[ 32.516802] audit: type=1800 audit(1549657889.573:28): pid=7204 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2417 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 33.407092] audit: type=1800 audit(1549657890.533:29): pid=7204 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 33.428727] audit: type=1800 audit(1549657890.543:30): pid=7204 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 [....] startpar: service(s) returned failure: rsyslog ...[?25l[?1c7[FAIL8[?25h[?0c failed! Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.228' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 43.392017] overlayfs: filesystem on './file0' not supported as upperdir [ 43.394337] [ 43.400653] ====================================================== [ 43.406967] WARNING: possible circular locking dependency detected [ 43.413274] 5.0.0-rc5+ #63 Not tainted [ 43.417194] ------------------------------------------------------ [ 43.423547] syz-executor470/7386 is trying to acquire lock: [ 43.429240] 000000000aacf440 (&ovl_i_mutex_key[depth]){+.+.}, at: ovl_write_iter+0x148/0xc20 [ 43.437849] [ 43.437849] but task is already holding lock: [ 43.443812] 00000000371871c6 (&pipe->mutex/1){+.+.}, at: pipe_lock+0x6e/0x80 [ 43.450999] [ 43.450999] which lock already depends on the new lock. [ 43.450999] [ 43.459295] [ 43.459295] the existing dependency chain (in reverse order) is: [ 43.466942] [ 43.466942] -> #2 (&pipe->mutex/1){+.+.}: [ 43.472575] __mutex_lock+0xf7/0x1310 [ 43.476891] mutex_lock_nested+0x16/0x20 [ 43.481457] pipe_lock+0x6e/0x80 [ 43.485342] iter_file_splice_write+0x18b/0xbe0 [ 43.490525] do_splice+0x644/0x1330 [ 43.494720] __x64_sys_splice+0x2c6/0x330 [ 43.499484] do_syscall_64+0x103/0x610 [ 43.503884] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 43.509574] [ 43.509574] -> #1 (sb_writers#3){.+.+}: [ 43.515025] __sb_start_write+0x20b/0x360 [ 43.519701] mnt_want_write+0x3f/0xc0 [ 43.524010] ovl_want_write+0x76/0xa0 [ 43.528361] ovl_setattr+0xdd/0x950 [ 43.532498] notify_change+0xad9/0xfb0 [ 43.536894] do_truncate+0x158/0x220 [ 43.541115] path_openat+0x2cc6/0x4690 [ 43.545508] do_filp_open+0x1a1/0x280 [ 43.549813] do_sys_open+0x3fe/0x5d0 [ 43.554029] __x64_sys_openat+0x9d/0x100 [ 43.558598] do_syscall_64+0x103/0x610 [ 43.562994] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 43.568693] [ 43.568693] -> #0 (&ovl_i_mutex_key[depth]){+.+.}: [ 43.575089] lock_acquire+0x16f/0x3f0 [ 43.579398] down_write+0x38/0x90 [ 43.583357] ovl_write_iter+0x148/0xc20 [ 43.587836] __vfs_write+0x613/0x8e0 [ 43.592057] __kernel_write+0x110/0x3b0 [ 43.596539] write_pipe_buf+0x15d/0x1f0 [ 43.601091] __splice_from_pipe+0x39a/0x7e0 [ 43.605923] splice_from_pipe+0x108/0x170 [ 43.610708] default_file_splice_write+0x3c/0x90 [ 43.615968] do_splice+0x644/0x1330 [ 43.620100] __x64_sys_splice+0x2c6/0x330 [ 43.624756] do_syscall_64+0x103/0x610 [ 43.629147] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 43.634841] [ 43.634841] other info that might help us debug this: [ 43.634841] [ 43.642959] Chain exists of: [ 43.642959] &ovl_i_mutex_key[depth] --> sb_writers#3 --> &pipe->mutex/1 [ 43.642959] [ 43.654214] Possible unsafe locking scenario: [ 43.654214] [ 43.660250] CPU0 CPU1 [ 43.664896] ---- ---- [ 43.669541] lock(&pipe->mutex/1); [ 43.673152] lock(sb_writers#3); [ 43.679105] lock(&pipe->mutex/1); [ 43.685230] lock(&ovl_i_mutex_key[depth]); [ 43.689680] [ 43.689680] *** DEADLOCK *** [ 43.689680] [ 43.695734] 2 locks held by syz-executor470/7386: [ 43.700553] #0: 000000006ad8cc31 (sb_writers#8){.+.+}, at: do_splice+0xceb/0x1330 [ 43.708260] #1: 00000000371871c6 (&pipe->mutex/1){+.+.}, at: pipe_lock+0x6e/0x80 [ 43.715929] [ 43.715929] stack backtrace: [ 43.720418] CPU: 0 PID: 7386 Comm: syz-executor470 Not tainted 5.0.0-rc5+ #63 [ 43.727674] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 43.737010] Call Trace: [ 43.739588] dump_stack+0x172/0x1f0 [ 43.743210] print_circular_bug.isra.0.cold+0x1cc/0x28f [ 43.748558] __lock_acquire+0x2f00/0x4700 [ 43.752790] ? noop_count+0x40/0x40 [ 43.756425] ? mark_held_locks+0x100/0x100 [ 43.760668] lock_acquire+0x16f/0x3f0 [ 43.764464] ? ovl_write_iter+0x148/0xc20 [ 43.768611] down_write+0x38/0x90 [ 43.772065] ? ovl_write_iter+0x148/0xc20 [ 43.776200] ovl_write_iter+0x148/0xc20 [ 43.780159] ? ovl_compat_ioctl+0x80/0x80 [ 43.784291] ? mark_held_locks+0x100/0x100 [ 43.788513] ? preempt_schedule_common+0x4f/0xe0 [ 43.793335] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 43.798865] ? iov_iter_init+0xea/0x220 [ 43.802824] __vfs_write+0x613/0x8e0 [ 43.806526] ? kernel_read+0x120/0x120 [ 43.810403] ? __lock_is_held+0xb6/0x140 [ 43.814444] ? lock_acquire+0x16f/0x3f0 [ 43.818449] __kernel_write+0x110/0x3b0 [ 43.822416] write_pipe_buf+0x15d/0x1f0 [ 43.826384] ? do_splice_direct+0x2a0/0x2a0 [ 43.830704] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 43.836282] ? splice_from_pipe_next.part.0+0x255/0x2f0 [ 43.841653] __splice_from_pipe+0x39a/0x7e0 [ 43.845961] ? do_splice_direct+0x2a0/0x2a0 [ 43.850277] ? do_splice_direct+0x2a0/0x2a0 [ 43.854661] splice_from_pipe+0x108/0x170 [ 43.858796] ? splice_shrink_spd+0xd0/0xd0 [ 43.863013] ? __lock_is_held+0xb6/0x140 [ 43.867056] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 43.872486] default_file_splice_write+0x3c/0x90 [ 43.877225] ? generic_splice_sendpage+0x50/0x50 [ 43.881964] do_splice+0x644/0x1330 [ 43.885571] ? iterate_fd+0x360/0x360 [ 43.889351] ? opipe_prep.part.0+0x2d0/0x2d0 [ 43.893743] ? __fget_light+0x1a9/0x230 [ 43.897697] __x64_sys_splice+0x2c6/0x330 [ 43.901847] do_syscall_64+0x103/0x610 [ 43.905733] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 43.910903] RIP: 0033:0x445919 [ 43.914082] Code: e8 6c b6 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b 12 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 43.932966] RSP: 002b:00007f72c7eb5da8 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 43.940663] RAX: ffffffffffffffda RBX: 00000000006dac88 RCX: 0000000000445919 [ 43.947917] RDX: 000000000000000b RSI: 0000000000000000 RDI: 0000000000000009 [ 43.955167] RBP: 00000000006dac80 R08: 000100000000ffe0 R09: 0000000000000000 [ 43.962421] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dac8c [ 43.969671] R13: 00007fff92742c9f R14: 00007f72c7eb69c0 R15: 20c49ba5e353f7cf