./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor737304236 <...> Warning: Permanently added '10.128.0.227' (ECDSA) to the list of known hosts. execve("./syz-executor737304236", ["./syz-executor737304236"], 0x7ffea85a1c40 /* 10 vars */) = 0 brk(NULL) = 0x555555c6c000 brk(0x555555c6cc40) = 0x555555c6cc40 arch_prctl(ARCH_SET_FS, 0x555555c6c300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor737304236", 4096) = 27 brk(0x555555c8dc40) = 0x555555c8dc40 brk(0x555555c8e000) = 0x555555c8e000 mprotect(0x7f6ea0207000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, "memory.events", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 openat(AT_FDCWD, "memory.events", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 mknodat(AT_FDCWD, "./file0", 000) = 0 mkdir("./bus", 000) = 0 mkdir("./file1", 000) = 0 [ 59.200650][ T26] audit: type=1400 audit(1683398332.230:83): avc: denied { write } for pid=4988 comm="strace-static-x" path="pipe:[29976]" dev="pipefs" ino=29976 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 59.228616][ T26] audit: type=1400 audit(1683398332.260:84): avc: denied { execmem } for pid=4991 comm="syz-executor737" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 mount(NULL, "./bus", "overlay", 0, "upperdir=./bus,workdir=./file1,lowerdir=.") = 0 chdir("./bus") = 0 [ 59.248693][ T26] audit: type=1400 audit(1683398332.260:85): avc: denied { mounton } for pid=4991 comm="syz-executor737" path="/root/bus" dev="sda1" ino=1929 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 59.253918][ T4991] [ 59.272296][ T26] audit: type=1400 audit(1683398332.260:86): avc: denied { unlink } for pid=4991 comm="syz-executor737" name="#1" dev="sda1" ino=1934 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=chr_file permissive=1 [ 59.273612][ T4991] ====================================================== [ 59.273620][ T4991] WARNING: possible circular locking dependency detected [ 59.296337][ T26] audit: type=1400 audit(1683398332.280:87): avc: denied { mount } for pid=4991 comm="syz-executor737" name="/" dev="overlay" ino=1929 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 59.302886][ T4991] 6.3.0-syzkaller-13390-g2e1e1337881b #0 Not tainted [ 59.302898][ T4991] ------------------------------------------------------ [ 59.302904][ T4991] syz-executor737/4991 is trying to acquire lock: [ 59.302913][ T4991] ffff88802ce5c460 (sb_writers#5){.+.+}-{0:0}, at: ovl_maybe_copy_up+0x123/0x190 [ 59.361380][ T4991] [ 59.361380][ T4991] but task is already holding lock: [ 59.368722][ T4991] ffff888024008ce0 (&iint->mutex){+.+.}-{3:3}, at: process_measurement+0x67b/0x1930 [ 59.378102][ T4991] [ 59.378102][ T4991] which lock already depends on the new lock. [ 59.378102][ T4991] [ 59.388501][ T4991] [ 59.388501][ T4991] the existing dependency chain (in reverse order) is: [ 59.397495][ T4991] [ 59.397495][ T4991] -> #1 (&iint->mutex){+.+.}-{3:3}: [ 59.404875][ T4991] __mutex_lock+0x12f/0x1350 [ 59.410160][ T4991] process_measurement+0x67b/0x1930 [ 59.415887][ T4991] ima_file_check+0xba/0x100 [ 59.420985][ T4991] path_openat+0x15d3/0x2750 [ 59.426086][ T4991] do_filp_open+0x1ba/0x410 [ 59.431099][ T4991] do_sys_openat2+0x16d/0x4c0 [ 59.436280][ T4991] __x64_sys_openat+0x143/0x1f0 [ 59.441649][ T4991] do_syscall_64+0x39/0xb0 [ 59.446578][ T4991] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 59.452996][ T4991] [ 59.452996][ T4991] -> #0 (sb_writers#5){.+.+}-{0:0}: [ 59.460462][ T4991] __lock_acquire+0x2f21/0x5df0 [ 59.465915][ T4991] lock_acquire+0x1b1/0x520 [ 59.470927][ T4991] mnt_want_write+0x70/0x420 [ 59.476027][ T4991] ovl_maybe_copy_up+0x123/0x190 [ 59.481478][ T4991] ovl_open+0xf5/0x2e0 [ 59.486071][ T4991] do_dentry_open+0x6cc/0x13f0 [ 59.491348][ T4991] dentry_open+0x136/0x1d0 [ 59.496275][ T4991] ima_calc_file_hash+0x2ca/0x4a0 [ 59.501809][ T4991] ima_collect_measurement+0x55b/0x670 [ 59.507777][ T4991] process_measurement+0xd2f/0x1930 [ 59.513483][ T4991] ima_file_check+0xba/0x100 [ 59.518581][ T4991] path_openat+0x15d3/0x2750 [ 59.523696][ T4991] do_filp_open+0x1ba/0x410 [ 59.528707][ T4991] do_sys_openat2+0x16d/0x4c0 [ 59.533885][ T4991] __x64_sys_open+0x11d/0x1c0 [ 59.539068][ T4991] do_syscall_64+0x39/0xb0 [ 59.543995][ T4991] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 59.550498][ T4991] [ 59.550498][ T4991] other info that might help us debug this: [ 59.550498][ T4991] [ 59.560708][ T4991] Possible unsafe locking scenario: [ 59.560708][ T4991] [ 59.568139][ T4991] CPU0 CPU1 [ 59.573484][ T4991] ---- ---- [ 59.578827][ T4991] lock(&iint->mutex); [ 59.582984][ T4991] lock(sb_writers#5); [ 59.589648][ T4991] lock(&iint->mutex); [ 59.596388][ T4991] rlock(sb_writers#5); [ 59.600617][ T4991] [ 59.600617][ T4991] *** DEADLOCK *** [ 59.600617][ T4991] [ 59.608739][ T4991] 1 lock held by syz-executor737/4991: [ 59.614173][ T4991] #0: ffff888024008ce0 (&iint->mutex){+.+.}-{3:3}, at: process_measurement+0x67b/0x1930 [ 59.623991][ T4991] [ 59.623991][ T4991] stack backtrace: [ 59.629855][ T4991] CPU: 0 PID: 4991 Comm: syz-executor737 Not tainted 6.3.0-syzkaller-13390-g2e1e1337881b #0 [ 59.639898][ T4991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 [ 59.649936][ T4991] Call Trace: [ 59.653200][ T4991] [ 59.656116][ T4991] dump_stack_lvl+0xd9/0x150 [ 59.660702][ T4991] check_noncircular+0x25f/0x2e0 [ 59.665628][ T4991] ? print_circular_bug+0x730/0x730 [ 59.670814][ T4991] ? print_usage_bug.part.0+0x660/0x660 [ 59.676345][ T4991] ? debug_check_no_obj_freed+0x210/0x420 [ 59.682057][ T4991] __lock_acquire+0x2f21/0x5df0 [ 59.686903][ T4991] ? lock_downgrade+0x690/0x690 [ 59.691761][ T4991] ? tomoyo_check_open_permission+0x187/0x3a0 [ 59.697819][ T4991] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 59.703787][ T4991] lock_acquire+0x1b1/0x520 [ 59.708299][ T4991] ? ovl_maybe_copy_up+0x123/0x190 [ 59.713398][ T4991] ? lock_sync+0x190/0x190 [ 59.717819][ T4991] mnt_want_write+0x70/0x420 [ 59.722411][ T4991] ? ovl_maybe_copy_up+0x123/0x190 [ 59.727519][ T4991] ovl_maybe_copy_up+0x123/0x190 [ 59.732450][ T4991] ovl_open+0xf5/0x2e0 [ 59.736510][ T4991] ? ovl_llseek+0x350/0x350 [ 59.741000][ T4991] ? fsnotify_perm.part.0+0x221/0x610 [ 59.746369][ T4991] do_dentry_open+0x6cc/0x13f0 [ 59.751145][ T4991] ? ovl_llseek+0x350/0x350 [ 59.755634][ T4991] dentry_open+0x136/0x1d0 [ 59.760064][ T4991] ima_calc_file_hash+0x2ca/0x4a0 [ 59.765082][ T4991] ima_collect_measurement+0x55b/0x670 [ 59.770533][ T4991] ? ima_get_action+0xa0/0xa0 [ 59.775199][ T4991] ? ima_get_cache_status+0x1e0/0x1e0 [ 59.780558][ T4991] process_measurement+0xd2f/0x1930 [ 59.785747][ T4991] ? mmap_violation_check+0x1f0/0x1f0 [ 59.791109][ T4991] ? lock_downgrade+0x690/0x690 [ 59.795946][ T4991] ? spin_bug+0x1c0/0x1c0 [ 59.800280][ T4991] ? file_ra_state_init+0x39/0xd0 [ 59.805294][ T4991] ? do_dentry_open+0xd1f/0x13f0 [ 59.810222][ T4991] ? ext4_file_write_iter+0x1740/0x1740 [ 59.815755][ T4991] ? __alloc_file+0x1e8/0x270 [ 59.820419][ T4991] ? revert_creds+0x1cc/0x250 [ 59.825085][ T4991] ? ovl_open_realfile+0x19c/0x390 [ 59.830184][ T4991] ? ovl_open+0x10b/0x2e0 [ 59.834495][ T4991] ? ovl_llseek+0x350/0x350 [ 59.838980][ T4991] ima_file_check+0xba/0x100 [ 59.843563][ T4991] ? process_measurement+0x1930/0x1930 [ 59.849009][ T4991] ? ovl_llseek+0x350/0x350 [ 59.853502][ T4991] ? may_open+0x1f6/0x420 [ 59.857819][ T4991] path_openat+0x15d3/0x2750 [ 59.862417][ T4991] ? path_lookupat+0x840/0x840 [ 59.867168][ T4991] ? find_held_lock+0x2d/0x110 [ 59.871920][ T4991] do_filp_open+0x1ba/0x410 [ 59.876411][ T4991] ? may_open_dev+0xf0/0xf0 [ 59.880903][ T4991] ? find_held_lock+0x2d/0x110 [ 59.885667][ T4991] ? do_raw_spin_lock+0x124/0x2b0 [ 59.890679][ T4991] ? spin_bug+0x1c0/0x1c0 [ 59.894999][ T4991] ? _raw_spin_unlock+0x28/0x40 [ 59.899847][ T4991] ? alloc_fd+0x2e4/0x750 [ 59.904163][ T4991] do_sys_openat2+0x16d/0x4c0 [ 59.908830][ T4991] ? ptrace_stop.part.0+0x60f/0x8e0 [ 59.914038][ T4991] ? build_open_flags+0x720/0x720 [ 59.919046][ T4991] ? ptrace_notify+0xfe/0x140 [ 59.923883][ T4991] ? lock_downgrade+0x690/0x690 [ 59.928819][ T4991] __x64_sys_open+0x11d/0x1c0 [ 59.933495][ T4991] ? do_sys_open+0x150/0x150 [ 59.938096][ T4991] ? _raw_spin_unlock_irq+0x2e/0x50 [ 59.943287][ T4991] ? ptrace_notify+0xfe/0x140 [ 59.947952][ T4991] do_syscall_64+0x39/0xb0 [ 59.952376][ T4991] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 59.958263][ T4991] RIP: 0033:0x7f6ea019ac69 [ 59.962665][ T4991] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 59.982266][ T4991] RSP: 002b:00007fff57140298 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 59.990666][ T4991] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007f6ea019ac69 open("./file0", O_ACCMODE|O_CREAT|0x3c, 000) = 5 exit_group(0) = ? +++ exited with 0 +++ [ 59.998631][ T4991] RDX: 0000000000000000 RSI: 00000000000000