====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Tainted: G L ------------------------------------------------------ udevd/4978 is trying to acquire lock: ffff8880259602d8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 but task is already holding lock: ffff88807ee57480 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: process_measurement+0x7d0/0x1c10 security/integrity/ima/ima_main.c:319 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #4 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}: __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x197/0x15a0 kernel/locking/mutex.c:821 process_measurement+0x7d0/0x1c10 security/integrity/ima/ima_main.c:319 ima_file_check+0xdc/0x130 security/integrity/ima/ima_main.c:686 security_file_post_open+0xb3/0x260 security/security.c:2801 do_open fs/namei.c:4848 [inline] path_openat+0x14e9/0x1da0 fs/namei.c:5011 do_file_open+0x23e/0x4a0 fs/namei.c:5040 file_open_name fs/open.c:1400 [inline] filp_open+0x16d/0x1d0 fs/open.c:1417 kernel_read_file_from_path_initns+0xde/0x1e0 fs/kernel_read_file.c:159 fw_get_filesystem_firmware drivers/base/firmware_loader/main.c:549 [inline] _request_firmware+0xa2b/0x1750 drivers/base/firmware_loader/main.c:873 request_firmware+0x36/0x50 drivers/base/firmware_loader/main.c:948 reg_reload_regdb+0x95/0x490 net/wireless/reg.c:1067 genl_family_rcv_msg_doit+0x233/0x340 net/netlink/genetlink.c:1114 genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline] genl_rcv_msg+0x614/0x7a0 net/netlink/genetlink.c:1209 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2572 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline] netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x7c3/0xae0 net/netlink/af_netlink.c:1916 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:800 __sock_sendmsg net/socket.c:815 [inline] ____sys_sendmsg+0x54e/0x850 net/socket.c:2712 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2766 __sys_sendmsg net/socket.c:2798 [inline] __do_sys_sendmsg net/socket.c:2803 [inline] __se_sys_sendmsg net/socket.c:2801 [inline] __x64_sys_sendmsg+0x1b1/0x290 net/socket.c:2801 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #3 (cb_lock){++++}-{4:4}: down_read+0x45/0x320 kernel/locking/rwsem.c:1574 genl_release+0x89/0x1e0 net/netlink/genetlink.c:697 netlink_release+0xe94/0x1a80 net/netlink/af_netlink.c:732 __sock_release+0xa0/0x1f0 net/socket.c:735 sock_close+0x1c/0x30 net/socket.c:1526 __fput+0x413/0xa50 fs/file_table.c:513 fput_close_sync+0x11f/0x240 fs/file_table.c:618 filp_close_sync fs/open.c:1573 [inline] __do_sys_close fs/open.c:1596 [inline] __se_sys_close+0xa2/0x160 fs/open.c:1583 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #2 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}: down_write+0x91/0x200 kernel/locking/rwsem.c:1631 inode_lock include/linux/fs.h:1024 [inline] __sock_release+0x7a/0x1f0 net/socket.c:734 sock_close+0x1c/0x30 net/socket.c:1526 __fput+0x413/0xa50 fs/file_table.c:513 nvme_tcp_alloc_queue+0x17ba/0x1e30 drivers/nvme/host/tcp.c:1976 nvme_tcp_alloc_admin_queue drivers/nvme/host/tcp.c:2158 [inline] nvme_tcp_configure_admin_queue+0x23/0x3f0 drivers/nvme/host/tcp.c:2312 nvme_tcp_setup_ctrl+0xba/0x1880 drivers/nvme/host/tcp.c:2442 nvme_tcp_create_ctrl+0x85f/0xc60 drivers/nvme/host/tcp.c:3070 nvmf_create_ctrl drivers/nvme/host/fabrics.c:1361 [inline] nvmf_dev_write+0x24ca/0x2d90 drivers/nvme/host/fabrics.c:1408 vfs_write+0x296/0xba0 fs/read_write.c:685 ksys_write+0x150/0x270 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #1 (nvmf_dev_mutex){+.+.}-{4:4}: __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x197/0x15a0 kernel/locking/mutex.c:821 nvmf_dev_show+0x2c/0x180 drivers/nvme/host/fabrics.c:1446 traverse+0x229/0x620 fs/seq_file.c:112 seq_read_iter+0xb6a/0xca0 fs/seq_file.c:196 seq_read+0x367/0x480 fs/seq_file.c:163 do_loop_readv_writev fs/read_write.c:848 [inline] vfs_readv+0x57c/0x850 fs/read_write.c:1021 do_preadv fs/read_write.c:1133 [inline] __do_sys_preadv fs/read_write.c:1180 [inline] __se_sys_preadv fs/read_write.c:1175 [inline] __x64_sys_preadv+0x19c/0x2b0 fs/read_write.c:1175 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (&p->lock){+.+.}-{4:4}: check_prev_add kernel/locking/lockdep.c:3209 [inline] check_prevs_add kernel/locking/lockdep.c:3328 [inline] validate_chain kernel/locking/lockdep.c:3952 [inline] __lock_acquire+0x164c/0x2de0 kernel/locking/lockdep.c:5288 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x197/0x15a0 kernel/locking/mutex.c:821 seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 __kernel_read+0x4ca/0x960 fs/read_write.c:532 integrity_kernel_read+0x89/0xd0 security/integrity/iint.c:28 ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:222 [inline] ima_calc_file_hash+0x451/0x890 security/integrity/ima/ima_crypto.c:280 ima_collect_measurement+0x51b/0xa00 security/integrity/ima/ima_api.c:300 process_measurement+0x1272/0x1c10 security/integrity/ima/ima_main.c:425 ima_file_check+0xdc/0x130 security/integrity/ima/ima_main.c:686 security_file_post_open+0xb3/0x260 security/security.c:2801 do_open fs/namei.c:4848 [inline] path_openat+0x14e9/0x1da0 fs/namei.c:5011 do_file_open+0x23e/0x4a0 fs/namei.c:5040 do_sys_openat2+0x115/0x200 fs/open.c:1442 do_sys_open fs/open.c:1448 [inline] __do_sys_openat fs/open.c:1464 [inline] __se_sys_openat fs/open.c:1459 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1459 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Chain exists of: &p->lock --> cb_lock --> &ima_iint_mutex_key[depth] Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&ima_iint_mutex_key[depth]); lock(cb_lock); lock(&ima_iint_mutex_key[depth]); lock(&p->lock); *** DEADLOCK *** locks held by udevd/4978: 1, last CPU#1: #0: ffff88807ee57480 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: process_measurement+0x7d0/0x1c10 security/integrity/ima/ima_main.c:319 stack backtrace: CPU: 1 UID: 0 PID: 4978 Comm: udevd Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_circular_bug+0x2e2/0x300 kernel/locking/lockdep.c:2087 check_noncircular+0x12f/0x150 kernel/locking/lockdep.c:2219 check_prev_add kernel/locking/lockdep.c:3209 [inline] check_prevs_add kernel/locking/lockdep.c:3328 [inline] validate_chain kernel/locking/lockdep.c:3952 [inline] __lock_acquire+0x164c/0x2de0 kernel/locking/lockdep.c:5288 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x197/0x15a0 kernel/locking/mutex.c:821 seq_read_iter+0xa4/0xca0 fs/seq_file.c:183 __kernel_read+0x4ca/0x960 fs/read_write.c:532 integrity_kernel_read+0x89/0xd0 security/integrity/iint.c:28 ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:222 [inline] ima_calc_file_hash+0x451/0x890 security/integrity/ima/ima_crypto.c:280 ima_collect_measurement+0x51b/0xa00 security/integrity/ima/ima_api.c:300 process_measurement+0x1272/0x1c10 security/integrity/ima/ima_main.c:425 ima_file_check+0xdc/0x130 security/integrity/ima/ima_main.c:686 security_file_post_open+0xb3/0x260 security/security.c:2801 do_open fs/namei.c:4848 [inline] path_openat+0x14e9/0x1da0 fs/namei.c:5011 do_file_open+0x23e/0x4a0 fs/namei.c:5040 do_sys_openat2+0x115/0x200 fs/open.c:1442 do_sys_open fs/open.c:1448 [inline] __do_sys_openat fs/open.c:1464 [inline] __se_sys_openat fs/open.c:1459 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1459 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd76b8a7407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007ffc79948b50 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007fd76c00e880 RCX: 00007fd76b8a7407 RDX: 0000000000080000 RSI: 00007ffc79948cd0 RDI: ffffffffffffff9c RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 00005619c451a7f5 R13: 00005619c451a7f5 R14: 0000000000000001 R15: 0000000000000000