====================================================== WARNING: possible circular locking dependency detected 4.20.0+ #175 Not tainted ------------------------------------------------------ syz-executor0/30785 is trying to acquire lock: 00000000e50bfd6d (&ovl_i_mutex_dir_key[depth]){++++}, at: inode_lock_shared include/linux/fs.h:767 [inline] 00000000e50bfd6d (&ovl_i_mutex_dir_key[depth]){++++}, at: lookup_slow+0x49/0x80 fs/namei.c:1687 but task is already holding lock: 000000006a63390e (&sig->cred_guard_mutex){+.+.}, at: __do_sys_perf_event_open+0x12fe/0x2f30 kernel/events/core.c:10511 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (&sig->cred_guard_mutex){+.+.}: __mutex_lock_common kernel/locking/mutex.c:925 [inline] __mutex_lock+0x166/0x1700 kernel/locking/mutex.c:1072 mutex_lock_killable_nested+0x16/0x20 kernel/locking/mutex.c:1102 do_io_accounting+0x1d2/0xf80 fs/proc/base.c:2703 proc_tgid_io_accounting+0x22/0x30 fs/proc/base.c:2752 proc_single_show+0x101/0x190 fs/proc/base.c:737 seq_read+0x4af/0x1150 fs/seq_file.c:229 do_loop_readv_writev fs/read_write.c:700 [inline] do_iter_read+0x4bc/0x670 fs/read_write.c:924 vfs_readv+0x175/0x1c0 fs/read_write.c:986 do_preadv+0x1cc/0x280 fs/read_write.c:1070 __do_sys_preadv fs/read_write.c:1120 [inline] __se_sys_preadv fs/read_write.c:1115 [inline] __x64_sys_preadv+0x9a/0xf0 fs/read_write.c:1115 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe -> #2 (&p->lock){+.+.}: __mutex_lock_common kernel/locking/mutex.c:925 [inline] __mutex_lock+0x166/0x1700 kernel/locking/mutex.c:1072 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087 seq_read+0x71/0x1150 fs/seq_file.c:161 do_loop_readv_writev fs/read_write.c:700 [inline] do_iter_read+0x4bc/0x670 fs/read_write.c:924 vfs_readv+0x175/0x1c0 fs/read_write.c:986 kernel_readv fs/splice.c:362 [inline] default_file_splice_read+0x539/0xb20 fs/splice.c:417 do_splice_to+0x12e/0x190 fs/splice.c:880 splice_direct_to_actor+0x31c/0x9d0 fs/splice.c:957 do_splice_direct+0x2d4/0x420 fs/splice.c:1066 do_sendfile+0x62a/0xe50 fs/read_write.c:1439 __do_sys_sendfile64 fs/read_write.c:1500 [inline] __se_sys_sendfile64 fs/read_write.c:1486 [inline] __x64_sys_sendfile64+0x1fd/0x250 fs/read_write.c:1486 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe -> #1 (sb_writers#4){.+.+}: percpu_down_read_preempt_disable include/linux/percpu-rwsem.h:36 [inline] percpu_down_read include/linux/percpu-rwsem.h:59 [inline] __sb_start_write+0x214/0x370 fs/super.c:1387 sb_start_write include/linux/fs.h:1602 [inline] mnt_want_write+0x3f/0xc0 fs/namespace.c:360 ovl_want_write+0x76/0xa0 fs/overlayfs/util.c:24 ovl_xattr_set+0x53/0x5b0 fs/overlayfs/inode.c:332 ovl_posix_acl_xattr_set+0x3c6/0xb00 fs/overlayfs/super.c:908 __vfs_setxattr+0x124/0x180 fs/xattr.c:149 __vfs_setxattr_noperm+0x11d/0x410 fs/xattr.c:180 vfs_setxattr+0xd8/0x100 fs/xattr.c:223 setxattr+0x2ea/0x450 fs/xattr.c:450 __do_sys_fsetxattr fs/xattr.c:505 [inline] __se_sys_fsetxattr fs/xattr.c:494 [inline] __x64_sys_fsetxattr+0x1fc/0x290 fs/xattr.c:494 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe -> #0 (&ovl_i_mutex_dir_key[depth]){++++}: lock_acquire+0x1ed/0x520 kernel/locking/lockdep.c:3841 down_read+0x8d/0x120 kernel/locking/rwsem.c:24 inode_lock_shared include/linux/fs.h:767 [inline] lookup_slow+0x49/0x80 fs/namei.c:1687 walk_component+0x92b/0x25b0 fs/namei.c:1810 lookup_last fs/namei.c:2273 [inline] path_lookupat.isra.43+0x212/0xc00 fs/namei.c:2318 filename_lookup+0x26a/0x520 fs/namei.c:2348 kern_path+0x33/0x40 fs/namei.c:2434 create_local_trace_uprobe+0x9b/0x620 kernel/trace/trace_uprobe.c:1377 perf_uprobe_init+0x18c/0x280 kernel/trace/trace_event_perf.c:316 perf_uprobe_event_init+0x106/0x1a0 kernel/events/core.c:8503 perf_try_init_event+0x137/0x2f0 kernel/events/core.c:9770 perf_init_event kernel/events/core.c:9801 [inline] perf_event_alloc.part.94+0x1c91/0x3590 kernel/events/core.c:10074 perf_event_alloc kernel/events/core.c:10430 [inline] __do_sys_perf_event_open+0xa9c/0x2f30 kernel/events/core.c:10531 __se_sys_perf_event_open kernel/events/core.c:10420 [inline] __x64_sys_perf_event_open+0xbe/0x150 kernel/events/core.c:10420 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe other info that might help us debug this: Chain exists of: &ovl_i_mutex_dir_key[depth] --> &p->lock --> &sig->cred_guard_mutex Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&sig->cred_guard_mutex); lock(&p->lock); lock(&sig->cred_guard_mutex); lock(&ovl_i_mutex_dir_key[depth]); *** DEADLOCK *** 2 locks held by syz-executor0/30785: #0: 000000006a63390e (&sig->cred_guard_mutex){+.+.}, at: __do_sys_perf_event_open+0x12fe/0x2f30 kernel/events/core.c:10511 #1: 00000000fa4a5b99 (&pmus_srcu){....}, at: perf_event_alloc.part.94+0x16c0/0x3590 kernel/events/core.c:10070 stack backtrace: CPU: 1 PID: 30785 Comm: syz-executor0 Not tainted 4.20.0+ #175 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1d3/0x2c6 lib/dump_stack.c:113 print_circular_bug.isra.34.cold.56+0x1bd/0x27d kernel/locking/lockdep.c:1224 check_prev_add kernel/locking/lockdep.c:1866 [inline] check_prevs_add kernel/locking/lockdep.c:1979 [inline] validate_chain kernel/locking/lockdep.c:2350 [inline] __lock_acquire+0x3360/0x4c20 kernel/locking/lockdep.c:3338 lock_acquire+0x1ed/0x520 kernel/locking/lockdep.c:3841 down_read+0x8d/0x120 kernel/locking/rwsem.c:24 inode_lock_shared include/linux/fs.h:767 [inline] lookup_slow+0x49/0x80 fs/namei.c:1687 walk_component+0x92b/0x25b0 fs/namei.c:1810 lookup_last fs/namei.c:2273 [inline] path_lookupat.isra.43+0x212/0xc00 fs/namei.c:2318 filename_lookup+0x26a/0x520 fs/namei.c:2348 kern_path+0x33/0x40 fs/namei.c:2434 create_local_trace_uprobe+0x9b/0x620 kernel/trace/trace_uprobe.c:1377 perf_uprobe_init+0x18c/0x280 kernel/trace/trace_event_perf.c:316 perf_uprobe_event_init+0x106/0x1a0 kernel/events/core.c:8503 perf_try_init_event+0x137/0x2f0 kernel/events/core.c:9770 perf_init_event kernel/events/core.c:9801 [inline] perf_event_alloc.part.94+0x1c91/0x3590 kernel/events/core.c:10074 perf_event_alloc kernel/events/core.c:10430 [inline] __do_sys_perf_event_open+0xa9c/0x2f30 kernel/events/core.c:10531 __se_sys_perf_event_open kernel/events/core.c:10420 [inline] __x64_sys_perf_event_open+0xbe/0x150 kernel/events/core.c:10420 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4579b9 Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f76d419ec78 EFLAGS: 00000246 ORIG_RAX: 000000000000012a RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000004579b9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000180 RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 00007f76d419f6d4 R13: 00000000004c3e10 R14: 00000000004d6e70 R15: 00000000ffffffff netlink: 'syz-executor2': attribute type 15 has an invalid length. netlink: 'syz-executor2': attribute type 21 has an invalid length. kobject: 'loop4' (00000000125a636a): kobject_uevent_env IPv6: NLM_F_CREATE should be specified when creating new route kobject: 'loop4' (00000000125a636a): fill_kobj_path: path = '/devices/virtual/block/loop4' netlink: 13 bytes leftover after parsing attributes in process `syz-executor2'. overlayfs: './file0' not a directory IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE IPv6: NLM_F_CREATE should be set when creating new route IPv6: NLM_F_CREATE should be set when creating new route IPv6: NLM_F_CREATE should be set when creating new route netlink: 'syz-executor2': attribute type 15 has an invalid length. netlink: 'syz-executor2': attribute type 21 has an invalid length. netlink: 13 bytes leftover after parsing attributes in process `syz-executor2'. IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE netlink: 'syz-executor2': attribute type 15 has an invalid length. netlink: 'syz-executor2': attribute type 21 has an invalid length. netlink: 13 bytes leftover after parsing attributes in process `syz-executor2'. IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE netlink: 'syz-executor5': attribute type 15 has an invalid length. netlink: 'syz-executor5': attribute type 21 has an invalid length. IPv6: NLM_F_CREATE should be specified when creating new route netlink: 13 bytes leftover after parsing attributes in process `syz-executor5'. IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE IPv6: NLM_F_CREATE should be set when creating new route IPv6: NLM_F_CREATE should be set when creating new route IPv6: NLM_F_CREATE should be set when creating new route kobject: 'loop4' (00000000125a636a): kobject_uevent_env kobject: 'loop4' (00000000125a636a): fill_kobj_path: path = '/devices/virtual/block/loop4' netlink: 'syz-executor5': attribute type 15 has an invalid length. netlink: 'syz-executor5': attribute type 21 has an invalid length. netlink: 13 bytes leftover after parsing attributes in process `syz-executor5'. IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE netlink: 13 bytes leftover after parsing attributes in process `syz-executor2'. IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE kobject: 'loop4' (00000000125a636a): kobject_uevent_env kobject: 'loop4' (00000000125a636a): fill_kobj_path: path = '/devices/virtual/block/loop4' netlink: 13 bytes leftover after parsing attributes in process `syz-executor5'. kobject: 'loop4' (00000000125a636a): kobject_uevent_env kobject: 'loop4' (00000000125a636a): fill_kobj_path: path = '/devices/virtual/block/loop4' IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE kobject: 'loop4' (00000000125a636a): kobject_uevent_env kobject: 'loop4' (00000000125a636a): fill_kobj_path: path = '/devices/virtual/block/loop4' kobject: 'loop4' (00000000125a636a): kobject_uevent_env kobject: 'loop4' (00000000125a636a): fill_kobj_path: path = '/devices/virtual/block/loop4' FS-Cache: Duplicate cookie detected FS-Cache: O-cookie c=00000000858d5ed6 [p=000000003a88eea9 fl=222 nc=0 na=1] FS-Cache: O-cookie d=00000000b2f86bf9 n=00000000c9f0dc0d FS-Cache: O-key=[10] '0200020000807f000008' FS-Cache: N-cookie c=0000000084c63f01 [p=000000003a88eea9 fl=2 nc=0 na=1] FS-Cache: N-cookie d=00000000b2f86bf9 n=000000000ad1ae29 FS-Cache: N-key=[10] '0200020000807f000008' kobject: 'loop4' (00000000125a636a): kobject_uevent_env kobject: 'loop4' (00000000125a636a): fill_kobj_path: path = '/devices/virtual/block/loop4' FS-Cache: Duplicate cookie detected FS-Cache: O-cookie c=00000000d91b30d4 [p=000000003a88eea9 fl=222 nc=0 na=1] FS-Cache: O-cookie d=00000000b2f86bf9 n=0000000068593442 FS-Cache: O-key=[10] '0200020000807f000008' FS-Cache: N-cookie c=00000000c64e9d6a [p=000000003a88eea9 fl=2 nc=0 na=1] FS-Cache: N-cookie d=00000000b2f86bf9 n=00000000bd8d622a FS-Cache: N-key=[10] '0200020000807f000008' FS-Cache: Duplicate cookie detected FS-Cache: O-cookie c=00000000d91b30d4 [p=000000003a88eea9 fl=222 nc=0 na=1] FS-Cache: O-cookie d=00000000b2f86bf9 n=0000000068593442 FS-Cache: O-key=[10] '0200020000807f000008' FS-Cache: N-cookie c=00000000e2ba584d [p=000000003a88eea9 fl=2 nc=0 na=1] FS-Cache: N-cookie d=00000000b2f86bf9 n=00000000bc77dc0b FS-Cache: N-key=[10] '0200020000807f000008' kobject: 'loop4' (00000000125a636a): kobject_uevent_env kobject: 'loop4' (00000000125a636a): fill_kobj_path: path = '/devices/virtual/block/loop4' FS-Cache: Duplicate cookie detected FS-Cache: O-cookie c=00000000de8c93a0 [p=000000003a88eea9 fl=222 nc=0 na=1] FS-Cache: O-cookie d=00000000b2f86bf9 n=000000005f9c1ddb FS-Cache: O-key=[10] '0200020000807f000008' FS-Cache: N-cookie c=000000004bdc3719 [p=000000003a88eea9 fl=2 nc=0 na=1] FS-Cache: N-cookie d=00000000b2f86bf9 n=0000000063464bc5 FS-Cache: N-key=[10] '0200020000807f000008' FS-Cache: Duplicate cookie detected FS-Cache: O-cookie c=00000000c4a0b234 [p=000000003a88eea9 fl=222 nc=0 na=1] FS-Cache: O-cookie d=00000000b2f86bf9 n=0000000018bc8eba FS-Cache: O-key=[10] '0200020000807f000008' FS-Cache: N-cookie c=00000000c19a43c6 [p=000000003a88eea9 fl=2 nc=0 na=1] FS-Cache: N-cookie d=00000000b2f86bf9 n=00000000b44e957a FS-Cache: N-key=[10] '0200020000807f000008' audit: type=1800 audit(2000000222.869:4108): pid=30978 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor3" name="file0" dev="sda1" ino=17124 res=0 audit: type=1804 audit(2000000222.909:4109): pid=30978 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor3" name="/root/syzkaller-testdir971287646/syzkaller.pcSGFi/1647/file0" dev="sda1" ino=17124 res=1 kobject: 'loop4' (00000000125a636a): kobject_uevent_env audit: type=1800 audit(2000000222.909:4110): pid=30978 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor3" name="file0" dev="sda1" ino=17124 res=0 kobject: 'loop4' (00000000125a636a): fill_kobj_path: path = '/devices/virtual/block/loop4' kobject: 'loop4' (00000000125a636a): kobject_uevent_env kobject: 'loop4' (00000000125a636a): fill_kobj_path: path = '/devices/virtual/block/loop4' audit: type=1804 audit(2000000223.839:4111): pid=30978 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor3" name="/root/syzkaller-testdir971287646/syzkaller.pcSGFi/1647/file0" dev="sda1" ino=17124 res=1 audit: type=1800 audit(2000000223.839:4112): pid=30978 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor3" name="file0" dev="sda1" ino=17124 res=0 kobject: 'loop4' (00000000125a636a): kobject_uevent_env kobject: 'loop4' (00000000125a636a): fill_kobj_path: path = '/devices/virtual/block/loop4' audit: type=1800 audit(2000000224.149:4113): pid=31027 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor3" name="file0" dev="sda1" ino=17411 res=0 audit: type=1804 audit(2000000224.239:4114): pid=31027 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor3" name="/root/syzkaller-testdir971287646/syzkaller.pcSGFi/1648/file0" dev="sda1" ino=17411 res=1 audit: type=1800 audit(2000000224.239:4115): pid=31027 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor3" name="file0" dev="sda1" ino=17411 res=0 audit: type=1800 audit(2000000224.279:4116): pid=31038 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor2" name="file0" dev="sda1" ino=17265 res=0 kobject: 'loop4' (00000000125a636a): kobject_uevent_env audit: type=1804 audit(2000000224.349:4117): pid=31038 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor2" name="/root/syzkaller-testdir352966181/syzkaller.cGHhpp/1671/file0" dev="sda1" ino=17265 res=1 kobject: 'loop4' (00000000125a636a): fill_kobj_path: path = '/devices/virtual/block/loop4' kobject: 'loop4' (00000000125a636a): kobject_uevent_env kobject: 'loop4' (00000000125a636a): fill_kobj_path: path = '/devices/virtual/block/loop4'