./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3946849299 <...> Warning: Permanently added '10.128.0.186' (ECDSA) to the list of known hosts. execve("./syz-executor3946849299", ["./syz-executor3946849299"], 0x7fff4f041de0 /* 10 vars */) = 0 brk(NULL) = 0x555557091000 brk(0x555557091c40) = 0x555557091c40 arch_prctl(ARCH_SET_FS, 0x555557091300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor3946849299", 4096) = 28 brk(0x5555570b2c40) = 0x5555570b2c40 brk(0x5555570b3000) = 0x5555570b3000 mprotect(0x7f14a7b7e000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, "memory.events", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 openat(AT_FDCWD, "memory.events", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 mkdirat(AT_FDCWD, "./file0", 000) = 0 openat(AT_FDCWD, "./file0", O_RDONLY) = 5 mknodat(5, "./file0", 000) = 0 mkdirat(AT_FDCWD, "./file1", 000) = 0 mkdirat(AT_FDCWD, "./bus", 000) = 0 mount(NULL, "./bus", "overlay", 0, "workdir=./file1,lowerdir=./file0,upperdir=./bus,index=on") = 0 chdir("./bus") = 0 openat(AT_FDCWD, ".", O_RDONLY) = 6 [ 40.304099][ T4998] [ 40.306426][ T4998] ====================================================== [ 40.313443][ T4998] WARNING: possible circular locking dependency detected [ 40.320431][ T4998] 6.4.0-rc5-syzkaller-00016-ga4d7d7011219 #0 Not tainted [ 40.327419][ T4998] ------------------------------------------------------ [ 40.334419][ T4998] syz-executor394/4998 is trying to acquire lock: [ 40.340799][ T4998] ffff8880298a4460 (sb_writers#4){.+.+}-{0:0}, at: ovl_maybe_copy_up+0x123/0x190 [ 40.349918][ T4998] [ 40.349918][ T4998] but task is already holding lock: [ 40.357260][ T4998] ffff88801739ff20 (&iint->mutex){+.+.}-{3:3}, at: process_measurement+0x67b/0x1930 [ 40.366632][ T4998] [ 40.366632][ T4998] which lock already depends on the new lock. [ 40.366632][ T4998] [ 40.377016][ T4998] [ 40.377016][ T4998] the existing dependency chain (in reverse order) is: [ 40.386010][ T4998] [ 40.386010][ T4998] -> #1 (&iint->mutex){+.+.}-{3:3}: [ 40.393372][ T4998] __mutex_lock+0x12f/0x1350 [ 40.398495][ T4998] process_measurement+0x67b/0x1930 [ 40.404204][ T4998] ima_file_check+0xba/0x100 [ 40.409303][ T4998] path_openat+0x15d3/0x2750 [ 40.414396][ T4998] do_filp_open+0x1ba/0x410 [ 40.419400][ T4998] do_sys_openat2+0x16d/0x4c0 [ 40.424584][ T4998] __x64_sys_openat+0x143/0x1f0 [ 40.429939][ T4998] do_syscall_64+0x39/0xb0 [ 40.434861][ T4998] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 40.441265][ T4998] [ 40.441265][ T4998] -> #0 (sb_writers#4){.+.+}-{0:0}: [ 40.448631][ T4998] __lock_acquire+0x2fcd/0x5f30 [ 40.453988][ T4998] lock_acquire+0x1b1/0x520 [ 40.458994][ T4998] mnt_want_write+0x70/0x420 [ 40.464105][ T4998] ovl_maybe_copy_up+0x123/0x190 [ 40.469546][ T4998] ovl_open+0xf5/0x2e0 [ 40.474121][ T4998] do_dentry_open+0x6cc/0x13f0 [ 40.479479][ T4998] dentry_open+0x136/0x1d0 [ 40.484401][ T4998] ima_calc_file_hash+0x2ca/0x4a0 [ 40.489937][ T4998] ima_collect_measurement+0x55b/0x670 [ 40.495903][ T4998] process_measurement+0xd2f/0x1930 [ 40.501606][ T4998] ima_file_check+0xba/0x100 [ 40.506702][ T4998] path_openat+0x15d3/0x2750 [ 40.511795][ T4998] do_filp_open+0x1ba/0x410 [ 40.516802][ T4998] do_sys_openat2+0x16d/0x4c0 [ 40.521983][ T4998] __x64_sys_openat+0x143/0x1f0 [ 40.527340][ T4998] do_syscall_64+0x39/0xb0 [ 40.532263][ T4998] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 40.538664][ T4998] [ 40.538664][ T4998] other info that might help us debug this: [ 40.538664][ T4998] [ 40.548868][ T4998] Possible unsafe locking scenario: [ 40.548868][ T4998] [ 40.556294][ T4998] CPU0 CPU1 [ 40.561634][ T4998] ---- ---- [ 40.566995][ T4998] lock(&iint->mutex); [ 40.571214][ T4998] lock(sb_writers#4); [ 40.577874][ T4998] lock(&iint->mutex); [ 40.584526][ T4998] rlock(sb_writers#4); [ 40.588766][ T4998] [ 40.588766][ T4998] *** DEADLOCK *** [ 40.588766][ T4998] [ 40.596894][ T4998] 1 lock held by syz-executor394/4998: [ 40.602326][ T4998] #0: ffff88801739ff20 (&iint->mutex){+.+.}-{3:3}, at: process_measurement+0x67b/0x1930 [ 40.612138][ T4998] [ 40.612138][ T4998] stack backtrace: [ 40.618000][ T4998] CPU: 0 PID: 4998 Comm: syz-executor394 Not tainted 6.4.0-rc5-syzkaller-00016-ga4d7d7011219 #0 [ 40.628386][ T4998] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 [ 40.638436][ T4998] Call Trace: [ 40.641697][ T4998] [ 40.644611][ T4998] dump_stack_lvl+0xd9/0x150 [ 40.649183][ T4998] check_noncircular+0x25f/0x2e0 [ 40.654108][ T4998] ? print_circular_bug+0x730/0x730 [ 40.659290][ T4998] ? lock_downgrade+0x690/0x690 [ 40.664125][ T4998] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 40.669934][ T4998] __lock_acquire+0x2fcd/0x5f30 [ 40.674772][ T4998] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 40.680739][ T4998] ? tomoyo_check_open_permission+0x1f9/0x3a0 [ 40.686791][ T4998] lock_acquire+0x1b1/0x520 [ 40.691293][ T4998] ? ovl_maybe_copy_up+0x123/0x190 [ 40.696389][ T4998] ? lock_sync+0x190/0x190 [ 40.700792][ T4998] mnt_want_write+0x70/0x420 [ 40.705365][ T4998] ? ovl_maybe_copy_up+0x123/0x190 [ 40.710457][ T4998] ovl_maybe_copy_up+0x123/0x190 [ 40.715377][ T4998] ovl_open+0xf5/0x2e0 [ 40.719432][ T4998] ? ovl_llseek+0x350/0x350 [ 40.723921][ T4998] ? fsnotify_perm.part.0+0x221/0x610 [ 40.729273][ T4998] do_dentry_open+0x6cc/0x13f0 [ 40.734021][ T4998] ? ovl_llseek+0x350/0x350 [ 40.738512][ T4998] dentry_open+0x136/0x1d0 [ 40.742912][ T4998] ima_calc_file_hash+0x2ca/0x4a0 [ 40.747942][ T4998] ima_collect_measurement+0x55b/0x670 [ 40.753389][ T4998] ? ima_get_action+0xa0/0xa0 [ 40.758054][ T4998] ? ima_get_cache_status+0x1e0/0x1e0 [ 40.763423][ T4998] process_measurement+0xd2f/0x1930 [ 40.768611][ T4998] ? mmap_violation_check+0x1f0/0x1f0 [ 40.773967][ T4998] ? lock_downgrade+0x690/0x690 [ 40.778803][ T4998] ? spin_bug+0x1c0/0x1c0 [ 40.783122][ T4998] ? file_ra_state_init+0x39/0xd0 [ 40.788128][ T4998] ? do_dentry_open+0xd1f/0x13f0 [ 40.793073][ T4998] ? ext4_file_write_iter+0x1740/0x1740 [ 40.798603][ T4998] ? __alloc_file+0x1e8/0x270 [ 40.803265][ T4998] ? revert_creds+0x1cc/0x250 [ 40.807941][ T4998] ? ovl_open_realfile+0x19c/0x390 [ 40.813040][ T4998] ? ovl_open+0x10b/0x2e0 [ 40.817373][ T4998] ? apparmor_current_getsecid_subj+0x1fe/0x570 [ 40.823600][ T4998] ima_file_check+0xba/0x100 [ 40.828174][ T4998] ? process_measurement+0x1930/0x1930 [ 40.833627][ T4998] ? ovl_llseek+0x350/0x350 [ 40.838119][ T4998] ? may_open+0x1f6/0x420 [ 40.842434][ T4998] path_openat+0x15d3/0x2750 [ 40.847009][ T4998] ? path_lookupat+0x840/0x840 [ 40.851755][ T4998] do_filp_open+0x1ba/0x410 [ 40.856243][ T4998] ? may_open_dev+0xf0/0xf0 [ 40.860726][ T4998] ? find_held_lock+0x2d/0x110 [ 40.865471][ T4998] ? do_raw_spin_lock+0x124/0x2b0 [ 40.870482][ T4998] ? spin_bug+0x1c0/0x1c0 [ 40.874800][ T4998] ? _raw_spin_unlock+0x28/0x40 [ 40.879635][ T4998] ? alloc_fd+0x2e4/0x750 [ 40.883952][ T4998] do_sys_openat2+0x16d/0x4c0 [ 40.888615][ T4998] ? ptrace_stop.part.0+0x60f/0x8e0 [ 40.893799][ T4998] ? build_open_flags+0x720/0x720 [ 40.898813][ T4998] ? ptrace_notify+0xfe/0x140 [ 40.903474][ T4998] ? lock_downgrade+0x690/0x690 [ 40.908309][ T4998] __x64_sys_openat+0x143/0x1f0 [ 40.913146][ T4998] ? __ia32_sys_open+0x1c0/0x1c0 [ 40.918070][ T4998] ? _raw_spin_unlock_irq+0x23/0x50 [ 40.923252][ T4998] ? lockdep_hardirqs_on+0x7d/0x100 [ 40.928435][ T4998] ? _raw_spin_unlock_irq+0x2e/0x50 [ 40.933616][ T4998] ? ptrace_notify+0xfe/0x140 [ 40.938275][ T4998] do_syscall_64+0x39/0xb0 [ 40.942680][ T4998] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 40.948563][ T4998] RIP: 0033:0x7f14a7b11d29 [ 40.952962][ T4998] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 40.972566][ T4998] RSP: 002b:00007fff48048678 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 40.980959][ T4998] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007f14a7b11d29 [ 40.988913][ T4998] RDX: 0000000000000003 RSI: 0000000020000340 RDI: 0000000000000006 [ 40.996863][ T4998] RBP: 00007f14a7ad5ed0 R08: 0000000000000000 R09: 0000000000000000 openat(6, "./file0", O_ACCMODE) = 7 exit_group(0) = ? +++ exited with 0 +++ [ 41.004830][ T4998] R1