[ OK ] Started OpenBSD Secure Shell server. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.93' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 34.232251] audit: type=1400 audit(1599897375.746:8): avc: denied { execmem } for pid=6353 comm="syz-executor275" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 34.257873] [ 34.259541] ====================================================== [ 34.266003] WARNING: possible circular locking dependency detected [ 34.272395] 4.14.197-syzkaller #0 Not tainted [ 34.276896] ------------------------------------------------------ [ 34.283260] syz-executor275/6354 is trying to acquire lock: [ 34.288979] (event_mutex){+.+.}, at: [] perf_trace_destroy+0x23/0xf0 [ 34.297161] [ 34.297161] but task is already holding lock: [ 34.303143] (&event->child_mutex){+.+.}, at: [] perf_event_release_kernel+0x208/0x8a0 [ 34.312762] [ 34.312762] which lock already depends on the new lock. [ 34.312762] [ 34.321070] [ 34.321070] the existing dependency chain (in reverse order) is: [ 34.328682] [ 34.328682] -> #5 (&event->child_mutex){+.+.}: [ 34.334747] __mutex_lock+0xc4/0x1310 [ 34.339073] perf_event_for_each_child+0x82/0x140 [ 34.344430] _perf_ioctl+0x3e9/0x1a80 [ 34.348766] perf_ioctl+0x55/0x80 [ 34.352768] do_vfs_ioctl+0x75a/0xff0 [ 34.357093] SyS_ioctl+0x7f/0xb0 [ 34.360984] do_syscall_64+0x1d5/0x640 [ 34.365392] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 34.371109] [ 34.371109] -> #4 (&cpuctx_mutex){+.+.}: [ 34.376660] __mutex_lock+0xc4/0x1310 [ 34.380979] perf_event_init_cpu+0xb7/0x170 [ 34.385839] perf_event_init+0x2cc/0x308 [ 34.390563] start_kernel+0x46a/0x770 [ 34.394892] secondary_startup_64+0xa5/0xb0 [ 34.399724] [ 34.399724] -> #3 (pmus_lock){+.+.}: [ 34.404922] __mutex_lock+0xc4/0x1310 [ 34.409244] perf_event_init_cpu+0x2c/0x170 [ 34.414107] cpuhp_invoke_callback+0x1e6/0x1a80 [ 34.419292] _cpu_up+0x219/0x500 [ 34.423170] do_cpu_up+0x9a/0x160 [ 34.427142] smp_init+0x197/0x1ac [ 34.431106] kernel_init_freeable+0x3f4/0x619 [ 34.436132] kernel_init+0xd/0x15b [ 34.440186] ret_from_fork+0x24/0x30 [ 34.444395] [ 34.444395] -> #2 (cpu_hotplug_lock.rw_sem){++++}: [ 34.450812] cpus_read_lock+0x39/0xc0 [ 34.455132] static_key_slow_inc+0xe/0x20 [ 34.459777] tracepoint_add_func+0x517/0x750 [ 34.464783] tracepoint_probe_register+0x8c/0xc0 [ 34.470051] trace_event_reg+0x272/0x330 [ 34.474606] perf_trace_init+0x424/0xa30 [ 34.479161] perf_tp_event_init+0x79/0xf0 [ 34.483807] perf_try_init_event+0x15b/0x1f0 [ 34.488716] perf_event_alloc.part.0+0xe2d/0x2640 [ 34.494074] SyS_perf_event_open+0x67f/0x24b0 [ 34.499082] do_syscall_64+0x1d5/0x640 [ 34.503477] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 34.509162] [ 34.509162] -> #1 (tracepoints_mutex){+.+.}: [ 34.515055] __mutex_lock+0xc4/0x1310 [ 34.519369] tracepoint_probe_register+0x68/0xc0 [ 34.524629] trace_event_reg+0x272/0x330 [ 34.529188] perf_trace_init+0x424/0xa30 [ 34.533743] perf_tp_event_init+0x79/0xf0 [ 34.538416] perf_try_init_event+0x15b/0x1f0 [ 34.544019] perf_event_alloc.part.0+0xe2d/0x2640 [ 34.549359] SyS_perf_event_open+0x67f/0x24b0 [ 34.554350] do_syscall_64+0x1d5/0x640 [ 34.558732] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 34.564414] [ 34.564414] -> #0 (event_mutex){+.+.}: [ 34.569761] lock_acquire+0x170/0x3f0 [ 34.574069] __mutex_lock+0xc4/0x1310 [ 34.578377] perf_trace_destroy+0x23/0xf0 [ 34.583043] _free_event+0x321/0xe20 [ 34.587266] free_event+0x32/0x40 [ 34.591229] perf_event_release_kernel+0x368/0x8a0 [ 34.596649] perf_release+0x33/0x40 [ 34.600771] __fput+0x25f/0x7a0 [ 34.604545] task_work_run+0x11f/0x190 [ 34.608931] do_exit+0xa08/0x27f0 [ 34.612885] do_group_exit+0x100/0x2e0 [ 34.617275] SyS_exit_group+0x19/0x20 [ 34.621574] do_syscall_64+0x1d5/0x640 [ 34.625955] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 34.631635] [ 34.631635] other info that might help us debug this: [ 34.631635] [ 34.639764] Chain exists of: [ 34.639764] event_mutex --> &cpuctx_mutex --> &event->child_mutex [ 34.639764] [ 34.650493] Possible unsafe locking scenario: [ 34.650493] [ 34.656526] CPU0 CPU1 [ 34.661184] ---- ---- [ 34.665841] lock(&event->child_mutex); [ 34.669875] lock(&cpuctx_mutex); [ 34.675904] lock(&event->child_mutex); [ 34.682454] lock(event_mutex); [ 34.685789] [ 34.685789] *** DEADLOCK *** [ 34.685789] [ 34.691838] 2 locks held by syz-executor275/6354: [ 34.696652] #0: (&ctx->mutex){+.+.}, at: [] perf_event_release_kernel+0x1fe/0x8a0 [ 34.706002] #1: (&event->child_mutex){+.+.}, at: [] perf_event_release_kernel+0x208/0x8a0 [ 34.716036] [ 34.716036] stack backtrace: [ 34.720509] CPU: 0 PID: 6354 Comm: syz-executor275 Not tainted 4.14.197-syzkaller #0 [ 34.728375] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 34.737717] Call Trace: [ 34.740310] dump_stack+0x1b2/0x283 [ 34.743912] print_circular_bug.constprop.0.cold+0x2d7/0x41e [ 34.749714] __lock_acquire+0x2e0e/0x3f20 [ 34.753849] ? trace_hardirqs_on+0x10/0x10 [ 34.758062] ? generic_exec_single+0x27e/0x420 [ 34.762619] ? trace_hardirqs_on_caller+0x3a8/0x580 [ 34.767612] ? smp_call_function_single+0x1b1/0x370 [ 34.772612] lock_acquire+0x170/0x3f0 [ 34.776410] ? perf_trace_destroy+0x23/0xf0 [ 34.780729] ? perf_trace_destroy+0x23/0xf0 [ 34.785045] __mutex_lock+0xc4/0x1310 [ 34.788829] ? perf_trace_destroy+0x23/0xf0 [ 34.793133] ? task_function_call+0xe6/0x120 [ 34.797522] ? pmu_dev_release+0x20/0x20 [ 34.801579] ? perf_trace_destroy+0x23/0xf0 [ 34.805889] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 34.811315] ? event_function_call+0x1fa/0x3c0 [ 34.815887] ? event_sched_out+0x11b0/0x11b0 [ 34.820284] ? rcu_lockdep_current_cpu_online+0xed/0x140 [ 34.825733] ? perf_tp_event_init+0xf0/0xf0 [ 34.830040] perf_trace_destroy+0x23/0xf0 [ 34.834188] ? perf_tp_event_init+0xf0/0xf0 [ 34.838489] _free_event+0x321/0xe20 [ 34.842205] free_event+0x32/0x40 [ 34.845644] perf_event_release_kernel+0x368/0x8a0 [ 34.850560] ? perf_event_release_kernel+0x8a0/0x8a0 [ 34.855641] perf_release+0x33/0x40 [ 34.859262] __fput+0x25f/0x7a0 [ 34.862540] task_work_run+0x11f/0x190 [ 34.866421] do_exit+0xa08/0x27f0 [ 34.869917] ? __do_page_fault+0x5a0/0xb50 [ 34.874155] ? mm_update_next_owner+0x5b0/0x5b0 [ 34.878860] ? lock_downgrade+0x740/0x740 [ 34.882985] do_group_exit+0x100/0x2e0 [ 34.886849] SyS_exit_group+0x19/0x20 [ 34.890622] ? do_group_exit+0x2e0/0x2e0 [ 34.894654] do_syscall_64+0x1d5/0x640 [ 34.898531] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 34.903695] RIP: 0033:0x43f138 [ 34.906862] RSP: 002b:00007ffffb54da68 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 34.914561] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043f138 [ 34.921805] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 [ 34.929055] RBP: 00000000004bf148 R08: 00000000000000e7 R09: ffffffffff