bisecting fixing commit since dd9c7df94c1b23feacd54112f33ad95d93f64533 building syzkaller on f115ae985a399ddce060f448097b8068450a8f48 testing commit dd9c7df94c1b23feacd54112f33ad95d93f64533 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: c4a4fdafcfd3ded7f218785be137a33c7504e46d278fd220776e2b302c31cfb4 all runs: crashed: possible deadlock in process_measurement testing current HEAD ecf93431963a95c0f475921101bedc0dd62ec96d testing commit ecf93431963a95c0f475921101bedc0dd62ec96d compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: 788f81e93162d8cc45111eaa45cb6afad14e146cbc6ae8f8a9f44470c7531db9 all runs: crashed: possible deadlock in process_measurement revisions tested: 2, total time: 19m52.547997277s (build: 12m54.259919043s, test: 6m34.894058816s) the crash still happens on HEAD commit msg: Merge tag 'powerpc-5.14-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux crash: possible deadlock in process_measurement ====================================================== WARNING: possible circular locking dependency detected 5.14.0-rc5-syzkaller #0 Not tainted ------------------------------------------------------ syz-executor.5/10150 is trying to acquire lock: ffff88801b354860 (&iint->mutex){+.+.}-{3:3}, at: process_measurement+0x455/0x1380 security/integrity/ima/ima_main.c:253 but task is already holding lock: ffff88814840e460 (sb_writers#5){.+.+}-{0:0}, at: do_open fs/namei.c:3367 [inline] ffff88814840e460 (sb_writers#5){.+.+}-{0:0}, at: path_openat+0x16bd/0x22c0 fs/namei.c:3507 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (sb_writers#5){.+.+}-{0:0}: percpu_down_read include/linux/percpu-rwsem.h:51 [inline] __sb_start_write include/linux/fs.h:1763 [inline] sb_start_write include/linux/fs.h:1833 [inline] mnt_want_write+0x6a/0x310 fs/namespace.c:375 ovl_maybe_copy_up+0xb3/0x100 fs/overlayfs/copy_up.c:996 ovl_open+0xa0/0x220 fs/overlayfs/file.c:149 do_dentry_open+0x42a/0xfc0 fs/open.c:826 vfs_open fs/open.c:949 [inline] dentry_open+0xf6/0x170 fs/open.c:965 ima_calc_file_hash+0x207/0x3c0 security/integrity/ima/ima_crypto.c:557 ima_collect_measurement+0x3c6/0x4a0 security/integrity/ima/ima_api.c:252 process_measurement+0x8b8/0x1380 security/integrity/ima/ima_main.c:330 ima_file_check+0xac/0x100 security/integrity/ima/ima_main.c:499 do_open fs/namei.c:3376 [inline] path_openat+0x10fb/0x22c0 fs/namei.c:3507 do_filp_open+0x199/0x3d0 fs/namei.c:3534 do_sys_openat2+0x11e/0x360 fs/open.c:1204 do_sys_open fs/open.c:1220 [inline] __do_sys_open fs/open.c:1228 [inline] __se_sys_open fs/open.c:1224 [inline] __x64_sys_open+0xfd/0x1a0 fs/open.c:1224 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae -> #0 (&iint->mutex){+.+.}-{3:3}: check_prev_add kernel/locking/lockdep.c:3051 [inline] check_prevs_add kernel/locking/lockdep.c:3174 [inline] validate_chain kernel/locking/lockdep.c:3789 [inline] __lock_acquire+0x2985/0x5410 kernel/locking/lockdep.c:5015 lock_acquire kernel/locking/lockdep.c:5625 [inline] lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5590 __mutex_lock_common kernel/locking/mutex.c:959 [inline] __mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104 process_measurement+0x455/0x1380 security/integrity/ima/ima_main.c:253 ima_file_check+0xac/0x100 security/integrity/ima/ima_main.c:499 do_open fs/namei.c:3376 [inline] path_openat+0x10fb/0x22c0 fs/namei.c:3507 do_filp_open+0x199/0x3d0 fs/namei.c:3534 do_sys_openat2+0x11e/0x360 fs/open.c:1204 do_sys_open fs/open.c:1220 [inline] __do_sys_openat fs/open.c:1236 [inline] __se_sys_openat fs/open.c:1231 [inline] __x64_sys_openat+0x11b/0x1d0 fs/open.c:1231 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(sb_writers#5); lock(&iint->mutex); lock(sb_writers#5); lock(&iint->mutex); *** DEADLOCK *** 1 lock held by syz-executor.5/10150: #0: ffff88814840e460 (sb_writers#5){.+.+}-{0:0}, at: do_open fs/namei.c:3367 [inline] #0: ffff88814840e460 (sb_writers#5){.+.+}-{0:0}, at: path_openat+0x16bd/0x22c0 fs/namei.c:3507 stack backtrace: CPU: 0 PID: 10150 Comm: syz-executor.5 Not tainted 5.14.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x57/0x7d lib/dump_stack.c:105 check_noncircular+0x25f/0x2e0 kernel/locking/lockdep.c:2131 check_prev_add kernel/locking/lockdep.c:3051 [inline] check_prevs_add kernel/locking/lockdep.c:3174 [inline] validate_chain kernel/locking/lockdep.c:3789 [inline] __lock_acquire+0x2985/0x5410 kernel/locking/lockdep.c:5015 lock_acquire kernel/locking/lockdep.c:5625 [inline] lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5590 __mutex_lock_common kernel/locking/mutex.c:959 [inline] __mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104 process_measurement+0x455/0x1380 security/integrity/ima/ima_main.c:253 ima_file_check+0xac/0x100 security/integrity/ima/ima_main.c:499 do_open fs/namei.c:3376 [inline] path_openat+0x10fb/0x22c0 fs/namei.c:3507 do_filp_open+0x199/0x3d0 fs/namei.c:3534 do_sys_openat2+0x11e/0x360 fs/open.c:1204 do_sys_open fs/open.c:1220 [inline] __do_sys_openat fs/open.c:1236 [inline] __se_sys_openat fs/open.c:1231 [inline] __x64_sys_openat+0x11b/0x1d0 fs/open.c:1231 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x4665d9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fa3dd05b188 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665d9 RDX: 000000000000275a RSI: 00000000200001c0 RDI: ffffffffffffff9c RBP: 00000000004bfcb9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80 R13: 00007fff18c4362f R14: 00007fa3dd05b300 R15: 0000000000022000 ---------------- Code disassembly (best guess), 1 bytes skipped: 0: ff c3 inc %ebx 2: 66 2e 0f 1f 84 00 00 nopw %cs:0x0(%rax,%rax,1) 9: 00 00 00 c: 0f 1f 40 00 nopl 0x0(%rax) 10: 48 89 f8 mov %rdi,%rax 13: 48 89 f7 mov %rsi,%rdi 16: 48 89 d6 mov %rdx,%rsi 19: 48 89 ca mov %rcx,%rdx 1c: 4d 89 c2 mov %r8,%r10 1f: 4d 89 c8 mov %r9,%r8 22: 4c 8b 4c 24 08 mov 0x8(%rsp),%r9 27: 0f 05 syscall 29: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction 2f: 73 01 jae 0x32 31: c3 retq 32: 48 c7 c1 bc ff ff ff mov $0xffffffffffffffbc,%rcx 39: f7 d8 neg %eax 3b: 64 89 01 mov %eax,%fs:(%rcx) 3e: 48 rex.W