binder: 15554:15557 ioctl c0306201 20012000 returned -14 ====================================================== WARNING: possible circular locking dependency detected 4.14.108+ #36 Not tainted ------------------------------------------------------ syz-executor.2/15556 is trying to acquire lock: (&sig->cred_guard_mutex){+.+.}, at: [] proc_pid_attr_write+0x152/0x280 fs/proc/base.c:2586 but task is already holding lock: (&pipe->mutex/1){+.+.}, at: [] pipe_lock_nested fs/pipe.c:67 [inline] (&pipe->mutex/1){+.+.}, at: [] pipe_lock fs/pipe.c:75 [inline] (&pipe->mutex/1){+.+.}, at: [] pipe_wait+0x1a1/0x1c0 fs/pipe.c:123 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&pipe->mutex/1){+.+.}: -> #0 (&sig->cred_guard_mutex){+.+.}: other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&pipe->mutex/1); lock(&sig->cred_guard_mutex); lock(&pipe->mutex/1); lock(&sig->cred_guard_mutex); *** DEADLOCK *** 2 locks held by syz-executor.2/15556: #0: (sb_writers#7){.+.+}, at: [] file_start_write include/linux/fs.h:2726 [inline] #0: (sb_writers#7){.+.+}, at: [] do_splice fs/splice.c:1146 [inline] #0: (sb_writers#7){.+.+}, at: [] SYSC_splice fs/splice.c:1402 [inline] #0: (sb_writers#7){.+.+}, at: [] SyS_splice+0xe6a/0x1230 fs/splice.c:1382 #1: (&pipe->mutex/1){+.+.}, at: [] pipe_lock_nested fs/pipe.c:67 [inline] #1: (&pipe->mutex/1){+.+.}, at: [] pipe_lock fs/pipe.c:75 [inline] #1: (&pipe->mutex/1){+.+.}, at: [] pipe_wait+0x1a1/0x1c0 fs/pipe.c:123 stack backtrace: CPU: 1 PID: 15556 Comm: syz-executor.2 Not tainted 4.14.108+ #36 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0xb9/0x10e lib/dump_stack.c:53 print_circular_bug.isra.0.cold+0x2dc/0x425 kernel/locking/lockdep.c:1258 binder: 15570:15572 ioctl c0306201 20012000 returned -14 binder: 15570:15577 ioctl c0306201 20012000 returned -14 binder: 15635:15640 unknown command 1541 binder: 15635:15640 ioctl c0306201 20012000 returned -22 binder: 15635:15648 unknown command 1541 binder: 15635:15648 ioctl c0306201 20012000 returned -22 binder: 15656:15657 Acquire 1 refcount change on invalid ref 4096 ret -22 binder: 15656:15657 ioctl c0306201 20012000 returned -14 binder: 15665:15667 ioctl c0306201 20012000 returned -14 binder: 15665:15668 ioctl c0306201 20012000 returned -14 binder: 15676:15684 ioctl c0306201 20012000 returned -14 binder: 15676:15684 ioctl c0306201 20012000 returned -14 binder: 15698:15704 unknown command -1903016443 binder: 15698:15704 ioctl c0306201 20012000 returned -22 binder: 15698:15709 unknown command -1903016443 binder: 15698:15709 ioctl c0306201 20012000 returned -22 binder: 15722:15725 ioctl 8008700b 20000000 returned -22 binder: 15722:15725 ioctl c0306201 20012000 returned -14 binder: 15722:15725 ioctl 8008700b 20000000 returned -22 binder: 15722:15731 ioctl c0306201 20012000 returned -14 kauditd_printk_skb: 724 callbacks suppressed audit: type=1400 audit(1553538937.725:810): avc: denied { map } for pid=15742 comm="syz-executor.1" path="socket:[48781]" dev="sockfs" ino=48781 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=rawip_socket permissive=1 binder: 15744:15751 ioctl 8008700b 20000000 returned -22 binder: 15742:15748 ioctl c0306201 20012000 returned -14 binder: 15744:15754 ioctl c0306201 20012000 returned -14 binder: 15742:15760 ioctl c0306201 20012000 returned -14 binder: 15768:15773 ioctl 8008700b 20000000 returned -22 binder: 15768:15773 ioctl c0306201 20012000 returned -14 binder: 15769:15772 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15769:15776 BC_ACQUIRE_DONE u0000000000000000 no match binder: 15782:15786 ioctl c0306201 20012000 returned -14 binder: 15780:15791 ioctl 8008700b 20000000 returned -22 binder: 15780:15791 ioctl c0306201 20012000 returned -14 binder: 15782:15795 ioctl c0306201 20012000 returned -14 binder: 15799:15803 ioctl c0306201 20012000 returned -14 binder: 15811:15812 ioctl c0306201 20012000 returned -14 binder: 15817:15822 ioctl c0306201 20012000 returned -14 binder: 15818:15828 unknown command -1501437448 binder: 15818:15828 ioctl c0306201 20012000 returned -22 binder: 15818:15842 unknown command -1501437448 binder: 15839:15846 ioctl c0306201 20012000 returned -14 binder: 15818:15842 ioctl c0306201 20012000 returned -22 binder: 15857:15863 unknown command 1075077893 binder: 15857:15863 ioctl c0306201 20012000 returned -22 binder: 15857:15876 unknown command 1075077893 binder: 15857:15876 ioctl c0306201 20012000 returned -22 binder: 15887:15890 unknown command -1183515657 binder: 15887:15890 ioctl c0306201 20012000 returned -22 binder: 15887:15899 unknown command -1183515657 binder: 15887:15899 ioctl c0306201 20012000 returned -22 binder: 15903:15906 ioctl c0306201 20012000 returned -14 binder: 15915:15917 Acquire 1 refcount change on invalid ref 0 ret -22 binder: 15915:15917 ioctl c0306201 20012000 returned -14 binder: 15915:15917 ioctl 6612 0 returned -22 binder: 15915:15922 Acquire 1 refcount change on invalid ref 0 ret -22 binder: 15915:15922 ioctl c0306201 20012000 returned -14 binder: 15927:15938 Acquire 1 refcount change on invalid ref 0 ret -22 binder: 15927:15938 ioctl c0306201 20012000 returned -14 binder: 15927:15938 Acquire 1 refcount change on invalid ref 0 ret -22 binder: 15927:15938 ioctl c0306201 20012000 returned -14 binder: 15967:15972 ioctl c0306201 20012000 returned -14 binder: 15967:15978 ioctl c0306201 20012000 returned -14 binder: 15980:15983 ioctl c0306201 20012000 returned -14 binder: 15989:15992 unknown command 2 binder: 15989:15992 ioctl c0306201 20012000 returned -22 binder: 15989:15996 unknown command 2 binder: 15989:15996 ioctl c0306201 20012000 returned -22 binder: 16006:16008 ioctl c0306201 20012000 returned -14 binder: 16006:16016 ioctl c0306201 20012000 returned -14 binder: 16004:16013 ioctl c0306201 20012000 returned -14 binder: 16027:16033 ioctl c0306201 20012000 returned -14 binder: 16047:16051 ioctl c0306201 20012000 returned -14 binder: 16054:16057 ioctl c0306201 20012000 returned -14 binder: 16047:16058 ioctl c0306201 20012000 returned -14 binder: 16071:16076 ioctl c0306201 20012000 returned -14 binder: 16070:16077 unknown command 3 binder: 16070:16077 ioctl c0306201 20012000 returned -22 binder: 16070:16079 unknown command 3 binder: 16070:16079 ioctl c0306201 20012000 returned -22 binder: 16087:16090 ioctl c0306201 20000140 returned -14 binder: 16087:16098 ioctl c0306201 20000140 returned -14 binder: 16105:16112 unknown command 1074021381 binder: 16105:16112 ioctl c0306201 20012000 returned -22 binder: 16105:16116 unknown command 1074021381 binder: 16105:16116 ioctl c0306201 20012000 returned -22