possible deadlock in mnt_want

possible deadlock in mnt_want_write
Status: upstream: reported C repro on 2019/04/19 16:54
Reported-by: syzbot+68b10d4d99f77e1dba4f@syzkaller.appspotmail.com
First crash: 1015d, last: 13h53m

similar bugs (4):
Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	possible deadlock in mnt_want_write	C	done	done	662	478d	1285d	17/22	fixed on 2020/11/16 12:12
android-49	possible deadlock in mnt_want_write				1	1268d	1268d	0/3	auto-closed as invalid on 2019/02/22 14:57
upstream	possible deadlock in mnt_want_write (2)				20	14d	227d	0/22	upstream: reported on 2021/06/15 16:59
linux-4.14	possible deadlock in mnt_want_write	C			5712	20m	1010d	0/1	upstream: reported C repro on 2019/04/25 05:09

Sample crash report:

======================================================
WARNING: possible circular locking dependency detected
4.19.206-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor678/8093 is trying to acquire lock:
000000006df09afe (sb_writers#3){.+.+}, at: sb_start_write include/linux/fs.h:1579 [inline]
000000006df09afe (sb_writers#3){.+.+}, at: mnt_want_write+0x3a/0xb0 fs/namespace.c:360

but task is already holding lock:
00000000d5b3aa6b (&iint->mutex){+.+.}, at: process_measurement+0x316/0x1440 security/integrity/ima/ima_main.c:224

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (&iint->mutex){+.+.}:
       process_measurement+0x316/0x1440 security/integrity/ima/ima_main.c:224
       ima_file_check+0xb9/0x100 security/integrity/ima/ima_main.c:391
       do_last fs/namei.c:3425 [inline]
       path_openat+0x7e4/0x2df0 fs/namei.c:3537
       do_filp_open+0x18c/0x3f0 fs/namei.c:3567
       do_sys_open+0x3b3/0x520 fs/open.c:1085
       do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
       entry_SYSCALL_64_after_hwframe+0x49/0xbe

-> #0 (sb_writers#3){.+.+}:
       percpu_down_read_preempt_disable include/linux/percpu-rwsem.h:36 [inline]
       percpu_down_read include/linux/percpu-rwsem.h:59 [inline]
       __sb_start_write+0x6e/0x2a0 fs/super.c:1366
       sb_start_write include/linux/fs.h:1579 [inline]
       mnt_want_write+0x3a/0xb0 fs/namespace.c:360
       ovl_maybe_copy_up+0x11f/0x190 fs/overlayfs/copy_up.c:888
       ovl_open+0xb4/0x260 fs/overlayfs/file.c:126
       do_dentry_open+0x4aa/0x1160 fs/open.c:796
       vfs_open fs/open.c:902 [inline]
       dentry_open+0x132/0x1d0 fs/open.c:918
       ima_calc_file_hash+0x628/0x8a0 security/integrity/ima/ima_crypto.c:435
       ima_collect_measurement+0x4c4/0x570 security/integrity/ima/ima_api.c:231
       process_measurement+0xddd/0x1440 security/integrity/ima/ima_main.c:284
       ima_file_check+0xb9/0x100 security/integrity/ima/ima_main.c:391
       do_last fs/namei.c:3425 [inline]
       path_openat+0x7e4/0x2df0 fs/namei.c:3537
       do_filp_open+0x18c/0x3f0 fs/namei.c:3567
       do_sys_open+0x3b3/0x520 fs/open.c:1085
       do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
       entry_SYSCALL_64_after_hwframe+0x49/0xbe

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&iint->mutex);
                               lock(sb_writers#3);
                               lock(&iint->mutex);
  lock(sb_writers#3);

 *** DEADLOCK ***

1 lock held by syz-executor678/8093:
 #0: 00000000d5b3aa6b (&iint->mutex){+.+.}, at: process_measurement+0x316/0x1440 security/integrity/ima/ima_main.c:224

stack backtrace:
CPU: 1 PID: 8093 Comm: syz-executor678 Not tainted 4.19.206-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 print_circular_bug.constprop.0.cold+0x2d7/0x41e kernel/locking/lockdep.c:1222
 check_prev_add kernel/locking/lockdep.c:1866 [inline]
 check_prevs_add kernel/locking/lockdep.c:1979 [inline]
 validate_chain kernel/locking/lockdep.c:2420 [inline]
 __lock_acquire+0x30c9/0x3ff0 kernel/locking/lockdep.c:3416
 lock_acquire+0x170/0x3c0 kernel/locking/lockdep.c:3908
 percpu_down_read_preempt_disable include/linux/percpu-rwsem.h:36 [inline]
 percpu_down_read include/linux/percpu-rwsem.h:59 [inline]
 __sb_start_write+0x6e/0x2a0 fs/super.c:1366
 sb_start_write include/linux/fs.h:1579 [inline]
 mnt_want_write+0x3a/0xb0 fs/namespace.c:360
 ovl_maybe_copy_up+0x11f/0x190 fs/overlayfs/copy_up.c:888
 ovl_open+0xb4/0x260 fs/overlayfs/file.c:126
 do_dentry_open+0x4aa/0x1160 fs/open.c:796
 vfs_open fs/open.c:902 [inline]
 dentry_open+0x132/0x1d0 fs/open.c:918
 ima_calc_file_hash+0x628/0x8a0 security/integrity/ima/ima_crypto.c:435
 ima_collect_measurement+0x4c4/0x570 security/integrity/ima/ima_api.c:231
 process_measurement+0xddd/0x1440 security/integrity/ima/ima_main.c:284
 ima_file_check+0xb9/0x100 security/integrity/ima/ima_main.c:391
 do_last fs/namei.c:3425 [inline]
 path_openat+0x7e4/0x2df0 fs/namei.c:3537
 do_filp_open+0x18c/0x3f0 fs/namei.c:3567
 do_sys_open+0x3b3/0x520 fs/open.c:1085
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x43ef59
Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc9de5ecc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda

Crashes (313):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Title
ci2-linux-4-19	2021/09/08 13:57	linux-4.19.y	b172b44fcb17	e2776ee4	.config	log	report	syz	C		possible deadlock in mnt_want_write
ci2-linux-4-19	2021/09/08 13:27	linux-4.19.y	b172b44fcb17	e2776ee4	.config	log	report	syz	C		possible deadlock in mnt_want_write
ci2-linux-4-19	2021/07/23 12:57	linux-4.19.y	4938296e03bd	bc5f1d88	.config	log	report	syz	C		possible deadlock in mnt_want_write
ci2-linux-4-19	2021/07/13 09:44	linux-4.19.y	fcfbdfe9626e	f415556d	.config	log	report	syz	C		possible deadlock in mnt_want_write
ci2-linux-4-19	2021/07/02 03:05	linux-4.19.y	9f84340f012e	658ebc66	.config	log	report	syz	C		possible deadlock in mnt_want_write
ci2-linux-4-19	2021/06/09 05:59	linux-4.19.y	1722257b8ece	5c2fe346	.config	log	report	syz	C		possible deadlock in mnt_want_write
ci2-linux-4-19	2021/05/19 22:35	linux-4.19.y	3c8c23092588	a343ba6b	.config	log	report	syz	C		possible deadlock in mnt_want_write
ci2-linux-4-19	2021/05/13 01:33	linux-4.19.y	3c8c23092588	ed7d41c5	.config	log	report	syz	C		possible deadlock in mnt_want_write
ci2-linux-4-19	2020/12/21 01:35	linux-4.19.y	13d2ce42de8c	04201c06	.config	log	report	syz	C
ci2-linux-4-19	2020/12/21 00:47	linux-4.19.y	13d2ce42de8c	04201c06	.config	log	report	syz	C
ci2-linux-4-19	2020/06/28 06:55	linux-4.19.y	a39e75458e1c	a2cdad9d	.config	log	report	syz	C
ci2-linux-4-19	2020/08/29 18:30	linux-4.19.y	f6d5cb9e2c06	d5a3ae1f	.config	log	report	syz
ci2-linux-4-19	2020/03/01 13:45	linux-4.19.y	a083db76118d	c88c7b75	.config	log	report	syz
ci2-linux-4-19	2019/06/21 11:21	linux-4.19.y	9f31eb60d7a2	34bf9440	.config	log	report	syz
ci2-linux-4-19	2019/06/18 01:01	linux-4.19.y	6500aa436df4	442206d7	.config	log	report	syz
ci2-linux-4-19	2019/06/17 17:53	linux-4.19.y	7aa823a959e1	442206d7	.config	log	report	syz
ci2-linux-4-19	2019/06/16 13:07	linux-4.19.y	7aa823a959e1	442206d7	.config	log	report	syz
ci2-linux-4-19	2019/06/09 06:39	linux-4.19.y	e109a984cf38	0159583c	.config	log	report	syz
ci2-linux-4-19	2019/04/26 16:36	linux-4.19.y	c98875d930e9	b617407b	.config	log	report	syz
ci2-linux-4-19	2019/04/21 01:55	linux-4.19.y	c98875d930e9	b0e8efcb	.config	log	report	syz
ci2-linux-4-19	2019/04/20 22:19	linux-4.19.y	c98875d930e9	b0e8efcb	.config	log	report	syz
ci2-linux-4-19	2022/01/28 23:06	linux-4.19.y	3f8a27f9e27b	495e00c5	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2022/01/28 15:08	linux-4.19.y	3f8a27f9e27b	495e00c5	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2022/01/27 21:04	linux-4.19.y	3f8a27f9e27b	64a8e201	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2022/01/27 15:45	linux-4.19.y	3f8a27f9e27b	2cbffd88	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2022/01/26 04:28	linux-4.19.y	3f8a27f9e27b	2cbffd88	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2022/01/25 15:24	linux-4.19.y	3f8a27f9e27b	2cbffd88	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2022/01/24 13:57	linux-4.19.y	3f8a27f9e27b	214351e1	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2022/01/23 11:09	linux-4.19.y	3f8a27f9e27b	214351e1	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2022/01/23 00:31	linux-4.19.y	3f8a27f9e27b	214351e1	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2022/01/22 20:46	linux-4.19.y	3f8a27f9e27b	214351e1	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2022/01/22 19:16	linux-4.19.y	3f8a27f9e27b	214351e1	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2022/01/20 14:27	linux-4.19.y	3f8a27f9e27b	5da9499f	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2022/01/19 18:01	linux-4.19.y	3f8a27f9e27b	0620189b	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2022/01/19 06:39	linux-4.19.y	3f8a27f9e27b	731a2d23	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2022/01/17 14:16	linux-4.19.y	3f8a27f9e27b	731a2d23	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2022/01/17 04:09	linux-4.19.y	3f8a27f9e27b	723cfaf0	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2022/01/16 04:33	linux-4.19.y	3f8a27f9e27b	723cfaf0	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2022/01/14 13:00	linux-4.19.y	3f8a27f9e27b	b8d780ab	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2022/01/14 09:49	linux-4.19.y	3f8a27f9e27b	b8d780ab	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2022/01/14 04:58	linux-4.19.y	3f8a27f9e27b	b8d780ab	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2022/01/10 17:48	linux-4.19.y	3f8a27f9e27b	ddb0ab8c	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2022/01/10 10:38	linux-4.19.y	3f8a27f9e27b	2ca0d385	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2022/01/09 10:20	linux-4.19.y	3f8a27f9e27b	2ca0d385	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2022/01/09 00:54	linux-4.19.y	3f8a27f9e27b	2ca0d385	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2022/01/08 17:50	linux-4.19.y	3f8a27f9e27b	2ca0d385	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2022/01/05 21:49	linux-4.19.y	3f8a27f9e27b	6acc789a	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2022/01/04 14:16	linux-4.19.y	3f8a27f9e27b	7f723fbe	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/12/30 19:28	linux-4.19.y	3f8a27f9e27b	2e49f10d	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/12/27 07:43	linux-4.19.y	3f8a27f9e27b	e4f103c4	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/12/15 09:39	linux-4.19.y	3f8a27f9e27b	f752fb53	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/12/14 06:36	linux-4.19.y	3f8a27f9e27b	5d14b1ea	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/12/12 07:56	linux-4.19.y	3f8a27f9e27b	49ca1f59	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/12/10 08:00	linux-4.19.y	3f8a27f9e27b	4d4ce9bc	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/12/08 00:41	linux-4.19.y	3f8a27f9e27b	0230ba3e	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/12/06 07:10	linux-4.19.y	3f8a27f9e27b	a617004c	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/12/03 23:26	linux-4.19.y	3f8a27f9e27b	c7c20675	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/12/02 05:01	linux-4.19.y	3f8a27f9e27b	61f86278	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/11/29 11:36	linux-4.19.y	3f8a27f9e27b	63eeac02	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/11/24 10:35	linux-4.19.y	3f8a27f9e27b	545ab074	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/11/19 09:00	linux-4.19.y	3f8a27f9e27b	31a30fc0	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/11/18 21:31	linux-4.19.y	3f8a27f9e27b	31a30fc0	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/11/18 05:29	linux-4.19.y	3f8a27f9e27b	cafff8b6	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/11/14 04:06	linux-4.19.y	3f8a27f9e27b	75b04091	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/11/13 01:11	linux-4.19.y	3f8a27f9e27b	75b04091	.config	log	report			info	possible deadlock in mnt_want_write
ci2-linux-4-19	2021/01/16 13:52	linux-4.19.y	675cc038067f	65a7a854	.config	log	report			info
ci2-linux-4-19	2019/04/19 15:53	linux-4.19.y	4b0e041c9dad	b0e8efcb	.config	log	report