input: syz1 as /devices/virtual/input/input168

======================================================
[ INFO: possible circular locking dependency detected ]
4.4.161+ #46 Not tainted
-------------------------------------------------------
syz-executor0/9559 is trying to acquire lock:
 (&pipe->mutex/1){+.+.+.}, at: [<ffffffff814a9d1e>] pipe_lock_nested fs/pipe.c:65 [inline]
 (&pipe->mutex/1){+.+.+.}, at: [<ffffffff814a9d1e>] pipe_lock+0x5e/0x70 fs/pipe.c:73

but task is already holding lock:
 (sb_writers#4){.+.+.+}, at: [<ffffffff8153156a>] file_start_write include/linux/fs.h:2541 [inline]
 (sb_writers#4){.+.+.+}, at: [<ffffffff8153156a>] do_splice fs/splice.c:1403 [inline]
 (sb_writers#4){.+.+.+}, at: [<ffffffff8153156a>] SYSC_splice fs/splice.c:1707 [inline]
 (sb_writers#4){.+.+.+}, at: [<ffffffff8153156a>] SyS_splice+0xfaa/0x1430 fs/splice.c:1690
audit: type=1400 audit(1539712698.902:1362): avc:  denied  { create } for  pid=9554 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0

which lock already depends on the new lock.

audit: type=1400 audit(1539712698.922:1363): avc:  denied  { create } for  pid=9554 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0

the existing dependency chain (in reverse order) is:

       [<ffffffff81202efe>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
       [<ffffffff81498ece>] percpu_down_read include/linux/percpu-rwsem.h:26 [inline]
       [<ffffffff81498ece>] __sb_start_write+0x1ae/0x310 fs/super.c:1221
       [<ffffffff816bb1e7>] sb_start_write include/linux/fs.h:1515 [inline]
       [<ffffffff816bb1e7>] ext4_run_li_request fs/ext4/super.c:2674 [inline]
       [<ffffffff816bb1e7>] ext4_lazyinit_thread+0x1a7/0x750 fs/ext4/super.c:2773
       [<ffffffff81134038>] kthread+0x268/0x300 kernel/kthread.c:211
       [<ffffffff82705f05>] ret_from_fork+0x55/0x80 arch/x86/entry/entry_64.S:510

-> #4 (&eli->li_list_mtx){+.+...}:
       [<ffffffff81202efe>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
       [<ffffffff826fa5db>] __mutex_lock_common kernel/locking/mutex.c:521 [inline]
       [<ffffffff826fa5db>] mutex_lock_nested+0xbb/0x8d0 kernel/locking/mutex.c:621
       [<ffffffff816c52e4>] ext4_register_li_request+0x304/0x7a0 fs/ext4/super.c:2961
       [<ffffffff816c6ae8>] ext4_remount+0x1368/0x1bb0 fs/ext4/super.c:4911
       [<ffffffff8149c178>] do_remount_sb2+0x428/0x7d0 fs/super.c:771
       [<ffffffff814fc0be>] do_remount fs/namespace.c:2335 [inline]
       [<ffffffff814fc0be>] do_mount+0x101e/0x2a10 fs/namespace.c:2848
       [<ffffffff814fe601>] SYSC_mount fs/namespace.c:3051 [inline]
       [<ffffffff814fe601>] SyS_mount+0x191/0x1c0 fs/namespace.c:3029
       [<ffffffff82705b21>] entry_SYSCALL_64_fastpath+0x1e/0x9a

-> #3 (&ext4_li_mtx){+.+.+.}:
       [<ffffffff81202efe>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
       [<ffffffff826fa5db>] __mutex_lock_common kernel/locking/mutex.c:521 [inline]
       [<ffffffff826fa5db>] mutex_lock_nested+0xbb/0x8d0 kernel/locking/mutex.c:621
       [<ffffffff816c5067>] ext4_register_li_request+0x87/0x7a0 fs/ext4/super.c:2934
       [<ffffffff816c6ae8>] ext4_remount+0x1368/0x1bb0 fs/ext4/super.c:4911
       [<ffffffff8149c178>] do_remount_sb2+0x428/0x7d0 fs/super.c:771
       [<ffffffff814fc0be>] do_remount fs/namespace.c:2335 [inline]
       [<ffffffff814fc0be>] do_mount+0x101e/0x2a10 fs/namespace.c:2848
       [<ffffffff814fe601>] SYSC_mount fs/namespace.c:3051 [inline]
       [<ffffffff814fe601>] SyS_mount+0x191/0x1c0 fs/namespace.c:3029
       [<ffffffff82705b21>] entry_SYSCALL_64_fastpath+0x1e/0x9a

-> #2 (&type->s_umount_key#34){++++++}:
       [<ffffffff81202efe>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
       [<ffffffff82700b52>] down_read+0x42/0x60 kernel/locking/rwsem.c:22
       [<ffffffff8149b891>] iterate_supers+0xe1/0x260 fs/super.c:537
       [<ffffffff8199e2e4>] selinux_complete_init+0x2f/0x31 security/selinux/hooks.c:6154
       [<ffffffff8198ff36>] security_load_policy+0x886/0x9b0 security/selinux/ss/services.c:2060
       [<ffffffff81965e61>] sel_write_load+0x191/0xfc0 security/selinux/selinuxfs.c:535
       [<ffffffff81490e3c>] __vfs_write+0x11c/0x3e0 fs/read_write.c:489
       [<ffffffff81492aee>] vfs_write+0x17e/0x4e0 fs/read_write.c:538
       [<ffffffff81495129>] SYSC_write fs/read_write.c:585 [inline]
       [<ffffffff81495129>] SyS_write+0xd9/0x1c0 fs/read_write.c:577
       [<ffffffff82705b21>] entry_SYSCALL_64_fastpath+0x1e/0x9a

-> #1 (sel_mutex){+.+.+.}:
       [<ffffffff81202efe>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
       [<ffffffff826fa5db>] __mutex_lock_common kernel/locking/mutex.c:521 [inline]
       [<ffffffff826fa5db>] mutex_lock_nested+0xbb/0x8d0 kernel/locking/mutex.c:621
       [<ffffffff81963947>] sel_commit_bools_write+0x87/0x250 security/selinux/selinuxfs.c:1142
       [<ffffffff81490e3c>] __vfs_write+0x11c/0x3e0 fs/read_write.c:489
       [<ffffffff8149120a>] __kernel_write+0x10a/0x350 fs/read_write.c:511
       [<ffffffff8152c27d>] write_pipe_buf+0x15d/0x1f0 fs/splice.c:1074
       [<ffffffff8152d114>] splice_from_pipe_feed fs/splice.c:776 [inline]
       [<ffffffff8152d114>] __splice_from_pipe+0x364/0x790 fs/splice.c:901
       [<ffffffff815301d9>] splice_from_pipe+0xf9/0x170 fs/splice.c:936
       [<ffffffff815302dc>] default_file_splice_write+0x3c/0x80 fs/splice.c:1086
       [<ffffffff815313a1>] do_splice_from fs/splice.c:1128 [inline]
       [<ffffffff815313a1>] do_splice fs/splice.c:1404 [inline]
       [<ffffffff815313a1>] SYSC_splice fs/splice.c:1707 [inline]
       [<ffffffff815313a1>] SyS_splice+0xde1/0x1430 fs/splice.c:1690
       [<ffffffff8100629e>] do_syscall_32_irqs_on arch/x86/entry/common.c:396 [inline]
       [<ffffffff8100629e>] do_fast_syscall_32+0x31e/0xa80 arch/x86/entry/common.c:463
       [<ffffffff82707290>] sysenter_flags_fixed+0xd/0x1a

-> #0 (&pipe->mutex/1){+.+.+.}:
       [<ffffffff811ff31c>] check_prev_add kernel/locking/lockdep.c:1853 [inline]
       [<ffffffff811ff31c>] check_prevs_add kernel/locking/lockdep.c:1958 [inline]
       [<ffffffff811ff31c>] validate_chain kernel/locking/lockdep.c:2144 [inline]
       [<ffffffff811ff31c>] __lock_acquire+0x3e6c/0x5f10 kernel/locking/lockdep.c:3213
       [<ffffffff81202efe>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
       [<ffffffff826fa5db>] __mutex_lock_common kernel/locking/mutex.c:521 [inline]
       [<ffffffff826fa5db>] mutex_lock_nested+0xbb/0x8d0 kernel/locking/mutex.c:621
       [<ffffffff814a9d1e>] pipe_lock_nested fs/pipe.c:65 [inline]
       [<ffffffff814a9d1e>] pipe_lock+0x5e/0x70 fs/pipe.c:73
       [<ffffffff8152d880>] iter_file_splice_write+0x160/0xb90 fs/splice.c:974
       [<ffffffff815313a1>] do_splice_from fs/splice.c:1128 [inline]
       [<ffffffff815313a1>] do_splice fs/splice.c:1404 [inline]
       [<ffffffff815313a1>] SYSC_splice fs/splice.c:1707 [inline]
       [<ffffffff815313a1>] SyS_splice+0xde1/0x1430 fs/splice.c:1690
       [<ffffffff8100629e>] do_syscall_32_irqs_on arch/x86/entry/common.c:396 [inline]
       [<ffffffff8100629e>] do_fast_syscall_32+0x31e/0xa80 arch/x86/entry/common.c:463
       [<ffffffff82707290>] sysenter_flags_fixed+0xd/0x1a

other info that might help us debug this:

Chain exists of:
  &pipe->mutex/1 --> &eli->li_list_mtx --> sb_writers#4

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(sb_writers#4);
                               lock(&eli->li_list_mtx);
                               lock(sb_writers#4);
  lock(&pipe->mutex/1);

 *** DEADLOCK ***

1 lock held by syz-executor0/9559:
 #0:  (sb_writers#4){.+.+.+}, at: [<ffffffff8153156a>] file_start_write include/linux/fs.h:2541 [inline]
 #0:  (sb_writers#4){.+.+.+}, at: [<ffffffff8153156a>] do_splice fs/splice.c:1403 [inline]
 #0:  (sb_writers#4){.+.+.+}, at: [<ffffffff8153156a>] SYSC_splice fs/splice.c:1707 [inline]
 #0:  (sb_writers#4){.+.+.+}, at: [<ffffffff8153156a>] SyS_splice+0xfaa/0x1430 fs/splice.c:1690

stack backtrace:
CPU: 1 PID: 9559 Comm: syz-executor0 Not tainted 4.4.161+ #46
 0000000000000000 5fa2bf51a5ef1d87 ffff8801c3927898 ffffffff81a9969d
 ffffffff83ac03a0 ffffffff83ab46a0 ffffffff83ab5930 ffff8801d68588e8
 ffff8801d6858000 ffff8801c39278e0 ffffffff813a856a 0000000000000001
Call Trace:
 [<ffffffff81a9969d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81a9969d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff813a856a>] print_circular_bug.cold.34+0x2f7/0x432 kernel/locking/lockdep.c:1226
 [<ffffffff811ff31c>] check_prev_add kernel/locking/lockdep.c:1853 [inline]
 [<ffffffff811ff31c>] check_prevs_add kernel/locking/lockdep.c:1958 [inline]
 [<ffffffff811ff31c>] validate_chain kernel/locking/lockdep.c:2144 [inline]
 [<ffffffff811ff31c>] __lock_acquire+0x3e6c/0x5f10 kernel/locking/lockdep.c:3213
 [<ffffffff81202efe>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
 [<ffffffff826fa5db>] __mutex_lock_common kernel/locking/mutex.c:521 [inline]
 [<ffffffff826fa5db>] mutex_lock_nested+0xbb/0x8d0 kernel/locking/mutex.c:621
 [<ffffffff814a9d1e>] pipe_lock_nested fs/pipe.c:65 [inline]
 [<ffffffff814a9d1e>] pipe_lock+0x5e/0x70 fs/pipe.c:73
 [<ffffffff8152d880>] iter_file_splice_write+0x160/0xb90 fs/splice.c:974
 [<ffffffff815313a1>] do_splice_from fs/splice.c:1128 [inline]
 [<ffffffff815313a1>] do_splice fs/splice.c:1404 [inline]
 [<ffffffff815313a1>] SYSC_splice fs/splice.c:1707 [inline]
 [<ffffffff815313a1>] SyS_splice+0xde1/0x1430 fs/splice.c:1690
 [<ffffffff8100629e>] do_syscall_32_irqs_on arch/x86/entry/common.c:396 [inline]
 [<ffffffff8100629e>] do_fast_syscall_32+0x31e/0xa80 arch/x86/entry/common.c:463
 [<ffffffff82707290>] sysenter_flags_fixed+0xd/0x1a
audit: type=1400 audit(1539712699.052:1364): avc:  denied  { create } for  pid=9569 comm="syz-executor1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
audit: type=1400 audit(1539712699.082:1365): avc:  denied  { create } for  pid=9569 comm="syz-executor1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
input: syz1 as /devices/virtual/input/input169
audit: type=1400 audit(1539712700.572:1366): avc:  denied  { setattr } for  pid=9647 comm="syz-executor5" name="current" dev="proc" ino=138688 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=file permissive=0
audit: type=1400 audit(1539712700.612:1367): avc:  denied  { setattr } for  pid=9647 comm="syz-executor5" name="current" dev="proc" ino=138688 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=file permissive=0
audit: type=1400 audit(1539712700.772:1368): avc:  denied  { setattr } for  pid=9655 comm="syz-executor5" name="current" dev="proc" ino=138713 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=file permissive=0
audit: type=1400 audit(1539712701.122:1369): avc:  denied  { create } for  pid=9685 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
audit: type=1400 audit(1539712701.162:1370): avc:  denied  { create } for  pid=9685 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
audit: type=1400 audit(1539712701.612:1371): avc:  denied  { setattr } for  pid=9718 comm="syz-executor5" name="current" dev="proc" ino=139618 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=file permissive=0
audit_printk_skb: 27 callbacks suppressed
audit: type=1400 audit(1539712704.482:1381): avc:  denied  { create } for  pid=9843 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
audit: type=1400 audit(1539712704.812:1382): avc:  denied  { setattr } for  pid=9887 comm="syz-executor5" name="current" dev="proc" ino=139240 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=file permissive=0
audit: type=1400 audit(1539712705.482:1383): avc:  denied  { setattr } for  pid=9924 comm="syz-executor5" name="current" dev="proc" ino=140107 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=file permissive=0
audit: type=1400 audit(1539712705.512:1384): avc:  denied  { create } for  pid=9926 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
audit: type=1400 audit(1539712705.962:1385): avc:  denied  { create } for  pid=9961 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
audit: type=1400 audit(1539712706.382:1386): avc:  denied  { create } for  pid=9997 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
audit: type=1400 audit(1539712706.592:1387): avc:  denied  { create } for  pid=10013 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
audit: type=1400 audit(1539712706.862:1388): avc:  denied  { create } for  pid=10034 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0
audit: type=1400 audit(1539712707.412:1389): avc:  denied  { create } for  pid=10054 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=0
audit: type=1400 audit(1539712707.472:1390): avc:  denied  { create } for  pid=10046 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=0