======================================================
[ INFO: possible circular locking dependency detected ]
4.4.171+ #12 Not tainted
-------------------------------------------------------
syz-executor4/21863 is trying to acquire lock:
 (sel_mutex){+.+.+.}, at: [ 1184.434398] Dead loop on virtual device ip6tnl0, fix it urgently!
[<ffffffff819775d9>] sel_commit_bools_write+0x89/0x260 security/selinux/selinuxfs.c:1142

but task is already holding lock:
 (&pipe->mutex/1){+.+.+.}, at: [<ffffffff814af493>] pipe_lock_nested fs/pipe.c:65 [inline]
 (&pipe->mutex/1){+.+.+.}, at: [<ffffffff814af493>] pipe_lock+0x63/0x80 fs/pipe.c:73

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

       [<ffffffff81205d5e>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
       [<ffffffff8270b861>] __mutex_lock_common kernel/locking/mutex.c:521 [inline]
       [<ffffffff8270b861>] mutex_lock_nested+0xc1/0xb80 kernel/locking/mutex.c:621
       [<ffffffff814b24dd>] __pipe_lock fs/pipe.c:86 [inline]
       [<ffffffff814b24dd>] fifo_open+0x15d/0xa00 fs/pipe.c:896
       [<ffffffff814912af>] do_dentry_open+0x38f/0xbd0 fs/open.c:749
       [<ffffffff81494a9b>] vfs_open+0x10b/0x210 fs/open.c:862
       [<ffffffff814c59bf>] do_last fs/namei.c:3269 [inline]
       [<ffffffff814c59bf>] path_openat+0x136f/0x4470 fs/namei.c:3406
       [<ffffffff814cc691>] do_filp_open+0x1a1/0x270 fs/namei.c:3440
       [<ffffffff814a786c>] do_open_execat+0x10c/0x6e0 fs/exec.c:805
       [<ffffffff814acee6>] do_execveat_common.isra.0+0x6f6/0x1e90 fs/exec.c:1577
       [<ffffffff814af0c8>] compat_do_execve fs/exec.c:1710 [inline]
       [<ffffffff814af0c8>] C_SYSC_execve fs/exec.c:1785 [inline]
       [<ffffffff814af0c8>] compat_SyS_execve+0x48/0x60 fs/exec.c:1781
       [<ffffffff8100603d>] do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline]
       [<ffffffff8100603d>] do_fast_syscall_32+0x32d/0xa90 arch/x86/entry/common.c:397
       [<ffffffff82719790>] sysenter_flags_fixed+0xd/0x1a

       [<ffffffff81205d5e>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
       [<ffffffff8270cf72>] __mutex_lock_common kernel/locking/mutex.c:521 [inline]
       [<ffffffff8270cf72>] mutex_lock_killable_nested+0xd2/0xd00 kernel/locking/mutex.c:641
       [<ffffffff815e48a2>] do_io_accounting+0x1f2/0x7f0 fs/proc/base.c:2666
       [<ffffffff815e4ec3>] proc_tgid_io_accounting+0x23/0x30 fs/proc/base.c:2715
       [<ffffffff815e2a46>] proc_single_show+0xf6/0x160 fs/proc/base.c:805
       [<ffffffff81507c3d>] seq_read+0x4cd/0x1240 fs/seq_file.c:240
       [<ffffffff81496196>] __vfs_read+0x116/0x3c0 fs/read_write.c:432
       [<ffffffff81497ea4>] vfs_read+0x134/0x360 fs/read_write.c:454
       [<ffffffff8149aaaf>] SYSC_pread64 fs/read_write.c:607 [inline]
       [<ffffffff8149aaaf>] SyS_pread64+0x13f/0x170 fs/read_write.c:594
       [<ffffffff810be6f9>] sys32_pread+0x39/0x50 arch/x86/ia32/sys_ia32.c:179
       [<ffffffff8100603d>] do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline]
       [<ffffffff8100603d>] do_fast_syscall_32+0x32d/0xa90 arch/x86/entry/common.c:397
       [<ffffffff82719790>] sysenter_flags_fixed+0xd/0x1a

       [<ffffffff81205d5e>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
       [<ffffffff8270b861>] __mutex_lock_common kernel/locking/mutex.c:521 [inline]
       [<ffffffff8270b861>] mutex_lock_nested+0xc1/0xb80 kernel/locking/mutex.c:621
       [<ffffffff81507846>] seq_read+0xd6/0x1240 fs/seq_file.c:178
       [<ffffffff815dff9d>] proc_reg_read+0xfd/0x180 fs/proc/inode.c:202
       [<ffffffff81496cc8>] do_loop_readv_writev+0x148/0x1e0 fs/read_write.c:680
       [<ffffffff81498b23>] do_readv_writev+0x573/0x6e0 fs/read_write.c:810
       [<ffffffff81498d0a>] vfs_readv+0x7a/0xb0 fs/read_write.c:834
       [<ffffffff81535bfc>] kernel_readv fs/splice.c:586 [inline]
       [<ffffffff81535bfc>] default_file_splice_read+0x3ac/0x8b0 fs/splice.c:662
       [<ffffffff81531ddf>] do_splice_to+0xff/0x160 fs/splice.c:1154
       [<ffffffff81532089>] splice_direct_to_actor+0x249/0x850 fs/splice.c:1226
       [<ffffffff81532835>] do_splice_direct+0x1a5/0x260 fs/splice.c:1337
       [<ffffffff81499f3d>] do_sendfile+0x4ed/0xba0 fs/read_write.c:1227
       [<ffffffff8149c0b4>] C_SYSC_sendfile fs/read_write.c:1309 [inline]
       [<ffffffff8149c0b4>] compat_SyS_sendfile+0x144/0x160 fs/read_write.c:1292
       [<ffffffff8100603d>] do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline]
       [<ffffffff8100603d>] do_fast_syscall_32+0x32d/0xa90 arch/x86/entry/common.c:397
       [<ffffffff82719790>] sysenter_flags_fixed+0xd/0x1a

       [<ffffffff81205d5e>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
       [<ffffffff8149e60f>] percpu_down_read include/linux/percpu-rwsem.h:26 [inline]
       [<ffffffff8149e60f>] __sb_start_write+0x1af/0x310 fs/super.c:1221
       [<ffffffff816c36d4>] sb_start_write include/linux/fs.h:1517 [inline]
       [<ffffffff816c36d4>] ext4_run_li_request fs/ext4/super.c:2685 [inline]
       [<ffffffff816c36d4>] ext4_lazyinit_thread fs/ext4/super.c:2784 [inline]
       [<ffffffff816c36d4>] ext4_lazyinit_thread+0x1e4/0x7b0 fs/ext4/super.c:2760
       [<ffffffff811340b3>] kthread+0x273/0x310 kernel/kthread.c:211
       [<ffffffff82718405>] ret_from_fork+0x55/0x80 arch/x86/entry/entry_64.S:537

       [<ffffffff81205d5e>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
       [<ffffffff8270b861>] __mutex_lock_common kernel/locking/mutex.c:521 [inline]
       [<ffffffff8270b861>] mutex_lock_nested+0xc1/0xb80 kernel/locking/mutex.c:621
       [<ffffffff816cd6ad>] ext4_register_li_request+0x2fd/0x7d0 fs/ext4/super.c:2972
       [<ffffffff816ceee6>] ext4_remount+0x1366/0x1b90 fs/ext4/super.c:4922
       [<ffffffff814a18ab>] do_remount_sb2+0x41b/0x7a0 fs/super.c:771
       [<ffffffff8150248b>] do_remount fs/namespace.c:2347 [inline]
       [<ffffffff8150248b>] do_mount+0xfdb/0x2a40 fs/namespace.c:2860
       [<ffffffff815048e0>] SYSC_mount fs/namespace.c:3063 [inline]
       [<ffffffff815048e0>] SyS_mount+0x130/0x1d0 fs/namespace.c:3041
       [<ffffffff82717fe1>] entry_SYSCALL_64_fastpath+0x1e/0x9a

       [<ffffffff81205d5e>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
       [<ffffffff8270b861>] __mutex_lock_common kernel/locking/mutex.c:521 [inline]
       [<ffffffff8270b861>] mutex_lock_nested+0xc1/0xb80 kernel/locking/mutex.c:621
       [<ffffffff816cd439>] ext4_register_li_request+0x89/0x7d0 fs/ext4/super.c:2945
       [<ffffffff816ceee6>] ext4_remount+0x1366/0x1b90 fs/ext4/super.c:4922
       [<ffffffff814a18ab>] do_remount_sb2+0x41b/0x7a0 fs/super.c:771
       [<ffffffff8150248b>] do_remount fs/namespace.c:2347 [inline]
       [<ffffffff8150248b>] do_mount+0xfdb/0x2a40 fs/namespace.c:2860
       [<ffffffff815048e0>] SYSC_mount fs/namespace.c:3063 [inline]
       [<ffffffff815048e0>] SyS_mount+0x130/0x1d0 fs/namespace.c:3041
       [<ffffffff82717fe1>] entry_SYSCALL_64_fastpath+0x1e/0x9a

       [<ffffffff81205d5e>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
       [<ffffffff82713072>] down_read+0x42/0x60 kernel/locking/rwsem.c:22
       [<ffffffff814a0ff1>] iterate_supers+0xe1/0x250 fs/super.c:537
       [<ffffffff819b1587>] selinux_complete_init+0x2f/0x31 security/selinux/hooks.c:6154
       [<ffffffff819a30cd>] security_load_policy+0x69d/0x9c0 security/selinux/ss/services.c:2060
       [<ffffffff819799f5>] sel_write_load+0x175/0xf90 security/selinux/selinuxfs.c:535
       [<ffffffff81496556>] __vfs_write+0x116/0x3d0 fs/read_write.c:489
       [<ffffffff81498252>] vfs_write+0x182/0x4e0 fs/read_write.c:538
       [<ffffffff8149a88c>] SYSC_write fs/read_write.c:585 [inline]
       [<ffffffff8149a88c>] SyS_write+0xdc/0x1c0 fs/read_write.c:577
       [<ffffffff82717fe1>] entry_SYSCALL_64_fastpath+0x1e/0x9a

       [<ffffffff81202b76>] check_prev_add kernel/locking/lockdep.c:1853 [inline]
       [<ffffffff81202b76>] check_prevs_add kernel/locking/lockdep.c:1958 [inline]
       [<ffffffff81202b76>] validate_chain kernel/locking/lockdep.c:2144 [inline]
       [<ffffffff81202b76>] __lock_acquire+0x37d6/0x4f50 kernel/locking/lockdep.c:3213
       [<ffffffff81205d5e>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
       [<ffffffff8270b861>] __mutex_lock_common kernel/locking/mutex.c:521 [inline]
       [<ffffffff8270b861>] mutex_lock_nested+0xc1/0xb80 kernel/locking/mutex.c:621
       [<ffffffff819775d9>] sel_commit_bools_write+0x89/0x260 security/selinux/selinuxfs.c:1142
       [<ffffffff81496556>] __vfs_write+0x116/0x3d0 fs/read_write.c:489
       [<ffffffff81496922>] __kernel_write+0x112/0x370 fs/read_write.c:511
       [<ffffffff81532a4d>] write_pipe_buf+0x15d/0x1f0 fs/splice.c:1074
       [<ffffffff8153374e>] splice_from_pipe_feed fs/splice.c:776 [inline]
       [<ffffffff8153374e>] __splice_from_pipe+0x37e/0x7a0 fs/splice.c:901
       [<ffffffff815367c8>] splice_from_pipe+0x108/0x170 fs/splice.c:936
       [<ffffffff815368bc>] default_file_splice_write+0x3c/0x80 fs/splice.c:1086
       [<ffffffff81537911>] do_splice_from fs/splice.c:1128 [inline]
       [<ffffffff81537911>] do_splice fs/splice.c:1404 [inline]
       [<ffffffff81537911>] SYSC_splice fs/splice.c:1707 [inline]
       [<ffffffff81537911>] SyS_splice+0xd71/0x13a0 fs/splice.c:1690
       [<ffffffff8100603d>] do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline]
       [<ffffffff8100603d>] do_fast_syscall_32+0x32d/0xa90 arch/x86/entry/common.c:397
       [<ffffffff82719790>] sysenter_flags_fixed+0xd/0x1a

other info that might help us debug this:

Chain exists of:
 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&pipe->mutex/1);
                               lock(&sig->cred_guard_mutex);
                               lock(&pipe->mutex/1);
  lock(sel_mutex);

 *** DEADLOCK ***

2 locks held by syz-executor4/21863:
 #0:  (sb_writers#3){.+.+.+}, at: [<ffffffff81537acd>] file_start_write include/linux/fs.h:2543 [inline]
 #0:  (sb_writers#3){.+.+.+}, at: [<ffffffff81537acd>] do_splice fs/splice.c:1403 [inline]
 #0:  (sb_writers#3){.+.+.+}, at: [<ffffffff81537acd>] SYSC_splice fs/splice.c:1707 [inline]
 #0:  (sb_writers#3){.+.+.+}, at: [<ffffffff81537acd>] SyS_splice+0xf2d/0x13a0 fs/splice.c:1690
 #1:  (&pipe->mutex/1){+.+.+.}, at: [<ffffffff814af493>] pipe_lock_nested fs/pipe.c:65 [inline]
 #1:  (&pipe->mutex/1){+.+.+.}, at: [<ffffffff814af493>] pipe_lock+0x63/0x80 fs/pipe.c:73

stack backtrace:
CPU: 1 PID: 21863 Comm: syz-executor4 Not tainted 4.4.171+ #12
 0000000000000000 210e102e69959910 ffff8801a148f540 ffffffff81aacd31
 ffffffff84057a80 ffff8800a361df00 ffffffff83ab8a20 ffffffff83abd2b0
 ffffffff83ab6860 ffff8801a148f590 ffffffff813abad4 ffffffff83e61680
Call Trace:
 [<ffffffff81aacd31>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81aacd31>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
 [<ffffffff813abad4>] print_circular_bug.cold+0x2f7/0x44e kernel/locking/lockdep.c:1226
 [<ffffffff81202b76>] check_prev_add kernel/locking/lockdep.c:1853 [inline]
 [<ffffffff81202b76>] check_prevs_add kernel/locking/lockdep.c:1958 [inline]
 [<ffffffff81202b76>] validate_chain kernel/locking/lockdep.c:2144 [inline]
 [<ffffffff81202b76>] __lock_acquire+0x37d6/0x4f50 kernel/locking/lockdep.c:3213
 [<ffffffff81205d5e>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
 [<ffffffff8270b861>] __mutex_lock_common kernel/locking/mutex.c:521 [inline]
 [<ffffffff8270b861>] mutex_lock_nested+0xc1/0xb80 kernel/locking/mutex.c:621
 [<ffffffff819775d9>] sel_commit_bools_write+0x89/0x260 security/selinux/selinuxfs.c:1142
 [<ffffffff81496556>] __vfs_write+0x116/0x3d0 fs/read_write.c:489
 [<ffffffff81496922>] __kernel_write+0x112/0x370 fs/read_write.c:511
 [<ffffffff81532a4d>] write_pipe_buf+0x15d/0x1f0 fs/splice.c:1074
 [<ffffffff8153374e>] splice_from_pipe_feed fs/splice.c:776 [inline]
 [<ffffffff8153374e>] __splice_from_pipe+0x37e/0x7a0 fs/splice.c:901
 [<ffffffff815367c8>] splice_from_pipe+0x108/0x170 fs/splice.c:936
 [<ffffffff815368bc>] default_file_splice_write+0x3c/0x80 fs/splice.c:1086
 [<ffffffff81537911>] do_splice_from fs/splice.c:1128 [inline]
 [<ffffffff81537911>] do_splice fs/splice.c:1404 [inline]
 [<ffffffff81537911>] SYSC_splice fs/splice.c:1707 [inline]
 [<ffffffff81537911>] SyS_splice+0xd71/0x13a0 fs/splice.c:1690
 [<ffffffff8100603d>] do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline]
 [<ffffffff8100603d>] do_fast_syscall_32+0x32d/0xa90 arch/x86/entry/common.c:397
 [<ffffffff82719790>] sysenter_flags_fixed+0xd/0x1a
Dead loop on virtual device ip6tnl0, fix it urgently!
Dead loop on virtual device ip6tnl0, fix it urgently!
Dead loop on virtual device ip6tnl0, fix it urgently!
Dead loop on virtual device ip6tnl0, fix it urgently!
Dead loop on virtual device ip6tnl0, fix it urgently!
Dead loop on virtual device ip6tnl0, fix it urgently!
Dead loop on virtual device ip6tnl0, fix it urgently!
Dead loop on virtual device ip6tnl0, fix it urgently!
Dead loop on virtual device ip6tnl0, fix it urgently!