binder: 25922:25930 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 binder: 25922:25930 unknown command 1074535729 binder: 25922:25930 ioctl c0306201 20000040 returned -22 binder: 25922:25942 Acquire 1 refcount change on invalid ref 0 ret -22 ====================================================== WARNING: possible circular locking dependency detected binder: 25922:25938 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 4.14.98+ #7 Not tainted ------------------------------------------------------ syz-executor.5/25941 is trying to acquire lock: (&sig->cred_guard_mutex){+.+.}, at: [] proc_pid_attr_write+0x152/0x280 fs/proc/base.c:2590 binder: 25922:25942 unknown command 1074535729 but task is already holding lock: (&pipe->mutex/1){+.+.}, at: [] pipe_lock_nested fs/pipe.c:67 [inline] (&pipe->mutex/1){+.+.}, at: [] pipe_lock+0x58/0x70 fs/pipe.c:75 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&pipe->mutex/1 binder: 25922:25942 ioctl c0306201 20000040 returned -22 ){+.+.}: -> #0 (&sig->cred_guard_mutex){+.+.}: other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&pipe->mutex/1); lock(&sig->cred_guard_mutex); lock(&pipe->mutex/1); lock(&sig->cred_guard_mutex); *** DEADLOCK *** 2 locks held by syz-executor.5/25941: #0: (sb_writers#7){.+.+}, at: [] file_start_write include/linux/fs.h:2726 [inline] #0: (sb_writers#7){.+.+}, at: [] do_splice fs/splice.c:1146 [inline] #0: (sb_writers#7){.+.+}, at: [] SYSC_splice fs/splice.c:1402 [inline] #0: (sb_writers#7){.+.+}, at: [] SyS_splice+0xec1/0x12d0 fs/splice.c:1382 #1: (&pipe->mutex/1){+.+.}, at: [] pipe_lock_nested fs/pipe.c:67 [inline] #1: (&pipe->mutex/1){+.+.}, at: [] pipe_lock+0x58/0x70 fs/pipe.c:75 stack backtrace: CPU: 0 PID: 25941 Comm: syz-executor.5 Not tainted 4.14.98+ #7 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0xb9/0x10e lib/dump_stack.c:53 print_circular_bug.isra.0.cold+0x2dc/0x425 kernel/locking/lockdep.c:1258 ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=25953 comm=syz-executor.2 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=25962 comm=syz-executor.2 ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=25983 comm=syz-executor.2 kauditd_printk_skb: 79 callbacks suppressed audit: type=1400 audit(2000000028.890:6719): avc: denied { map } for pid=25992 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=25995 comm=syz-executor.4 ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=26004 comm=syz-executor.2 audit: type=1400 audit(2000000029.460:6720): avc: denied { create } for pid=26011 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0 ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! audit: type=1400 audit(2000000029.480:6721): avc: denied { map } for pid=26014 comm="modprobe" path="/bin/kmod" dev="sda1" ino=1440 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=0 ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! audit: type=1400 audit(2000000029.480:6722): avc: denied { map } for pid=26015 comm="modprobe" path="/bin/kmod" dev="sda1" ino=1440 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=0 ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! audit: type=1400 audit(2000000029.480:6723): avc: denied { map } for pid=26016 comm="modprobe" path="/bin/kmod" dev="sda1" ino=1440 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=0 ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! audit: type=1400 audit(2000000029.480:6724): avc: denied { map } for pid=26017 comm="modprobe" path="/bin/kmod" dev="sda1" ino=1440 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=0 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=26033 comm=syz-executor.2 audit: type=1400 audit(2000000029.520:6725): avc: denied { map } for pid=26019 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=0 audit: type=1400 audit(2000000029.570:6726): avc: denied { map } for pid=26022 comm="modprobe" path="/bin/kmod" dev="sda1" ino=1440 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=0 ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! audit: type=1400 audit(2000000029.590:6727): avc: denied { map } for pid=26023 comm="modprobe" path="/bin/kmod" dev="sda1" ino=1440 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=0 audit: type=1400 audit(2000000029.620:6728): avc: denied { map } for pid=26024 comm="modprobe" path="/bin/kmod" dev="sda1" ino=1440 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=0 ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! kauditd_printk_skb: 64 callbacks suppressed audit: type=1400 audit(2000000034.280:6793): avc: denied { create } for pid=26303 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0 netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. audit: type=1400 audit(2000000034.310:6794): avc: denied { map } for pid=26312 comm="modprobe" path="/bin/kmod" dev="sda1" ino=1440 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=0 audit: type=1400 audit(2000000034.350:6795): avc: denied { map } for pid=26316 comm="modprobe" path="/bin/kmod" dev="sda1" ino=1440 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=0 audit: type=1400 audit(2000000034.350:6796): avc: denied { map } for pid=26313 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=0 audit: type=1400 audit(2000000034.350:6797): avc: denied { create } for pid=26303 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0 audit: type=1400 audit(2000000034.390:6798): avc: denied { map } for pid=26323 comm="modprobe" path="/bin/kmod" dev="sda1" ino=1440 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=0 audit: type=1400 audit(2000000034.410:6799): avc: denied { map } for pid=26326 comm="modprobe" path="/bin/kmod" dev="sda1" ino=1440 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=0 audit: type=1400 audit(2000000034.440:6800): avc: denied { map } for pid=26331 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=0 audit: type=1400 audit(2000000034.440:6801): avc: denied { map } for pid=26330 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=0 ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! audit: type=1400 audit(2000000034.500:6802): avc: denied { map } for pid=26339 comm="blkid" path="/sbin/blkid" dev="sda1" ino=16128 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=0