./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2151652347 <...> Warning: Permanently added '10.128.1.67' (ECDSA) to the list of known hosts. execve("./syz-executor2151652347", ["./syz-executor2151652347"], 0x7ffd38a5c760 /* 10 vars */) = 0 brk(NULL) = 0x55555744f000 brk(0x55555744fc40) = 0x55555744fc40 arch_prctl(ARCH_SET_FS, 0x55555744f300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor2151652347", 4096) = 28 brk(0x555557470c40) = 0x555557470c40 brk(0x555557471000) = 0x555557471000 mprotect(0x7f847109d000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, "memory.events", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 openat(AT_FDCWD, "memory.events", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 mkdirat(AT_FDCWD, "./file0", 000) = 0 openat(AT_FDCWD, "./file0", O_RDONLY) = 5 mknodat(5, "./file0", 000) = 0 mkdirat(AT_FDCWD, "./file1", 000) = 0 mkdirat(AT_FDCWD, "./bus", 000) = 0 mount(NULL, "./bus", "overlay", 0, "workdir=./file1,lowerdir=./file0,upperdir=./bus,index=on") = 0 chdir("./bus") = 0 openat(AT_FDCWD, ".", O_RDONLY) = 6 syzkaller login: [ 58.230266][ T5024] [ 58.232603][ T5024] ====================================================== [ 58.239629][ T5024] WARNING: possible circular locking dependency detected [ 58.246637][ T5024] 6.5.0-rc1-next-20230710-syzkaller #0 Not tainted [ 58.253120][ T5024] ------------------------------------------------------ [ 58.260161][ T5024] syz-executor215/5024 is trying to acquire lock: [ 58.266557][ T5024] ffff88801abca410 (sb_writers#4){.+.+}-{0:0}, at: ovl_maybe_copy_up+0x123/0x190 [ 58.275705][ T5024] [ 58.275705][ T5024] but task is already holding lock: [ 58.283079][ T5024] ffff88802b38a740 (&iint->mutex){+.+.}-{3:3}, at: process_measurement+0x678/0x1940 [ 58.292464][ T5024] [ 58.292464][ T5024] which lock already depends on the new lock. [ 58.292464][ T5024] [ 58.302858][ T5024] [ 58.302858][ T5024] the existing dependency chain (in reverse order) is: [ 58.311855][ T5024] [ 58.311855][ T5024] -> #1 (&iint->mutex){+.+.}-{3:3}: [ 58.319221][ T5024] __mutex_lock+0x12f/0x1350 [ 58.324337][ T5024] process_measurement+0x678/0x1940 [ 58.330044][ T5024] ima_file_check+0xba/0x100 [ 58.335148][ T5024] path_openat+0x1588/0x2710 [ 58.340243][ T5024] do_filp_open+0x1ba/0x410 [ 58.345254][ T5024] do_sys_openat2+0x160/0x1c0 [ 58.350438][ T5024] __x64_sys_openat+0x143/0x1f0 [ 58.355794][ T5024] do_syscall_64+0x39/0xb0 [ 58.360715][ T5024] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 58.367114][ T5024] [ 58.367114][ T5024] -> #0 (sb_writers#4){.+.+}-{0:0}: [ 58.374491][ T5024] __lock_acquire+0x2e9d/0x5e20 [ 58.379867][ T5024] lock_acquire+0x1b1/0x520 [ 58.384882][ T5024] mnt_want_write+0x70/0x420 [ 58.389978][ T5024] ovl_maybe_copy_up+0x123/0x190 [ 58.395424][ T5024] ovl_open+0x15b/0x330 [ 58.400089][ T5024] do_dentry_open+0x6ce/0x17b0 [ 58.405366][ T5024] dentry_open+0x13f/0x1d0 [ 58.410303][ T5024] ima_calc_file_hash+0x2d0/0x4b0 [ 58.415835][ T5024] ima_collect_measurement+0x5a8/0x6b0 [ 58.421802][ T5024] process_measurement+0xd32/0x1940 [ 58.427506][ T5024] ima_file_check+0xba/0x100 [ 58.432600][ T5024] path_openat+0x1588/0x2710 [ 58.437693][ T5024] do_filp_open+0x1ba/0x410 [ 58.442700][ T5024] do_sys_openat2+0x160/0x1c0 [ 58.447887][ T5024] __x64_sys_openat+0x143/0x1f0 [ 58.453259][ T5024] do_syscall_64+0x39/0xb0 [ 58.458207][ T5024] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 58.464606][ T5024] [ 58.464606][ T5024] other info that might help us debug this: [ 58.464606][ T5024] [ 58.474812][ T5024] Possible unsafe locking scenario: [ 58.474812][ T5024] [ 58.482330][ T5024] CPU0 CPU1 [ 58.487671][ T5024] ---- ---- [ 58.493014][ T5024] lock(&iint->mutex); [ 58.497153][ T5024] lock(sb_writers#4); [ 58.503822][ T5024] lock(&iint->mutex); [ 58.510488][ T5024] rlock(sb_writers#4); [ 58.514717][ T5024] [ 58.514717][ T5024] *** DEADLOCK *** [ 58.514717][ T5024] [ 58.522907][ T5024] 1 lock held by syz-executor215/5024: [ 58.528348][ T5024] #0: ffff88802b38a740 (&iint->mutex){+.+.}-{3:3}, at: process_measurement+0x678/0x1940 [ 58.538181][ T5024] [ 58.538181][ T5024] stack backtrace: [ 58.544067][ T5024] CPU: 1 PID: 5024 Comm: syz-executor215 Not tainted 6.5.0-rc1-next-20230710-syzkaller #0 [ 58.553941][ T5024] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023 [ 58.563994][ T5024] Call Trace: [ 58.567260][ T5024] [ 58.570175][ T5024] dump_stack_lvl+0xd9/0x150 [ 58.574771][ T5024] check_noncircular+0x2df/0x3b0 [ 58.579703][ T5024] ? print_circular_bug+0x740/0x740 [ 58.584890][ T5024] ? lock_downgrade+0x690/0x690 [ 58.589738][ T5024] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 58.595537][ T5024] __lock_acquire+0x2e9d/0x5e20 [ 58.600381][ T5024] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 58.606359][ T5024] ? tomoyo_check_open_permission+0x1f9/0x3a0 [ 58.612419][ T5024] lock_acquire+0x1b1/0x520 [ 58.616918][ T5024] ? ovl_maybe_copy_up+0x123/0x190 [ 58.622033][ T5024] ? lock_sync+0x190/0x190 [ 58.626456][ T5024] mnt_want_write+0x70/0x420 [ 58.631031][ T5024] ? ovl_maybe_copy_up+0x123/0x190 [ 58.636127][ T5024] ovl_maybe_copy_up+0x123/0x190 [ 58.641047][ T5024] ovl_open+0x15b/0x330 [ 58.645198][ T5024] ? ovl_llseek+0x350/0x350 [ 58.649697][ T5024] ? fsnotify_perm.part.0+0x248/0x680 [ 58.655060][ T5024] do_dentry_open+0x6ce/0x17b0 [ 58.659809][ T5024] ? ovl_llseek+0x350/0x350 [ 58.664341][ T5024] dentry_open+0x13f/0x1d0 [ 58.668742][ T5024] ima_calc_file_hash+0x2d0/0x4b0 [ 58.673755][ T5024] ima_collect_measurement+0x5a8/0x6b0 [ 58.679202][ T5024] ? ima_get_action+0xa0/0xa0 [ 58.683866][ T5024] ? revert_creds+0x1cc/0x250 [ 58.688533][ T5024] ? ovl_other_xattr_set+0x50/0x50 [ 58.693631][ T5024] ? vfs_getxattr_alloc+0xea/0x330 [ 58.698735][ T5024] ? ima_get_cache_status+0x1e0/0x1e0 [ 58.704099][ T5024] process_measurement+0xd32/0x1940 [ 58.709286][ T5024] ? mmap_violation_check+0x200/0x200 [ 58.714653][ T5024] ? apparmor_path_chmod+0x30/0x30 [ 58.719750][ T5024] ? fsnotify_perm.part.0+0x248/0x680 [ 58.725109][ T5024] ? inode_to_bdi+0x9c/0x140 [ 58.729679][ T5024] ? do_dentry_open+0xdf3/0x17b0 [ 58.734603][ T5024] ? do_raw_spin_unlock+0x175/0x230 [ 58.739802][ T5024] ? revert_creds+0x1cc/0x250 [ 58.744488][ T5024] ? ovl_open_realfile+0x1a8/0x3a0 [ 58.749587][ T5024] ? ovl_open+0xe9/0x330 [ 58.753818][ T5024] ? apparmor_current_getsecid_subj+0x1fe/0x570 [ 58.760045][ T5024] ima_file_check+0xba/0x100 [ 58.764628][ T5024] ? process_measurement+0x1940/0x1940 [ 58.770079][ T5024] ? may_open+0x1f6/0x420 [ 58.774393][ T5024] path_openat+0x1588/0x2710 [ 58.778973][ T5024] ? path_lookupat+0x840/0x840 [ 58.783807][ T5024] do_filp_open+0x1ba/0x410 [ 58.788296][ T5024] ? may_open_dev+0xf0/0xf0 [ 58.792786][ T5024] ? find_held_lock+0x2d/0x110 [ 58.797549][ T5024] ? do_raw_spin_lock+0x124/0x2b0 [ 58.802564][ T5024] ? spin_bug+0x1c0/0x1c0 [ 58.806883][ T5024] ? _raw_spin_unlock+0x28/0x40 [ 58.811715][ T5024] ? alloc_fd+0x2e4/0x750 [ 58.816037][ T5024] do_sys_openat2+0x160/0x1c0 [ 58.820699][ T5024] ? build_open_flags+0x720/0x720 [ 58.825713][ T5024] ? ptrace_notify+0xfe/0x140 [ 58.830375][ T5024] ? lock_downgrade+0x690/0x690 [ 58.835241][ T5024] __x64_sys_openat+0x143/0x1f0 [ 58.840079][ T5024] ? __ia32_sys_open+0x1c0/0x1c0 [ 58.845002][ T5024] ? _raw_spin_unlock_irq+0x23/0x50 [ 58.850201][ T5024] ? lockdep_hardirqs_on+0x7d/0x100 [ 58.855389][ T5024] ? _raw_spin_unlock_irq+0x2e/0x50 [ 58.860657][ T5024] ? ptrace_notify+0xfe/0x140 [ 58.865319][ T5024] do_syscall_64+0x39/0xb0 [ 58.869723][ T5024] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 58.875605][ T5024] RIP: 0033:0x7f8471030d29 [ 58.880000][ T5024] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 58.899593][ T5024] RSP: 002b:00007ffd2a8d5538 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 58.907993][ T5024] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007f8471030d29 [ 58.915947][ T5024] RDX: 0000000000000003 RSI: 0000000020000340 RDI: 0000000000000006 [ 58.923908][ T5024] RBP: 00007f8470ff4ed0 R08: 0000000000000000 R09: 0000000000000000 openat(6, "./file0", O_ACCMODE) = 7 exit_group(0) = ? +++ exited with 0 +++ [ 58.931860][ T5