audit: type=1400 audit(2000000035.250:125): avc: denied { read } for pid=6465 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_fib_lookup_socket permissive=1 ====================================================== WARNING: possible circular locking dependency detected 4.14.106+ #30 Not tainted ------------------------------------------------------ syz-executor.1/6484 is trying to acquire lock: (&sig->cred_guard_mutex){+.+.}, at: [] proc_pid_attr_write+0x152/0x280 fs/proc/base.c:2586 but task is already holding lock: (&pipe->mutex/1){+.+.}, at: [] pipe_lock_nested fs/pipe.c:67 [inline] (&pipe->mutex/1){+.+.}, at: [] pipe_lock+0x58/0x70 fs/pipe.c:75 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&pipe->mutex/1){+.+.}: -> #0 (&sig->cred_guard_mutex){+.+.}: other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&pipe->mutex/1); lock(&sig->cred_guard_mutex); lock(&pipe->mutex/1); lock(&sig->cred_guard_mutex); *** DEADLOCK *** 2 locks held by syz-executor.1/6484: #0: (sb_writers#7){.+.+}, at: [] file_start_write include/linux/fs.h:2726 [inline] #0: (sb_writers#7){.+.+}, at: [] do_splice fs/splice.c:1146 [inline] #0: (sb_writers#7){.+.+}, at: [] SYSC_splice fs/splice.c:1402 [inline] #0: (sb_writers#7){.+.+}, at: [] SyS_splice+0xec1/0x12d0 fs/splice.c:1382 #1: (&pipe->mutex/1){+.+.}, at: [] pipe_lock_nested fs/pipe.c:67 [inline] #1: (&pipe->mutex/1){+.+.}, at: [] pipe_lock+0x58/0x70 fs/pipe.c:75 stack backtrace: CPU: 1 PID: 6484 Comm: syz-executor.1 Not tainted 4.14.106+ #30 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0xb9/0x10e lib/dump_stack.c:53 print_circular_bug.isra.0.cold+0x2dc/0x425 kernel/locking/lockdep.c:1258 PF_BRIDGE: RTM_NEWNEIGH with invalid address PF_BRIDGE: RTM_NEWNEIGH with invalid address PF_BRIDGE: RTM_NEWNEIGH with invalid ifindex PF_BRIDGE: RTM_NEWNEIGH with invalid ifindex PF_BRIDGE: RTM_NEWNEIGH with unknown ifindex PF_BRIDGE: RTM_NEWNEIGH with invalid ifindex PF_BRIDGE: RTM_NEWNEIGH with unknown ifindex PF_BRIDGE: RTM_NEWNEIGH with invalid ifindex nla_parse: 8 callbacks suppressed netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. PF_BRIDGE: RTM_NEWNEIGH with unknown ifindex netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. PF_BRIDGE: RTM_NEWNEIGH with unknown ifindex PF_BRIDGE: RTM_NEWNEIGH with invalid ifindex PF_BRIDGE: RTM_NEWNEIGH with invalid ifindex PF_BRIDGE: RTM_NEWNEIGH with invalid ifindex PF_BRIDGE: RTM_NEWNEIGH with invalid ifindex device syz_tun entered promiscuous mode netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'. audit: type=1400 audit(2000000040.340:126): avc: denied { create } for pid=7450 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_connector_socket permissive=1 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=64342 sclass=netlink_route_socket pig=7576 comm=syz-executor.2 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=64342 sclass=netlink_route_socket pig=7586 comm=syz-executor.2 netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. PF_BRIDGE: RTM_NEWNEIGH with invalid address netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. PF_BRIDGE: RTM_NEWNEIGH with invalid address SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=7700 comm=syz-executor.2 PF_BRIDGE: RTM_NEWNEIGH with invalid address SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=7715 comm=syz-executor.2 PF_BRIDGE: RTM_NEWNEIGH with invalid address netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. PF_BRIDGE: RTM_NEWNEIGH with invalid address netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. PF_BRIDGE: RTM_NEWNEIGH with unknown ifindex netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. PF_BRIDGE: RTM_NEWNEIGH with unknown ifindex PF_BRIDGE: RTM_NEWNEIGH with invalid address PF_BRIDGE: RTM_NEWNEIGH with invalid address netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'. SELinux: unrecognized netlink message: protocol=0 nlmsg_type=61808 sclass=netlink_route_socket pig=7965 comm=syz-executor.2 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=61808 sclass=netlink_route_socket pig=7965 comm=syz-executor.2 PF_BRIDGE: RTM_NEWNEIGH with invalid ifindex PF_BRIDGE: RTM_NEWNEIGH with invalid ifindex