overlayfs: bad mount option "redirect_dir=./file1"
======================================================
WARNING: possible circular locking dependency detected
4.19.211-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.1/6604 is trying to acquire lock:
000000004afddc8b (&ovl_i_mutex_dir_key[depth]){++++}, at: inode_lock_shared include/linux/fs.h:758 [inline]
000000004afddc8b (&ovl_i_mutex_dir_key[depth]){++++}, at: lookup_slow fs/namei.c:1688 [inline]
000000004afddc8b (&ovl_i_mutex_dir_key[depth]){++++}, at: walk_component+0x798/0xda0 fs/namei.c:1811

but task is already holding lock:
000000002bf9821a (&sig->cred_guard_mutex){+.+.}, at: prepare_bprm_creds fs/exec.c:1419 [inline]
000000002bf9821a (&sig->cred_guard_mutex){+.+.}, at: __do_execve_file+0x38c/0x2360 fs/exec.c:1762

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #3 (&sig->cred_guard_mutex){+.+.}:
       do_io_accounting fs/proc/base.c:2750 [inline]
       proc_tgid_io_accounting+0x1cf/0x7f0 fs/proc/base.c:2799
       proc_single_show+0xeb/0x170 fs/proc/base.c:755
overlayfs: missing 'lowerdir'
       seq_read+0x4e0/0x11c0 fs/seq_file.c:232
       __vfs_read+0xf7/0x750 fs/read_write.c:416
       vfs_read+0x194/0x3c0 fs/read_write.c:452
       ksys_read+0x12b/0x2a0 fs/read_write.c:579
       do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
overlayfs: missing 'lowerdir'
       entry_SYSCALL_64_after_hwframe+0x49/0xbe

-> #2 (&p->lock){+.+.}:
       seq_read+0x6b/0x11c0 fs/seq_file.c:164
       proc_reg_read+0x1bd/0x2d0 fs/proc/inode.c:231
overlayfs: missing 'lowerdir'
       do_loop_readv_writev fs/read_write.c:701 [inline]
       do_loop_readv_writev fs/read_write.c:688 [inline]
       do_iter_read+0x471/0x630 fs/read_write.c:925
       vfs_readv+0xe5/0x150 fs/read_write.c:987
       kernel_readv fs/splice.c:362 [inline]
       default_file_splice_read+0x457/0xa00 fs/splice.c:417
       do_splice_to+0x10e/0x160 fs/splice.c:881
overlayfs: missing 'lowerdir'
       splice_direct_to_actor+0x2b9/0x8d0 fs/splice.c:959
       do_splice_direct+0x1a7/0x270 fs/splice.c:1068
       do_sendfile+0x550/0xc30 fs/read_write.c:1447
       __do_sys_sendfile64 fs/read_write.c:1508 [inline]
       __se_sys_sendfile64+0x147/0x160 fs/read_write.c:1494
overlayfs: missing 'lowerdir'
       do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
       entry_SYSCALL_64_after_hwframe+0x49/0xbe

-> #1 (sb_writers#3){.+.+}:
overlayfs: missing 'lowerdir'
       sb_start_write include/linux/fs.h:1579 [inline]
       mnt_want_write+0x3a/0xb0 fs/namespace.c:360
       ovl_create_object+0x96/0x290 fs/overlayfs/dir.c:602
       lookup_open+0x893/0x1a20 fs/namei.c:3235
       do_last fs/namei.c:3327 [inline]
       path_openat+0x1094/0x2df0 fs/namei.c:3537
overlayfs: missing 'lowerdir'
       do_filp_open+0x18c/0x3f0 fs/namei.c:3567
       do_sys_open+0x3b3/0x520 fs/open.c:1085
       do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
       entry_SYSCALL_64_after_hwframe+0x49/0xbe

-> #0 (&ovl_i_mutex_dir_key[depth]){++++}:
overlayfs: missing 'lowerdir'
       down_read+0x36/0x80 kernel/locking/rwsem.c:24
       inode_lock_shared include/linux/fs.h:758 [inline]
       lookup_slow fs/namei.c:1688 [inline]
       walk_component+0x798/0xda0 fs/namei.c:1811
       link_path_walk.part.0+0x901/0x1230 fs/namei.c:2142
       link_path_walk fs/namei.c:2073 [inline]
       path_openat+0x1db/0x2df0 fs/namei.c:3536
overlayfs: missing 'lowerdir'
       do_filp_open+0x18c/0x3f0 fs/namei.c:3567
       do_open_execat+0x11d/0x5b0 fs/exec.c:853
       __do_execve_file+0x1a8b/0x2360 fs/exec.c:1770
       do_execveat_common fs/exec.c:1879 [inline]
       do_execve+0x35/0x50 fs/exec.c:1896
overlayfs: missing 'lowerdir'
       __do_sys_execve fs/exec.c:1977 [inline]
       __se_sys_execve fs/exec.c:1972 [inline]
       __x64_sys_execve+0x7c/0xa0 fs/exec.c:1972
       do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
       entry_SYSCALL_64_after_hwframe+0x49/0xbe

other info that might help us debug this:

Chain exists of:
  &ovl_i_mutex_dir_key[depth] --> &p->lock --> &sig->cred_guard_mutex

overlayfs: missing 'lowerdir'
 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&sig->cred_guard_mutex);
                               lock(&p->lock);
                               lock(&sig->cred_guard_mutex);
  lock(&ovl_i_mutex_dir_key[depth]);

 *** DEADLOCK ***

1 lock held by syz-executor.1/6604:
 #0: 000000002bf9821a (&sig->cred_guard_mutex){+.+.}, at: prepare_bprm_creds fs/exec.c:1419 [inline]
 #0: 000000002bf9821a (&sig->cred_guard_mutex){+.+.}, at: __do_execve_file+0x38c/0x2360 fs/exec.c:1762
overlayfs: missing 'lowerdir'

stack backtrace:
CPU: 0 PID: 6604 Comm: syz-executor.1 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 print_circular_bug.constprop.0.cold+0x2d7/0x41e kernel/locking/lockdep.c:1222
overlayfs: missing 'lowerdir'
 check_prev_add kernel/locking/lockdep.c:1866 [inline]
 check_prevs_add kernel/locking/lockdep.c:1979 [inline]
 validate_chain kernel/locking/lockdep.c:2420 [inline]
 __lock_acquire+0x30c9/0x3ff0 kernel/locking/lockdep.c:3416
overlayfs: missing 'lowerdir'
 lock_acquire+0x170/0x3c0 kernel/locking/lockdep.c:3908
overlayfs: missing 'lowerdir'
 down_read+0x36/0x80 kernel/locking/rwsem.c:24
 inode_lock_shared include/linux/fs.h:758 [inline]
 lookup_slow fs/namei.c:1688 [inline]
 walk_component+0x798/0xda0 fs/namei.c:1811
overlayfs: missing 'lowerdir'
 link_path_walk.part.0+0x901/0x1230 fs/namei.c:2142
overlayfs: missing 'lowerdir'
 link_path_walk fs/namei.c:2073 [inline]
 path_openat+0x1db/0x2df0 fs/namei.c:3536
overlayfs: missing 'lowerdir'
 do_filp_open+0x18c/0x3f0 fs/namei.c:3567
 do_open_execat+0x11d/0x5b0 fs/exec.c:853
 __do_execve_file+0x1a8b/0x2360 fs/exec.c:1770
 do_execveat_common fs/exec.c:1879 [inline]
 do_execve+0x35/0x50 fs/exec.c:1896
 __do_sys_execve fs/exec.c:1977 [inline]
 __se_sys_execve fs/exec.c:1972 [inline]
 __x64_sys_execve+0x7c/0xa0 fs/exec.c:1972
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
overlayfs: missing 'lowerdir'
RIP: 0033:0x7fa09be9e059
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa09a7b0168 EFLAGS: 00000246 ORIG_RAX: 000000000000003b
RAX: ffffffffffffffda RBX: 00007fa09bfb11d0 RCX: 00007fa09be9e059
RDX: 0000000020000780 RSI: 00000000200001c0 RDI: 0000000020000100
RBP: 00007fa09bef808d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
overlayfs: missing 'lowerdir'
R13: 00007ffe11bdf36f R14: 00007fa09a7b0300 R15: 0000000000022000
overlayfs: filesystem on './bus' not supported as upperdir
overlayfs: missing 'lowerdir'
overlayfs: missing 'lowerdir'
overlayfs: failed to resolve './bus': -2
nla_parse: 7 callbacks suppressed
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'.
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'.
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'.
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 1
CPU: 0 PID: 7322 Comm: syz-executor.1 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0xa/0xf lib/fault-inject.c:149
 __should_failslab+0x115/0x180 mm/failslab.c:32
 should_failslab+0x5/0x10 mm/slab_common.c:1590
 slab_pre_alloc_hook mm/slab.h:424 [inline]
 slab_alloc mm/slab.c:3383 [inline]
 __do_kmalloc mm/slab.c:3725 [inline]
 __kmalloc+0x2ab/0x3c0 mm/slab.c:3736
 kmalloc include/linux/slab.h:520 [inline]
 x25_asy_open drivers/net/wan/x25_asy.c:473 [inline]
 x25_asy_open_tty+0x411/0x7c0 drivers/net/wan/x25_asy.c:580
 tty_ldisc_open+0x81/0xc0 drivers/tty/tty_ldisc.c:469
 tty_set_ldisc+0x2d2/0x650 drivers/tty/tty_ldisc.c:594
 tiocsetd drivers/tty/tty_io.c:2359 [inline]
 tty_ioctl+0xb4b/0x1630 drivers/tty/tty_io.c:2603
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:501 [inline]
 do_vfs_ioctl+0xcdb/0x12e0 fs/ioctl.c:688
 ksys_ioctl+0x9b/0xc0 fs/ioctl.c:705
 __do_sys_ioctl fs/ioctl.c:712 [inline]
 __se_sys_ioctl fs/ioctl.c:710 [inline]
 __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:710
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fa09be9e059
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa09a813168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fa09bfb0f60 RCX: 00007fa09be9e059
RDX: 00000000200000c0 RSI: 0000000000005423 RDI: 0000000000000003
RBP: 00007fa09a8131d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffe11bdf36f R14: 00007fa09a813300 R15: 0000000000022000
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 1
CPU: 0 PID: 7343 Comm: syz-executor.5 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0xa/0xf lib/fault-inject.c:149
 __should_failslab+0x115/0x180 mm/failslab.c:32
 should_failslab+0x5/0x10 mm/slab_common.c:1590
 slab_pre_alloc_hook mm/slab.h:424 [inline]
 slab_alloc mm/slab.c:3383 [inline]
 __do_kmalloc mm/slab.c:3725 [inline]
 __kmalloc_track_caller+0x2a6/0x3c0 mm/slab.c:3742
 memdup_user+0x22/0xb0 mm/util.c:160
 con_font_set drivers/tty/vt/vt.c:4518 [inline]
 con_font_op+0x69a/0xf20 drivers/tty/vt/vt.c:4599
 vt_ioctl+0x1543/0x2380 drivers/tty/vt/vt_ioctl.c:993
 tty_ioctl+0x5b0/0x1630 drivers/tty/tty_io.c:2669
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:501 [inline]
 do_vfs_ioctl+0xcdb/0x12e0 fs/ioctl.c:688
 ksys_ioctl+0x9b/0xc0 fs/ioctl.c:705
 __do_sys_ioctl fs/ioctl.c:712 [inline]
 __se_sys_ioctl fs/ioctl.c:710 [inline]
 __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:710
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f9b85ef7059
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9b8486c168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f9b86009f60 RCX: 00007f9b85ef7059
RDX: 0000000020000400 RSI: 0000000000004b72 RDI: 0000000000000003
RBP: 00007f9b8486c1d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fff471a96cf R14: 00007f9b8486c300 R15: 0000000000022000
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 7369 Comm: syz-executor.1 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0xa/0xf lib/fault-inject.c:149
 __should_failslab+0x115/0x180 mm/failslab.c:32
 should_failslab+0x5/0x10 mm/slab_common.c:1590
 slab_pre_alloc_hook mm/slab.h:424 [inline]
 slab_alloc mm/slab.c:3383 [inline]
 __do_kmalloc mm/slab.c:3725 [inline]
 __kmalloc+0x2ab/0x3c0 mm/slab.c:3736
 kmalloc include/linux/slab.h:520 [inline]
 x25_asy_open drivers/net/wan/x25_asy.c:476 [inline]
 x25_asy_open_tty+0x470/0x7c0 drivers/net/wan/x25_asy.c:580
 tty_ldisc_open+0x81/0xc0 drivers/tty/tty_ldisc.c:469
 tty_set_ldisc+0x2d2/0x650 drivers/tty/tty_ldisc.c:594
 tiocsetd drivers/tty/tty_io.c:2359 [inline]
 tty_ioctl+0xb4b/0x1630 drivers/tty/tty_io.c:2603
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:501 [inline]
 do_vfs_ioctl+0xcdb/0x12e0 fs/ioctl.c:688
 ksys_ioctl+0x9b/0xc0 fs/ioctl.c:705
 __do_sys_ioctl fs/ioctl.c:712 [inline]
 __se_sys_ioctl fs/ioctl.c:710 [inline]
 __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:710
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fa09be9e059
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa09a813168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fa09bfb0f60 RCX: 00007fa09be9e059
RDX: 00000000200000c0 RSI: 0000000000005423 RDI: 0000000000000003
RBP: 00007fa09a8131d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffe11bdf36f R14: 00007fa09a813300 R15: 0000000000022000
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 0 PID: 7403 Comm: syz-executor.1 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 fail_dump lib/fault-inject.c:51 [inline]
 should_fail.cold+0xa/0xf lib/fault-inject.c:149
 __should_failslab+0x115/0x180 mm/failslab.c:32
 should_failslab+0x5/0x10 mm/slab_common.c:1590
 slab_pre_alloc_hook mm/slab.h:424 [inline]
 slab_alloc mm/slab.c:3383 [inline]
 kmem_cache_alloc_trace+0x46/0x380 mm/slab.c:3623
 kmalloc include/linux/slab.h:515 [inline]
 kzalloc include/linux/slab.h:709 [inline]
 lapb_create_cb net/lapb/lapb_iface.c:121 [inline]
 lapb_register+0xb9/0x5a0 net/lapb/lapb_iface.c:158
 x25_asy_open drivers/net/wan/x25_asy.c:490 [inline]
 x25_asy_open_tty+0x5ac/0x7c0 drivers/net/wan/x25_asy.c:580
 tty_ldisc_open+0x81/0xc0 drivers/tty/tty_ldisc.c:469
 tty_set_ldisc+0x2d2/0x650 drivers/tty/tty_ldisc.c:594
 tiocsetd drivers/tty/tty_io.c:2359 [inline]
 tty_ioctl+0xb4b/0x1630 drivers/tty/tty_io.c:2603
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:501 [inline]
 do_vfs_ioctl+0xcdb/0x12e0 fs/ioctl.c:688
 ksys_ioctl+0x9b/0xc0 fs/ioctl.c:705
 __do_sys_ioctl fs/ioctl.c:712 [inline]
 __se_sys_ioctl fs/ioctl.c:710 [inline]
 __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:710
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fa09be9e059
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa09a813168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fa09bfb0f60 RCX: 00007fa09be9e059
RDX: 00000000200000c0 RSI: 0000000000005423 RDI: 0000000000000003
RBP: 00007fa09a8131d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffe11bdf36f R14: 00007fa09a813300 R15: 0000000000022000