audit: type=1400 audit(1539755749.782:12): avc: denied { read } for pid=4438 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1539755749.932:13): avc: denied { map } for pid=4438 comm="syz-executor0" path="/dev/loop-control" dev="devtmpfs" ino=1058 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=chr_file permissive=1 ====================================================== WARNING: possible circular locking dependency detected 4.14.76+ #20 Not tainted ------------------------------------------------------ kworker/1:1/68 is trying to acquire lock: (&sb->s_type->i_mutex_key#9){+.+.}, at: [] inode_lock include/linux/fs.h:713 [inline] (&sb->s_type->i_mutex_key#9){+.+.}, at: [] __generic_file_fsync+0x9e/0x1a0 fs/libfs.c:981 but task is already holding lock: ((&dio->complete_work)){+.+.}, at: [] process_one_work+0x7bf/0x15c0 kernel/workqueue.c:2089 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 ((&dio->complete_work)){+.+.}: process_one_work+0x813/0x15c0 kernel/workqueue.c:2090 worker_thread+0xdc/0x1000 kernel/workqueue.c:2248 kthread+0x348/0x420 kernel/kthread.c:232 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:402 -> #1 ("dio/%s"sb->s_id){+.+.}: flush_workqueue+0xfc/0x1390 kernel/workqueue.c:2616 drain_workqueue+0x17b/0x3f0 kernel/workqueue.c:2781 destroy_workqueue+0x23/0x600 kernel/workqueue.c:4088 sb_init_dio_done_wq+0x5e/0x70 fs/direct-io.c:613 do_blockdev_direct_IO fs/direct-io.c:1263 [inline] __blockdev_direct_IO+0x29e2/0xc4e0 fs/direct-io.c:1399 ext4_direct_IO_write fs/ext4/inode.c:3710 [inline] ext4_direct_IO+0x905/0x27f0 fs/ext4/inode.c:3863 generic_file_direct_write+0x225/0x430 mm/filemap.c:2940 __generic_file_write_iter+0x213/0x540 mm/filemap.c:3119 ext4_file_write_iter+0x4f6/0xe20 fs/ext4/file.c:264 call_write_iter include/linux/fs.h:1782 [inline] aio_write+0x2f2/0x510 fs/aio.c:1551 io_submit_one fs/aio.c:1639 [inline] do_io_submit+0xef4/0x12a0 fs/aio.c:1707 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289 entry_SYSCALL_64_after_hwframe+0x42/0xb7 -> #0 (&sb->s_type->i_mutex_key#9){+.+.}: lock_acquire+0x10f/0x380 kernel/locking/lockdep.c:3991 down_write+0x34/0x90 kernel/locking/rwsem.c:54 inode_lock include/linux/fs.h:713 [inline] __generic_file_fsync+0x9e/0x1a0 fs/libfs.c:981 ext4_sync_file+0x39e/0x1050 fs/ext4/fsync.c:120 vfs_fsync_range+0x105/0x260 fs/sync.c:196 generic_write_sync include/linux/fs.h:2689 [inline] dio_complete+0x621/0x800 fs/direct-io.c:308 process_one_work+0x86e/0x15c0 kernel/workqueue.c:2114 worker_thread+0xdc/0x1000 kernel/workqueue.c:2248 kthread+0x348/0x420 kernel/kthread.c:232 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:402 other info that might help us debug this: Chain exists of: &sb->s_type->i_mutex_key#9 --> "dio/%s"sb->s_id --> (&dio->complete_work) Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock((&dio->complete_work)); lock("dio/%s"sb->s_id); lock((&dio->complete_work)); lock(&sb->s_type->i_mutex_key#9); *** DEADLOCK *** 2 locks held by kworker/1:1/68: #0: ("dio/%s"sb->s_id){+.+.}, at: [] process_one_work+0x787/0x15c0 kernel/workqueue.c:2085 #1: ((&dio->complete_work)){+.+.}, at: [] process_one_work+0x7bf/0x15c0 kernel/workqueue.c:2089 stack backtrace: CPU: 1 PID: 68 Comm: kworker/1:1 Not tainted 4.14.76+ #20 Workqueue: dio/sda1 dio_aio_complete_work Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0xb9/0x11b lib/dump_stack.c:53 print_circular_bug.isra.18.cold.43+0x2d3/0x40c kernel/locking/lockdep.c:1258 check_prev_add kernel/locking/lockdep.c:1901 [inline] check_prevs_add kernel/locking/lockdep.c:2018 [inline] validate_chain kernel/locking/lockdep.c:2460 [inline] __lock_acquire+0x2ff9/0x4320 kernel/locking/lockdep.c:3487 lock_acquire+0x10f/0x380 kernel/locking/lockdep.c:3991 down_write+0x34/0x90 kernel/locking/rwsem.c:54 inode_lock include/linux/fs.h:713 [inline] __generic_file_fsync+0x9e/0x1a0 fs/libfs.c:981 ext4_sync_file+0x39e/0x1050 fs/ext4/fsync.c:120 vfs_fsync_range+0x105/0x260 fs/sync.c:196 generic_write_sync include/linux/fs.h:2689 [inline] dio_complete+0x621/0x800 fs/direct-io.c:308 process_one_work+0x86e/0x15c0 kernel/workqueue.c:2114 worker_thread+0xdc/0x1000 kernel/workqueue.c:2248 kthread+0x348/0x420 kernel/kthread.c:232 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:402 hrtimer: interrupt took 15813 ns