./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor255782231 <...> forked to background, child pid 3184 no interfaces have a carrier [ 24.470652][ T3185] 8021q: adding VLAN 0 to HW filter on device bond0 [ 24.480696][ T3185] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.154' (ECDSA) to the list of known hosts. execve("./syz-executor255782231", ["./syz-executor255782231"], 0x7ffc68a5f430 /* 10 vars */) = 0 brk(NULL) = 0x5555564e2000 brk(0x5555564e2c40) = 0x5555564e2c40 arch_prctl(ARCH_SET_FS, 0x5555564e2300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor255782231", 4096) = 27 brk(0x555556503c40) = 0x555556503c40 brk(0x555556504000) = 0x555556504000 mprotect(0x7f8b75208000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 openat(AT_FDCWD, "memory.events", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 openat(AT_FDCWD, "memory.events", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 mknodat(AT_FDCWD, "./file0", 000) = 0 mkdir("./bus", 000) = 0 mkdir("./file1", 000) = 0 mount(NULL, "./bus", "overlay", 0, "upperdir=./bus,workdir=./file1,lowerdir=.") = 0 chdir("./bus") = 0 syzkaller login: [ 44.170529][ T3605] [ 44.172895][ T3605] ====================================================== [ 44.179895][ T3605] WARNING: possible circular locking dependency detected [ 44.186889][ T3605] 6.1.0-rc4-syzkaller-00356-g8f2975c2bb4c #0 Not tainted [ 44.193882][ T3605] ------------------------------------------------------ [ 44.200876][ T3605] syz-executor255/3605 is trying to acquire lock: [ 44.207262][ T3605] ffff88814ab9a460 (sb_writers#4){.+.+}-{0:0}, at: ovl_maybe_copy_up+0x11f/0x190 [ 44.216383][ T3605] [ 44.216383][ T3605] but task is already holding lock: [ 44.223724][ T3605] ffff8880266553e0 (&iint->mutex){+.+.}-{3:3}, at: process_measurement+0x3b9/0x18b0 [ 44.233116][ T3605] [ 44.233116][ T3605] which lock already depends on the new lock. [ 44.233116][ T3605] [ 44.243517][ T3605] [ 44.243517][ T3605] the existing dependency chain (in reverse order) is: [ 44.252511][ T3605] [ 44.252511][ T3605] -> #1 (&iint->mutex){+.+.}-{3:3}: [ 44.259878][ T3605] __mutex_lock+0x12f/0x1350 [ 44.264973][ T3605] process_measurement+0x3b9/0x18b0 [ 44.270674][ T3605] ima_file_check+0xac/0x100 [ 44.275768][ T3605] path_openat+0x1611/0x2860 [ 44.280859][ T3605] do_filp_open+0x1b6/0x400 [ 44.285859][ T3605] do_sys_openat2+0x16d/0x4c0 [ 44.291038][ T3605] __x64_sys_openat+0x13f/0x1f0 [ 44.296390][ T3605] do_syscall_64+0x35/0xb0 [ 44.301313][ T3605] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 44.307712][ T3605] [ 44.307712][ T3605] -> #0 (sb_writers#4){.+.+}-{0:0}: [ 44.315075][ T3605] __lock_acquire+0x2a43/0x56d0 [ 44.320431][ T3605] lock_acquire+0x1df/0x630 [ 44.325434][ T3605] mnt_want_write+0x6c/0x3e0 [ 44.330521][ T3605] ovl_maybe_copy_up+0x11f/0x190 [ 44.335962][ T3605] ovl_open+0xf1/0x2d0 [ 44.340529][ T3605] do_dentry_open+0x6cc/0x13f0 [ 44.345791][ T3605] dentry_open+0x132/0x1d0 [ 44.350704][ T3605] ima_calc_file_hash+0x2c6/0x4a0 [ 44.356228][ T3605] ima_collect_measurement+0x63e/0x7a0 [ 44.362202][ T3605] process_measurement+0xd1e/0x18b0 [ 44.367901][ T3605] ima_file_check+0xac/0x100 [ 44.372991][ T3605] path_openat+0x1611/0x2860 [ 44.378079][ T3605] do_filp_open+0x1b6/0x400 [ 44.383081][ T3605] do_sys_openat2+0x16d/0x4c0 [ 44.388259][ T3605] __x64_sys_open+0x119/0x1c0 [ 44.393437][ T3605] do_syscall_64+0x35/0xb0 [ 44.398362][ T3605] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 44.404760][ T3605] [ 44.404760][ T3605] other info that might help us debug this: [ 44.404760][ T3605] [ 44.414976][ T3605] Possible unsafe locking scenario: [ 44.414976][ T3605] [ 44.422411][ T3605] CPU0 CPU1 [ 44.427757][ T3605] ---- ---- [ 44.433110][ T3605] lock(&iint->mutex); [ 44.437246][ T3605] lock(sb_writers#4); [ 44.443900][ T3605] lock(&iint->mutex); [ 44.450552][ T3605] lock(sb_writers#4); [ 44.454701][ T3605] [ 44.454701][ T3605] *** DEADLOCK *** [ 44.454701][ T3605] [ 44.462820][ T3605] 1 lock held by syz-executor255/3605: [ 44.468254][ T3605] #0: ffff8880266553e0 (&iint->mutex){+.+.}-{3:3}, at: process_measurement+0x3b9/0x18b0 [ 44.478071][ T3605] [ 44.478071][ T3605] stack backtrace: [ 44.483934][ T3605] CPU: 0 PID: 3605 Comm: syz-executor255 Not tainted 6.1.0-rc4-syzkaller-00356-g8f2975c2bb4c #0 [ 44.494327][ T3605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 44.504373][ T3605] Call Trace: [ 44.507640][ T3605] [ 44.510550][ T3605] dump_stack_lvl+0xcd/0x134 [ 44.515126][ T3605] check_noncircular+0x25f/0x2e0 [ 44.520044][ T3605] ? debug_check_no_obj_freed+0x20c/0x420 [ 44.525751][ T3605] ? print_circular_bug+0x1e0/0x1e0 [ 44.530927][ T3605] ? mark_held_locks+0x9f/0xe0 [ 44.535689][ T3605] ? mark_held_locks+0x9f/0xe0 [ 44.540434][ T3605] __lock_acquire+0x2a43/0x56d0 [ 44.545269][ T3605] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 44.551230][ T3605] lock_acquire+0x1df/0x630 [ 44.555713][ T3605] ? ovl_maybe_copy_up+0x11f/0x190 [ 44.560810][ T3605] ? lock_release+0x810/0x810 [ 44.565470][ T3605] mnt_want_write+0x6c/0x3e0 [ 44.570042][ T3605] ? ovl_maybe_copy_up+0x11f/0x190 [ 44.575134][ T3605] ovl_maybe_copy_up+0x11f/0x190 [ 44.580053][ T3605] ovl_open+0xf1/0x2d0 [ 44.584098][ T3605] ? ovl_llseek+0x340/0x340 [ 44.588582][ T3605] ? fsnotify_perm.part.0+0x221/0x610 [ 44.593943][ T3605] do_dentry_open+0x6cc/0x13f0 [ 44.598695][ T3605] ? ovl_llseek+0x340/0x340 [ 44.603190][ T3605] dentry_open+0x132/0x1d0 [ 44.607596][ T3605] ima_calc_file_hash+0x2c6/0x4a0 [ 44.612613][ T3605] ima_collect_measurement+0x63e/0x7a0 [ 44.618055][ T3605] ? ima_get_action+0xa0/0xa0 [ 44.622712][ T3605] ? ovl_other_xattr_set+0x50/0x50 [ 44.627812][ T3605] ? ima_get_cache_status+0x1d0/0x1d0 [ 44.633168][ T3605] process_measurement+0xd1e/0x18b0 [ 44.638350][ T3605] ? mmap_violation_check+0x1f0/0x1f0 [ 44.644144][ T3605] ? check_access_path_dual.part.0+0x3360/0x3360 [ 44.650458][ T3605] ? apparmor_path_chmod+0x20/0x20 [ 44.655551][ T3605] ? rwlock_bug.part.0+0x90/0x90 [ 44.660471][ T3605] ? fsnotify_perm.part.0+0x221/0x610 [ 44.665830][ T3605] ? inode_to_bdi+0x98/0x150 [ 44.670411][ T3605] ? do_dentry_open+0xd1f/0x13f0 [ 44.675329][ T3605] ? ext4_file_write_iter+0x16e0/0x16e0 [ 44.680863][ T3605] ? __alloc_file+0x1e8/0x270 [ 44.685519][ T3605] ? revert_creds+0x18c/0x1f0 [ 44.690183][ T3605] ? ovl_open_realfile+0x19c/0x380 [ 44.695276][ T3605] ? ovl_open+0x107/0x2d0 [ 44.699584][ T3605] ? ovl_llseek+0x340/0x340 [ 44.704069][ T3605] ? apparmor_current_getsecid_subj+0x1f5/0x570 [ 44.710291][ T3605] ima_file_check+0xac/0x100 [ 44.714878][ T3605] ? do_dentry_open+0xd1f/0x13f0 [ 44.719796][ T3605] ? process_measurement+0x18b0/0x18b0 [ 44.725232][ T3605] ? ovl_llseek+0x340/0x340 [ 44.729716][ T3605] ? may_open+0x1f6/0x420 [ 44.734024][ T3605] path_openat+0x1611/0x2860 [ 44.738598][ T3605] ? path_lookupat+0x840/0x840 [ 44.743343][ T3605] do_filp_open+0x1b6/0x400 [ 44.747828][ T3605] ? may_open_dev+0xf0/0xf0 [ 44.752308][ T3605] ? find_held_lock+0x2d/0x110 [ 44.757050][ T3605] ? do_raw_spin_lock+0x120/0x2a0 [ 44.762055][ T3605] ? rwlock_bug.part.0+0x90/0x90 [ 44.766972][ T3605] ? _raw_spin_unlock+0x24/0x40 [ 44.771802][ T3605] ? alloc_fd+0x2d8/0x6d0 [ 44.776114][ T3605] do_sys_openat2+0x16d/0x4c0 [ 44.780775][ T3605] ? build_open_flags+0x6f0/0x6f0 [ 44.785779][ T3605] ? ptrace_notify+0xfa/0x140 [ 44.790438][ T3605] ? lock_downgrade+0x6e0/0x6e0 [ 44.795267][ T3605] __x64_sys_open+0x119/0x1c0 [ 44.799929][ T3605] ? do_sys_open+0x140/0x140 [ 44.804499][ T3605] ? _raw_spin_unlock_irq+0x2a/0x40 [ 44.809701][ T3605] ? ptrace_notify+0xfa/0x140 [ 44.814357][ T3605] do_syscall_64+0x35/0xb0 [ 44.818762][ T3605] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 44.824640][ T3605] RIP: 0033:0x7f8b7519bc69 [ 44.829031][ T3605] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 44.848626][ T3605] RSP: 002b:00007ffee264fc58 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 44.857017][ T3605] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007f8b7519bc69 [ 44.864968][ T3605] RDX: 0000000000000000 RSI: 000000000000007f RDI: 0000000020000180 open("./file0", O_ACCMODE|O_CREAT|0x3c, 000) = 5 exit_group(0) = ? +++ exited with 0 +++ [ 44.