binder: 5480:5503 transaction failed 29189/-3, size 40-8 line 3128 binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29201 ====================================================== [ INFO: possible circular locking dependency detected ] 4.4.120-gd63fdf6 #29 Not tainted ------------------------------------------------------- syz-executor1/5522 is trying to acquire lock: (&sb->s_type->i_mutex_key#10){+.+.+.}, at: [] shmem_file_llseek+0xf1/0x240 mm/shmem.c:1816 but task is already holding lock: (ashmem_mutex){+.+.+.}, at: [] ashmem_llseek+0x56/0x1f0 drivers/staging/android/ashmem.c:330 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: [] lock_acquire+0x15e/0x460 kernel/locking/lockdep.c:3592 [] __mutex_lock_common kernel/locking/mutex.c:521 [inline] [] mutex_lock_nested+0xbb/0x850 kernel/locking/mutex.c:621 [] ashmem_mmap+0x53/0x400 drivers/staging/android/ashmem.c:366 [] mmap_region+0x94f/0x1250 mm/mmap.c:1664 [] do_mmap+0x4fd/0x9d0 mm/mmap.c:1441 [] do_mmap_pgoff include/linux/mm.h:1915 [inline] [] vm_mmap_pgoff+0x16e/0x1c0 mm/util.c:296 [] SYSC_mmap_pgoff mm/mmap.c:1491 [inline] [] SyS_mmap_pgoff+0x33f/0x560 mm/mmap.c:1449 [] do_syscall_32_irqs_on arch/x86/entry/common.c:392 [inline] [] do_fast_syscall_32+0x321/0x8a0 arch/x86/entry/common.c:459 [] sysenter_flags_fixed+0xd/0x17 [] lock_acquire+0x15e/0x460 kernel/locking/lockdep.c:3592 [] __might_fault+0x14a/0x1d0 mm/memory.c:3810 [] copy_to_user arch/x86/include/asm/uaccess.h:760 [inline] [] filldir+0x162/0x2d0 fs/readdir.c:180 [] dir_emit_dot include/linux/fs.h:3070 [inline] [] dir_emit_dots include/linux/fs.h:3081 [inline] [] dcache_readdir+0x11e/0x7b0 fs/libfs.c:150 [] iterate_dir+0x1c8/0x420 fs/readdir.c:42 [] SYSC_getdents fs/readdir.c:215 [inline] [] SyS_getdents+0x14a/0x270 fs/readdir.c:196 [] entry_SYSCALL_64_fastpath+0x1c/0x98 [] check_prev_add kernel/locking/lockdep.c:1853 [inline] [] check_prevs_add kernel/locking/lockdep.c:1958 [inline] [] validate_chain kernel/locking/lockdep.c:2144 [inline] [] __lock_acquire+0x371f/0x4b50 kernel/locking/lockdep.c:3213 [] lock_acquire+0x15e/0x460 kernel/locking/lockdep.c:3592 [] __mutex_lock_common kernel/locking/mutex.c:521 [inline] [] mutex_lock_nested+0xbb/0x850 kernel/locking/mutex.c:621 [] shmem_file_llseek+0xf1/0x240 mm/shmem.c:1816 [] vfs_llseek+0xa2/0xd0 fs/read_write.c:260 [] ashmem_llseek+0xe7/0x1f0 drivers/staging/android/ashmem.c:342 [] vfs_llseek fs/read_write.c:260 [inline] [] SYSC_lseek fs/read_write.c:285 [inline] [] SyS_lseek fs/read_write.c:276 [inline] [] C_SYSC_lseek fs/read_write.c:297 [inline] [] compat_SyS_lseek+0xeb/0x170 fs/read_write.c:295 [] do_syscall_32_irqs_on arch/x86/entry/common.c:392 [inline] [] do_fast_syscall_32+0x321/0x8a0 arch/x86/entry/common.c:459 [] sysenter_flags_fixed+0xd/0x17 other info that might help us debug this: Chain exists of: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(ashmem_mutex); lock(&mm->mmap_sem); lock(ashmem_mutex); lock(&sb->s_type->i_mutex_key#10); *** DEADLOCK *** 1 lock held by syz-executor1/5522: #0: (ashmem_mutex){+.+.+.}, at: [] ashmem_llseek+0x56/0x1f0 drivers/staging/android/ashmem.c:330 stack backtrace: CPU: 0 PID: 5522 Comm: syz-executor1 Not tainted 4.4.120-gd63fdf6 #29 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 0000000000000000 32b1f7e99020f716 ffff8800b54e7a58 ffffffff81d0408d ffffffff851a0010 ffffffff851a97f0 ffffffff851bee80 ffff8800ad4dd0f8 ffff8800ad4dc800 ffff8800b54e7aa0 ffffffff81233ba1 ffff8800ad4dd0f8 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x124 lib/dump_stack.c:51 [] print_circular_bug+0x271/0x310 kernel/locking/lockdep.c:1226 [] check_prev_add kernel/locking/lockdep.c:1853 [inline] [] check_prevs_add kernel/locking/lockdep.c:1958 [inline] [] validate_chain kernel/locking/lockdep.c:2144 [inline] [] __lock_acquire+0x371f/0x4b50 kernel/locking/lockdep.c:3213 [] lock_acquire+0x15e/0x460 kernel/locking/lockdep.c:3592 [] __mutex_lock_common kernel/locking/mutex.c:521 [inline] [] mutex_lock_nested+0xbb/0x850 kernel/locking/mutex.c:621 [] shmem_file_llseek+0xf1/0x240 mm/shmem.c:1816 [] vfs_llseek+0xa2/0xd0 fs/read_write.c:260 [] ashmem_llseek+0xe7/0x1f0 drivers/staging/android/ashmem.c:342 [] vfs_llseek fs/read_write.c:260 [inline] [] SYSC_lseek fs/read_write.c:285 [inline] [] SyS_lseek fs/read_write.c:276 [inline] [] C_SYSC_lseek fs/read_write.c:297 [inline] [] compat_SyS_lseek+0xeb/0x170 fs/read_write.c:295 [] do_syscall_32_irqs_on arch/x86/entry/common.c:392 [inline] [] do_fast_syscall_32+0x321/0x8a0 arch/x86/entry/common.c:459 [] sysenter_flags_fixed+0xd/0x17 audit: type=1401 audit(1521400824.338:11): op=setxattr invalid_context=5E637075736574405E776C616E31B9007ED4C715B44323D0F08C7A7B8BABDEB9FC62DF50601D6EC83A225BB51D9972F9C15E25CCE2397BCD000000EBED81D80490963C796563797A696E4E8B47CA8DB3F75E0E370A8C60A59FE0EB175F5FE95EBC2D1A89738C7D579C9BCEB79B9F07D71D3960E8570BE75124CBCBF31BB103FE41E0E2DE57EB0C1006CCF8F580C69066EC5368AD6D2F61B1F51DF263B8A29181EEF70C9E411B01732F2AE16DCE7D0A4451A84E386FA2733661F1 audit: type=1401 audit(1521400824.408:12): op=setxattr invalid_context=5E637075736574405E776C616E31B9007ED4C715B44323D0F08C7A7B8BABDEB9FC62DF50601D6EC83A225BB51D9972F9C15E25CCE2397BCD000000EBED81D80490963C796563797A696E4E8B47CA8DB3F75E0E370A8C60A59FE0EB175F5FE95EBC2D1A89738C7D579C9BCEB79B9F07D71D3960E8570BE75124CBCBF31BB103FE41E0E2DE57EB0C1006CCF8F580C69066EC5368AD6D2F61B1F51DF263B8A29181EEF70C9E411B01732F2AE16DCE7D0A4451A84E386FA2733661F1 audit: type=1400 audit(1521400824.818:13): avc: denied { dyntransition } for pid=5651 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0,c1 tclass=process permissive=1 blk_update_request: I/O error, dev loop0, sector 0 device syz_tun entered promiscuous mode blk_update_request: I/O error, dev loop0, sector 0 device syz_tun left promiscuous mode binder: 5794:5795 ERROR: BC_REGISTER_LOOPER called without request binder: 5794:5800 ioctl c0306201 20000180 returned -14 binder: 5794:5800 got reply transaction with no transaction stack binder: 5794:5800 transaction failed 29201/-71, size 32-8 line 2921 binder: BINDER_SET_CONTEXT_MGR already set binder: 5794:5804 ioctl 40046207 0 returned -16 binder: 5794:5800 ERROR: BC_REGISTER_LOOPER called without request binder: 5794:5811 ioctl c0306201 20000180 returned -14 binder: 5794:5800 got reply transaction with no transaction stack binder: 5794:5800 transaction failed 29201/-71, size 32-8 line 2921 binder: undelivered TRANSACTION_ERROR: 29201 binder: undelivered TRANSACTION_ERROR: 29201 netlink: 8 bytes leftover after parsing attributes in process `syz-executor6'. binder: 5871:5878 got transaction to invalid handle binder: 5871:5878 transaction failed 29201/-22, size 0-4096 line 3005 binder: 5871:5878 got transaction to invalid handle binder: 5871:5878 transaction failed 29201/-22, size 0-4096 line 3005 capability: warning: `syz-executor7' uses deprecated v2 capabilities in a way that may be insecure TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. SELinux: unrecognized netlink message: protocol=4 nlmsg_type=770 sclass=netlink_tcpdiag_socket SELinux: unrecognized netlink message: protocol=4 nlmsg_type=770 sclass=netlink_tcpdiag_socket binder: 6225:6231 got transaction with invalid data ptr binder: 6225:6231 transaction failed 29201/-14, size 40-40 line 3147 binder_alloc: binder_alloc_mmap_handler: 6225 20000000-20002000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 6225:6237 ioctl 40046207 0 returned -16 binder_alloc: 6225: binder_alloc_buf, no vma binder: 6225:6231 transaction failed 29189/-3, size 40-40 line 3128 binder: undelivered TRANSACTION_ERROR: 29201 binder: undelivered TRANSACTION_ERROR: 29189 TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. binder: 6417:6420 unknown command 1592137808 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=38307 sclass=netlink_route_socket SELinux: unrecognized netlink message: protocol=0 nlmsg_type=38307 sclass=netlink_route_socket binder: 6417:6420 ioctl c0306201 20007000 returned -22 binder: BINDER_SET_CONTEXT_MGR already set binder: 6417:6420 unknown command 1592137808 binder: 6417:6420 ioctl c0306201 20007000 returned -22 binder: BINDER_SET_CONTEXT_MGR already set binder: 6417:6420 ioctl 40046207 0 returned -16 binder: 6417:6428 ioctl 40046207 0 returned -16 sg_write: data in/out 1327718381/99 bytes for SCSI command 0x1e-- guessing data in; program syz-executor1 not setting count and/or reply_len properly audit_printk_skb: 14 callbacks suppressed audit: type=1400 audit(1521400828.278:18): avc: denied { setopt } for pid=6545 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=6393 sclass=netlink_route_socket SELinux: unrecognized netlink message: protocol=0 nlmsg_type=33019 sclass=netlink_route_socket SELinux: unrecognized netlink message: protocol=0 nlmsg_type=6393 sclass=netlink_route_socket audit: type=1400 audit(1521400828.358:19): avc: denied { getopt } for pid=6545 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 audit: type=1401 audit(1521400828.358:20): op=security_bounded_transition seresult=denied oldcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 newcontext=system_u:object_r:lastlog_t:s0 l2tp_core: tunl 2: sockfd_lookup(fd=21) returned -9 binder: 6562:6582 unknown command -2028313895 binder: 6562:6582 ioctl c0306201 2018b000 returned -22 binder: 6562:6584 got reply transaction with no transaction stack BUG: unable to handle kernel NULL pointer dereference at 0000000000000080 IP: [] sock_hold include/net/sock.h:589 [inline] IP: [] l2tp_session_create+0x93e/0x10f0 net/l2tp/l2tp_core.c:1805 PGD 80000000b3ce3067 PUD bad2e067 PMD 0 Oops: 0002 [#1] PREEMPT SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 1 PID: 6581 Comm: syz-executor6 Not tainted 4.4.120-gd63fdf6 #29 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff8801d7b66000 task.stack: ffff8800b96e0000 RIP: 0010:[] [] sock_hold include/net/sock.h:589 [inline] RIP: 0010:[] [] l2tp_session_create+0x93e/0x10f0 net/l2tp/l2tp_core.c:1805 RSP: 0018:ffff8800b96e7ad0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8801d876b680 RCX: ffffffff83458dd6 binder: BINDER_SET_CONTEXT_MGR already set binder: 6562:6585 ioctl 40046207 0 returned -16 binder_alloc: 6562: binder_alloc_buf, no vma binder: 6562:6595 transaction failed 29189/-3, size 0-0 line 3128 binder: 6562:6595 got reply transaction with no transaction stack binder: 6562:6595 transaction failed 29201/-71, size 0--6284587267136963681 line 2921 binder: 6562:6585 unknown command -2028313895 binder: 6562:6585 ioctl c0306201 2018b000 returned -22 RDX: 1ffff1003b0ed700 RSI: ffffc90003aa6000 RDI: ffff8801d876b800 RBP: ffff8800b96e7b40 R08: 000000000000000a R09: 000000000000ffff R10: ffffffff85700600 R11: ffffffff84418340 R12: ffff8801d876b4a8 binder: 6562:6584 transaction failed 29201/-71, size 0--6284587267136963681 line 2921 binder: undelivered TRANSACTION_ERROR: 29201 binder: release 6562:6564 transaction 27 out, still active binder: undelivered TRANSACTION_COMPLETE binder: undelivered TRANSACTION_ERROR: 29201 binder: send failed reply for transaction 27, target dead R13: ffff8800b96e7c58 R14: ffff8801d876b760 R15: ffff8801d876b400 FS: 0000000000000000(0000) GS:ffff8801db300000(0063) knlGS:00000000f6ef0b40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 0000000000000080 CR3: 00000000b4d26000 CR4: 0000000000160670 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: ffffffff8113bd95 ffff8801d876b6a0 ffff8801d876b558 ffff8800b96e7b00 ffff8801d876b410 0000000000000000 ffff8801d876b4b0 ffff8801d876b550 6b5f7b3500000000 0000000000000000 ffff8801d7f9a200 0000000000000000 Call Trace: [] pppol2tp_connect+0x10fc/0x1930 net/l2tp/l2tp_ppp.c:718 [] SYSC_connect+0x1b6/0x310 net/socket.c:1557 [] SyS_connect+0x24/0x30 net/socket.c:1538 [] do_syscall_32_irqs_on arch/x86/entry/common.c:392 [inline] [] do_fast_syscall_32+0x321/0x8a0 arch/x86/entry/common.c:459 [] sysenter_flags_fixed+0xd/0x17 Code: 00 00 48 8d bb 80 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 4f 07 00 00 48 8b 83 80 01 00 00 ff 80 80 00 00 00 48 8d 43 20 48 89 c7 48 89 45 b8 e8 cb 38 RIP [] sock_hold include/net/sock.h:589 [inline] RIP [] l2tp_session_create+0x93e/0x10f0 net/l2tp/l2tp_core.c:1805 RSP CR2: 0000000000000080 ---[ end trace a2d47384c92dfbd9 ]---