./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3952488510 <...> Warning: Permanently added '10.128.1.73' (ED25519) to the list of known hosts. execve("./syz-executor3952488510", ["./syz-executor3952488510"], 0x7ffecd770520 /* 10 vars */) = 0 brk(NULL) = 0x555556994000 brk(0x555556994d00) = 0x555556994d00 arch_prctl(ARCH_SET_FS, 0x555556994380) = 0 set_tid_address(0x555556994650) = 5029 set_robust_list(0x555556994660, 24) = 0 rseq(0x555556994ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3952488510", 4096) = 28 getrandom("\x8d\xc2\xbc\x9d\x6b\x1c\xca\x73", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555556994d00 brk(0x5555569b5d00) = 0x5555569b5d00 brk(0x5555569b6000) = 0x5555569b6000 mprotect(0x7fc16ab5c000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, "cpuset.effective_cpus", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 openat(AT_FDCWD, "cpuset.effective_cpus", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 mkdirat(AT_FDCWD, "./file0", 000) = 0 mkdirat(AT_FDCWD, "./file1", 000) = 0 openat(AT_FDCWD, "./file0", O_RDONLY) = 5 mknodat(5, "./file0", 000) = 0 mkdirat(AT_FDCWD, "./bus", 000) = 0 mount(NULL, "./bus", "overlay", 0, "workdir=./file1,lowerdir=./file0,upperdir=./bus,index=on") = 0 chdir("./bus") = 0 [ 56.678984][ T5029] [ 56.681315][ T5029] ====================================================== [ 56.688305][ T5029] WARNING: possible circular locking dependency detected [ 56.695309][ T5029] 6.6.0-rc7-syzkaller-00195-g2af9b20dbb39 #0 Not tainted [ 56.702301][ T5029] ------------------------------------------------------ [ 56.709300][ T5029] syz-executor395/5029 is trying to acquire lock: [ 56.715689][ T5029] ffff88814c096410 (sb_writers#4){.+.+}-{0:0}, at: ovl_maybe_copy_up+0x121/0x180 [ 56.724822][ T5029] [ 56.724822][ T5029] but task is already holding lock: [ 56.732161][ T5029] ffff8880167833e0 (&iint->mutex){+.+.}-{3:3}, at: process_measurement+0x893/0x1cc0 [ 56.741528][ T5029] [ 56.741528][ T5029] which lock already depends on the new lock. [ 56.741528][ T5029] [ 56.751904][ T5029] [ 56.751904][ T5029] the existing dependency chain (in reverse order) is: [ 56.760890][ T5029] [ 56.760890][ T5029] -> #1 (&iint->mutex){+.+.}-{3:3}: [ 56.768242][ T5029] __mutex_lock+0x181/0x1340 [ 56.773339][ T5029] process_measurement+0x893/0x1cc0 [ 56.779033][ T5029] ima_file_check+0xc2/0x110 [ 56.784117][ T5029] path_openat+0x17a1/0x29c0 [ 56.789204][ T5029] do_filp_open+0x1de/0x430 [ 56.794205][ T5029] do_sys_openat2+0x176/0x1e0 [ 56.799376][ T5029] __x64_sys_openat+0x175/0x210 [ 56.804718][ T5029] do_syscall_64+0x38/0xb0 [ 56.809629][ T5029] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 56.816016][ T5029] [ 56.816016][ T5029] -> #0 (sb_writers#4){.+.+}-{0:0}: [ 56.823369][ T5029] __lock_acquire+0x2e3d/0x5de0 [ 56.828717][ T5029] lock_acquire+0x1ae/0x510 [ 56.833717][ T5029] mnt_want_write+0x6f/0x440 [ 56.838803][ T5029] ovl_maybe_copy_up+0x121/0x180 [ 56.844253][ T5029] ovl_open+0x16f/0x330 [ 56.848922][ T5029] do_dentry_open+0x88b/0x1730 [ 56.854189][ T5029] dentry_open+0x13f/0x1d0 [ 56.859104][ T5029] ima_calc_file_hash+0x2c4/0x4a0 [ 56.864623][ T5029] ima_collect_measurement+0x5e2/0x6f0 [ 56.870577][ T5029] process_measurement+0xc87/0x1cc0 [ 56.876269][ T5029] ima_file_check+0xc2/0x110 [ 56.881356][ T5029] path_openat+0x17a1/0x29c0 [ 56.886443][ T5029] do_filp_open+0x1de/0x430 [ 56.891445][ T5029] do_sys_openat2+0x176/0x1e0 [ 56.896615][ T5029] __x64_sys_openat+0x175/0x210 [ 56.901958][ T5029] do_syscall_64+0x38/0xb0 [ 56.906871][ T5029] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 56.913283][ T5029] [ 56.913283][ T5029] other info that might help us debug this: [ 56.913283][ T5029] [ 56.923482][ T5029] Possible unsafe locking scenario: [ 56.923482][ T5029] [ 56.930903][ T5029] CPU0 CPU1 [ 56.936238][ T5029] ---- ---- [ 56.941578][ T5029] lock(&iint->mutex); [ 56.945709][ T5029] lock(sb_writers#4); [ 56.952363][ T5029] lock(&iint->mutex); [ 56.959015][ T5029] rlock(sb_writers#4); [ 56.963235][ T5029] [ 56.963235][ T5029] *** DEADLOCK *** [ 56.963235][ T5029] [ 56.971524][ T5029] 1 lock held by syz-executor395/5029: [ 56.976950][ T5029] #0: ffff8880167833e0 (&iint->mutex){+.+.}-{3:3}, at: process_measurement+0x893/0x1cc0 [ 56.986747][ T5029] [ 56.986747][ T5029] stack backtrace: [ 56.992608][ T5029] CPU: 1 PID: 5029 Comm: syz-executor395 Not tainted 6.6.0-rc7-syzkaller-00195-g2af9b20dbb39 #0 [ 57.002989][ T5029] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 57.013030][ T5029] Call Trace: [ 57.016289][ T5029] [ 57.019202][ T5029] dump_stack_lvl+0xd9/0x1b0 [ 57.023770][ T5029] check_noncircular+0x311/0x3f0 [ 57.028687][ T5029] ? print_circular_bug+0x750/0x750 [ 57.033864][ T5029] __lock_acquire+0x2e3d/0x5de0 [ 57.038707][ T5029] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 57.044667][ T5029] lock_acquire+0x1ae/0x510 [ 57.049194][ T5029] ? ovl_maybe_copy_up+0x121/0x180 [ 57.054289][ T5029] ? lock_sync+0x190/0x190 [ 57.058684][ T5029] ? preempt_count_sub+0x150/0x150 [ 57.063773][ T5029] ? ovl_path_next+0x3f0/0x3f0 [ 57.068516][ T5029] mnt_want_write+0x6f/0x440 [ 57.073082][ T5029] ? ovl_maybe_copy_up+0x121/0x180 [ 57.078170][ T5029] ovl_maybe_copy_up+0x121/0x180 [ 57.083083][ T5029] ovl_open+0x16f/0x330 [ 57.087215][ T5029] ? spin_bug+0x1d0/0x1d0 [ 57.091519][ T5029] ? ovl_llseek+0x380/0x380 [ 57.095995][ T5029] do_dentry_open+0x88b/0x1730 [ 57.100738][ T5029] ? ovl_llseek+0x380/0x380 [ 57.105216][ T5029] dentry_open+0x13f/0x1d0 [ 57.109609][ T5029] ima_calc_file_hash+0x2c4/0x4a0 [ 57.114623][ T5029] ima_collect_measurement+0x5e2/0x6f0 [ 57.120072][ T5029] ? ima_get_action+0xa0/0xa0 [ 57.124721][ T5029] ? revert_creds+0x1ce/0x250 [ 57.129380][ T5029] ? vfs_getxattr_alloc+0xf1/0x340 [ 57.134477][ T5029] ? ima_get_cache_status+0x1c0/0x1c0 [ 57.139838][ T5029] process_measurement+0xc87/0x1cc0 [ 57.145013][ T5029] ? mmap_violation_check+0x1f0/0x1f0 [ 57.150370][ T5029] ? __fsnotify_update_child_dentry_flags+0x360/0x360 [ 57.157113][ T5029] ? reacquire_held_locks+0x4b0/0x4b0 [ 57.162490][ T5029] ? ovl_open+0xfc/0x330 [ 57.166705][ T5029] ? spin_bug+0x1d0/0x1d0 [ 57.171012][ T5029] ? apparmor_current_getsecid_subj+0x208/0x5d0 [ 57.177230][ T5029] ima_file_check+0xc2/0x110 [ 57.181793][ T5029] ? process_measurement+0x1cc0/0x1cc0 [ 57.187226][ T5029] ? ovl_llseek+0x380/0x380 [ 57.191702][ T5029] ? may_open+0x1f2/0x400 [ 57.196012][ T5029] path_openat+0x17a1/0x29c0 [ 57.200583][ T5029] ? path_lookupat+0x770/0x770 [ 57.205326][ T5029] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 57.211288][ T5029] do_filp_open+0x1de/0x430 [ 57.215783][ T5029] ? may_open_dev+0xf0/0xf0 [ 57.220268][ T5029] ? _raw_spin_unlock+0x28/0x40 [ 57.225105][ T5029] ? alloc_fd+0x2da/0x6c0 [ 57.229428][ T5029] do_sys_openat2+0x176/0x1e0 [ 57.234078][ T5029] ? build_open_flags+0x690/0x690 [ 57.239077][ T5029] ? ptrace_notify+0xf4/0x130 [ 57.243725][ T5029] ? reacquire_held_locks+0x4b0/0x4b0 [ 57.249082][ T5029] __x64_sys_openat+0x175/0x210 [ 57.253918][ T5029] ? __ia32_sys_open+0x1e0/0x1e0 [ 57.258828][ T5029] ? lockdep_hardirqs_on+0x7d/0x100 [ 57.263998][ T5029] ? _raw_spin_unlock_irq+0x2e/0x50 [ 57.269184][ T5029] ? ptrace_notify+0xf4/0x130 [ 57.273845][ T5029] do_syscall_64+0x38/0xb0 [ 57.278243][ T5029] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 57.284117][ T5029] RIP: 0033:0x7fc16aae9469 [ 57.288505][ T5029] Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 57.308089][ T5029] RSP: 002b:00007fff32799958 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 57.316473][ T5029] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007fc16aae9469 openat(AT_FDCWD, "./file0", O_ACCMODE|O_CREAT, 000) = 6 exit_group(0) = ? +++ exited with 0 +++ [ 57.324417][ T5029] RDX: 0000000000000043 RSI: 00000000200000c0 RDI: 00000000ffffff