====================================================== WARNING: possible circular locking dependency detected 4.14.107+ #33 Not tainted binder: 26659:26663 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 ------------------------------------------------------ syz-executor.5/26662 is trying to acquire lock: (&p->lock){+.+.}, at: [] seq_read+0xcd/0x1180 fs/seq_file.c:165 but task is already holding lock: binder: 26659:26663 got reply transaction with no transaction stack (&pipe->mutex/1){+.+.}, at: [] pipe_lock_nested fs/pipe.c:67 [inline] (&pipe->mutex/1){+.+.}, at: [] pipe_lock+0x58/0x70 fs/pipe.c:75 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&pipe->mutex/1){+.+.}: -> #1 ( binder: 26659:26663 transaction failed 29201/-71, size 0-0 line 2926 &sig->cred_guard_mutex){+.+.}: -> #0 (&p->lock){+.+.}: other info that might help us debug this: Chain exists of: &p->lock --> &sig->cred_guard_mutex --> &pipe->mutex/1 Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&pipe->mutex/1); lock(&sig->cred_guard_mutex); lock( binder: 26659:26671 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 &pipe->mutex/1); lock(&p->lock); *** DEADLOCK *** 1 lock held by syz-executor.5/26662: #0: (&pipe->mutex/1){+.+.}, at: [] pipe_lock_nested fs/pipe.c:67 [inline] #0: (&pipe->mutex/1){+.+.}, at: [] pipe_lock+0x58/0x70 fs/pipe.c:75 binder: 26659:26671 got reply transaction with no transaction stack stack backtrace: CPU: 1 PID: 26662 Comm: syz-executor.5 Not tainted 4.14.107+ #33 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0xb9/0x10e lib/dump_stack.c:53 print_circular_bug.isra.0.cold+0x2dc/0x425 kernel/locking/lockdep.c:1258 binder: 26659:26671 transaction failed 29201/-71, size 0-0 line 2926 device lo entered promiscuous mode binder: undelivered TRANSACTION_ERROR: 29201 binder: undelivered TRANSACTION_ERROR: 29201 binder: 26682:26690 unknown command 811793 binder: 26682:26690 ioctl c0306201 20000280 returned -22 binder: 26682:26690 got reply transaction with no transaction stack binder: 26682:26690 transaction failed 29201/-71, size 32-24 line 2926 binder: 26682:26690 unknown command 811793 binder: 26682:26698 got reply transaction with no transaction stack binder: undelivered TRANSACTION_ERROR: 29201 binder: 26682:26690 ioctl c0306201 20000280 returned -22 binder: 26682:26698 transaction failed 29201/-71, size 32-24 line 2926 binder: undelivered TRANSACTION_ERROR: 29201 binder: 26708:26717 unknown command 0 binder: 26708:26717 ioctl c0306201 20000280 returned -22 binder: 26708:26734 unknown command 0 binder: 26708:26734 ioctl c0306201 20000280 returned -22 binder: 26751:26756 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 binder: 26751:26756 got reply transaction with no transaction stack binder: 26751:26756 transaction failed 29201/-71, size -5862124642259586985-7277816997857381670 line 2926 binder: 26751:26756 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 binder: undelivered TRANSACTION_ERROR: 29201 binder: 26751:26756 got reply transaction with no transaction stack binder: 26751:26756 transaction failed 29201/-71, size -5862124642259586985-7277816997857381670 line 2926 binder: undelivered TRANSACTION_ERROR: 29201 binder: 26786:26789 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 binder: 26786:26789 got reply transaction with no transaction stack binder: 26786:26789 transaction failed 29201/-71, size 0-0 line 2926 binder: 26786:26789 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 binder: undelivered TRANSACTION_ERROR: 29201 binder: 26786:26789 got reply transaction with no transaction stack binder: 26786:26789 transaction failed 29201/-71, size 0-0 line 2926 binder: undelivered TRANSACTION_ERROR: 29201 device lo left promiscuous mode device lo entered promiscuous mode binder: 26802:26803 ioctl 5404 20000080 returned -22 binder: 26802:26803 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 binder: 26802:26803 got reply transaction with no transaction stack binder: 26802:26803 transaction failed 29201/-71, size 0-0 line 2926 binder: 26802:26803 ioctl 5404 20000080 returned -22 binder: 26802:26818 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 binder: 26802:26818 got reply transaction with no transaction stack binder: 26802:26818 transaction failed 29201/-71, size 0-0 line 2926 binder: undelivered TRANSACTION_ERROR: 29201 binder: undelivered TRANSACTION_ERROR: 29201 binder: 26825:26827 unknown command 234881536 binder: 26825:26827 ioctl c0306201 20000280 returned -22 device lo left promiscuous mode device lo entered promiscuous mode binder: 26825:26877 unknown command 234881536 binder: 26825:26877 ioctl c0306201 20000280 returned -22 device lo left promiscuous mode device lo entered promiscuous mode binder: 26912:26918 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 binder: 26912:26918 got reply transaction with no transaction stack binder: 26912:26918 transaction failed 29201/-71, size 0-0 line 2926 binder: undelivered TRANSACTION_ERROR: 29201 binder: 26952:26958 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1080229889 binder: 26952:26958 unknown command 0 binder: 26952:26958 ioctl c0306201 20000280 returned -22 binder: 26982:26983 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 binder: 26982:26983 got reply transaction with no transaction stack device lo left promiscuous mode device lo entered promiscuous mode binder: 26982:26983 transaction failed 29201/-71, size 0-0 line 2926 binder: 26982:27001 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 binder: 26982:27001 got reply transaction with no transaction stack binder: 26982:27001 transaction failed 29201/-71, size 0-0 line 2926 binder: undelivered TRANSACTION_ERROR: 29201 binder: undelivered TRANSACTION_ERROR: 29201 binder: 27012:27017 BC_DEAD_BINDER_DONE 0000000000000000 not found binder: 27012:27017 got reply transaction with no transaction stack binder: 27012:27017 transaction failed 29201/-71, size 88-48 line 2926 binder: 27012:27029 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 binder: 27012:27029 unknown command -2113924021 binder: 27012:27029 ioctl c0306201 20000540 returned -22 binder: 27012:27017 BC_DEAD_BINDER_DONE 0000000000000000 not found binder: 27012:27017 got reply transaction with no transaction stack device lo left promiscuous mode binder: 27012:27029 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 device lo entered promiscuous mode binder: 27012:27017 transaction failed 29201/-71, size 88-48 line 2926 binder: 27012:27029 unknown command -2113924021 binder: 27012:27029 ioctl c0306201 20000540 returned -22 binder: 27052:27059 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 binder: 27052:27059 got reply transaction with no transaction stack binder: 27052:27059 transaction failed 29201/-71, size 0-0 line 2926 binder: undelivered TRANSACTION_ERROR: 29201 device lo left promiscuous mode device lo entered promiscuous mode binder: 27106:27114 unknown command 20996877 binder: 27106:27114 ioctl c0306201 20000280 returned -22 device lo left promiscuous mode device lo entered promiscuous mode binder: 27126:27131 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 binder: 27126:27131 got reply transaction with no transaction stack binder: 27126:27131 transaction failed 29201/-71, size 0-0 line 2926 binder: 27126:27140 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 binder: 27126:27140 got reply transaction with no transaction stack binder: 27126:27140 transaction failed 29201/-71, size 0-0 line 2926 binder: undelivered TRANSACTION_ERROR: 29201 binder: undelivered TRANSACTION_ERROR: 29201 binder: 27157:27160 unknown command 25101 binder: 27157:27160 ioctl c0306201 20000280 returned -22 device lo left promiscuous mode device lo entered promiscuous mode binder: 27177:27179 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 binder: 27177:27179 unknown command 25344 binder: 27177:27179 ioctl c0306201 20000280 returned -22 binder: 27197:27200 unknown command 29453 binder: 27197:27200 ioctl c0306201 20000280 returned -22 binder: 27197:27204 unknown command 29453 binder: 27197:27204 ioctl c0306201 20000280 returned -22 binder: 27208:27211 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 binder: 27208:27211 got reply transaction with no transaction stack binder: 27208:27211 transaction failed 29201/-71, size 0-0 line 2926 binder: undelivered TRANSACTION_ERROR: 29201 binder: 27208:27211 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 binder: 27208:27211 got reply transaction with no transaction stack binder: 27208:27211 transaction failed 29201/-71, size 0-0 line 2926 binder: undelivered TRANSACTION_ERROR: 29201 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=467 sclass=netlink_route_socket pig=27223 comm=syz-executor.3 binder: 27221:27223 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 binder: 27221:27223 got reply transaction with no transaction stack binder: 27221:27223 transaction failed 29201/-71, size 720295594978967552-1760936591827 line 2926 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=467 sclass=netlink_route_socket pig=27223 comm=syz-executor.3 binder: 27221:27233 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 binder: undelivered TRANSACTION_ERROR: 29201 binder: 27221:27233 got reply transaction with no transaction stack device lo left promiscuous mode device lo entered promiscuous mode binder: 27221:27233 transaction failed 29201/-71, size 720295594978967552-1760936591827 line 2926 binder: undelivered TRANSACTION_ERROR: 29201 binder: 27257:27258 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 binder: 27257:27258 got reply transaction with no transaction stack binder: 27257:27258 transaction failed 29201/-71, size 0-0 line 2926 binder: 27257:27258 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 binder: 27257:27258 got reply transaction with no transaction stack binder: undelivered TRANSACTION_ERROR: 29201 binder: 27257:27258 transaction failed 29201/-71, size 0-0 line 2926 binder: undelivered TRANSACTION_ERROR: 29201 binder: 27275:27278 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 binder: 27275:27278 got reply transaction with no transaction stack binder: 27275:27278 transaction failed 29201/-71, size 0-0 line 2926 binder: 27275:27296 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 binder: undelivered TRANSACTION_ERROR: 29201 binder: 27275:27296 got reply transaction with no transaction stack binder: 27275:27296 transaction failed 29201/-71, size 0-0 line 2926