./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor92762022 <...> Warning: Permanently added '10.128.1.74' (ED25519) to the list of known hosts. execve("./syz-executor92762022", ["./syz-executor92762022"], 0x7ffe27703f20 /* 10 vars */) = 0 brk(NULL) = 0x555555b04000 brk(0x555555b04d00) = 0x555555b04d00 arch_prctl(ARCH_SET_FS, 0x555555b04380) = 0 set_tid_address(0x555555b04650) = 5034 set_robust_list(0x555555b04660, 24) = 0 rseq(0x555555b04ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor92762022", 4096) = 26 getrandom("\x46\xe0\x9f\x40\xaf\xa4\x1b\x79", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555555b04d00 brk(0x555555b25d00) = 0x555555b25d00 brk(0x555555b26000) = 0x555555b26000 mprotect(0x7fc662c47000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, "cpuset.effective_cpus", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 openat(AT_FDCWD, "cpuset.effective_cpus", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 mkdirat(AT_FDCWD, "./file0", 000) = 0 mkdirat(AT_FDCWD, "./file1", 000) = 0 openat(AT_FDCWD, "./file0", O_RDONLY) = 5 mknodat(5, "./file0", 000) = 0 mkdirat(AT_FDCWD, "./bus", 000) = 0 mount(NULL, "./bus", "overlay", 0, "workdir=./file1,lowerdir=./file0,upperdir=./bus,index=on") = 0 chdir("./bus") = 0 [ 54.283590][ T5034] [ 54.285926][ T5034] ====================================================== [ 54.293003][ T5034] WARNING: possible circular locking dependency detected [ 54.299992][ T5034] 6.6.0-rc6-syzkaller-00043-gdd72f9c7e512 #0 Not tainted [ 54.306981][ T5034] ------------------------------------------------------ [ 54.313988][ T5034] syz-executor927/5034 is trying to acquire lock: [ 54.320372][ T5034] ffff88802a5da410 (sb_writers#4){.+.+}-{0:0}, at: ovl_maybe_copy_up+0x121/0x180 [ 54.329499][ T5034] [ 54.329499][ T5034] but task is already holding lock: [ 54.336837][ T5034] ffff88801f1f2aa0 (&iint->mutex){+.+.}-{3:3}, at: process_measurement+0x893/0x1cc0 [ 54.346201][ T5034] [ 54.346201][ T5034] which lock already depends on the new lock. [ 54.346201][ T5034] [ 54.356586][ T5034] [ 54.356586][ T5034] the existing dependency chain (in reverse order) is: [ 54.365612][ T5034] [ 54.365612][ T5034] -> #1 (&iint->mutex){+.+.}-{3:3}: [ 54.372994][ T5034] __mutex_lock+0x181/0x1340 [ 54.378124][ T5034] process_measurement+0x893/0x1cc0 [ 54.383818][ T5034] ima_file_check+0xc2/0x110 [ 54.388906][ T5034] path_openat+0x17a1/0x29c0 [ 54.393995][ T5034] do_filp_open+0x1de/0x430 [ 54.398997][ T5034] do_sys_openat2+0x176/0x1e0 [ 54.404166][ T5034] __x64_sys_openat+0x175/0x210 [ 54.409517][ T5034] do_syscall_64+0x38/0xb0 [ 54.414434][ T5034] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 54.420936][ T5034] [ 54.420936][ T5034] -> #0 (sb_writers#4){.+.+}-{0:0}: [ 54.428295][ T5034] __lock_acquire+0x2e3d/0x5de0 [ 54.433651][ T5034] lock_acquire+0x1ae/0x510 [ 54.438676][ T5034] mnt_want_write+0x6f/0x440 [ 54.443768][ T5034] ovl_maybe_copy_up+0x121/0x180 [ 54.449208][ T5034] ovl_open+0x16f/0x330 [ 54.453863][ T5034] do_dentry_open+0x88b/0x1730 [ 54.459127][ T5034] dentry_open+0x13f/0x1d0 [ 54.464042][ T5034] ima_calc_file_hash+0x2c4/0x4a0 [ 54.469563][ T5034] ima_collect_measurement+0x5e2/0x6f0 [ 54.475518][ T5034] process_measurement+0xc87/0x1cc0 [ 54.481209][ T5034] ima_file_check+0xc2/0x110 [ 54.486295][ T5034] path_openat+0x17a1/0x29c0 [ 54.491388][ T5034] do_filp_open+0x1de/0x430 [ 54.496406][ T5034] do_sys_openat2+0x176/0x1e0 [ 54.501576][ T5034] __x64_sys_openat+0x175/0x210 [ 54.506937][ T5034] do_syscall_64+0x38/0xb0 [ 54.511849][ T5034] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 54.518241][ T5034] [ 54.518241][ T5034] other info that might help us debug this: [ 54.518241][ T5034] [ 54.528450][ T5034] Possible unsafe locking scenario: [ 54.528450][ T5034] [ 54.535880][ T5034] CPU0 CPU1 [ 54.541224][ T5034] ---- ---- [ 54.546562][ T5034] lock(&iint->mutex); [ 54.550718][ T5034] lock(sb_writers#4); [ 54.557398][ T5034] lock(&iint->mutex); [ 54.564051][ T5034] rlock(sb_writers#4); [ 54.568275][ T5034] [ 54.568275][ T5034] *** DEADLOCK *** [ 54.568275][ T5034] [ 54.576395][ T5034] 1 lock held by syz-executor927/5034: [ 54.581831][ T5034] #0: ffff88801f1f2aa0 (&iint->mutex){+.+.}-{3:3}, at: process_measurement+0x893/0x1cc0 [ 54.591641][ T5034] [ 54.591641][ T5034] stack backtrace: [ 54.597504][ T5034] CPU: 1 PID: 5034 Comm: syz-executor927 Not tainted 6.6.0-rc6-syzkaller-00043-gdd72f9c7e512 #0 [ 54.607985][ T5034] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 [ 54.618035][ T5034] Call Trace: [ 54.621296][ T5034] [ 54.624203][ T5034] dump_stack_lvl+0xd9/0x1b0 [ 54.628782][ T5034] check_noncircular+0x311/0x3f0 [ 54.633710][ T5034] ? print_circular_bug+0x750/0x750 [ 54.638894][ T5034] __lock_acquire+0x2e3d/0x5de0 [ 54.643730][ T5034] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 54.649694][ T5034] lock_acquire+0x1ae/0x510 [ 54.654184][ T5034] ? ovl_maybe_copy_up+0x121/0x180 [ 54.659281][ T5034] ? lock_sync+0x190/0x190 [ 54.663714][ T5034] ? preempt_count_sub+0x150/0x150 [ 54.668817][ T5034] ? ovl_path_next+0x3f0/0x3f0 [ 54.673595][ T5034] mnt_want_write+0x6f/0x440 [ 54.678170][ T5034] ? ovl_maybe_copy_up+0x121/0x180 [ 54.683260][ T5034] ovl_maybe_copy_up+0x121/0x180 [ 54.688181][ T5034] ovl_open+0x16f/0x330 [ 54.692312][ T5034] ? spin_bug+0x1d0/0x1d0 [ 54.696623][ T5034] ? ovl_llseek+0x380/0x380 [ 54.701103][ T5034] do_dentry_open+0x88b/0x1730 [ 54.705846][ T5034] ? ovl_llseek+0x380/0x380 [ 54.710348][ T5034] dentry_open+0x13f/0x1d0 [ 54.714745][ T5034] ima_calc_file_hash+0x2c4/0x4a0 [ 54.719754][ T5034] ima_collect_measurement+0x5e2/0x6f0 [ 54.725192][ T5034] ? ima_get_action+0xa0/0xa0 [ 54.729845][ T5034] ? revert_creds+0x1ce/0x250 [ 54.734511][ T5034] ? vfs_getxattr_alloc+0xf1/0x340 [ 54.739603][ T5034] ? ima_get_cache_status+0x1c0/0x1c0 [ 54.744956][ T5034] process_measurement+0xc87/0x1cc0 [ 54.750138][ T5034] ? mmap_violation_check+0x1f0/0x1f0 [ 54.755512][ T5034] ? __fsnotify_update_child_dentry_flags+0x360/0x360 [ 54.762258][ T5034] ? reacquire_held_locks+0x4b0/0x4b0 [ 54.767620][ T5034] ? ovl_open+0xfc/0x330 [ 54.771845][ T5034] ? spin_bug+0x1d0/0x1d0 [ 54.776176][ T5034] ? apparmor_current_getsecid_subj+0x208/0x5d0 [ 54.782400][ T5034] ima_file_check+0xc2/0x110 [ 54.786969][ T5034] ? process_measurement+0x1cc0/0x1cc0 [ 54.792408][ T5034] ? ovl_llseek+0x380/0x380 [ 54.796890][ T5034] ? may_open+0x1f2/0x400 [ 54.801284][ T5034] path_openat+0x17a1/0x29c0 [ 54.805852][ T5034] ? path_lookupat+0x770/0x770 [ 54.810597][ T5034] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 54.816559][ T5034] do_filp_open+0x1de/0x430 [ 54.821046][ T5034] ? may_open_dev+0xf0/0xf0 [ 54.825539][ T5034] ? _raw_spin_unlock+0x28/0x40 [ 54.830367][ T5034] ? alloc_fd+0x2da/0x6c0 [ 54.834677][ T5034] do_sys_openat2+0x176/0x1e0 [ 54.839332][ T5034] ? build_open_flags+0x690/0x690 [ 54.844333][ T5034] ? ptrace_notify+0xf4/0x130 [ 54.849017][ T5034] ? reacquire_held_locks+0x4b0/0x4b0 [ 54.854390][ T5034] __x64_sys_openat+0x175/0x210 [ 54.859222][ T5034] ? __ia32_sys_open+0x1e0/0x1e0 [ 54.864138][ T5034] ? lockdep_hardirqs_on+0x7d/0x100 [ 54.869321][ T5034] ? _raw_spin_unlock_irq+0x2e/0x50 [ 54.874501][ T5034] ? ptrace_notify+0xf4/0x130 [ 54.879157][ T5034] do_syscall_64+0x38/0xb0 [ 54.883556][ T5034] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 54.889439][ T5034] RIP: 0033:0x7fc662bd4469 [ 54.893838][ T5034] Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 54.913519][ T5034] RSP: 002b:00007ffdb7276358 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 54.921918][ T5034] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007fc662bd4469 openat(AT_FDCWD, "./file0", O_ACCMODE|O_CREAT, 000) = 6 exit_group(0) = ? +++ exited with 0 +++ [ 54.929880][ T5034] RDX: 0000000000000043 RSI: 00000000200000c0 RDI: 0000