possible deadlock in mnt_want

possible deadlock in mnt_want_write
Status: upstream: reported C repro on 2019/04/19 16:54
Reported-by: syzbot+68b10d4d99f77e1dba4f@syzkaller.appspotmail.com
First crash: 884d, last: 13h37m

similar bugs (4):
Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	possible deadlock in mnt_want_write	C	done	done	662	346d	1153d	17/22	fixed on 2020/11/16 12:12
android-49	possible deadlock in mnt_want_write				1	1136d	1136d	0/3	auto-closed as invalid on 2019/02/22 14:57
upstream	possible deadlock in mnt_want_write (2)				12	11d	95d	0/22	upstream: reported on 2021/06/15 16:59
linux-4.14	possible deadlock in mnt_want_write	C			4513	14h04m	878d	0/1	upstream: reported C repro on 2019/04/25 05:09

Sample crash report:

======================================================
WARNING: possible circular locking dependency detected
4.19.206-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor678/8093 is trying to acquire lock:
000000006df09afe (sb_writers#3){.+.+}, at: sb_start_write include/linux/fs.h:1579 [inline]
000000006df09afe (sb_writers#3){.+.+}, at: mnt_want_write+0x3a/0xb0 fs/namespace.c:360

but task is already holding lock:
00000000d5b3aa6b (&iint->mutex){+.+.}, at: process_measurement+0x316/0x1440 security/integrity/ima/ima_main.c:224

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (&iint->mutex){+.+.}:
       process_measurement+0x316/0x1440 security/integrity/ima/ima_main.c:224
       ima_file_check+0xb9/0x100 security/integrity/ima/ima_main.c:391
       do_last fs/namei.c:3425 [inline]
       path_openat+0x7e4/0x2df0 fs/namei.c:3537
       do_filp_open+0x18c/0x3f0 fs/namei.c:3567
       do_sys_open+0x3b3/0x520 fs/open.c:1085
       do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
       entry_SYSCALL_64_after_hwframe+0x49/0xbe

-> #0 (sb_writers#3){.+.+}:
       percpu_down_read_preempt_disable include/linux/percpu-rwsem.h:36 [inline]
       percpu_down_read include/linux/percpu-rwsem.h:59 [inline]
       __sb_start_write+0x6e/0x2a0 fs/super.c:1366
       sb_start_write include/linux/fs.h:1579 [inline]
       mnt_want_write+0x3a/0xb0 fs/namespace.c:360
       ovl_maybe_copy_up+0x11f/0x190 fs/overlayfs/copy_up.c:888
       ovl_open+0xb4/0x260 fs/overlayfs/file.c:126
       do_dentry_open+0x4aa/0x1160 fs/open.c:796
       vfs_open fs/open.c:902 [inline]
       dentry_open+0x132/0x1d0 fs/open.c:918
       ima_calc_file_hash+0x628/0x8a0 security/integrity/ima/ima_crypto.c:435
       ima_collect_measurement+0x4c4/0x570 security/integrity/ima/ima_api.c:231
       process_measurement+0xddd/0x1440 security/integrity/ima/ima_main.c:284
       ima_file_check+0xb9/0x100 security/integrity/ima/ima_main.c:391
       do_last fs/namei.c:3425 [inline]
       path_openat+0x7e4/0x2df0 fs/namei.c:3537
       do_filp_open+0x18c/0x3f0 fs/namei.c:3567
       do_sys_open+0x3b3/0x520 fs/open.c:1085
       do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
       entry_SYSCALL_64_after_hwframe+0x49/0xbe

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&iint->mutex);
                               lock(sb_writers#3);
                               lock(&iint->mutex);
  lock(sb_writers#3);

 *** DEADLOCK ***

1 lock held by syz-executor678/8093:
 #0: 00000000d5b3aa6b (&iint->mutex){+.+.}, at: process_measurement+0x316/0x1440 security/integrity/ima/ima_main.c:224

stack backtrace:
CPU: 1 PID: 8093 Comm: syz-executor678 Not tainted 4.19.206-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 print_circular_bug.constprop.0.cold+0x2d7/0x41e kernel/locking/lockdep.c:1222
 check_prev_add kernel/locking/lockdep.c:1866 [inline]
 check_prevs_add kernel/locking/lockdep.c:1979 [inline]
 validate_chain kernel/locking/lockdep.c:2420 [inline]
 __lock_acquire+0x30c9/0x3ff0 kernel/locking/lockdep.c:3416
 lock_acquire+0x170/0x3c0 kernel/locking/lockdep.c:3908
 percpu_down_read_preempt_disable include/linux/percpu-rwsem.h:36 [inline]
 percpu_down_read include/linux/percpu-rwsem.h:59 [inline]
 __sb_start_write+0x6e/0x2a0 fs/super.c:1366
 sb_start_write include/linux/fs.h:1579 [inline]
 mnt_want_write+0x3a/0xb0 fs/namespace.c:360
 ovl_maybe_copy_up+0x11f/0x190 fs/overlayfs/copy_up.c:888
 ovl_open+0xb4/0x260 fs/overlayfs/file.c:126
 do_dentry_open+0x4aa/0x1160 fs/open.c:796
 vfs_open fs/open.c:902 [inline]
 dentry_open+0x132/0x1d0 fs/open.c:918
 ima_calc_file_hash+0x628/0x8a0 security/integrity/ima/ima_crypto.c:435
 ima_collect_measurement+0x4c4/0x570 security/integrity/ima/ima_api.c:231
 process_measurement+0xddd/0x1440 security/integrity/ima/ima_main.c:284
 ima_file_check+0xb9/0x100 security/integrity/ima/ima_main.c:391
 do_last fs/namei.c:3425 [inline]
 path_openat+0x7e4/0x2df0 fs/namei.c:3537
 do_filp_open+0x18c/0x3f0 fs/namei.c:3567
 do_sys_open+0x3b3/0x520 fs/open.c:1085
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x43ef59
Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc9de5ecc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda

Crashes (242):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Title
ci2-linux-4-19	2021/09/08 13:57	linux-4.19.y	b172b44fcb17	e2776ee4	.config	log	report	syz	C		possible deadlock in mnt_want_write
ci2-linux-4-19	2021/09/08 13:27	linux-4.19.y	b172b44fcb17	e2776ee4	.config	log	report	syz	C		possible deadlock in mnt_want_write
ci2-linux-4-19	2021/07/23 12:57	linux-4.19.y	4938296e03bd	bc5f1d88	.config	log	report	syz	C		possible deadlock in mnt_want_write
ci2-linux-4-19	2021/07/13 09:44	linux-4.19.y	fcfbdfe9626e	f415556d	.config	log	report	syz	C		possible deadlock in mnt_want_write
ci2-linux-4-19	2021/07/02 03:05	linux-4.19.y	9f84340f012e	658ebc66	.config	log	report	syz	C		possible deadlock in mnt_want_write
ci2-linux-4-19	2021/06/09 05:59	linux-4.19.y	1722257b8ece	5c2fe346	.config	log	report	syz	C		possible deadlock in mnt_want_write
ci2-linux-4-19	2021/05/19 22:35	linux-4.19.y	3c8c23092588	a343ba6b	.config	log	report	syz	C		possible deadlock in mnt_want_write
ci2-linux-4-19	2021/05/13 01:33	linux-4.19.y	3c8c23092588	ed7d41c5	.config	log	report	syz	C		possible deadlock in mnt_want_write
ci2-linux-4-19	2020/12/21 01:35	linux-4.19.y	13d2ce42de8c	04201c06	.config	log	report	syz	C
ci2-linux-4-19	2020/12/21 00:47	linux-4.19.y	13d2ce42de8c	04201c06	.config	log	report	syz	C
ci2-linux-4-19	2020/06/28 06:55	linux-4.19.y	a39e75458e1c	a2cdad9d	.config	log	report	syz	C
ci2-linux-4-19	2020/08/29 18:30	linux-4.19.y	f6d5cb9e2c06	d5a3ae1f	.config	log	report	syz
ci2-linux-4-19	2020/03/01 13:45	linux-4.19.y	a083db76118d	c88c7b75	.config	log	report	syz
ci2-linux-4-19	2019/06/21 11:21	linux-4.19.y	9f31eb60d7a2	34bf9440	.config	log	report	syz
ci2-linux-4-19	2019/06/18 01:01	linux-4.19.y	6500aa436df4	442206d7	.config	log	report	syz
ci2-linux-4-19	2019/06/17 17:53	linux-4.19.y	7aa823a959e1	442206d7	.config	log	report	syz
ci2-linux-4-19	2019/06/16 13:07	linux-4.19.y	7aa823a959e1	442206d7	.config	log	report	syz
ci2-linux-4-19	2019/06/09 06:39	linux-4.19.y	e109a984cf38	0159583c	.config	log	report	syz
ci2-linux-4-19	2019/04/26 16:36	linux-4.19.y	c98875d930e9	b617407b	.config	log	report	syz
ci2-linux-4-19	2019/04/21 01:55	linux-4.19.y	c98875d930e9	b0e8efcb	.config	log	report	syz
ci2-linux-4-19	2019/04/20 22:19	linux-4.19.y	c98875d930e9	b0e8efcb	.config	log	report	syz
ci2-linux-4-19	2021/09/19 03:06	linux-4.19.y	b172b44fcb17	70b76c1d	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/09/17 20:11	linux-4.19.y	b172b44fcb17	70b76c1d	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/09/17 15:23	linux-4.19.y	b172b44fcb17	70b76c1d	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/09/17 09:52	linux-4.19.y	b172b44fcb17	5b989942	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/09/16 14:01	linux-4.19.y	b172b44fcb17	aae492f2	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/09/16 10:25	linux-4.19.y	b172b44fcb17	07e953c1	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/09/13 19:22	linux-4.19.y	b172b44fcb17	58d09404	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/09/13 18:18	linux-4.19.y	b172b44fcb17	58d09404	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/09/11 22:44	linux-4.19.y	b172b44fcb17	3ce60af8	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/09/09 13:20	linux-4.19.y	b172b44fcb17	e2776ee4	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/09/09 11:21	linux-4.19.y	b172b44fcb17	e2776ee4	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/09/08 05:11	linux-4.19.y	b172b44fcb17	064c9eb7	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/09/07 08:58	linux-4.19.y	b172b44fcb17	6ca60148	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/09/05 05:29	linux-4.19.y	b172b44fcb17	d236a457	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/09/02 18:53	linux-4.19.y	e23d55af0e1f	d0f0970b	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/09/01 19:30	linux-4.19.y	e23d55af0e1f	7eb7e152	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/08/31 17:30	linux-4.19.y	e23d55af0e1f	7eb7e152	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/08/14 07:57	linux-4.19.y	addba38e7c3b	2489ab88	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/08/10 20:31	linux-4.19.y	5c66974a6304	6972b106	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/07/24 09:13	linux-4.19.y	4938296e03bd	bc5f1d88	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/07/21 01:30	linux-4.19.y	4938296e03bd	1b201b48	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/07/20 17:24	linux-4.19.y	4938296e03bd	1b201b48	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/07/07 01:32	linux-4.19.y	9f84340f012e	cca78469	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/07/03 22:27	linux-4.19.y	9f84340f012e	55aa55c2	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/07/03 11:30	linux-4.19.y	9f84340f012e	55aa55c2	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/06/30 01:57	linux-4.19.y	eb575cd5d7f6	a4fccb01	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/06/25 10:25	linux-4.19.y	eb575cd5d7f6	0edbbe31	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/06/18 16:01	linux-4.19.y	eb575cd5d7f6	aba2b2fb	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/06/13 20:44	linux-4.19.y	9a2dc0e6c531	1ba81399	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/06/06 08:50	linux-4.19.y	1722257b8ece	500c2339	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/05/28 09:04	linux-4.19.y	6b7b0056defc	858ea628	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/05/21 21:23	linux-4.19.y	3c8c23092588	3c7fef33	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/05/21 19:18	linux-4.19.y	3c8c23092588	3c7fef33	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/05/18 06:35	linux-4.19.y	3c8c23092588	a343ba6b	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/05/17 11:25	linux-4.19.y	3c8c23092588	a2eb125d	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/05/17 10:16	linux-4.19.y	3c8c23092588	a2eb125d	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/05/16 03:48	linux-4.19.y	3c8c23092588	f54a5c09	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/05/15 17:33	linux-4.19.y	3c8c23092588	93f844de	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/05/10 04:46	linux-4.19.y	3c8c23092588	bc5434be	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/05/05 00:35	linux-4.19.y	97a8651cadce	06c27ff5	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/04/27 22:37	linux-4.19.y	2965db2e004c	805b5003	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/04/23 23:10	linux-4.19.y	2965db2e004c	17f0b706	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/04/17 23:37	linux-4.19.y	2965db2e004c	7e2b734b	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/01/16 13:52	linux-4.19.y	675cc038067f	65a7a854	.config	log	report			info
ci2-linux-4-19	2019/04/19 15:53	linux-4.19.y	4b0e041c9dad	b0e8efcb	.config	log	report