syzbot


possible deadlock in proc_pid_attr_write

Status: closed as dup on 2017/12/12 22:00
Subsystems: fs
[Documentation on labels]
Reported-by: syzbot+d75766bf481d4fa47bb2e5a7073c9483fb0587cf@syzkaller.appspotmail.com
First crash: 2328d, last: 1848d
Duplicate of
Title Repro Cause bisect Fix bisect Count Last Reported
possible deadlock in seq_read fs C 19074 1841d 2330d
Similar bugs (6)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-414 possible deadlock in proc_pid_attr_write C 203 1849d 1835d 0/1 public: reported C repro on 2019/04/11 00:00
linux-4.14 possible deadlock in proc_pid_attr_write 3 1546d 1635d 0/1 auto-closed as invalid on 2020/05/23 15:46
upstream possible deadlock in proc_pid_attr_write (2) fs 1 1524d 1520d 0/26 auto-closed as invalid on 2020/04/15 17:32
linux-4.19 possible deadlock in proc_pid_attr_write 1 1309d 1309d 0/1 auto-closed as invalid on 2021/01/16 05:53
linux-4.14 possible deadlock in proc_pid_attr_write (2) 1 1091d 1091d 0/1 auto-closed as invalid on 2021/08/21 09:25
linux-4.19 possible deadlock in proc_pid_attr_write (2) 1 936d 936d 0/1 auto-closed as invalid on 2022/01/23 20:06

Sample crash report:
======================================================
WARNING: possible circular locking dependency detected
5.0.0-rc7+ #79 Not tainted
------------------------------------------------------
syz-executor078/7863 is trying to acquire lock:
00000000ce924167 (&sig->cred_guard_mutex){+.+.}, at: proc_pid_attr_write+0x1fa/0x530 fs/proc/base.c:2573

but task is already holding lock:
000000001577bd72 (&pipe->mutex/1){+.+.}, at: pipe_lock_nested fs/pipe.c:62 [inline]
000000001577bd72 (&pipe->mutex/1){+.+.}, at: pipe_lock+0x6e/0x80 fs/pipe.c:70

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (&pipe->mutex/1){+.+.}:
       __mutex_lock_common kernel/locking/mutex.c:925 [inline]
       __mutex_lock+0xf7/0x1310 kernel/locking/mutex.c:1072
       mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
       __pipe_lock fs/pipe.c:83 [inline]
       fifo_open+0x159/0xb00 fs/pipe.c:905
       do_dentry_open+0x47d/0x1130 fs/open.c:771
       vfs_open+0xa0/0xd0 fs/open.c:880
       do_last fs/namei.c:3418 [inline]
       path_openat+0x10d7/0x4690 fs/namei.c:3534
       do_filp_open+0x1a1/0x280 fs/namei.c:3564
       do_open_execat+0x13b/0x6d0 fs/exec.c:856
       __do_execve_file.isra.0+0x178d/0x23f0 fs/exec.c:1758
       do_execveat_common fs/exec.c:1865 [inline]
       do_execve fs/exec.c:1882 [inline]
       __do_sys_execve fs/exec.c:1963 [inline]
       __se_sys_execve fs/exec.c:1958 [inline]
       __x64_sys_execve+0x8f/0xc0 fs/exec.c:1958
       do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
       entry_SYSCALL_64_after_hwframe+0x49/0xbe

-> #0 (&sig->cred_guard_mutex){+.+.}:
       lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:3841
       __mutex_lock_common kernel/locking/mutex.c:925 [inline]
       __mutex_lock+0xf7/0x1310 kernel/locking/mutex.c:1072
       mutex_lock_interruptible_nested+0x16/0x20 kernel/locking/mutex.c:1109
       proc_pid_attr_write+0x1fa/0x530 fs/proc/base.c:2573
       __vfs_write+0x116/0x8e0 fs/read_write.c:485
       __kernel_write+0x110/0x3b0 fs/read_write.c:506
       write_pipe_buf+0x15d/0x1f0 fs/splice.c:797
       splice_from_pipe_feed fs/splice.c:503 [inline]
       __splice_from_pipe+0x39a/0x7e0 fs/splice.c:627
       splice_from_pipe+0x108/0x170 fs/splice.c:662
       default_file_splice_write+0x3c/0x90 fs/splice.c:809
       do_splice_from fs/splice.c:851 [inline]
       do_splice+0x644/0x1330 fs/splice.c:1152
       __do_sys_splice fs/splice.c:1419 [inline]
       __se_sys_splice fs/splice.c:1399 [inline]
       __x64_sys_splice+0x2c6/0x330 fs/splice.c:1399
       do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
       entry_SYSCALL_64_after_hwframe+0x49/0xbe

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&pipe->mutex/1);
                               lock(&sig->cred_guard_mutex);
                               lock(&pipe->mutex/1);
  lock(&sig->cred_guard_mutex);

 *** DEADLOCK ***

2 locks held by syz-executor078/7863:
 #0: 00000000f2e0ce39 (sb_writers#6){.+.+}, at: file_start_write include/linux/fs.h:2816 [inline]
 #0: 00000000f2e0ce39 (sb_writers#6){.+.+}, at: do_splice+0xceb/0x1330 fs/splice.c:1151
 #1: 000000001577bd72 (&pipe->mutex/1){+.+.}, at: pipe_lock_nested fs/pipe.c:62 [inline]
 #1: 000000001577bd72 (&pipe->mutex/1){+.+.}, at: pipe_lock+0x6e/0x80 fs/pipe.c:70

stack backtrace:
CPU: 1 PID: 7863 Comm: syz-executor078 Not tainted 5.0.0-rc7+ #79
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 print_circular_bug.isra.0.cold+0x1cc/0x28f kernel/locking/lockdep.c:1224
 check_prev_add kernel/locking/lockdep.c:1866 [inline]
 check_prevs_add kernel/locking/lockdep.c:1979 [inline]
 validate_chain kernel/locking/lockdep.c:2350 [inline]
 __lock_acquire+0x2f00/0x4700 kernel/locking/lockdep.c:3338
 lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:3841
 __mutex_lock_common kernel/locking/mutex.c:925 [inline]
 __mutex_lock+0xf7/0x1310 kernel/locking/mutex.c:1072
 mutex_lock_interruptible_nested+0x16/0x20 kernel/locking/mutex.c:1109
 proc_pid_attr_write+0x1fa/0x530 fs/proc/base.c:2573
 __vfs_write+0x116/0x8e0 fs/read_write.c:485
 __kernel_write+0x110/0x3b0 fs/read_write.c:506
 write_pipe_buf+0x15d/0x1f0 fs/splice.c:797
 splice_from_pipe_feed fs/splice.c:503 [inline]
 __splice_from_pipe+0x39a/0x7e0 fs/splice.c:627
 splice_from_pipe+0x108/0x170 fs/splice.c:662
 default_file_splice_write+0x3c/0x90 fs/splice.c:809
 do_splice_from fs/splice.c:851 [inline]
 do_splice+0x644/0x1330 fs/splice.c:1152
 __do_sys_splice fs/splice.c:1419 [inline]
 __se_sys_splice fs/splice.c:1399 [inline]
 __x64_sys_splice+0x2c6/0x330 fs/splice.c:1399
 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x445779
Code: e8 6c b6 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b 12 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fc8cda61da8 EFLAGS: 00000246 ORIG_RAX: 0000000000000113
RAX: ffffffffffffffda RBX: 00000000006dac68 RCX: 0000000000445779
RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00000000006dac60 R08: 0000020000000003 R09: 0000000000000009
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dac6c
R13: 00007ffed72eae3f R14: 00007fc8cda629c0 R15: 20c49ba5e353f7cf

Crashes (281):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/02/19 21:23 upstream b5372fe5dc84 4df543c9 .config console log report syz C ci-upstream-kasan-gce-root
2019/02/19 17:21 upstream b5372fe5dc84 4df543c9 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/02/19 17:12 upstream b5372fe5dc84 4df543c9 .config console log report syz C ci-upstream-kasan-gce
2019/02/19 16:52 upstream b5372fe5dc84 4df543c9 .config console log report syz C ci-upstream-kasan-gce-smack-root
2018/10/22 20:07 upstream 84df9525b0c2 ecb386fe .config console log report syz C ci-upstream-kasan-gce-smack-root
2018/10/21 20:38 upstream 23469de647c4 ecb386fe .config console log report syz C ci-upstream-kasan-gce
2019/02/20 05:04 upstream 40e196a906d9 4df543c9 .config console log report syz C ci-upstream-kasan-gce-386
2019/02/20 14:03 linux-next abf446c90405 c95f0707 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2018/12/24 12:20 upstream 8fe28cb58bcb be79df56 .config console log report syz ci-upstream-kasan-gce-root
2018/12/24 05:09 upstream 3c730b1041ae e3bd7ab8 .config console log report syz ci-upstream-kasan-gce
2018/12/24 04:08 upstream 3c730b1041ae e3bd7ab8 .config console log report syz ci-upstream-kasan-gce-selinux-root
2018/12/24 03:21 upstream 3c730b1041ae e3bd7ab8 .config console log report syz ci-upstream-kasan-gce-smack-root
2018/11/06 14:17 upstream 163c8d54a997 8bd6bd63 .config console log report syz ci-upstream-kasan-gce-smack-root
2018/11/06 13:29 upstream 163c8d54a997 8bd6bd63 .config console log report syz ci-upstream-kasan-gce-smack-root
2018/11/05 09:42 upstream 4710e78940d8 8bd6bd63 .config console log report syz ci-upstream-kasan-gce-selinux-root
2018/11/05 07:46 upstream 4710e78940d8 8bd6bd63 .config console log report syz ci-upstream-kasan-gce-selinux-root
2018/11/05 01:44 upstream 4710e78940d8 8bd6bd63 .config console log report syz ci-upstream-kasan-gce-root
2018/11/04 05:49 upstream d2ff0ff2c23f 8bd6bd63 .config console log report syz ci-upstream-kasan-gce
2018/11/04 03:51 upstream d2ff0ff2c23f 8bd6bd63 .config console log report syz ci-upstream-kasan-gce
2018/10/23 09:02 upstream ca9eb48fe01f ecb386fe .config console log report syz ci-upstream-kasan-gce-root
2018/10/22 22:51 upstream 84df9525b0c2 ecb386fe .config console log report syz ci-upstream-kasan-gce-root
2018/10/22 16:37 upstream 84df9525b0c2 ecb386fe .config console log report syz ci-upstream-kasan-gce-selinux-root
2018/10/22 16:34 upstream 84df9525b0c2 ecb386fe .config console log report syz ci-upstream-kasan-gce
2018/10/22 10:14 upstream 467e050e9760 ecb386fe .config console log report syz ci-upstream-kasan-gce-smack-root
2018/10/21 13:35 upstream 23469de647c4 ecb386fe .config console log report syz ci-upstream-kasan-gce-selinux-root
2018/12/24 02:49 upstream 3c730b1041ae e3bd7ab8 .config console log report syz ci-upstream-kasan-gce-386
2018/11/04 03:28 upstream 83650fd58a93 8bd6bd63 .config console log report syz ci-upstream-kasan-gce-386
2018/11/04 02:42 upstream 83650fd58a93 8bd6bd63 .config console log report syz ci-upstream-kasan-gce-386
2018/10/22 17:11 upstream 84df9525b0c2 ecb386fe .config console log report syz ci-upstream-kasan-gce-386
2018/12/27 16:14 linux-next 6a1d293238c1 43cf01dd .config console log report syz ci-upstream-linux-next-kasan-gce-root
2018/11/06 01:06 linux-next 55e5059cb572 8bd6bd63 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2018/11/06 00:15 linux-next 55e5059cb572 8bd6bd63 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2018/10/23 00:40 linux-next 8c60c36d0b8c ecb386fe .config console log report syz ci-upstream-linux-next-kasan-gce-root
2018/10/22 02:43 linux-next 8c60c36d0b8c ecb386fe .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/03/25 18:05 upstream 8c2ffd917477 2c86e0a5 .config console log report ci-upstream-kasan-gce
2019/03/25 15:22 upstream 8c2ffd917477 2c86e0a5 .config console log report ci-upstream-kasan-gce
2019/03/25 13:15 upstream 8c2ffd917477 2c86e0a5 .config console log report ci-upstream-kasan-gce-root
2019/03/25 00:05 upstream 1bdd3dbfff7a acbc5b7d .config console log report ci-upstream-kasan-gce
2019/03/24 15:03 upstream 1bdd3dbfff7a acbc5b7d .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/23 13:42 upstream fd1f297b794c 3361bde5 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/22 04:12 upstream 0939221e6468 dce6e62f .config console log report ci-upstream-kasan-gce
2019/03/21 02:40 upstream babf09c3837f a664c187 .config console log report ci-upstream-kasan-gce-smack-root
2019/03/20 08:46 upstream b7a42146dca3 2458c1c6 .config console log report ci-upstream-kasan-gce
2019/03/18 17:52 upstream 9e98c678c2d6 4656beca .config console log report ci-upstream-kasan-gce
2019/03/15 00:29 upstream 3b319ee220a8 d72db19b .config console log report ci-upstream-kasan-gce-root
2019/03/14 22:17 upstream 3b319ee220a8 d72db19b .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/14 17:11 upstream fa3d493f7a57 d09a902e .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/12 18:13 upstream ea295481b6e3 a71bfb62 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/12 16:37 upstream ea295481b6e3 a71bfb62 .config console log report ci-upstream-kasan-gce
2019/03/12 10:09 upstream a089e4fed5c5 12365b99 .config console log report ci-upstream-kasan-gce-smack-root
2019/03/12 07:29 upstream a089e4fed5c5 12365b99 .config console log report ci-upstream-kasan-gce
2019/03/09 22:24 upstream 38e7571c07be 12365b99 .config console log report ci-upstream-kasan-gce
2019/03/09 11:11 upstream 3601fe43e816 12365b99 .config console log report ci-upstream-kasan-gce-smack-root
2019/03/08 04:40 upstream 1fc1cd8399ab 4b69c3cb .config console log report ci-upstream-kasan-gce
2019/03/07 18:40 upstream f90d64483ebd 8c085c5e .config console log report ci-upstream-kasan-gce
2019/03/07 13:04 upstream f90d64483ebd 8c085c5e .config console log report ci-upstream-kasan-gce
2019/03/06 12:14 upstream 3717f613f48d 05cf83bf .config console log report ci-upstream-kasan-gce-smack-root
2019/03/06 07:40 upstream 63bdf4284c38 16559f86 .config console log report ci-upstream-kasan-gce-root
2019/03/05 16:58 upstream cd2a3bf02625 bb91cf81 .config console log report ci-upstream-kasan-gce-smack-root
2019/03/05 13:56 upstream cd2a3bf02625 bb91cf81 .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/04 18:37 upstream 1c163f4c7b3f 7c693b52 .config console log report ci-upstream-kasan-gce-smack-root
2019/03/03 18:03 upstream c027c7cf1577 1c0e457a .config console log report ci-upstream-kasan-gce-selinux-root
2019/03/01 00:37 upstream 7d762d69145a 09aeeba4 .config console log report ci-upstream-kasan-gce
2019/02/28 22:24 upstream 7d762d69145a 09aeeba4 .config console log report ci-upstream-kasan-gce-smack-root
2019/03/28 16:47 upstream 1a9df9e29c2a f94f56fe .config console log report ci-upstream-kasan-gce-386
2019/03/22 11:46 upstream 0939221e6468 dce6e62f .config console log report ci-upstream-kasan-gce-386
2019/03/14 06:13 upstream ebc551f2b8f9 2881fc25 .config console log report ci-upstream-kasan-gce-386
2019/03/09 07:23 upstream 3601fe43e816 12365b99 .config console log report ci-upstream-kasan-gce-386
2019/03/07 07:04 upstream afe6fe7036c6 18215b8d .config console log report ci-upstream-kasan-gce-386
2019/03/04 15:01 upstream 1c163f4c7b3f 7c693b52 .config console log report ci-upstream-kasan-gce-386
2019/03/27 09:21 linux-next a392ee45bae7 55684ce1 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/03/26 23:45 linux-next ab8bba4ec4b9 55684ce1 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/03/23 07:14 linux-next e382d91f5f80 3361bde5 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/03/23 03:06 linux-next e382d91f5f80 3361bde5 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/03/22 00:17 linux-next 32a217bae32c dce6e62f .config console log report ci-upstream-linux-next-kasan-gce-root
2019/03/15 12:28 linux-next cf08baa29613 bab43553 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/03/14 04:03 linux-next cf08baa29613 2881fc25 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/03/08 16:03 linux-next cf08baa29613 12365b99 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/03/06 03:40 linux-next baf5a9d1f9b9 16559f86 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/03/04 22:08 linux-next 5d57915a1c8b 7c693b52 .config console log report ci-upstream-linux-next-kasan-gce-root
2017/12/27 14:04 mmots 37759fa6d0fa 09c8f4c0 .config console log report ci-upstream-mmots-kasan-gce
2017/12/27 14:03 linux-next 0e08c463db38 09c8f4c0 .config console log report ci-upstream-next-kasan-gce
* Struck through repros no longer work on HEAD.