[ 42.632043] audit: type=1800 audit(1549658034.576:30): pid=7911 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 47.642541] kauditd_printk_skb: 4 callbacks suppressed [ 47.642556] audit: type=1400 audit(1549658039.626:35): avc: denied { map } for pid=8082 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.0.13' (ECDSA) to the list of known hosts. executing program [ 54.394040] audit: type=1400 audit(1549658046.376:36): avc: denied { map } for pid=8094 comm="syz-executor394" path="/root/syz-executor394751126" dev="sda1" ino=16484 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 54.615328] audit: type=1400 audit(1549658046.596:37): avc: denied { associate } for pid=8094 comm="syz-executor394" name="file0" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1 [ 54.641926] overlayfs: filesystem on './file0' not supported as upperdir [ 54.643707] [ 54.650496] ====================================================== [ 54.656791] WARNING: possible circular locking dependency detected [ 54.663096] 5.0.0-rc5+ #63 Not tainted [ 54.666970] ------------------------------------------------------ [ 54.673266] syz-executor394/8099 is trying to acquire lock: [ 54.678952] 00000000273cdae5 (&ovl_i_mutex_key[depth]){+.+.}, at: ovl_write_iter+0x148/0xc20 [ 54.687521] [ 54.687521] but task is already holding lock: [ 54.693469] 000000006e02cbff (&pipe->mutex/1){+.+.}, at: pipe_lock+0x6e/0x80 [ 54.700649] [ 54.700649] which lock already depends on the new lock. [ 54.700649] [ 54.708945] [ 54.708945] the existing dependency chain (in reverse order) is: [ 54.716555] [ 54.716555] -> #2 (&pipe->mutex/1){+.+.}: [ 54.722182] __mutex_lock+0xf7/0x1310 [ 54.726702] mutex_lock_nested+0x16/0x20 [ 54.731269] pipe_lock+0x6e/0x80 [ 54.735138] iter_file_splice_write+0x18b/0xbe0 [ 54.740318] do_splice+0x644/0x1330 [ 54.744453] __x64_sys_splice+0x2c6/0x330 [ 54.749104] do_syscall_64+0x103/0x610 [ 54.753494] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 54.759178] [ 54.759178] -> #1 (sb_writers#4){.+.+}: [ 54.764617] __sb_start_write+0x20b/0x360 [ 54.769265] mnt_want_write+0x3f/0xc0 [ 54.773763] ovl_want_write+0x76/0xa0 [ 54.778062] ovl_setattr+0xdd/0x950 [ 54.782188] notify_change+0xad9/0xfb0 [ 54.786579] do_truncate+0x158/0x220 [ 54.790796] path_openat+0x2cc6/0x4690 [ 54.795183] do_filp_open+0x1a1/0x280 [ 54.799482] do_sys_open+0x3fe/0x5d0 [ 54.803700] __x64_sys_openat+0x9d/0x100 [ 54.808266] do_syscall_64+0x103/0x610 [ 54.812655] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 54.818342] [ 54.818342] -> #0 (&ovl_i_mutex_key[depth]){+.+.}: [ 54.824740] lock_acquire+0x16f/0x3f0 [ 54.829043] down_write+0x38/0x90 [ 54.832998] ovl_write_iter+0x148/0xc20 [ 54.837475] __vfs_write+0x613/0x8e0 [ 54.841689] __kernel_write+0x110/0x3b0 [ 54.846167] write_pipe_buf+0x15d/0x1f0 [ 54.850661] __splice_from_pipe+0x39a/0x7e0 [ 54.855484] splice_from_pipe+0x108/0x170 [ 54.860166] default_file_splice_write+0x3c/0x90 [ 54.865426] do_splice+0x644/0x1330 [ 54.869562] __x64_sys_splice+0x2c6/0x330 [ 54.874232] do_syscall_64+0x103/0x610 [ 54.878622] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 54.884306] [ 54.884306] other info that might help us debug this: [ 54.884306] [ 54.892421] Chain exists of: [ 54.892421] &ovl_i_mutex_key[depth] --> sb_writers#4 --> &pipe->mutex/1 [ 54.892421] [ 54.903934] Possible unsafe locking scenario: [ 54.903934] [ 54.910110] CPU0 CPU1 [ 54.914774] ---- ---- [ 54.919416] lock(&pipe->mutex/1); [ 54.923023] lock(sb_writers#4); [ 54.928971] lock(&pipe->mutex/1); [ 54.935114] lock(&ovl_i_mutex_key[depth]); [ 54.939502] [ 54.939502] *** DEADLOCK *** [ 54.939502] [ 54.945540] 2 locks held by syz-executor394/8099: [ 54.950357] #0: 00000000939615a5 (sb_writers#9){.+.+}, at: do_splice+0xceb/0x1330 [ 54.958058] #1: 000000006e02cbff (&pipe->mutex/1){+.+.}, at: pipe_lock+0x6e/0x80 [ 54.965670] [ 54.965670] stack backtrace: [ 54.970147] CPU: 0 PID: 8099 Comm: syz-executor394 Not tainted 5.0.0-rc5+ #63 [ 54.977397] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 54.986728] Call Trace: [ 54.989298] dump_stack+0x172/0x1f0 [ 54.992910] print_circular_bug.isra.0.cold+0x1cc/0x28f [ 54.998273] __lock_acquire+0x2f00/0x4700 [ 55.002409] ? noop_count+0x40/0x40 [ 55.006032] ? mark_held_locks+0x100/0x100 [ 55.010255] lock_acquire+0x16f/0x3f0 [ 55.014049] ? ovl_write_iter+0x148/0xc20 [ 55.018180] down_write+0x38/0x90 [ 55.021615] ? ovl_write_iter+0x148/0xc20 [ 55.025745] ovl_write_iter+0x148/0xc20 [ 55.029704] ? ovl_compat_ioctl+0x80/0x80 [ 55.033857] ? mark_held_locks+0x100/0x100 [ 55.038075] ? preempt_schedule_common+0x4f/0xe0 [ 55.042814] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 55.048332] ? iov_iter_init+0xea/0x220 [ 55.052291] __vfs_write+0x613/0x8e0 [ 55.055989] ? kernel_read+0x120/0x120 [ 55.059879] ? __lock_is_held+0xb6/0x140 [ 55.063922] ? lock_acquire+0x16f/0x3f0 [ 55.067878] __kernel_write+0x110/0x3b0 [ 55.071835] write_pipe_buf+0x15d/0x1f0 [ 55.075819] ? do_splice_direct+0x2a0/0x2a0 [ 55.080132] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 55.085651] ? splice_from_pipe_next.part.0+0x255/0x2f0 [ 55.090999] __splice_from_pipe+0x39a/0x7e0 [ 55.095314] ? do_splice_direct+0x2a0/0x2a0 [ 55.099632] ? do_splice_direct+0x2a0/0x2a0 [ 55.103936] splice_from_pipe+0x108/0x170 [ 55.108066] ? splice_shrink_spd+0xd0/0xd0 [ 55.112805] ? __lock_is_held+0xb6/0x140 [ 55.116874] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 55.122320] default_file_splice_write+0x3c/0x90 [ 55.127074] ? generic_splice_sendpage+0x50/0x50 [ 55.131826] do_splice+0x644/0x1330 [ 55.135440] ? iterate_fd+0x360/0x360 [ 55.139228] ? opipe_prep.part.0+0x2d0/0x2d0 [ 55.143623] ? __fget_light+0x1a9/0x230 [ 55.147586] __x64_sys_splice+0x2c6/0x330 [ 55.151721] do_syscall_64+0x103/0x610 [ 55.155593] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 55.160761] RIP: 0033:0x445919 [ 55.163933] Code: e8 6c b6 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b 12 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 55.182813] RSP: 002b:00007fe5eec7ada8 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 55.190504] RAX: ffffffffffffffda RBX: 00000000006dac88 RCX: 0000000000445919 [ 55.197756] RDX: 000000000000000b RSI: 0000000000000000 RDI: 0000000000000009 [ 55.205004] RBP: 00000000006dac80 R08: 000100000000ffe0 R09: 0000000000000000 [ 55.212272] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dac8c [ 55.219524] R13: 00007ffec36d916f R14: 00007fe5eec7b9c0 R15: 20c49ba5e353f7cf