./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2962424239 <...> Warning: Permanently added '10.128.0.223' (ED25519) to the list of known hosts. execve("./syz-executor2962424239", ["./syz-executor2962424239"], 0x7ffc731da540 /* 10 vars */) = 0 brk(NULL) = 0x555555f71000 brk(0x555555f71d00) = 0x555555f71d00 arch_prctl(ARCH_SET_FS, 0x555555f71380) = 0 set_tid_address(0x555555f71650) = 5031 set_robust_list(0x555555f71660, 24) = 0 rseq(0x555555f71ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2962424239", 4096) = 28 getrandom("\x2b\xd6\x78\x24\xe0\x0b\xe9\x64", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555555f71d00 brk(0x555555f92d00) = 0x555555f92d00 brk(0x555555f93000) = 0x555555f93000 mprotect(0x7f329dd98000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, ".pending_reads", O_RDONLY|O_CREAT|O_NOCTTY|O_TRUNC|FASYNC, 000) = 3 openat(AT_FDCWD, ".pending_reads", O_RDONLY|O_CREAT|O_NOCTTY|O_TRUNC|FASYNC, 000) = 4 mkdir("./bus", 000) = 0 mkdir("./file1", 000) = 0 mount(NULL, "./bus", "overlay", 0, "upperdir=./bus,workdir=./file1,lowerdir=.") = 0 creat("./file0", 000) = 5 [ 72.625780][ T5031] [ 72.628159][ T5031] ====================================================== [ 72.635169][ T5031] WARNING: possible circular locking dependency detected [ 72.642174][ T5031] 6.6.0-rc2-syzkaller-00386-g3aba70aed91f #0 Not tainted [ 72.649186][ T5031] ------------------------------------------------------ [ 72.656194][ T5031] syz-executor296/5031 is trying to acquire lock: [ 72.662595][ T5031] ffff88807fcf6410 (sb_writers#4){.+.+}-{0:0}, at: mnt_want_write+0x3f/0x90 [ 72.671334][ T5031] [ 72.671334][ T5031] but task is already holding lock: [ 72.678693][ T5031] ffff8880293ed620 (&iint->mutex){+.+.}-{3:3}, at: process_measurement+0x7c9/0x1cf0 [ 72.688110][ T5031] [ 72.688110][ T5031] which lock already depends on the new lock. [ 72.688110][ T5031] [ 72.698535][ T5031] [ 72.698535][ T5031] the existing dependency chain (in reverse order) is: [ 72.707549][ T5031] [ 72.707549][ T5031] -> #1 (&iint->mutex){+.+.}-{3:3}: [ 72.714941][ T5031] __mutex_lock+0x136/0xd60 [ 72.719972][ T5031] process_measurement+0x7c9/0x1cf0 [ 72.725699][ T5031] ima_file_check+0xf1/0x170 [ 72.730817][ T5031] path_openat+0x2812/0x3180 [ 72.735932][ T5031] do_filp_open+0x234/0x490 [ 72.740960][ T5031] do_sys_openat2+0x13e/0x1d0 [ 72.746167][ T5031] __x64_sys_openat+0x247/0x290 [ 72.751547][ T5031] do_syscall_64+0x41/0xc0 [ 72.756507][ T5031] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 72.762926][ T5031] [ 72.762926][ T5031] -> #0 (sb_writers#4){.+.+}-{0:0}: [ 72.770330][ T5031] __lock_acquire+0x39ff/0x7f70 [ 72.775707][ T5031] lock_acquire+0x1e3/0x520 [ 72.780732][ T5031] sb_start_write+0x4d/0x1c0 [ 72.785842][ T5031] mnt_want_write+0x3f/0x90 [ 72.790868][ T5031] ovl_maybe_copy_up+0x115/0x180 [ 72.796326][ T5031] ovl_open+0x12b/0x310 [ 72.801013][ T5031] do_dentry_open+0x80f/0x1430 [ 72.806308][ T5031] dentry_open+0xcb/0x120 [ 72.811161][ T5031] ima_calc_file_hash+0x166/0x1d20 [ 72.816808][ T5031] ima_collect_measurement+0x4a5/0x890 [ 72.822792][ T5031] process_measurement+0xfea/0x1cf0 [ 72.828515][ T5031] ima_file_check+0xf1/0x170 [ 72.833643][ T5031] path_openat+0x2812/0x3180 [ 72.838758][ T5031] do_filp_open+0x234/0x490 [ 72.843788][ T5031] do_sys_openat2+0x13e/0x1d0 [ 72.848997][ T5031] __x64_sys_open+0x225/0x270 [ 72.854201][ T5031] do_syscall_64+0x41/0xc0 [ 72.859153][ T5031] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 72.865574][ T5031] [ 72.865574][ T5031] other info that might help us debug this: [ 72.865574][ T5031] [ 72.875798][ T5031] Possible unsafe locking scenario: [ 72.875798][ T5031] [ 72.883266][ T5031] CPU0 CPU1 [ 72.888628][ T5031] ---- ---- [ 72.893992][ T5031] lock(&iint->mutex); [ 72.898153][ T5031] lock(sb_writers#4); [ 72.904837][ T5031] lock(&iint->mutex); [ 72.911512][ T5031] rlock(sb_writers#4); [ 72.915784][ T5031] [ 72.915784][ T5031] *** DEADLOCK *** [ 72.915784][ T5031] [ 72.923923][ T5031] 1 lock held by syz-executor296/5031: [ 72.929385][ T5031] #0: ffff8880293ed620 (&iint->mutex){+.+.}-{3:3}, at: process_measurement+0x7c9/0x1cf0 [ 72.939228][ T5031] [ 72.939228][ T5031] stack backtrace: [ 72.945128][ T5031] CPU: 1 PID: 5031 Comm: syz-executor296 Not tainted 6.6.0-rc2-syzkaller-00386-g3aba70aed91f #0 [ 72.955532][ T5031] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 [ 72.965588][ T5031] Call Trace: [ 72.968871][ T5031] [ 72.971800][ T5031] dump_stack_lvl+0x1e7/0x2d0 [ 72.976496][ T5031] ? nf_tcp_handle_invalid+0x650/0x650 [ 72.981982][ T5031] ? print_circular_bug+0x12b/0x1a0 [ 72.987190][ T5031] check_noncircular+0x375/0x4a0 [ 72.992138][ T5031] ? print_irqtrace_events+0x220/0x220 [ 72.997607][ T5031] ? print_deadlock_bug+0x600/0x600 [ 73.002813][ T5031] ? lockdep_lock+0x123/0x2b0 [ 73.007494][ T5031] ? stack_trace_save+0x117/0x1c0 [ 73.012524][ T5031] ? mark_lock+0x9a/0x340 [ 73.016859][ T5031] ? _find_first_zero_bit+0xd4/0x100 [ 73.022157][ T5031] __lock_acquire+0x39ff/0x7f70 [ 73.027019][ T5031] ? ____kasan_slab_free+0xd6/0x120 [ 73.032226][ T5031] ? ima_calc_file_hash+0x166/0x1d20 [ 73.037534][ T5031] ? __x64_sys_open+0x225/0x270 [ 73.042394][ T5031] ? do_syscall_64+0x41/0xc0 [ 73.046993][ T5031] ? verify_lock_unused+0x140/0x140 [ 73.052199][ T5031] ? mark_lock+0x9a/0x340 [ 73.056540][ T5031] ? tomoyo_check_open_permission+0x204/0x500 [ 73.062614][ T5031] ? __lock_acquire+0x7f70/0x7f70 [ 73.067643][ T5031] ? lockdep_hardirqs_on+0x98/0x140 [ 73.072850][ T5031] lock_acquire+0x1e3/0x520 [ 73.077358][ T5031] ? mnt_want_write+0x3f/0x90 [ 73.082041][ T5031] ? read_lock_is_recursive+0x20/0x20 [ 73.087419][ T5031] ? __might_sleep+0xc0/0xc0 [ 73.092012][ T5031] ? ovl_path_next+0x370/0x370 [ 73.096777][ T5031] sb_start_write+0x4d/0x1c0 [ 73.101366][ T5031] ? mnt_want_write+0x3f/0x90 [ 73.106041][ T5031] mnt_want_write+0x3f/0x90 [ 73.110552][ T5031] ovl_maybe_copy_up+0x115/0x180 [ 73.115491][ T5031] ovl_open+0x12b/0x310 [ 73.119675][ T5031] ? ovl_mmap+0x4d0/0x4d0 [ 73.124032][ T5031] ? __mnt_want_write+0x68/0x2a0 [ 73.128976][ T5031] ? fsnotify_perm+0x420/0x5a0 [ 73.133749][ T5031] ? ovl_mmap+0x4d0/0x4d0 [ 73.138088][ T5031] do_dentry_open+0x80f/0x1430 [ 73.142866][ T5031] dentry_open+0xcb/0x120 [ 73.147204][ T5031] ima_calc_file_hash+0x166/0x1d20 [ 73.152322][ T5031] ? generic_fillattr+0x2bc/0x670 [ 73.157353][ T5031] ? __asan_memcpy+0x40/0x70 [ 73.161951][ T5031] ? generic_fillattr+0x44a/0x670 [ 73.166992][ T5031] ? ext4_getattr+0x51e/0x9b0 [ 73.171673][ T5031] ? __asan_memset+0x23/0x40 [ 73.176270][ T5031] ? ima_alloc_tfm+0x310/0x310 [ 73.181034][ T5031] ? revert_creds+0x1a8/0x270 [ 73.185717][ T5031] ? ovl_getattr+0x9d4/0xf70 [ 73.190313][ T5031] ? check_xattrs+0xa67/0xbc0 [ 73.194996][ T5031] ? ovl_setattr+0x4e0/0x4e0 [ 73.199601][ T5031] ? __up_read+0x2bd/0x690 [ 73.204062][ T5031] ? up_read+0x20/0x20 [ 73.208140][ T5031] ? ext4_xattr_get+0x3ce/0x840 [ 73.213004][ T5031] ? do_filp_open+0x234/0x490 [ 73.217694][ T5031] ? do_sys_openat2+0x13e/0x1d0 [ 73.222556][ T5031] ? __asan_memset+0x23/0x40 [ 73.227159][ T5031] ima_collect_measurement+0x4a5/0x890 [ 73.232634][ T5031] ? ima_get_action+0xb0/0xb0 [ 73.237316][ T5031] ? revert_creds+0x1a8/0x270 [ 73.242001][ T5031] ? ovl_xattr_set+0x4f0/0x4f0 [ 73.246784][ T5031] ? ima_get_cache_status+0x1e0/0x1e0 [ 73.252163][ T5031] process_measurement+0xfea/0x1cf0 [ 73.257375][ T5031] ? ima_file_mmap+0x2b0/0x2b0 [ 73.262152][ T5031] ? inode_to_bdi+0x69/0xe0 [ 73.266688][ T5031] ? ovl_open+0x20c/0x310 [ 73.271041][ T5031] ? do_raw_spin_unlock+0x13b/0x8b0 [ 73.276240][ T5031] ? smack_current_getsecid_subj+0x22/0xf0 [ 73.282046][ T5031] ima_file_check+0xf1/0x170 [ 73.286731][ T5031] ? do_dentry_open+0xf36/0x1430 [ 73.291689][ T5031] ? ima_bprm_check+0x2b0/0x2b0 [ 73.296563][ T5031] path_openat+0x2812/0x3180 [ 73.301176][ T5031] ? do_filp_open+0x490/0x490 [ 73.305867][ T5031] do_filp_open+0x234/0x490 [ 73.310370][ T5031] ? vfs_tmpfile+0x4b0/0x4b0 [ 73.314982][ T5031] ? _raw_spin_unlock+0x28/0x40 [ 73.319848][ T5031] ? alloc_fd+0x59c/0x640 [ 73.324283][ T5031] do_sys_openat2+0x13e/0x1d0 [ 73.328979][ T5031] ? do_sys_open+0x230/0x230 [ 73.333583][ T5031] ? lockdep_hardirqs_on+0x98/0x140 [ 73.338790][ T5031] ? _raw_spin_unlock_irq+0x2e/0x50 [ 73.344000][ T5031] ? ptrace_notify+0x278/0x380 [ 73.348773][ T5031] __x64_sys_open+0x225/0x270 [ 73.353480][ T5031] ? do_sys_openat2+0x1d0/0x1d0 [ 73.358353][ T5031] ? syscall_enter_from_user_mode+0x32/0x230 [ 73.364353][ T5031] ? syscall_enter_from_user_mode+0x8c/0x230 [ 73.370353][ T5031] do_syscall_64+0x41/0xc0 [ 73.374783][ T5031] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 73.380689][ T5031] RIP: 0033:0x7f329dd253e9 [ 73.385112][ T5031] Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 73.404725][ T5031] RSP: 002b:00007ffe4a747858 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 73.413147][ T5031] RAX: ffffffffffffffda RBX: 0073646165725f67 RCX: 00007f329dd253e9 [ 73.421124][ T5031] RDX: 0000000000000000 RSI: 0000000000101003 RDI: 0000000020000000 open("./bus/file0", O_ACCMODE|O_SYNC) = 6 exit_group(0) = ? +++ exited with 0 +++ [