======================================================
[ INFO: possible circular locking dependency detected ]
4.4.174+ #17 Not tainted
-------------------------------------------------------
syz-executor.4/19686 is trying to acquire lock:
 (&bdev->bd_mutex){+.+.+.}, at: [<ffffffff81a7920f>] blkdev_reread_part+0x1f/0x40 block/ioctl.c:189

but task is already holding lock:
 (loop_ctl_mutex#2){+.+.+.}, at: [<ffffffff81d48065>] lo_compat_ioctl+0x105/0x140 drivers/block/loop.c:1599

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

       [<ffffffff81205f6e>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
       [<ffffffff8270c191>] __mutex_lock_common kernel/locking/mutex.c:521 [inline]
       [<ffffffff8270c191>] mutex_lock_nested+0xc1/0xb80 kernel/locking/mutex.c:621
       [<ffffffff81d48124>] __lo_release drivers/block/loop.c:1653 [inline]
       [<ffffffff81d48124>] lo_release+0x84/0x1b0 drivers/block/loop.c:1676
       [<ffffffff8154e4e1>] __blkdev_put+0x461/0x840 fs/block_dev.c:1535
       [<ffffffff8154f738>] blkdev_put+0x88/0x560 fs/block_dev.c:1600
       [<ffffffff8154fc9b>] blkdev_close+0x8b/0xb0 fs/block_dev.c:1607
       [<ffffffff8149c8c6>] __fput+0x246/0x710 fs/file_table.c:208
       [<ffffffff8149ce16>] ____fput+0x16/0x20 fs/file_table.c:244
       [<ffffffff8112f352>] task_work_run+0x202/0x2b0 kernel/task_work.c:115
       [<ffffffff81003dca>] tracehook_notify_resume include/linux/tracehook.h:191 [inline]
       [<ffffffff81003dca>] exit_to_usermode_loop+0x14a/0x170 arch/x86/entry/common.c:188
       [<ffffffff8100569b>] prepare_exit_to_usermode arch/x86/entry/common.c:221 [inline]
       [<ffffffff8100569b>] syscall_return_slowpath+0x25b/0x2e0 arch/x86/entry/common.c:286
       [<ffffffff82718ce1>] int_ret_from_sys_call+0x25/0xa3

       [<ffffffff81205f6e>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
       [<ffffffff8270c191>] __mutex_lock_common kernel/locking/mutex.c:521 [inline]
       [<ffffffff8270c191>] mutex_lock_nested+0xc1/0xb80 kernel/locking/mutex.c:621
       [<ffffffff81d3d70d>] lo_open+0x1d/0xb0 drivers/block/loop.c:1633
       [<ffffffff8154eb6e>] __blkdev_get+0x2ae/0xdf0 fs/block_dev.c:1213
       [<ffffffff81551938>] blkdev_get+0x2e8/0x920 fs/block_dev.c:1353
       [<ffffffff8155219a>] blkdev_open+0x1aa/0x250 fs/block_dev.c:1508
       [<ffffffff8149154f>] do_dentry_open+0x38f/0xbd0 fs/open.c:749
       [<ffffffff81494d3b>] vfs_open+0x10b/0x210 fs/open.c:862
       [<ffffffff814c5ddf>] do_last fs/namei.c:3269 [inline]
       [<ffffffff814c5ddf>] path_openat+0x136f/0x4470 fs/namei.c:3406
       [<ffffffff814ccab1>] do_filp_open+0x1a1/0x270 fs/namei.c:3440
       [<ffffffff81495668>] do_sys_open+0x2f8/0x600 fs/open.c:1038
       [<ffffffff8149599d>] SYSC_open fs/open.c:1056 [inline]
       [<ffffffff8149599d>] SyS_open+0x2d/0x40 fs/open.c:1051
       [<ffffffff82718ba1>] entry_SYSCALL_64_fastpath+0x1e/0x9a

       [<ffffffff81202d86>] check_prev_add kernel/locking/lockdep.c:1853 [inline]
       [<ffffffff81202d86>] check_prevs_add kernel/locking/lockdep.c:1958 [inline]
       [<ffffffff81202d86>] validate_chain kernel/locking/lockdep.c:2144 [inline]
       [<ffffffff81202d86>] __lock_acquire+0x37d6/0x4f50 kernel/locking/lockdep.c:3213
       [<ffffffff81205f6e>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
       [<ffffffff8270c191>] __mutex_lock_common kernel/locking/mutex.c:521 [inline]
       [<ffffffff8270c191>] mutex_lock_nested+0xc1/0xb80 kernel/locking/mutex.c:621
       [<ffffffff81a7920f>] blkdev_reread_part+0x1f/0x40 block/ioctl.c:189
       [<ffffffff81d3ed4c>] loop_reread_partitions+0x7c/0x90 drivers/block/loop.c:649
       [<ffffffff81d3f962>] loop_set_status+0xc02/0x1260 drivers/block/loop.c:1208
       [<ffffffff81d40072>] loop_set_status_compat+0xb2/0x110 drivers/block/loop.c:1572
       [<ffffffff81d48070>] lo_compat_ioctl+0x110/0x140 drivers/block/loop.c:1600
       [<ffffffff81aa7200>] compat_blkdev_ioctl+0xca0/0x344f block/compat_ioctl.c:751
       [<ffffffff8159b2c3>] C_SYSC_ioctl fs/compat_ioctl.c:1592 [inline]
       [<ffffffff8159b2c3>] compat_SyS_ioctl+0x403/0x2210 fs/compat_ioctl.c:1544
       [<ffffffff8100603d>] do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline]
       [<ffffffff8100603d>] do_fast_syscall_32+0x32d/0xa90 arch/x86/entry/common.c:397
       [<ffffffff8271a350>] sysenter_flags_fixed+0xd/0x1a

other info that might help us debug this:

Chain exists of:
 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(loop_ctl_mutex#2);
                               lock(loop_index_mutex);
                               lock(loop_ctl_mutex#2);
  lock(&bdev->bd_mutex);

 *** DEADLOCK ***

1 lock held by syz-executor.4/19686:
 #0:  (loop_ctl_mutex#2){+.+.+.}, at: [<ffffffff81d48065>] lo_compat_ioctl+0x105/0x140 drivers/block/loop.c:1599

stack backtrace:
CPU: 1 PID: 19686 Comm: syz-executor.4 Not tainted 4.4.174+ #17
 0000000000000000 8d653c17396ca229 ffff8800990775e0 ffffffff81aad1a1
 ffffffff84057a80 ffff8801cea297c0 ffffffff83aa0cc0 ffffffff83ac68e0
 ffffffff83aa1890 ffff880099077630 ffffffff813abcda ffffffff83e1a600
Call Trace:
 [<ffffffff81aad1a1>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81aad1a1>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
 [<ffffffff813abcda>] print_circular_bug.cold+0x2f7/0x44e kernel/locking/lockdep.c:1226
 [<ffffffff81202d86>] check_prev_add kernel/locking/lockdep.c:1853 [inline]
 [<ffffffff81202d86>] check_prevs_add kernel/locking/lockdep.c:1958 [inline]
 [<ffffffff81202d86>] validate_chain kernel/locking/lockdep.c:2144 [inline]
 [<ffffffff81202d86>] __lock_acquire+0x37d6/0x4f50 kernel/locking/lockdep.c:3213
 [<ffffffff81205f6e>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
 [<ffffffff8270c191>] __mutex_lock_common kernel/locking/mutex.c:521 [inline]
 [<ffffffff8270c191>] mutex_lock_nested+0xc1/0xb80 kernel/locking/mutex.c:621
 [<ffffffff81a7920f>] blkdev_reread_part+0x1f/0x40 block/ioctl.c:189
 [<ffffffff81d3ed4c>] loop_reread_partitions+0x7c/0x90 drivers/block/loop.c:649
 [<ffffffff81d3f962>] loop_set_status+0xc02/0x1260 drivers/block/loop.c:1208
 [<ffffffff81d40072>] loop_set_status_compat+0xb2/0x110 drivers/block/loop.c:1572
 [<ffffffff81d48070>] lo_compat_ioctl+0x110/0x140 drivers/block/loop.c:1600
 [<ffffffff81aa7200>] compat_blkdev_ioctl+0xca0/0x344f block/compat_ioctl.c:751
 [<ffffffff8159b2c3>] C_SYSC_ioctl fs/compat_ioctl.c:1592 [inline]
 [<ffffffff8159b2c3>] compat_SyS_ioctl+0x403/0x2210 fs/compat_ioctl.c:1544
 [<ffffffff8100603d>] do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline]
 [<ffffffff8100603d>] do_fast_syscall_32+0x32d/0xa90 arch/x86/entry/common.c:397
 [<ffffffff8271a350>] sysenter_flags_fixed+0xd/0x1a
Dead loop on virtual device ip6tnl0, fix it urgently!
loop_reread_partitions: partition scan of loop0 (
ñy§rZ³²èï>¥iÛj¦î$^¡g/¼ }÷ó€éI­×oòzy#
¸„«`‰¡Þ‡£RnVÊAIn) failed (rc=-13)
lowmemorykiller: Killing 'syz-executor.3' (19724) (tgid 19724), adj 1000,
   to free 52152kB on behalf of 'kswapd0' (28) because
   cache 31936kB is below limit 65536kB for oom_score_adj 12
   Free memory is 6968kB above reserved
lowmemorykiller: Killing 'syz-executor.3' (19584) (tgid 19584), adj 1000,
   to free 52132kB on behalf of 'kswapd0' (28) because
   cache 31976kB is below limit 65536kB for oom_score_adj 12
   Free memory is 7028kB above reserved
lowmemorykiller: Killing 'syz-executor.3' (19659) (tgid 19659), adj 1000,
   to free 52132kB on behalf of 'kswapd0' (28) because
   cache 31976kB is below limit 65536kB for oom_score_adj 12
   Free memory is 24820kB above reserved
lowmemorykiller: Killing 'syz-executor.2' (19548) (tgid 19548), adj 1000,
   to free 51956kB on behalf of 'kswapd0' (28) because
   cache 31976kB is below limit 65536kB for oom_score_adj 12
   Free memory is 40672kB above reserved
lowmemorykiller: Killing 'syz-executor.4' (19777) (tgid 19777), adj 1000,
   to free 51936kB on behalf of 'kswapd0' (28) because
   cache 31976kB is below limit 65536kB for oom_score_adj 12
   Free memory is 57792kB above reserved
lowmemorykiller: Killing 'syz-executor.4' (19894) (tgid 19894), adj 1000,
   to free 52208kB on behalf of 'kswapd0' (28) because
   cache 30944kB is below limit 65536kB for oom_score_adj 12
   Free memory is 8072kB above reserved
lowmemorykiller: Killing 'syz-executor.3' (19854) (tgid 19854), adj 1000,
   to free 52156kB on behalf of 'kswapd0' (28) because
   cache 30944kB is below limit 65536kB for oom_score_adj 12
   Free memory is 33632kB above reserved
lowmemorykiller: Killing 'syz-executor.3' (19922) (tgid 19922), adj 1000,
   to free 52152kB on behalf of 'kswapd0' (28) because
   cache 30948kB is below limit 65536kB for oom_score_adj 12
   Free memory is 34564kB above reserved
lowmemorykiller: Killing 'syz-executor.4' (19802) (tgid 19802), adj 1000,
   to free 51948kB on behalf of 'kswapd0' (28) because
   cache 30948kB is below limit 65536kB for oom_score_adj 12
   Free memory is 37464kB above reserved
lowmemorykiller: Killing 'syz-executor.4' (19970) (tgid 19970), adj 1000,
   to free 51932kB on behalf of 'kswapd0' (28) because
   cache 30948kB is below limit 65536kB for oom_score_adj 12
   Free memory is 49136kB above reserved
lowmemorykiller: Killing 'syz-executor.4' (19977) (tgid 19970), adj 1000,
   to free 52196kB on behalf of 'kswapd0' (28) because
   cache 30948kB is below limit 65536kB for oom_score_adj 12
   Free memory is 42632kB above reserved
lowmemorykiller: Killing 'syz-executor.3' (19978) (tgid 19978), adj 1000,
   to free 52152kB on behalf of 'kswapd0' (28) because
   cache 30956kB is below limit 65536kB for oom_score_adj 12
   Free memory is 9040kB above reserved
lowmemorykiller: Killing 'syz-executor.3' (9335) (tgid 9335), adj 1000,
   to free 51908kB on behalf of 'kswapd0' (28) because
   cache 31020kB is below limit 65536kB for oom_score_adj 12
   Free memory is 22500kB above reserved
lowmemorykiller: Killing 'syz-executor.3' (9356) (tgid 9356), adj 1000,
   to free 52120kB on behalf of 'kswapd0' (28) because
   cache 31020kB is below limit 65536kB for oom_score_adj 12
   Free memory is 22500kB above reserved
lowmemorykiller: Killing 'syz-executor.3' (12403) (tgid 12403), adj 1000,
   to free 51908kB on behalf of 'kswapd0' (28) because
   cache 31020kB is below limit 65536kB for oom_score_adj 12
   Free memory is 37992kB above reserved
lowmemorykiller: Killing 'syz-executor.3' (15359) (tgid 15359), adj 1000,
   to free 51908kB on behalf of 'kswapd0' (28) because
   cache 31020kB is below limit 65536kB for oom_score_adj 12
   Free memory is 54988kB above reserved
lowmemorykiller: Killing 'syz-executor.2' (20158) (tgid 20158), adj 1000,
   to free 52172kB on behalf of 'kswapd0' (28) because
   cache 31024kB is below limit 65536kB for oom_score_adj 12
   Free memory is 7908kB above reserved
lowmemorykiller: Killing 'syz-executor.3' (20107) (tgid 20107), adj 1000,
   to free 52132kB on behalf of 'kswapd0' (28) because
   cache 31024kB is below limit 65536kB for oom_score_adj 12
   Free memory is 24336kB above reserved
lowmemorykiller: Killing 'syz-executor.3' (20208) (tgid 20208), adj 1000,
   to free 52132kB on behalf of 'kswapd0' (28) because
   cache 31024kB is below limit 65536kB for oom_score_adj 12
   Free memory is 39732kB above reserved
lowmemorykiller: Killing 'syz-executor.3' (15320) (tgid 15320), adj 1000,
   to free 51904kB on behalf of 'kswapd0' (28) because
   cache 31024kB is below limit 65536kB for oom_score_adj 12
   Free memory is 55392kB above reserved
lowmemorykiller: Killing 'syz-executor.2' (20224) (tgid 20224), adj 1000,
   to free 52168kB on behalf of 'kswapd0' (28) because
   cache 30440kB is below limit 65536kB for oom_score_adj 12
   Free memory is 10296kB above reserved
lowmemorykiller: Killing 'syz-executor.3' (20251) (tgid 20251), adj 1000,
   to free 52156kB on behalf of 'kswapd0' (28) because
   cache 30440kB is below limit 65536kB for oom_score_adj 12
   Free memory is 5716kB above reserved