./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3878031088 <...> Warning: Permanently added '10.128.0.97' (ED25519) to the list of known hosts. execve("./syz-executor3878031088", ["./syz-executor3878031088"], 0x7ffecb2df440 /* 10 vars */) = 0 brk(NULL) = 0x55555579b000 brk(0x55555579bd00) = 0x55555579bd00 arch_prctl(ARCH_SET_FS, 0x55555579b380) = 0 set_tid_address(0x55555579b650) = 5015 set_robust_list(0x55555579b660, 24) = 0 rseq(0x55555579bca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3878031088", 4096) = 28 getrandom("\x2f\x7d\xa6\xd9\x3c\x46\xff\xb9", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55555579bd00 brk(0x5555557bcd00) = 0x5555557bcd00 brk(0x5555557bd000) = 0x5555557bd000 mprotect(0x7f871e941000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, "cpuset.effective_cpus", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 openat(AT_FDCWD, "cpuset.effective_cpus", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 mkdirat(AT_FDCWD, "./file0", 000) = 0 mkdirat(AT_FDCWD, "./file1", 000) = 0 openat(AT_FDCWD, "./file0", O_RDONLY) = 5 mknodat(5, "./file0", 000) = 0 mkdirat(AT_FDCWD, "./bus", 000) = 0 mount(NULL, "./bus", "overlay", 0, "workdir=./file1,lowerdir=./file0,upperdir=./bus,index=on") = 0 chdir("./bus") = 0 [ 55.467284][ T5015] [ 55.469659][ T5015] ====================================================== [ 55.476667][ T5015] WARNING: possible circular locking dependency detected [ 55.483666][ T5015] 6.5.0-rc4-syzkaller-00251-gf0ab9f34e59e #0 Not tainted [ 55.490677][ T5015] ------------------------------------------------------ [ 55.497684][ T5015] syz-executor387/5015 is trying to acquire lock: [ 55.504191][ T5015] ffff88802d410410 (sb_writers#4){.+.+}-{0:0}, at: mnt_want_write+0x3f/0x90 [ 55.512887][ T5015] [ 55.512887][ T5015] but task is already holding lock: [ 55.520246][ T5015] ffff88801ab54e00 (&iint->mutex){+.+.}-{3:3}, at: process_measurement+0x7c9/0x1cf0 [ 55.529626][ T5015] [ 55.529626][ T5015] which lock already depends on the new lock. [ 55.529626][ T5015] [ 55.540005][ T5015] [ 55.540005][ T5015] the existing dependency chain (in reverse order) is: [ 55.548995][ T5015] [ 55.548995][ T5015] -> #1 (&iint->mutex){+.+.}-{3:3}: [ 55.556359][ T5015] __mutex_lock_common+0x1d8/0x2530 [ 55.562065][ T5015] mutex_lock_nested+0x1b/0x20 [ 55.567333][ T5015] process_measurement+0x7c9/0x1cf0 [ 55.573136][ T5015] ima_file_check+0xf1/0x170 [ 55.578231][ T5015] path_openat+0x2812/0x3180 [ 55.583330][ T5015] do_filp_open+0x234/0x490 [ 55.588352][ T5015] do_sys_openat2+0x13e/0x1d0 [ 55.593533][ T5015] __x64_sys_openat+0x247/0x290 [ 55.598889][ T5015] do_syscall_64+0x41/0xc0 [ 55.603808][ T5015] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 55.610214][ T5015] [ 55.610214][ T5015] -> #0 (sb_writers#4){.+.+}-{0:0}: [ 55.617587][ T5015] __lock_acquire+0x39ff/0x7f70 [ 55.622979][ T5015] lock_acquire+0x1e3/0x520 [ 55.627990][ T5015] sb_start_write+0x4d/0x1c0 [ 55.633083][ T5015] mnt_want_write+0x3f/0x90 [ 55.638106][ T5015] ovl_maybe_copy_up+0x115/0x180 [ 55.643565][ T5015] ovl_open+0x12b/0x310 [ 55.648242][ T5015] do_dentry_open+0x829/0x1470 [ 55.653522][ T5015] dentry_open+0xcb/0x120 [ 55.658360][ T5015] ima_calc_file_hash+0x166/0x1d20 [ 55.663979][ T5015] ima_collect_measurement+0x4a5/0x890 [ 55.669953][ T5015] process_measurement+0xfea/0x1cf0 [ 55.675695][ T5015] ima_file_check+0xf1/0x170 [ 55.680789][ T5015] path_openat+0x2812/0x3180 [ 55.685882][ T5015] do_filp_open+0x234/0x490 [ 55.690889][ T5015] do_sys_openat2+0x13e/0x1d0 [ 55.696071][ T5015] __x64_sys_openat+0x247/0x290 [ 55.701432][ T5015] do_syscall_64+0x41/0xc0 [ 55.706355][ T5015] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 55.712758][ T5015] [ 55.712758][ T5015] other info that might help us debug this: [ 55.712758][ T5015] [ 55.722965][ T5015] Possible unsafe locking scenario: [ 55.722965][ T5015] [ 55.730400][ T5015] CPU0 CPU1 [ 55.735764][ T5015] ---- ---- [ 55.741112][ T5015] lock(&iint->mutex); [ 55.745256][ T5015] lock(sb_writers#4); [ 55.751917][ T5015] lock(&iint->mutex); [ 55.758574][ T5015] rlock(sb_writers#4); [ 55.762824][ T5015] [ 55.762824][ T5015] *** DEADLOCK *** [ 55.762824][ T5015] [ 55.770968][ T5015] 1 lock held by syz-executor387/5015: [ 55.776412][ T5015] #0: ffff88801ab54e00 (&iint->mutex){+.+.}-{3:3}, at: process_measurement+0x7c9/0x1cf0 [ 55.786231][ T5015] [ 55.786231][ T5015] stack backtrace: [ 55.792102][ T5015] CPU: 0 PID: 5015 Comm: syz-executor387 Not tainted 6.5.0-rc4-syzkaller-00251-gf0ab9f34e59e #0 [ 55.802496][ T5015] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023 [ 55.812621][ T5015] Call Trace: [ 55.815889][ T5015] [ 55.818816][ T5015] dump_stack_lvl+0x1e7/0x2d0 [ 55.823486][ T5015] ? nf_tcp_handle_invalid+0x650/0x650 [ 55.828969][ T5015] ? print_circular_bug+0x12b/0x1a0 [ 55.834164][ T5015] check_noncircular+0x375/0x4a0 [ 55.839262][ T5015] ? print_irqtrace_events+0x220/0x220 [ 55.844708][ T5015] ? print_deadlock_bug+0x600/0x600 [ 55.849898][ T5015] ? lockdep_lock+0x123/0x2b0 [ 55.855605][ T5015] ? stack_trace_save+0x117/0x1c0 [ 55.860619][ T5015] ? mark_lock+0x9a/0x340 [ 55.864935][ T5015] ? _find_first_zero_bit+0xd4/0x100 [ 55.870214][ T5015] __lock_acquire+0x39ff/0x7f70 [ 55.875053][ T5015] ? ____kasan_slab_free+0xd6/0x120 [ 55.880238][ T5015] ? ima_calc_file_hash+0x166/0x1d20 [ 55.885512][ T5015] ? __x64_sys_openat+0x247/0x290 [ 55.890525][ T5015] ? do_syscall_64+0x41/0xc0 [ 55.895363][ T5015] ? verify_lock_unused+0x140/0x140 [ 55.900550][ T5015] ? mark_lock+0x9a/0x340 [ 55.904882][ T5015] ? srcu_lock_release+0x5/0x30 [ 55.909721][ T5015] ? __lock_acquire+0x7f70/0x7f70 [ 55.914732][ T5015] ? lockdep_hardirqs_on+0x98/0x140 [ 55.920014][ T5015] lock_acquire+0x1e3/0x520 [ 55.924503][ T5015] ? mnt_want_write+0x3f/0x90 [ 55.929167][ T5015] ? read_lock_is_recursive+0x20/0x20 [ 55.934525][ T5015] ? smk_access+0x4b0/0x4b0 [ 55.939013][ T5015] ? __might_sleep+0xc0/0xc0 [ 55.943592][ T5015] ? smk_access+0x477/0x4b0 [ 55.948081][ T5015] ? __asan_memset+0x23/0x40 [ 55.952659][ T5015] ? ovl_maybe_lookup_lowerdata+0xcf/0x2f0 [ 55.958455][ T5015] sb_start_write+0x4d/0x1c0 [ 55.963033][ T5015] ? mnt_want_write+0x3f/0x90 [ 55.967693][ T5015] mnt_want_write+0x3f/0x90 [ 55.972273][ T5015] ovl_maybe_copy_up+0x115/0x180 [ 55.977198][ T5015] ovl_open+0x12b/0x310 [ 55.981341][ T5015] ? ovl_mmap+0x450/0x450 [ 55.985765][ T5015] ? fsnotify_perm+0x420/0x5a0 [ 55.990518][ T5015] ? ovl_mmap+0x450/0x450 [ 55.994834][ T5015] do_dentry_open+0x829/0x1470 [ 55.999590][ T5015] dentry_open+0xcb/0x120 [ 56.003952][ T5015] ima_calc_file_hash+0x166/0x1d20 [ 56.009053][ T5015] ? generic_fillattr+0x305/0x560 [ 56.014068][ T5015] ? __asan_memcpy+0x40/0x70 [ 56.018648][ T5015] ? generic_fillattr+0x33d/0x560 [ 56.023662][ T5015] ? ext4_getattr+0x4c3/0x8e0 [ 56.028420][ T5015] ? ima_alloc_tfm+0x310/0x310 [ 56.033256][ T5015] ? revert_creds+0x1a8/0x270 [ 56.037926][ T5015] ? ovl_getattr+0x9d4/0xf70 [ 56.042504][ T5015] ? check_xattrs+0xa67/0xbc0 [ 56.047177][ T5015] ? ovl_setattr+0x4e0/0x4e0 [ 56.051760][ T5015] ? __up_read+0x2bd/0x690 [ 56.056161][ T5015] ? up_read+0x20/0x20 [ 56.060240][ T5015] ? ext4_xattr_get+0x3ce/0x840 [ 56.065076][ T5015] ? __asan_memset+0x23/0x40 [ 56.069655][ T5015] ? vfs_getattr_nosec+0x377/0x460 [ 56.074758][ T5015] ima_collect_measurement+0x4a5/0x890 [ 56.080215][ T5015] ? ima_get_action+0xb0/0xb0 [ 56.084880][ T5015] ? revert_creds+0x1a8/0x270 [ 56.089547][ T5015] ? ovl_xattr_set+0x4f0/0x4f0 [ 56.094296][ T5015] ? ima_get_cache_status+0x1e0/0x1e0 [ 56.099659][ T5015] process_measurement+0xfea/0x1cf0 [ 56.104852][ T5015] ? ima_file_mmap+0x2b0/0x2b0 [ 56.109602][ T5015] ? inode_to_bdi+0x69/0xe0 [ 56.114189][ T5015] ? ovl_open+0x20c/0x310 [ 56.118504][ T5015] ? do_raw_spin_unlock+0x13b/0x8b0 [ 56.123692][ T5015] ? smack_current_getsecid_subj+0x22/0xf0 [ 56.129483][ T5015] ima_file_check+0xf1/0x170 [ 56.134059][ T5015] ? do_dentry_open+0xf50/0x1470 [ 56.138985][ T5015] ? ima_bprm_check+0x2b0/0x2b0 [ 56.143834][ T5015] path_openat+0x2812/0x3180 [ 56.148417][ T5015] ? do_filp_open+0x490/0x490 [ 56.153088][ T5015] do_filp_open+0x234/0x490 [ 56.157575][ T5015] ? vfs_tmpfile+0x4b0/0x4b0 [ 56.162159][ T5015] ? _raw_spin_unlock+0x28/0x40 [ 56.167000][ T5015] ? alloc_fd+0x59c/0x640 [ 56.171320][ T5015] do_sys_openat2+0x13e/0x1d0 [ 56.175988][ T5015] ? do_sys_open+0x230/0x230 [ 56.180736][ T5015] ? lockdep_hardirqs_on+0x98/0x140 [ 56.185922][ T5015] ? _raw_spin_unlock_irq+0x2e/0x50 [ 56.191111][ T5015] ? ptrace_notify+0x278/0x380 [ 56.197520][ T5015] __x64_sys_openat+0x247/0x290 [ 56.202405][ T5015] ? __ia32_sys_open+0x270/0x270 [ 56.207340][ T5015] ? syscall_enter_from_user_mode+0x32/0x230 [ 56.213309][ T5015] ? syscall_enter_from_user_mode+0x8c/0x230 [ 56.219280][ T5015] do_syscall_64+0x41/0xc0 [ 56.223684][ T5015] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 56.229569][ T5015] RIP: 0033:0x7f871e8ce469 [ 56.233973][ T5015] Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 56.253562][ T5015] RSP: 002b:00007fff1cd651c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 56.261967][ T5015] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007f871e8ce469 openat(AT_FDCWD, "./file0", O_ACCMODE|O_CREAT, 000) = 6 exit_group(0) = ? +++ exited with 0 +++ [ 56.269931