306201 200002c0 returned -22 audit: type=1400 audit(1540913065.100:92): avc: denied { call } for pid=6423 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 audit: type=1400 audit(1540913065.130:93): avc: denied { call } for pid=6416 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket audit: type=1400 audit(1540913065.290:94): avc: denied { call } for pid=6416 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 binder: BINDER_SET_CONTEXT_MGR already set binder: 6416:6419 ioctl 40046207 0 returned -16 binder: 6416:6419 unknown command 8388864 audit: type=1400 audit(1540913065.350:95): avc: denied { call } for pid=6416 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 binder: 6416:6419 ioctl c0306201 200002c0 returned -22 binder: send failed reply for transaction 17 to 6416:6423 binder: send failed reply for transaction 18 to 6416:6431 binder: undelivered TRANSACTION_COMPLETE binder: undelivered TRANSACTION_ERROR: 29189 binder_alloc: 6416: binder_alloc_buf, no vma binder: 6416:6420 transaction failed 29189/-3, size 0-0 line 3137 binder: undelivered TRANSACTION_COMPLETE binder: undelivered TRANSACTION_ERROR: 29189 binder_alloc: 6416: binder_alloc_buf, no vma binder: 6416:6428 transaction failed 29189/-3, size 0-0 line 3137 binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29189 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket audit: type=1400 audit(1540913066.220:96): avc: denied { set_context_mgr } for pid=6456 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 audit: type=1400 audit(1540913066.340:97): avc: denied { call } for pid=6473 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 binder: 6456:6458 unknown command 8388864 binder: 6456:6458 ioctl c0306201 200002c0 returned -22 audit: type=1400 audit(1540913066.440:98): avc: denied { call } for pid=6456 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 binder: release 6456:6458 transaction 24 out, still active binder: undelivered TRANSACTION_COMPLETE binder: release 6456:6473 transaction 22 out, still active binder: undelivered TRANSACTION_COMPLETE binder: send failed reply for transaction 22, target dead binder: send failed reply for transaction 24, target dead SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket binder: 6491:6492 unknown command 8388864 binder: 6491:6492 ioctl c0306201 200002c0 returned -22 binder: 6491:6492 got new transaction with bad transaction stack, transaction 26 has target 6491:0 binder: 6491:6492 transaction failed 29201/-71, size 0-0 line 3041 binder: release 6491:6492 transaction 26 out, still active binder: undelivered TRANSACTION_COMPLETE binder: undelivered TRANSACTION_ERROR: 29201 binder: send failed reply for transaction 26, target dead SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket audit_printk_skb: 9 callbacks suppressed audit: type=1400 audit(1540913069.490:102): avc: denied { set_context_mgr } for pid=6594 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 binder: 6594:6612 unknown command 8388864 binder: 6594:6612 ioctl c0306201 200002c0 returned -22 audit: type=1400 audit(1540913069.710:103): avc: denied { call } for pid=6609 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 audit: type=1400 audit(1540913069.730:104): avc: denied { call } for pid=6594 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 binder: BINDER_SET_CONTEXT_MGR already set audit: type=1400 audit(1540913069.850:105): avc: denied { call } for pid=6603 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 binder: 6603:6622 ioctl 40046207 0 returned -16 binder: 6603:6626 unknown command 8388864 binder: 6603:6626 ioctl c0306201 200002c0 returned -22 binder: release 6594:6609 transaction 28 out, still active binder: undelivered TRANSACTION_COMPLETE audit: type=1400 audit(1540913070.030:106): avc: denied { call } for pid=6603 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 binder: release 6594:6615 transaction 29 out, still active binder: undelivered TRANSACTION_COMPLETE binder: send failed reply for transaction 28, target dead binder: send failed reply for transaction 29, target dead binder_alloc: 6594: binder_alloc_buf, no vma binder: 6603:6620 transaction failed 29189/-3, size 0-0 line 3137 binder_alloc: 6594: binder_alloc_buf, no vma SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket binder: 6603:6605 transaction failed 29189/-3, size 0-0 line 3137 binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29189 audit: type=1400 audit(1540913070.680:107): avc: denied { set_context_mgr } for pid=6640 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket audit: type=1400 audit(1540913070.870:108): avc: denied { call } for pid=6640 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 binder: BINDER_SET_CONTEXT_MGR already set binder: 6657:6662 ioctl 40046207 0 returned -16 audit: type=1400 audit(1540913071.230:109): avc: denied { call } for pid=6672 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 binder: 6657:6662 unknown command 8388864 binder: 6657:6662 ioctl c0306201 200002c0 returned -22 audit: type=1400 audit(1540913071.320:110): avc: denied { call } for pid=6657 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket binder: release 6657:6672 transaction 35 out, still active binder: undelivered TRANSACTION_COMPLETE binder: release 6657:6677 transaction 36 out, still active binder: BINDER_SET_CONTEXT_MGR already set binder: undelivered TRANSACTION_COMPLETE audit: type=1400 audit(1540913071.570:111): avc: denied { call } for pid=6685 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 binder: 6674:6684 ioctl 40046207 0 returned -16 binder: 6674:6690 unknown command 8388864 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket binder: 6674:6690 ioctl c0306201 200002c0 returned -22 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket binder: release 6674:6675 transaction 38 out, still active binder: undelivered TRANSACTION_COMPLETE binder: release 6674:6685 transaction 37 out, still active binder: BINDER_SET_CONTEXT_MGR already set binder: 6680:6693 ioctl 40046207 0 returned -16 binder: 6680:6703 unknown command 8388864 binder: undelivered TRANSACTION_COMPLETE binder: 6680:6703 ioctl c0306201 200002c0 returned -22 binder: BINDER_SET_CONTEXT_MGR already set binder: 6692:6707 unknown command 8388864 binder: 6692:6705 ioctl 40046207 0 returned -16 binder: 6692:6707 ioctl c0306201 200002c0 returned -22 binder: release 6680:6693 transaction 40 out, still active binder: undelivered TRANSACTION_COMPLETE binder: release 6680:6703 transaction 39 out, still active SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket