====================================================== WARNING: possible circular locking dependency detected 4.14.101+ #15 Not tainted ------------------------------------------------------ syz-executor.1/13786 is trying to acquire lock: (&sig->cred_guard_mutex){+.+.}, at: [] proc_pid_attr_write+0x152/0x280 fs/proc/base.c:2590 but task is already holding lock: (&pipe->mutex/1){+.+.}, at: [] pipe_lock_nested fs/pipe.c:67 [inline] (&pipe->mutex/1){+.+.}, at: [] pipe_lock+0x58/0x70 fs/pipe.c:75 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&pipe->mutex/1){+.+.}: -> #0 (&sig->cred_guard_mutex){+.+.}: other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&pipe->mutex/1); lock(&sig->cred_guard_mutex); lock(&pipe->mutex/1); lock(&sig->cred_guard_mutex); *** DEADLOCK *** 2 locks held by syz-executor.1/13786: #0: (sb_writers#7){.+.+}, at: [] file_start_write include/linux/fs.h:2726 [inline] #0: (sb_writers#7){.+.+}, at: [] do_splice fs/splice.c:1146 [inline] #0: (sb_writers#7){.+.+}, at: [] SYSC_splice fs/splice.c:1402 [inline] #0: (sb_writers#7){.+.+}, at: [] SyS_splice+0xec1/0x12d0 fs/splice.c:1382 #1: (&pipe->mutex/1){+.+.}, at: [] pipe_lock_nested fs/pipe.c:67 [inline] #1: (&pipe->mutex/1){+.+.}, at: [] pipe_lock+0x58/0x70 fs/pipe.c:75 stack backtrace: CPU: 0 PID: 13786 Comm: syz-executor.1 Not tainted 4.14.101+ #15 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0xb9/0x10e lib/dump_stack.c:53 print_circular_bug.isra.0.cold+0x2dc/0x425 kernel/locking/lockdep.c:1258 audit: type=1400 audit(1550618406.446:44): avc: denied { map } for pid=13954 comm="syz-executor.5" path="socket:[40007]" dev="sockfs" ino=40007 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=key_socket permissive=1 selinux_nlmsg_perm: 6 callbacks suppressed SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14067 comm=syz-executor.1 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14067 comm=syz-executor.1 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14067 comm=syz-executor.1 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14067 comm=syz-executor.1 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14067 comm=syz-executor.1 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14067 comm=syz-executor.1 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14067 comm=syz-executor.1 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14067 comm=syz-executor.1 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14067 comm=syz-executor.1 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14067 comm=syz-executor.1 audit: type=1400 audit(1550618409.946:45): avc: denied { map } for pid=14146 comm="syz-executor.2" path="socket:[41176]" dev="sockfs" ino=41176 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=1 audit: type=1326 audit(1550618413.426:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=14360 comm="syz-executor.0" exe="/root/syz-executor.0" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45ac8a code=0x0 audit: type=1326 audit(1550618414.276:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=14424 comm="syz-executor.0" exe="/root/syz-executor.0" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45ac8a code=0x0