====================================================== WARNING: possible circular locking dependency detected 4.14.215-syzkaller #0 Not tainted IPVS: Error connecting to the multicast addr ------------------------------------------------------ syz-executor.4/22139 is trying to acquire lock: (&oi->lock){+.+.}, at: [] ovl_copy_up_start+0x40/0xe0 fs/overlayfs/util.c:318 but task is already holding lock: (sb_writers#6){.+.+}, at: [] sb_start_write include/linux/fs.h:1549 [inline] (sb_writers#6){.+.+}, at: [] mnt_want_write+0x3a/0xb0 fs/namespace.c:386 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (sb_writers#6){.+.+}: IPVS: sync thread started: state = MASTER, mcast_ifn = syz_tun, syncid = 0, id = 0 percpu_down_read_preempt_disable include/linux/percpu-rwsem.h:36 [inline] percpu_down_read include/linux/percpu-rwsem.h:59 [inline] __sb_start_write+0x64/0x260 fs/super.c:1342 sb_start_write include/linux/fs.h:1549 [inline] mnt_want_write+0x3a/0xb0 fs/namespace.c:386 ovl_create_object+0x75/0x1d0 fs/overlayfs/dir.c:538 lookup_open+0x77a/0x1750 fs/namei.c:3241 do_last fs/namei.c:3334 [inline] path_openat+0xe08/0x2970 fs/namei.c:3569 do_filp_open+0x179/0x3c0 fs/namei.c:3603 do_sys_open+0x296/0x410 fs/open.c:1081 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb -> #1 (&ovl_i_mutex_dir_key[depth]){++++}: down_read+0x36/0x80 kernel/locking/rwsem.c:24 inode_lock_shared include/linux/fs.h:729 [inline] lookup_slow+0x129/0x400 fs/namei.c:1674 lookup_one_len_unlocked+0x3a0/0x410 fs/namei.c:2595 ovl_lower_positive+0x184/0x345 fs/overlayfs/namei.c:783 ovl_rename+0x47c/0xf10 fs/overlayfs/dir.c:968 vfs_rename+0x560/0x1820 fs/namei.c:4496 SYSC_renameat2 fs/namei.c:4644 [inline] SyS_renameat2+0x95b/0xad0 fs/namei.c:4533 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb -> #0 (&oi->lock){+.+.}: lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 __mutex_lock_common kernel/locking/mutex.c:756 [inline] __mutex_lock+0xc4/0x1310 kernel/locking/mutex.c:893 ovl_copy_up_start+0x40/0xe0 fs/overlayfs/util.c:318 ovl_copy_up_one+0x21f/0x910 fs/overlayfs/copy_up.c:630 ovl_copy_up_flags+0xd5/0x120 fs/overlayfs/copy_up.c:685 ovl_xattr_set+0x1fc/0x270 fs/overlayfs/inode.c:225 __vfs_removexattr+0xcf/0x120 fs/xattr.c:416 cap_inode_killpriv+0x19/0x40 security/commoncap.c:323 security_inode_killpriv+0x66/0xa0 security/security.c:796 setattr_prepare+0x116/0x530 fs/attr.c:90 ovl_setattr+0x27/0x500 fs/overlayfs/inode.c:34 notify_change+0x56b/0xd10 fs/attr.c:313 chown_common+0x40b/0x4b0 fs/open.c:631 SYSC_fchownat fs/open.c:661 [inline] SyS_fchownat+0xf6/0x190 fs/open.c:641 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb other info that might help us debug this: Chain exists of: &oi->lock --> &ovl_i_mutex_dir_key[depth] --> sb_writers#6 Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(sb_writers#6); lock(&ovl_i_mutex_dir_key[depth]); lock(sb_writers#6); lock(&oi->lock); *** DEADLOCK *** 3 locks held by syz-executor.4/22139: #0: (sb_writers#17){.+.+}, at: [] sb_start_write include/linux/fs.h:1549 [inline] #0: (sb_writers#17){.+.+}, at: [] mnt_want_write+0x3a/0xb0 fs/namespace.c:386 #1: (&ovl_i_mutex_key[depth]#2){+.+.}, at: [] inode_lock include/linux/fs.h:719 [inline] #1: (&ovl_i_mutex_key[depth]#2){+.+.}, at: [] chown_common+0x272/0x4b0 fs/open.c:628 #2: (sb_writers#6){.+.+}, at: [] sb_start_write include/linux/fs.h:1549 [inline] #2: (sb_writers#6){.+.+}, at: [] mnt_want_write+0x3a/0xb0 fs/namespace.c:386 stack backtrace: CPU: 1 PID: 22139 Comm: syz-executor.4 Not tainted 4.14.215-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x283 lib/dump_stack.c:58 print_circular_bug.constprop.0.cold+0x2d7/0x41e kernel/locking/lockdep.c:1258 check_prev_add kernel/locking/lockdep.c:1905 [inline] check_prevs_add kernel/locking/lockdep.c:2022 [inline] validate_chain kernel/locking/lockdep.c:2464 [inline] __lock_acquire+0x2e0e/0x3f20 kernel/locking/lockdep.c:3491 lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 __mutex_lock_common kernel/locking/mutex.c:756 [inline] __mutex_lock+0xc4/0x1310 kernel/locking/mutex.c:893 ovl_copy_up_start+0x40/0xe0 fs/overlayfs/util.c:318 ovl_copy_up_one+0x21f/0x910 fs/overlayfs/copy_up.c:630 ovl_copy_up_flags+0xd5/0x120 fs/overlayfs/copy_up.c:685 ovl_xattr_set+0x1fc/0x270 fs/overlayfs/inode.c:225 __vfs_removexattr+0xcf/0x120 fs/xattr.c:416 cap_inode_killpriv+0x19/0x40 security/commoncap.c:323 security_inode_killpriv+0x66/0xa0 security/security.c:796 setattr_prepare+0x116/0x530 fs/attr.c:90 ovl_setattr+0x27/0x500 fs/overlayfs/inode.c:34 notify_change+0x56b/0xd10 fs/attr.c:313 chown_common+0x40b/0x4b0 fs/open.c:631 SYSC_fchownat fs/open.c:661 [inline] SyS_fchownat+0xf6/0x190 fs/open.c:641 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45e219 RSP: 002b:00007f0679480c68 EFLAGS: 00000246 ORIG_RAX: 000000000000005c RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045e219 RDX: 000000000000ee01 RSI: 0000000000000000 RDI: 0000000020000600 RBP: 000000000119bfc0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000119bf8c R13: 00007ffedb57917f R14: 00007f06794819c0 R15: 000000000119bf8c IPVS: stopping master sync thread 22144 ... ptrace attach of "/root/syz-executor.5"[8013] was attempted by " g3SZ&ټά(q:\x07]ωe\x0c}\x0b \x0aǚ'k,wtrE`5y\x5cvA1GZ.m>E0`]ZYfoSA1-0E1Rmʵ?IpeO${$\x22^0Uƾ6\x09n~`e`'٭'L^ c*38fvg\x5cij)P-9 \x0dڝ^R@kw-c8\x0brv6R]$Dmڅc;T]Z'ܴ\x0bSPKz,1-\x22~*a>uH%&3btrύBJxš\x09\x1b:\x0dO<0Pxf m׼3^Z %c[R֌\x0cǏ6e\x1bqGvҵtJoe_demA-0,eE\x0dzM{@^?е\x0bZAjitdҽo(A濃 m;(1Hg5\x0a ptrace attach of "/root/syz-executor.5"[8013] was attempted by " g3SZ&ټά(q:\x07]ωe\x0c}\x0b \x0aǚ'k,wtrE`5y\x5cvA1GZ.m>E0`]ZYfoSA1-0E1Rmʵ?IpeO${$\x22^0Uƾ6\x09n~`e`'٭'L^ c*38fvg\x5cij)P-9 \x0dڝ^R@kw-c8\x0brv6R]$Dmڅc;T]Z'ܴ\x0bSPKz,1-\x22~*a>uH%&3btrύBJxš\x09\x1b:\x0dO<0Pxf m׼3^Z %c[R֌\x0cǏ6e\x1bqGvҵtJoe_demA-0,eE\x0dzM{@^?е\x0bZAjitdҽo(A濃 m;(1Hg5\x0a IPVS: Error connecting to the multicast addr IPVS: sync thread started: state = MASTER, mcast_ifn = syz_tun, syncid = 0, id = 0 IPVS: stopping master sync thread 22186 ... ptrace attach of "/root/syz-executor.5"[8013] was attempted by " g3SZ&ټά(q:\x07]ωe\x0c}\x0b \x0aǚ'k,wtrE`5y\x5cvA1GZ.m>E0`]ZYfoSA1-0E1Rmʵ?IpeO${$\x22^0Uƾ6\x09n~`e`'٭'L^ c*38fvg\x5cij)P-9 \x0dڝ^R@kw-c8\x0brv6R]$Dmڅc;T]Z'ܴ\x0bSPKz,1-\x22~*a>uH%&3btrύBJxš\x09\x1b:\x0dO<0Pxf m׼3^Z %c[R֌\x0cǏ6e\x1bqGvҵtJoe_demA-0,eE\x0dzM{@^?е\x0bZAjitdҽo(A濃 m;(1Hg5\x0a ptrace attach of "/root/syz-executor.2"[8012] was attempted by " g3SZ&ټά(q:\x07]ωe\x0c}\x0b \x0aǚ'k,wtrE`5y\x5cvA1GZ.m>E0`]ZYfoSA1-0E1Rmʵ?IpeO${$\x22^0Uƾ6\x09n~`e`'٭'L^ c*38fvg\x5cij)P-9 \x0dڝ^R@kw-c8\x0brv6R]$Dmڅc;T]Z'ܴ\x0bSPKz,1-\x22~*a>uH%&3btrύBJxš\x09\x1b:\x0dO<0Pxf m׼3^Z %c[R֌\x0cǏ6e\x1bqGvҵtJoe_demA-0,eE\x0dzM{@^?е\x0bZAjitdҽo(A濃 m;(1Hg5\x0a ptrace attach of "/root/syz-executor.0"[8011] was attempted by " g3SZ&ټά(q:\x07]ωe\x0c}\x0b \x0aǚ'k,wtrE`5y\x5cvA1GZ.m>E0`]ZYfoSA1-0E1Rmʵ?IpeO${$\x22^0Uƾ6\x09n~`e`'٭'L^ c*38fvg\x5cij)P-9 \x0dڝ^R@kw-c8\x0brv6R]$Dmڅc;T]Z'ܴ\x0bSPKz,1-\x22~*a>uH%&3btrύBJxš\x09\x1b:\x0dO<0Pxf m׼3^Z %c[R֌\x0cǏ6e\x1bqGvҵtJoe_demA-0,eE\x0dzM{@^?е\x0bZAjitdҽo(A濃 m;(1Hg5\x0a ptrace attach of "/root/syz-executor.0"[8011] was attempted by " g3SZ&ټά(q:\x07]ωe\x0c}\x0b \x0aǚ'k,wtrE`5y\x5cvA1GZ.m>E0`]ZYfoSA1-0E1Rmʵ?IpeO${$\x22^0Uƾ6\x09n~`e`'٭'L^ c*38fvg\x5cij)P-9 \x0dڝ^R@kw-c8\x0brv6R]$Dmڅc;T]Z'ܴ\x0bSPKz,1-\x22~*a>uH%&3btrύBJxš\x09\x1b:\x0dO<0Pxf m׼3^Z %c[R֌\x0cǏ6e\x1bqGvҵtJoe_demA-0,eE\x0dzM{@^?е\x0bZAjitdҽo(A濃 m;(1Hg5\x0a ptrace attach of "/root/syz-executor.5"[8013] was attempted by " g3SZ&ټά(q:\x07]ωe\x0c}\x0b \x0aǚ'k,wtrE`5y\x5cvA1GZ.m>E0`]ZYfoSA1-0E1Rmʵ?IpeO${$\x22^0Uƾ6\x09n~`e`'٭'L^ c*38fvg\x5cij)P-9 \x0dڝ^R@kw-c8\x0brv6R]$Dmڅc;T]Z'ܴ\x0bSPKz,1-\x22~*a>uH%&3btrύBJxš\x09\x1b:\x0dO<0Pxf m׼3^Z %c[R֌\x0cǏ6e\x1bqGvҵtJoe_demA-0,eE\x0dzM{@^?е\x0bZAjitdҽo(A濃 m;(1Hg5\x0a netlink: 180 bytes leftover after parsing attributes in process `syz-executor.1'. ptrace attach of "/root/syz-executor.0"[8011] was attempted by " g3SZ&ټά(q:\x07]ωe\x0c}\x0b \x0aǚ'k,wtrE`5y\x5cvA1GZ.m>E0`]ZYfoSA1-0E1Rmʵ?IpeO${$\x22^0Uƾ6\x09n~`e`'٭'L^ c*38fvg\x5cij)P-9 \x0dڝ^R@kw-c8\x0brv6R]$Dmڅc;T]Z'ܴ\x0bSPKz,1-\x22~*a>uH%&3btrύBJxš\x09\x1b:\x0dO<0Pxf m׼3^Z %c[R֌\x0cǏ6e\x1bqGvҵtJoe_demA-0,eE\x0dzM{@^?е\x0bZAjitdҽo(A濃 m;(1Hg5\x0a ptrace attach of "/root/syz-executor.5"[8013] was attempted by " g3SZ&ټά(q:\x07]ωe\x0c}\x0b \x0aǚ'k,wtrE`5y\x5cvA1GZ.m>E0`]ZYfoSA1-0E1Rmʵ?IpeO${$\x22^0Uƾ6\x09n~`e`'٭'L^ c*38fvg\x5cij)P-9 \x0dڝ^R@kw-c8\x0brv6R]$Dmڅc;T]Z'ܴ\x0bSPKz,1-\x22~*a>uH%&3btrύBJxš\x09\x1b:\x0dO<0Pxf m׼3^Z %c[R֌\x0cǏ6e\x1bqGvҵtJoe_demA-0,eE\x0dzM{@^?е\x0bZAjitdҽo(A濃 m;(1Hg5\x0a netlink: 180 bytes leftover after parsing attributes in process `syz-executor.1'. netlink: 180 bytes leftover after parsing attributes in process `syz-executor.1'. netlink: 180 bytes leftover after parsing attributes in process `syz-executor.1'. encrypted_key: insufficient parameters specified encrypted_key: insufficient parameters specified xt_connlimit: cannot load conntrack support for address family 10 encrypted_key: insufficient parameters specified xt_connlimit: cannot load conntrack support for address family 10 encrypted_key: insufficient parameters specified xt_connlimit: cannot load conntrack support for address family 10 audit: type=1804 audit(1610485134.476:63): pid=22459 uid=0 auid=0 ses=4 op="invalid_pcr" cause="open_writers" comm="syz-executor.4" name="/root/syzkaller-testdir329461737/syzkaller.pLyZDB/466/bus" dev="sda1" ino=17081 res=1 audit: type=1804 audit(1610485134.526:64): pid=22459 uid=0 auid=0 ses=4 op="invalid_pcr" cause="open_writers" comm="syz-executor.4" name="/root/syzkaller-testdir329461737/syzkaller.pLyZDB/466/bus" dev="sda1" ino=17081 res=1 audit: type=1804 audit(1610485134.766:65): pid=22466 uid=0 auid=0 ses=4 op="invalid_pcr" cause="open_writers" comm="syz-executor.4" name="/root/syzkaller-testdir329461737/syzkaller.pLyZDB/467/bus" dev="sda1" ino=17089 res=1 audit: type=1804 audit(1610485135.076:66): pid=22478 uid=0 auid=0 ses=4 op="invalid_pcr" cause="open_writers" comm="syz-executor.4" name="/root/syzkaller-testdir329461737/syzkaller.pLyZDB/468/bus" dev="sda1" ino=17107 res=1 netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. device vlan2 entered promiscuous mode netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. audit: type=1804 audit(1610485135.296:67): pid=22492 uid=0 auid=0 ses=4 op="invalid_pcr" cause="open_writers" comm="syz-executor.4" name="/root/syzkaller-testdir329461737/syzkaller.pLyZDB/469/bus" dev="sda1" ino=17107 res=1 device vlan2 entered promiscuous mode netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. device vlan2 entered promiscuous mode netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. device vlan2 entered promiscuous mode netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. device vlan2 entered promiscuous mode PF_BRIDGE: RTM_NEWNEIGH with invalid address PF_BRIDGE: RTM_NEWNEIGH with invalid address PF_BRIDGE: RTM_NEWNEIGH with invalid address libceph: resolve 'd' (ret=-3): failed libceph: parse_ips bad ip 'd::]' PF_BRIDGE: RTM_NEWNEIGH with invalid address libceph: resolve 'd' (ret=-3): failed libceph: parse_ips bad ip 'd::]' libceph: resolve 'd' (ret=-3): failed libceph: parse_ips bad ip 'd::]' libceph: resolve 'd' (ret=-3): failed libceph: parse_ips bad ip 'd::]' libceph: resolve 'd' (ret=-3): failed libceph: parse_ips bad ip 'd::]' libceph: resolve 'd' (ret=-3): failed libceph: parse_ips bad ip 'd::]' libceph: resolve 'd' (ret=-3): failed libceph: parse_ips bad ip 'd::]' libceph: resolve 'd' (ret=-3): failed libceph: resolve 'd' (ret=-3): failed libceph: parse_ips bad ip 'd::]' libceph: parse_ips bad ip 'd::]' libceph: resolve 'd' (ret=-3): failed libceph: parse_ips bad ip 'd::]' libceph: resolve 'd' (ret=-3): failed libceph: parse_ips bad ip 'd::]'