[ 34.080315][ T26] audit: type=1800 audit(1549672215.156:27): pid=7366 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [ 34.103449][ T26] audit: type=1800 audit(1549672215.156:28): pid=7366 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2417 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 34.776065][ T26] audit: type=1800 audit(1549672215.896:29): pid=7366 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 34.796366][ T26] audit: type=1800 audit(1549672215.906:30): pid=7366 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.207' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 45.888127][ T7522] overlayfs: filesystem on './file0' not supported as upperdir [ 45.889660][ T7524] [ 45.898237][ T7524] ====================================================== [ 45.905227][ T7524] WARNING: possible circular locking dependency detected [ 45.912225][ T7524] 5.0.0-rc5-next-20190208 #31 Not tainted [ 45.917920][ T7524] ------------------------------------------------------ [ 45.924924][ T7524] syz-executor998/7524 is trying to acquire lock: [ 45.931435][ T7524] 00000000d0ad08d3 (&ovl_i_mutex_key[depth]){+.+.}, at: ovl_write_iter+0x148/0xc20 [ 45.940707][ T7524] [ 45.940707][ T7524] but task is already holding lock: [ 45.948051][ T7524] 00000000816ad2e9 (&pipe->mutex/1){+.+.}, at: pipe_lock+0x6e/0x80 [ 45.955931][ T7524] [ 45.955931][ T7524] which lock already depends on the new lock. [ 45.955931][ T7524] [ 45.966310][ T7524] [ 45.966310][ T7524] the existing dependency chain (in reverse order) is: [ 45.975399][ T7524] [ 45.975399][ T7524] -> #2 (&pipe->mutex/1){+.+.}: [ 45.982423][ T7524] __mutex_lock+0xf7/0x1310 [ 45.987559][ T7524] mutex_lock_nested+0x16/0x20 [ 45.992942][ T7524] pipe_lock+0x6e/0x80 [ 45.997522][ T7524] iter_file_splice_write+0x18b/0xbe0 [ 46.003398][ T7524] do_splice+0x644/0x1260 [ 46.008234][ T7524] __x64_sys_splice+0x2c6/0x330 [ 46.013601][ T7524] do_syscall_64+0x103/0x610 [ 46.018714][ T7524] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 46.025111][ T7524] [ 46.025111][ T7524] -> #1 (sb_writers#3){.+.+}: [ 46.031950][ T7524] __sb_start_write+0x20b/0x360 [ 46.037309][ T7524] mnt_want_write+0x3f/0xc0 [ 46.042323][ T7524] ovl_want_write+0x76/0xa0 [ 46.047335][ T7524] ovl_setattr+0xdd/0x8b0 [ 46.052165][ T7524] notify_change+0xad9/0xfb0 [ 46.057254][ T7524] do_truncate+0x158/0x220 [ 46.062226][ T7524] path_openat+0x2d6a/0x46e0 [ 46.067424][ T7524] do_filp_open+0x1a1/0x280 [ 46.072441][ T7524] do_sys_open+0x3fe/0x5d0 [ 46.077361][ T7524] __x64_sys_openat+0x9d/0x100 [ 46.082627][ T7524] do_syscall_64+0x103/0x610 [ 46.087719][ T7524] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 46.094191][ T7524] [ 46.094191][ T7524] -> #0 (&ovl_i_mutex_key[depth]){+.+.}: [ 46.101990][ T7524] lock_acquire+0x16f/0x3f0 [ 46.107000][ T7524] down_write+0x38/0x90 [ 46.111723][ T7524] ovl_write_iter+0x148/0xc20 [ 46.116995][ T7524] __vfs_write+0x613/0x8e0 [ 46.121916][ T7524] __kernel_write+0x110/0x3b0 [ 46.127185][ T7524] write_pipe_buf+0x15d/0x1f0 [ 46.132381][ T7524] __splice_from_pipe+0x395/0x7d0 [ 46.137904][ T7524] splice_from_pipe+0x108/0x170 [ 46.143257][ T7524] default_file_splice_write+0x3c/0x90 [ 46.149224][ T7524] do_splice+0x644/0x1260 [ 46.154054][ T7524] __x64_sys_splice+0x2c6/0x330 [ 46.159408][ T7524] do_syscall_64+0x103/0x610 [ 46.164503][ T7524] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 46.170986][ T7524] [ 46.170986][ T7524] other info that might help us debug this: [ 46.170986][ T7524] [ 46.181416][ T7524] Chain exists of: [ 46.181416][ T7524] &ovl_i_mutex_key[depth] --> sb_writers#3 --> &pipe->mutex/1 [ 46.181416][ T7524] [ 46.194761][ T7524] Possible unsafe locking scenario: [ 46.194761][ T7524] [ 46.202193][ T7524] CPU0 CPU1 [ 46.207537][ T7524] ---- ---- [ 46.212877][ T7524] lock(&pipe->mutex/1); [ 46.217303][ T7524] lock(sb_writers#3); [ 46.223955][ T7524] lock(&pipe->mutex/1); [ 46.230784][ T7524] lock(&ovl_i_mutex_key[depth]); [ 46.235875][ T7524] [ 46.235875][ T7524] *** DEADLOCK *** [ 46.235875][ T7524] [ 46.244006][ T7524] 2 locks held by syz-executor998/7524: [ 46.249528][ T7524] #0: 00000000089b53ba (sb_writers#8){.+.+}, at: do_splice+0xcf4/0x1260 [ 46.258059][ T7524] #1: 00000000816ad2e9 (&pipe->mutex/1){+.+.}, at: pipe_lock+0x6e/0x80 [ 46.266464][ T7524] [ 46.266464][ T7524] stack backtrace: [ 46.272348][ T7524] CPU: 0 PID: 7524 Comm: syz-executor998 Not tainted 5.0.0-rc5-next-20190208 #31 [ 46.281431][ T7524] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 46.291465][ T7524] Call Trace: [ 46.294733][ T7524] dump_stack+0x172/0x1f0 [ 46.299167][ T7524] print_circular_bug.isra.0.cold+0x1cc/0x28f [ 46.305265][ T7524] __lock_acquire+0x2e7a/0x4790 [ 46.310105][ T7524] ? noop_count+0x40/0x40 [ 46.314421][ T7524] ? mark_held_locks+0xf0/0xf0 [ 46.319174][ T7524] lock_acquire+0x16f/0x3f0 [ 46.323663][ T7524] ? ovl_write_iter+0x148/0xc20 [ 46.328600][ T7524] down_write+0x38/0x90 [ 46.332756][ T7524] ? ovl_write_iter+0x148/0xc20 [ 46.337592][ T7524] ovl_write_iter+0x148/0xc20 [ 46.342248][ T7524] ? ovl_compat_ioctl+0x80/0x80 [ 46.347083][ T7524] ? mark_held_locks+0xf0/0xf0 [ 46.351826][ T7524] ? preempt_schedule_common+0x4f/0xe0 [ 46.357266][ T7524] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 46.363486][ T7524] ? iov_iter_init+0xea/0x220 [ 46.368253][ T7524] __vfs_write+0x613/0x8e0 [ 46.372669][ T7524] ? kernel_read+0x120/0x120 [ 46.377251][ T7524] ? __lock_is_held+0xb6/0x140 [ 46.382008][ T7524] ? lock_acquire+0x16f/0x3f0 [ 46.386684][ T7524] __kernel_write+0x110/0x3b0 [ 46.391349][ T7524] write_pipe_buf+0x15d/0x1f0 [ 46.396001][ T7524] ? do_splice_direct+0x2a0/0x2a0 [ 46.401157][ T7524] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 46.407388][ T7524] ? splice_from_pipe_next.part.0+0x255/0x2f0 [ 46.413441][ T7524] __splice_from_pipe+0x395/0x7d0 [ 46.418602][ T7524] ? do_splice_direct+0x2a0/0x2a0 [ 46.423915][ T7524] ? do_splice_direct+0x2a0/0x2a0 [ 46.429016][ T7524] splice_from_pipe+0x108/0x170 [ 46.433865][ T7524] ? splice_shrink_spd+0xd0/0xd0 [ 46.438786][ T7524] ? __lock_is_held+0xb6/0x140 [ 46.443705][ T7524] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 46.449856][ T7524] default_file_splice_write+0x3c/0x90 [ 46.455460][ T7524] ? generic_splice_sendpage+0x50/0x50 [ 46.460913][ T7524] do_splice+0x644/0x1260 [ 46.465243][ T7524] ? opipe_prep.part.0+0x2d0/0x2d0 [ 46.470345][ T7524] ? __fget_light+0x1a9/0x230 [ 46.475011][ T7524] __x64_sys_splice+0x2c6/0x330 [ 46.479853][ T7524] do_syscall_64+0x103/0x610 [ 46.484430][ T7524] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 46.490302][ T7524] RIP: 0033:0x445919 [ 46.494174][ T7524] Code: e8 6c b6 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b 12 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 46.513754][ T7524] RSP: 002b:00007f24c8f3cda8 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 46.522146][ T7524] RAX: ffffffffffffffda RBX: 00000000006dac88 RCX: 0000000000445919 [ 46.530094][ T7524] RDX: 000000000000000b RSI: 0000000000000000 RDI: 0000000000000009 [ 46.538249][ T7524] RBP: 00000000006dac80 R08: 000100000000ffe0 R09: 0000000000000000 [ 46.546216][ T7524] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dac8c [ 46.554172][ T7524] R13: 00007fff0fc85b0f R14: 00007f24c8f3d9c0 R15: 20c49ba5e353f7cf