Warning: Permanently added '10.128.0.97' (ECDSA) to the list of known hosts. [ 59.105656][ T26] audit: type=1400 audit(1555808741.461:36): avc: denied { map } for pid=8232 comm="syz-execprog" path="/root/syz-execprog" dev="sda1" ino=15901 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2019/04/21 01:05:42 parsed 1 programs [ 60.095544][ T26] audit: type=1400 audit(1555808742.451:37): avc: denied { map } for pid=8232 comm="syz-execprog" path="/sys/kernel/debug/kcov" dev="debugfs" ino=15693 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 2019/04/21 01:05:43 executed programs: 0 [ 61.628312][ T8246] IPVS: ftp: loaded support on port[0] = 21 [ 61.689162][ T8246] chnl_net:caif_netlink_parms(): no params data found [ 61.723322][ T8246] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.730833][ T8246] bridge0: port 1(bridge_slave_0) entered disabled state [ 61.738839][ T8246] device bridge_slave_0 entered promiscuous mode [ 61.748050][ T8246] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.755668][ T8246] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.763933][ T8246] device bridge_slave_1 entered promiscuous mode [ 61.780106][ T8246] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 61.792043][ T8246] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 61.809039][ T8246] team0: Port device team_slave_0 added [ 61.816549][ T8246] team0: Port device team_slave_1 added [ 61.862890][ T8246] device hsr_slave_0 entered promiscuous mode [ 61.901066][ T8246] device hsr_slave_1 entered promiscuous mode [ 61.968904][ T8246] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.976189][ T8246] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.984146][ T8246] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.991309][ T8246] bridge0: port 1(bridge_slave_0) entered forwarding state [ 62.026498][ T8246] 8021q: adding VLAN 0 to HW filter on device bond0 [ 62.038719][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 62.050111][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 62.058831][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 62.067098][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 62.080032][ T8246] 8021q: adding VLAN 0 to HW filter on device team0 [ 62.091050][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 62.099610][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.106733][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 62.117816][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 62.127213][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.134364][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 62.157248][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 62.166154][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 62.176095][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 62.185740][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 62.197474][ T8246] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 62.209440][ T8246] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 62.218200][ T3244] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 62.237021][ T8246] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 62.248082][ T26] audit: type=1400 audit(1555808744.601:38): avc: denied { associate } for pid=8246 comm="syz-executor.0" name="syz0" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1 [ 62.315950][ T8252] [ 62.318301][ T8252] ====================================================== [ 62.325419][ T8252] WARNING: possible circular locking dependency detected [ 62.332429][ T8252] 5.1.0-rc5+ #77 Not tainted [ 62.337002][ T8252] ------------------------------------------------------ [ 62.344013][ T8252] syz-executor.0/8252 is trying to acquire lock: [ 62.350340][ T8252] 000000003118342a (sb_writers#4){.+.+}, at: mnt_want_write+0x3f/0xc0 [ 62.358501][ T8252] [ 62.358501][ T8252] but task is already holding lock: [ 62.365875][ T8252] 00000000cbf1e789 (&iint->mutex){+.+.}, at: process_measurement+0x354/0x1570 [ 62.374721][ T8252] [ 62.374721][ T8252] which lock already depends on the new lock. [ 62.374721][ T8252] [ 62.385111][ T8252] [ 62.385111][ T8252] the existing dependency chain (in reverse order) is: [ 62.394115][ T8252] [ 62.394115][ T8252] -> #1 (&iint->mutex){+.+.}: [ 62.400962][ T8252] lock_acquire+0x16f/0x3f0 [ 62.405974][ T8252] __mutex_lock+0xf7/0x1310 [ 62.411011][ T8252] mutex_lock_nested+0x16/0x20 [ 62.416288][ T8252] process_measurement+0x354/0x1570 [ 62.422010][ T8252] ima_file_check+0xc5/0x110 [ 62.427112][ T8252] path_openat+0x1142/0x46e0 [ 62.432218][ T8252] do_filp_open+0x1a1/0x280 [ 62.437252][ T8252] do_sys_open+0x3fe/0x5d0 [ 62.442180][ T8252] __x64_sys_open+0x7e/0xc0 [ 62.447195][ T8252] do_syscall_64+0x103/0x610 [ 62.452304][ T8252] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 62.458704][ T8252] [ 62.458704][ T8252] -> #0 (sb_writers#4){.+.+}: [ 62.465575][ T8252] __lock_acquire+0x239c/0x3fb0 [ 62.470942][ T8252] lock_acquire+0x16f/0x3f0 [ 62.475956][ T8252] __sb_start_write+0x20b/0x360 [ 62.481317][ T8252] mnt_want_write+0x3f/0xc0 [ 62.486371][ T8252] ovl_want_write+0x76/0xa0 [ 62.491380][ T8252] ovl_open_maybe_copy_up+0x122/0x180 [ 62.497270][ T8252] ovl_open+0xb3/0x270 [ 62.501848][ T8252] do_dentry_open+0x4e2/0x1250 [ 62.507119][ T8252] dentry_open+0x132/0x1d0 [ 62.512044][ T8252] ima_calc_file_hash+0x33f/0x570 [ 62.517575][ T8252] ima_collect_measurement+0x50f/0x5c0 [ 62.523541][ T8252] process_measurement+0xeca/0x1570 [ 62.529254][ T8252] ima_file_check+0xc5/0x110 [ 62.534369][ T8252] path_openat+0x1142/0x46e0 [ 62.539467][ T8252] do_filp_open+0x1a1/0x280 [ 62.544480][ T8252] do_sys_open+0x3fe/0x5d0 [ 62.549407][ T8252] __x64_sys_open+0x7e/0xc0 [ 62.554418][ T8252] do_syscall_64+0x103/0x610 [ 62.559519][ T8252] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 62.565908][ T8252] [ 62.565908][ T8252] other info that might help us debug this: [ 62.565908][ T8252] [ 62.576148][ T8252] Possible unsafe locking scenario: [ 62.576148][ T8252] [ 62.583587][ T8252] CPU0 CPU1 [ 62.588933][ T8252] ---- ---- [ 62.594274][ T8252] lock(&iint->mutex); [ 62.598407][ T8252] lock(sb_writers#4); [ 62.605085][ T8252] lock(&iint->mutex); [ 62.611740][ T8252] lock(sb_writers#4); [ 62.615877][ T8252] [ 62.615877][ T8252] *** DEADLOCK *** [ 62.615877][ T8252] [ 62.624019][ T8252] 1 lock held by syz-executor.0/8252: [ 62.629368][ T8252] #0: 00000000cbf1e789 (&iint->mutex){+.+.}, at: process_measurement+0x354/0x1570 [ 62.638647][ T8252] [ 62.638647][ T8252] stack backtrace: [ 62.644529][ T8252] CPU: 0 PID: 8252 Comm: syz-executor.0 Not tainted 5.1.0-rc5+ #77 [ 62.652425][ T8252] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 62.662472][ T8252] Call Trace: [ 62.665754][ T8252] dump_stack+0x172/0x1f0 [ 62.670072][ T8252] print_circular_bug.isra.0.cold+0x1cc/0x28f [ 62.676139][ T8252] check_prev_add.constprop.0+0xf11/0x23c0 [ 62.681968][ T8252] ? check_usage+0x570/0x570 [ 62.686661][ T8252] ? tomoyo_check_open_permission+0x1b1/0x3f0 [ 62.692811][ T8252] ? find_held_lock+0x35/0x130 [ 62.697571][ T8252] ? graph_lock+0x7b/0x200 [ 62.701983][ T8252] ? __lockdep_reset_lock+0x450/0x450 [ 62.707362][ T8252] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 62.713600][ T8252] __lock_acquire+0x239c/0x3fb0 [ 62.718443][ T8252] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 62.724766][ T8252] ? mark_held_locks+0xf0/0xf0 [ 62.729523][ T8252] lock_acquire+0x16f/0x3f0 [ 62.734018][ T8252] ? mnt_want_write+0x3f/0xc0 [ 62.738704][ T8252] __sb_start_write+0x20b/0x360 [ 62.743555][ T8252] ? mnt_want_write+0x3f/0xc0 [ 62.748257][ T8252] mnt_want_write+0x3f/0xc0 [ 62.752752][ T8252] ovl_want_write+0x76/0xa0 [ 62.757258][ T8252] ovl_open_maybe_copy_up+0x122/0x180 [ 62.762657][ T8252] ovl_open+0xb3/0x270 [ 62.767417][ T8252] do_dentry_open+0x4e2/0x1250 [ 62.772181][ T8252] ? ovl_llseek+0x110/0x110 [ 62.776706][ T8252] ? chown_common+0x5c0/0x5c0 [ 62.781369][ T8252] dentry_open+0x132/0x1d0 [ 62.785771][ T8252] ima_calc_file_hash+0x33f/0x570 [ 62.790793][ T8252] ima_collect_measurement+0x50f/0x5c0 [ 62.796249][ T8252] ? ima_get_action+0xa0/0xa0 [ 62.800916][ T8252] process_measurement+0xeca/0x1570 [ 62.806107][ T8252] ? ima_add_template_entry.cold+0x48/0x48 [ 62.811925][ T8252] ? do_dentry_open+0xb9f/0x1250 [ 62.816866][ T8252] ? lockdep_init_map+0x1be/0x6d0 [ 62.821881][ T8252] ? selinux_task_getsecid+0x176/0x2e0 [ 62.827414][ T8252] ? find_held_lock+0x35/0x130 [ 62.832354][ T8252] ? selinux_task_getsecid+0x176/0x2e0 [ 62.837813][ T8252] ? lock_downgrade+0x880/0x880 [ 62.842661][ T8252] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 62.848913][ T8252] ? kasan_check_read+0x11/0x20 [ 62.853759][ T8252] ? selinux_task_getsecid+0x19d/0x2e0 [ 62.859212][ T8252] ima_file_check+0xc5/0x110 [ 62.863808][ T8252] ? process_measurement+0x1570/0x1570 [ 62.869267][ T8252] ? inode_permission+0xb4/0x570 [ 62.874215][ T8252] path_openat+0x1142/0x46e0 [ 62.878896][ T8252] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 62.884701][ T8252] ? kasan_slab_alloc+0xf/0x20 [ 62.889452][ T8252] ? kmem_cache_alloc+0x11a/0x6f0 [ 62.894551][ T8252] ? getname_flags+0xd6/0x5b0 [ 62.899216][ T8252] ? getname+0x1a/0x20 [ 62.903297][ T8252] ? do_sys_open+0x2c9/0x5d0 [ 62.907884][ T8252] ? path_lookupat.isra.0+0x8d0/0x8d0 [ 62.913262][ T8252] ? __alloc_fd+0x44d/0x560 [ 62.917753][ T8252] do_filp_open+0x1a1/0x280 [ 62.922373][ T8252] ? may_open_dev+0x100/0x100 [ 62.927126][ T8252] ? kasan_check_read+0x11/0x20 [ 62.931962][ T8252] ? do_raw_spin_unlock+0x57/0x270 [ 62.937060][ T8252] ? _raw_spin_unlock+0x2d/0x50 [ 62.941895][ T8252] ? __alloc_fd+0x44d/0x560 [ 62.946388][ T8252] do_sys_open+0x3fe/0x5d0 [ 62.950815][ T8252] ? filp_open+0x80/0x80 [ 62.955065][ T8252] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 62.960521][ T8252] ? do_syscall_64+0x26/0x610 [ 62.965196][ T8252] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 62.971271][ T8252] ? do_syscall_64+0x26/0x610 [ 62.976024][ T8252] __x64_sys_open+0x7e/0xc0 [ 62.980523][ T8252] do_syscall_64+0x103/0x610 [ 62.985116][ T8252] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 62.990994][ T8252] RIP: 0033:0x458c29 [ 62.994872][ T8252] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 63.014480][ T8252] RSP: 002b:00007ffc741e50d8 EFLA