binder: 27972:28009 ioctl c018620b 0 returned -14 binder: 28012:28017 BC_FREE_BUFFER u0000000020001000 no match binder: 28016:28021 ioctl c018620b 0 returned -14 ====================================================== binder_alloc: binder_alloc_mmap_handler: 28012 20001000-20004000 already mapped failed -16 WARNING: possible circular locking dependency detected 4.14.105+ #29 Not tainted ------------------------------------------------------ syz-executor.2/28018 is trying to acquire lock: (&pipe->mutex/1){+.+.}, at: [] __pipe_lock fs/pipe.c:88 [inline] (&pipe->mutex/1){+.+.}, at: [] fifo_open+0x156/0x9b0 fs/pipe.c:921 but task is already holding lock: (&sig->cred_guard_mutex){+.+.}, at: [] prepare_bprm_creds+0x51/0x110 fs/exec.c:1389 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&sig->cred_guard_mutex){+.+.}: -> #0 (&pipe->mutex/1){+.+.}: other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&sig->cred_guard_mutex); lock(&pipe->mutex/1); binder: BINDER_SET_CONTEXT_MGR already set lock(&sig->cred_guard_mutex binder: 28012:28025 BC_FREE_BUFFER u0000000020001000 no match ); lock( binder: 28012:28017 ioctl 40046207 0 returned -16 &pipe->mutex/1); *** DEADLOCK *** 1 lock held by syz-executor.2/28018: #0: (&sig->cred_guard_mutex){+.+.}, at: [] prepare_bprm_creds+0x51/0x110 fs/exec.c:1389 stack backtrace: CPU: 1 PID: 28018 Comm: syz-executor.2 Not tainted 4.14.105+ #29 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0xb9/0x10e lib/dump_stack.c:53 print_circular_bug.isra.0.cold+0x2dc/0x425 kernel/locking/lockdep.c:1258 binder: 28034:28038 ioctl c0306201 200005c0 returned -14 binder: 28034:28038 BC_FREE_BUFFER u0000000020001000 no match binder: 28034:28038 ioctl c0c0583b 20000100 returned -22 binder_alloc: binder_alloc_mmap_handler: 28034 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 28034:28043 ioctl 40046207 0 returned -16 binder: 28034:28038 ioctl c0306201 200005c0 returned -14 binder: 28034:28043 BC_FREE_BUFFER u0000000020001000 no match binder: 28034:28038 ioctl c0c0583b 20000100 returned -22 binder: 28052:28057 unknown command 1078485905 binder: 28052:28057 ioctl c0306201 20007000 returned -22 binder: 28052:28057 BC_INCREFS_DONE u0000000020001000 no match binder: 28052:28057 ioctl c0306201 20000080 returned -14 binder_alloc: binder_alloc_mmap_handler: 28052 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 28052:28062 unknown command 1078485905 binder: 28052:28057 ioctl 40046207 0 returned -16 binder: 28052:28062 ioctl c0306201 20007000 returned -22 binder: 28052:28057 BC_INCREFS_DONE u0000000020001000 no match binder: 28052:28057 ioctl c0306201 20000080 returned -14 binder: 28016:28036 ioctl c018620b 0 returned -14 binder: 28074:28079 BC_FREE_BUFFER u0000000000000000 no match binder: 28075:28081 ioctl c018620b 0 returned -14 binder_alloc: binder_alloc_mmap_handler: 28074 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 28074:28089 BC_FREE_BUFFER u0000000000000000 no match binder: 28074:28079 ioctl 40046207 0 returned -16 binder: 28103:28104 got transaction to context manager from process owning it binder: 28103:28104 transaction failed 29201/-22, size 0-0 line 3009 binder: 28103:28104 BC_FREE_BUFFER u0000000020001000 no match binder: BINDER_SET_CONTEXT_MGR already set binder: 28103:28106 ioctl 40046207 0 returned -16 binder_alloc: 28103: binder_alloc_buf, no vma binder: 28103:28104 transaction failed 29189/-3, size 0-0 line 3155 binder: 28103:28106 BC_FREE_BUFFER u0000000020001000 no match binder: undelivered TRANSACTION_ERROR: 29201 binder: undelivered TRANSACTION_ERROR: 29189 binder: 28075:28114 ioctl c018620b 0 returned -14 binder: 28123:28128 ioctl c018620b 0 returned -14 binder: 28121:28124 BC_FREE_BUFFER u0000000020001000 matched unreturned or currently freeing buffer binder_alloc: binder_alloc_mmap_handler: 28121 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 28121:28124 ioctl 40046207 0 returned -16 binder_alloc: 28121: binder_alloc_buf, no vma binder: 28121:28134 transaction failed 29189/-3, size 0-0 line 3155 binder: 28121:28134 BC_FREE_BUFFER u0000000020001000 no match binder: send failed reply for transaction 196 to 28121:28124 binder: undelivered TRANSACTION_COMPLETE binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29189 binder: 28123:28155 ioctl c018620b 0 returned -14 binder: 28161:28165 BC_FREE_BUFFER u0000000020001000 matched unreturned or currently freeing buffer binder: 28163:28168 ioctl c018620b 0 returned -14 binder_alloc: binder_alloc_mmap_handler: 28161 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 28161:28171 ioctl 40046207 0 returned -16 binder_alloc: 28161: binder_alloc_buf, no vma binder: 28161:28171 transaction failed 29189/-3, size 0-0 line 3155 binder: 28173:28174 ioctl c018620b 0 returned -14 binder: 28161:28176 BC_FREE_BUFFER u0000000020001000 matched unreturned or currently freeing buffer binder: send failed reply for transaction 199 to 28161:28165 binder: undelivered TRANSACTION_COMPLETE binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29189 binder: 28190:28200 BC_FREE_BUFFER u0000000020001000 matched unreturned or currently freeing buffer binder: 28173:28185 ioctl c018620b 0 returned -14 binder_alloc: binder_alloc_mmap_handler: 28190 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 28190:28200 ioctl 40046207 0 returned -16 binder_alloc: 28190: binder_alloc_buf, no vma binder: 28190:28234 transaction failed 29189/-3, size 0-0 line 3155 binder: 28190:28233 BC_FREE_BUFFER u0000000020001000 no match binder: send failed reply for transaction 202 to 28190:28191 binder: undelivered TRANSACTION_COMPLETE binder: undelivered TRANSACTION_ERROR: 29189 binder: 28237:28242 ioctl c018620b 0 returned -14 binder: 28240:28247 ioctl c0306201 20007000 returned -14 binder: undelivered TRANSACTION_ERROR: 29189 binder: 28240:28247 BC_FREE_BUFFER ue137d5b8568ba056 no match binder_alloc: binder_alloc_mmap_handler: 28240 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 28240:28247 ioctl 40046207 0 returned -16 binder: 28240:28256 BC_FREE_BUFFER ue137d5b8568ba056 no match binder: 28268:28272 unknown command -913414894 binder: 28268:28272 ioctl c0306201 20007000 returned -22 binder: 28268:28272 BC_FREE_BUFFER u0000000020001000 no match binder_alloc: binder_alloc_mmap_handler: 28268 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 28268:28272 ioctl 40046207 0 returned -16 binder: 28268:28283 unknown command -913414894 binder: 28268:28283 ioctl c0306201 20007000 returned -22 binder: 28268:28272 BC_FREE_BUFFER u0000000020001000 no match binder: 28237:28289 ioctl c018620b 0 returned -14 binder: 28292:28302 got reply transaction with no transaction stack binder: 28292:28302 transaction failed 29201/-71, size 56-16 line 2926 binder: 28305:28309 ioctl c018620b 0 returned -14 binder: 28292:28302 unknown command 0 binder: 28292:28302 ioctl c0306201 20000080 returned -22 binder: 28292:28302 BC_FREE_BUFFER u0000000000000000 no match binder: 28292:28321 got reply transaction with no transaction stack binder: 28292:28321 transaction failed 29201/-71, size 56-16 line 2926 binder: BINDER_SET_CONTEXT_MGR already set binder: 28292:28334 ioctl 40046207 0 returned -16 binder: 28292:28302 unknown command 0 binder: 28292:28321 BC_FREE_BUFFER u0000000000000000 no match binder: 28292:28302 ioctl c0306201 20000080 returned -22 binder: 28342:28345 BC_FREE_BUFFER u0000000020001000 matched unreturned or currently freeing buffer binder_alloc: binder_alloc_mmap_handler: 28342 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder_alloc: 28342: binder_alloc_buf, no vma binder: send failed reply for transaction 210 to 28342:28345 binder: 28342:28343 ioctl 40046207 0 returned -16 binder: undelivered TRANSACTION_COMPLETE binder: 28342:28345 transaction failed 29189/-3, size 0-0 line 3155 binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29189 binder: 28305:28327 ioctl c018620b 0 returned -14 binder: 28353:28357 BC_FREE_BUFFER u0000000020001000 matched unreturned or currently freeing buffer binder_alloc: binder_alloc_mmap_handler: 28353 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 28353:28357 ioctl 40046207 0 returned -16 binder: 28358:28362 ioctl c018620b 0 returned -14 binder_alloc: 28353: binder_alloc_buf, no vma binder: 28358:28362 ioctl c0306201 20000000 returned -11 binder: 28358:28362 ioctl c018620b 0 returned -14 binder: 28353:28363 transaction failed 29189/-3, size 0-0 line 3155 binder: 28353:28370 BC_FREE_BUFFER u0000000020001000 no match binder: send failed reply for transaction 213 to 28353:28357 binder: undelivered TRANSACTION_COMPLETE binder: 28383:28390 ioctl c018620b 0 returned -14 binder: undelivered TRANSACTION_ERROR: 29189 binder: 28393:28399 unknown command -118754704 binder: undelivered TRANSACTION_ERROR: 29189 binder: 28393:28399 ioctl c0306201 20007000 returned -22 binder: 28383:28390 ioctl c018620b 0 returned -14 binder: 28393:28399 BC_FREE_BUFFER u0000000020001000 no match binder_alloc: binder_alloc_mmap_handler: 28393 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 28393:28411 unknown command -118754704 binder: 28393:28399 ioctl 40046207 0 returned -16 binder: 28393:28411 ioctl c0306201 20007000 returned -22 binder: 28393:28426 BC_FREE_BUFFER u0000000020001000 no match binder: 28421:28425 ioctl c018620b 0 returned -14 binder: 28436:28441 BC_FREE_BUFFER u0000000020001000 matched unreturned or currently freeing buffer binder_alloc: binder_alloc_mmap_handler: 28436 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 28436:28441 ioctl 40046207 0 returned -16 binder_alloc: 28436: binder_alloc_buf, no vma binder: 28436:28452 transaction failed 29189/-3, size 0-0 line 3155 binder: 28436:28452 BC_FREE_BUFFER u0000000020001000 no match binder: send failed reply for transaction 217 to 28436:28441 binder: undelivered TRANSACTION_COMPLETE binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29189 binder: 28421:28442 ioctl c018620b 0 returned -14 binder: 28467:28475 ioctl c0306201 20007000 returned -14 binder: 28473:28479 ioctl c018620b 0 returned -14 binder: 28467:28475 BC_FREE_BUFFER u0000000020001000 no match binder_alloc: binder_alloc_mmap_handler: 28467 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 28467:28475 ioctl 40046207 0 returned -16 binder: 28467:28483 ioctl c0306201 20007000 returned -14 binder: 28473:28479 ioctl c018620b 0 returned -14 binder: 28467:28483 BC_FREE_BUFFER u0000000020001000 no match binder: 28501:28505 ioctl c018620b 0 returned -14 binder: 28511:28514 got transaction to invalid handle binder: 28511:28514 transaction failed 29201/-22, size 6641258932425866934-5740694466480615429 line 3018 binder: 28511:28514 BC_FREE_BUFFER u0000000020001000 no match binder_alloc: binder_alloc_mmap_handler: 28511 20001000-20004000 already mapped failed -16 binder: 28526:28531 ioctl c018620b 0 returned -14 binder: BINDER_SET_CONTEXT_MGR already set binder: 28511:28532 got transaction to invalid handle binder: 28511:28514 ioctl 40046207 0 returned -16 binder: 28511:28532 transaction failed 29201/-22, size 6641258932425866934-5740694466480615429 line 3018 binder: 28511:28541 BC_FREE_BUFFER u0000000020001000 no match binder: undelivered TRANSACTION_ERROR: 29201 binder: undelivered TRANSACTION_ERROR: 29201 binder: 28555:28557 ioctl c018620b 0 returned -14 binder: 28547:28553 BC_FREE_BUFFER u0000000020001000 matched unreturned or currently freeing buffer binder_alloc: binder_alloc_mmap_handler: 28547 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 28547:28553 ioctl 40046207 0 returned -16 binder_alloc: 28547: binder_alloc_buf, no vma binder: 28547:28558 transaction failed 29189/-3, size 0-0 line 3155 binder: 28547:28569 BC_FREE_BUFFER u0000000020001000 no match binder: send failed reply for transaction 224 to 28547:28553 binder: undelivered TRANSACTION_COMPLETE binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29189 binder: 28575:28579 ioctl c018620b 0 returned -14 binder: 28583:28584 got transaction to invalid handle binder: 28583:28584 transaction failed 29201/-22, size 4776368651657170334-2197250194371405033 line 3018 binder: 28583:28584 BC_FREE_BUFFER u0000000020001000 no match binder_alloc: binder_alloc_mmap_handler: 28583 20001000-20004000 already mapped failed -16 binder: 28583:28585 got transaction to invalid handle binder: BINDER_SET_CONTEXT_MGR already set binder: 28583:28584 ioctl 40046207 0 returned -16 binder: 28583:28585 transaction failed 29201/-22, size 4776368651657170334-2197250194371405033 line 3018 binder: 28583:28585 BC_FREE_BUFFER u0000000020001000 no match binder: undelivered TRANSACTION_ERROR: 29201 binder: undelivered TRANSACTION_ERROR: 29201 binder: 28592:28598 BC_FREE_BUFFER u0000000020001000 matched unreturned or currently freeing buffer binder_alloc: binder_alloc_mmap_handler: 28592 20001000-20004000 already mapped failed -16 binder: 28599:28606 ioctl c018620b 0 returned -14 binder_alloc: 28592: binder_alloc_buf, no vma binder: BINDER_SET_CONTEXT_MGR already set binder: 28592:28607 transaction failed 29189/-3, size 0-0 line 3155 binder: 28592:28609 BC_FREE_BUFFER u0000000020001000 no match binder: 28592:28598 ioctl 40046207 0 returned -16 binder: send failed reply for transaction 230 to 28592:28598 binder: undelivered TRANSACTION_COMPLETE binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29189 binder: 28623:28628 ioctl c018620b 0 returned -14 binder: 28625:28629 got transaction to invalid handle binder: 28627:28631 ioctl c018620b 0 returned -14 binder: 28625:28629 transaction failed 29201/-22, size 4556868536898420736-3210373613 line 3018 binder: 28625:28629 BC_FREE_BUFFER u0000000020001000 no match binder_alloc: binder_alloc_mmap_handler: 28625 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder: 28625:28629 ioctl 40046207 0 returned -16 binder: 28625:28637 got transaction to invalid handle binder: 28625:28637 transaction failed 29201/-22, size 4556868536898420736-3210373613 line 3018 binder: 28625:28637 BC_FREE_BUFFER u0000000020001000 no match binder: undelivered TRANSACTION_ERROR: 29201 binder: undelivered TRANSACTION_ERROR: 29201 binder_alloc: 28654: binder_alloc_buf, no vma binder: 28654:28656 transaction failed 29189/-3, size 0-0 line 3155 binder: 28654:28656 BC_FREE_BUFFER u0000000020001000 no match binder: BINDER_SET_CONTEXT_MGR already set binder: 28654:28656 ioctl 40046207 0 returned -16 binder: undelivered TRANSACTION_ERROR: 29189 binder_alloc: 28654: binder_alloc_buf, no vma binder: 28654:28661 transaction failed 29189/-3, size 0-0 line 3155 binder: undelivered TRANSACTION_ERROR: 29189 binder: 28670:28678 ioctl c018620b 0 returned -14 binder_alloc: binder_alloc_mmap_handler: 28674 20001000-20004000 already mapped failed -16 binder: 28668:28681 ioctl c018620b 0 returned -14 binder: BINDER_SET_CONTEXT_MGR already set binder_alloc: 28674: binder_alloc_buf, no vma binder: send failed reply for transaction 239 to 28674:28679 binder: 28674:28679 transaction failed 29189/-3, size 0-0 line 3155 binder: undelivered TRANSACTION_COMPLETE binder: 28674:28683 ioctl 40046207 0 returned -16 binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29189 binder: 28697:28701 BC_FREE_BUFFER u0000000020001000 matched unreturned or currently freeing buffer binder_alloc: binder_alloc_mmap_handler: 28697 20001000-20004000 already mapped failed -16 binder: BINDER_SET_CONTEXT_MGR already set binder_alloc: 28697: binder_alloc_buf, no vma binder: 28697:28701 ioctl 40046207 0 returned -16 binder: 28697:28703 transaction failed 29189/-3, size 0-0 line 3155 binder: 28697:28703 BC_FREE_BUFFER u0000000020001000 no match binder: send failed reply for transaction 242 to 28697:28701 binder: undelivered TRANSACTION_COMPLETE binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29189 binder: 28719:28727 BC_FREE_BUFFER u0000000020001000 matched unreturned or currently freeing buffer binder: 28723:28729 ioctl c018620b 0 returned -14 binder: 28724:28730 ioctl c018620b 0 returned -14