Warning: Permanently added '10.128.1.105' (ED25519) to the list of known hosts. [+] Starting reproducer for possible deadlock in ovl_copy_up_start... [+] Activating IMA measurement policy... [+] securityfs mounted successfully. [+] Opened /sys/kernel/security/ima/policy. [+] Wrote IMA policy rule successfully (24 bytes). [+] IMA policy activated. [+] Detected ext4 filesystem at cwd: /root (f_type=0xef53) [+] Mount directories created successfully. [+] Created file /root/ovl_repro/m1_lower/file_copy1 successfully. [+] Created file /root/ovl_repro/m1_lower/file_copy2 successfully. [+] Objects in lower layer prepared. [+] Mount 1 overlayfs mounted successfully at /root/ovl_repro/m1_merged. [+] Mount 2 nested overlayfs mounted successfully at /root/ovl_repro/m2_merged. [+] Executing Edge 1: ovl_i_lock_key -> sb_writers... [+] ioctl(FS_IOC_FSSETXATTR) on /root/ovl_repro/m1_merged/file_copy1 succeeded. [+] ioctl(FS_IOC_FSSETXATTR) on /root/ovl_repro/m2_merged/file_copy2 succeeded. [+] Edge 1 completed successfully. [+] Executing Edge 2: sb_writers -> ima_iint_mutex_key... [+] Created file /root/ovl_repro/ext4_trunc successfully. [+] Opened /root/ovl_repro/ext4_trunc with O_RDWR | O_TRUNC successfully. [ 107.176081][ T34] audit: type=1807 audit(1794746320.741:2): action=measure func=FILE_CHECK res=1 [ 107.176168][ T5967] ima: policy update completed [ 107.176902][ T34] audit: type=1802 audit(1794746320.741:3): pid=5967 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=completed comm="syz-executor101" res=1 errno=0 [+] Created file /root/ovl_repro/m1_merged/ovl_trunc1 successfully. [+] Opened /root/ovl_repro/m1_merged/ovl_trunc1 with O_RDWR | O_TRUNC successfully. [+] Created file /root/ovl_repro/m2_merged/ovl_trunc2 successfully. [+] Opened /root/ovl_repro/m2_merged/ovl_trunc2 with O_RDWR | O_TRUNC successfully. [+] Edge 2 completed successfully. [+] Executing Edge 3 & 4 via /sys/power/resume (O_RDWR)... [+] Opened /sys/power/resume with O_RDWR (Edge 3: ima_iint_mutex_key -> of->mutex). [ 107.263335][ T5967] evm: overlay not supported [ 107.269340][ T34] audit: type=1800 audit(1794746320.831:4): pid=5967 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz-executor101" name="resume" dev="sysfs" ino=1437 res=0 errno=-22 [+] Dropped caches via /proc/sys/vm/drop_caches. [+] Traversing Mount 2 directory in lookup_slow under of->mutex succeeded. [+] Traversing Mount 1 directory in lookup_slow under of->mutex succeeded. [+] Edge 3 & 4 completed successfully. [+] Executing Edge 0 (Trigger): ovl_i_mutex_dir_key -> ovl_i_lock_key... [ 108.584607][ T5967] syz-executor101 (5967): drop_caches: 3 [ 108.615073][ T5967] [ 108.617557][ T5967] ====================================================== [ 108.624664][ T5967] WARNING: possible circular locking dependency detected [ 108.633289][ T5967] syzkaller #0 Not tainted [ 108.637849][ T5967] ------------------------------------------------------ [ 108.644953][ T5967] syz-executor101/5967 is trying to acquire lock: [ 108.651808][ T5967] ffff888069862b18 (&ovl_i_lock_key[depth]#2){+.+.}-{4:4}, at: ovl_copy_up_start+0x56/0x330 [ 108.662261][ T5967] [ 108.662261][ T5967] but task is already holding lock: [ 108.669801][ T5967] ffff8880698627a8 (&ovl_i_mutex_dir_key[depth]#4){++++}-{4:4}, at: vfs_setxattr+0x12b/0x370 [ 108.680416][ T5967] [ 108.680416][ T5967] which lock already depends on the new lock. [ 108.680416][ T5967] [ 108.690829][ T5967] [ 108.690829][ T5967] the existing dependency chain (in reverse order) is: [ 108.700938][ T5967] [ 108.700938][ T5967] -> #5 (&ovl_i_mutex_dir_key[depth]#4){++++}-{4:4}: [ 108.711989][ T5967] down_read+0x45/0x320 [ 108.716944][ T5967] lookup_slow+0x46/0x80 [ 108.722513][ T5967] link_path_walk+0xd9d/0x19c0 [ 108.727822][ T5967] path_lookupat+0xe4/0x8c0 [ 108.733044][ T5967] filename_lookup+0x265/0x5d0 [ 108.738319][ T5967] kern_path+0x3d/0x150 [ 108.743771][ T5967] lookup_bdev+0xc8/0x2b0 [ 108.748873][ T5967] resume_store+0x181/0x500 [ 108.754147][ T5967] kernfs_fop_write_iter+0x3a4/0x540 [ 108.759972][ T5967] vfs_write+0x612/0xba0 [ 108.764998][ T5967] ksys_write+0x150/0x270 [ 108.769875][ T5967] do_syscall_64+0x171/0x540 [ 108.774989][ T5967] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.781488][ T5967] [ 108.781488][ T5967] -> #4 (&of->mutex){+.+.}-{4:4}: [ 108.788968][ T5967] __mutex_lock+0x197/0x15a0 [ 108.794079][ T5967] kernfs_seq_start+0x5d/0x420 [ 108.799531][ T5967] seq_read_iter+0x37e/0xca0 [ 108.804649][ T5967] __kernel_read+0x4ca/0x960 [ 108.809928][ T5967] integrity_kernel_read+0x89/0xd0 [ 108.815742][ T5967] ima_calc_file_hash+0x451/0x890 [ 108.821474][ T5967] ima_collect_measurement+0x51b/0xa00 [ 108.827468][ T5967] process_measurement+0x1272/0x1c10 [ 108.833313][ T5967] ima_file_check+0xdc/0x130 [ 108.838520][ T5967] security_file_post_open+0xb3/0x260 [ 108.844448][ T5967] path_openat+0x179e/0x20e0 [ 108.849562][ T5967] do_file_open+0x23e/0x4a0 [ 108.854826][ T5967] do_sys_openat2+0x115/0x200 [ 108.860003][ T5967] __x64_sys_openat+0x138/0x170 [ 108.865368][ T5967] do_syscall_64+0x171/0x540 [ 108.870462][ T5967] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.876948][ T5967] [ 108.876948][ T5967] -> #3 (&p->lock){+.+.}-{4:4}: [ 108.883962][ T5967] __mutex_lock+0x197/0x15a0 [ 108.889194][ T5967] seq_read_iter+0xa4/0xca0 [ 108.894314][ T5967] __kernel_read+0x4ca/0x960 [ 108.899539][ T5967] integrity_kernel_read+0x89/0xd0 [ 108.905198][ T5967] ima_calc_file_hash+0x451/0x890 [ 108.910916][ T5967] ima_collect_measurement+0x51b/0xa00 [ 108.916892][ T5967] process_measurement+0x1272/0x1c10 [ 108.922786][ T5967] ima_file_check+0xdc/0x130 [ 108.927969][ T5967] security_file_post_open+0xb3/0x260 [ 108.934206][ T5967] path_openat+0x179e/0x20e0 [ 108.939717][ T5967] do_file_open+0x23e/0x4a0 [ 108.944848][ T5967] do_sys_openat2+0x115/0x200 [ 108.950311][ T5967] __x64_sys_openat+0x138/0x170 [ 108.955773][ T5967] do_syscall_64+0x171/0x540 [ 108.960998][ T5967] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.967503][ T5967] [ 108.967503][ T5967] -> #2 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}: [ 108.976701][ T5967] __mutex_lock+0x197/0x15a0 [ 108.981858][ T5967] process_measurement+0x7d0/0x1c10 [ 108.987705][ T5967] ima_file_check+0xdc/0x130 [ 108.992841][ T5967] security_file_post_open+0xb3/0x260 [ 108.999047][ T5967] path_openat+0x179e/0x20e0 [ 109.004513][ T5967] do_file_open+0x23e/0x4a0 [ 109.009538][ T5967] do_sys_openat2+0x115/0x200 [ 109.014731][ T5967] __x64_sys_openat+0x138/0x170 [ 109.020192][ T5967] do_syscall_64+0x171/0x540 [ 109.025290][ T5967] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.031827][ T5967] [ 109.031827][ T5967] -> #1 (sb_writers#4){.+.+}-{0:0}: [ 109.039294][ T5967] ovl_start_write+0x115/0x290 [ 109.044657][ T5967] ovl_copy_up_flags+0xe90/0x3890 [ 109.050306][ T5967] ovl_fileattr_set+0x204/0x580 [ 109.055683][ T5967] vfs_fileattr_set+0xa2b/0xd10 [ 109.061064][ T5967] ioctl_fssetxattr+0x349/0x3b0 [ 109.066587][ T5967] do_vfs_ioctl+0x914/0x15a0 [ 109.071688][ T5967] __se_sys_ioctl+0x82/0x170 [ 109.076801][ T5967] do_syscall_64+0x171/0x540 [ 109.082186][ T5967] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.088692][ T5967] [ 109.088692][ T5967] -> #0 (&ovl_i_lock_key[depth]#2){+.+.}-{4:4}: [ 109.097294][ T5967] __lock_acquire+0x164c/0x2de0 [ 109.102855][ T5967] lock_acquire+0x115/0x350 [ 109.107971][ T5967] __mutex_lock+0x197/0x15a0 [ 109.113078][ T5967] ovl_copy_up_start+0x56/0x330 [ 109.118543][ T5967] ovl_copy_up_flags+0xaf7/0x3890 [ 109.124367][ T5967] ovl_xattr_set+0x395/0x5e0 [ 109.129565][ T5967] __vfs_setxattr+0x442/0x480 [ 109.134905][ T5967] __vfs_setxattr_noperm+0x12a/0x660 [ 109.140713][ T5967] vfs_setxattr+0x151/0x370 [ 109.145762][ T5967] filename_setxattr+0x296/0x630 [ 109.151218][ T5967] path_setxattrat+0x408/0x450 [ 109.156672][ T5967] __x64_sys_lsetxattr+0xbf/0xe0 [ 109.162136][ T5967] do_syscall_64+0x171/0x540 [ 109.167252][ T5967] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.173678][ T5967] [ 109.173678][ T5967] other info that might help us debug this: [ 109.173678][ T5967] [ 109.183920][ T5967] Chain exists of: [ 109.183920][ T5967] &ovl_i_lock_key[depth]#2 --> &of->mutex --> &ovl_i_mutex_dir_key[depth]#4 [ 109.183920][ T5967] [ 109.198698][ T5967] Possible unsafe locking scenario: [ 109.198698][ T5967] [ 109.206345][ T5967] CPU0 CPU1 [ 109.211997][ T5967] ---- ---- [ 109.217379][ T5967] lock(&ovl_i_mutex_dir_key[depth]#4); [ 109.223049][ T5967] lock(&of->mutex); [ 109.229683][ T5967] lock(&ovl_i_mutex_dir_key[depth]#4); [ 109.238002][ T5967] lock(&ovl_i_lock_key[depth]#2); [ 109.243200][ T5967] [ 109.243200][ T5967] *** DEADLOCK *** [ 109.243200][ T5967] [ 109.251425][ T5967] locks held by syz-executor101/5967: 2, on CPU#1: [ 109.258207][ T5967] #0: ffff88807b2e6478 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 109.267476][ T5967] #1: ffff8880698627a8 (&ovl_i_mutex_dir_key[depth]#4){++++}-{4:4}, at: vfs_setxattr+0x12b/0x370 [ 109.278099][ T5967] [ 109.278099][ T5967] stack backtrace: [ 109.284168][ T5967] CPU: 1 UID: 0 PID: 5967 Comm: syz-executor101 Not tainted syzkaller #0 PREEMPT(full) [ 109.293882][ T5967] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 109.303941][ T5967] Call Trace: [ 109.307220][ T5967] [ 109.310157][ T5967] dump_stack_lvl+0xe8/0x150 [ 109.314850][ T5967] print_circular_bug+0x2e2/0x300 [ 109.320418][ T5967] check_noncircular+0x12f/0x150 [ 109.325527][ T5967] __lock_acquire+0x164c/0x2de0 [ 109.330738][ T5967] ? kasan_quarantine_put+0xbb/0x1f0 [ 109.336131][ T5967] ? tomoyo_path_perm+0x251/0x560 [ 109.341250][ T5967] lock_acquire+0x115/0x350 [ 109.345839][ T5967] ? ovl_copy_up_start+0x56/0x330 [ 109.350942][ T5967] __mutex_lock+0x197/0x15a0 [ 109.355530][ T5967] ? ovl_copy_up_start+0x56/0x330 [ 109.360552][ T5967] ? rcu_is_watching+0x16/0xb0 [ 109.365495][ T5967] ? ovl_copy_up_start+0x56/0x330 [ 109.370622][ T5967] ? __pfx___mutex_lock+0x10/0x10 [ 109.375749][ T5967] ? ext4_getattr+0x6d0/0xae0 [ 109.380450][ T5967] ovl_copy_up_start+0x56/0x330 [ 109.385412][ T5967] ovl_copy_up_flags+0xaf7/0x3890 [ 109.390445][ T5967] ? is_bpf_text_address+0x292/0x2b0 [ 109.395810][ T5967] ? __pfx_ovl_copy_up_flags+0x10/0x10 [ 109.401451][ T5967] ? rcu_is_watching+0x16/0xb0 [ 109.406390][ T5967] ? __kasan_check_byte+0x12/0x40 [ 109.411429][ T5967] ? rcu_is_watching+0x16/0xb0 [ 109.416306][ T5967] ? rcu_is_watching+0x16/0xb0 [ 109.421058][ T5967] ? __kasan_check_byte+0x12/0x40 [ 109.426175][ T5967] ? rcu_is_watching+0x16/0xb0 [ 109.430940][ T5967] ? lock_release+0x4b/0x3c0 [ 109.435590][ T5967] ? lock_release+0x4b/0x3c0 [ 109.440175][ T5967] ? is_bpf_text_address+0x292/0x2b0 [ 109.445721][ T5967] ? is_bpf_text_address+0x26/0x2b0 [ 109.450912][ T5967] ? kernel_text_address+0xa5/0xe0 [ 109.456015][ T5967] ? __kernel_text_address+0xd/0x30 [ 109.461207][ T5967] ? unwind_get_return_address+0x4d/0x90 [ 109.467271][ T5967] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 109.473594][ T5967] ? arch_stack_walk+0xfb/0x150 [ 109.478450][ T5967] ? stack_trace_save+0xa9/0x100 [ 109.483469][ T5967] ? __pfx_stack_trace_save+0x10/0x10 [ 109.488846][ T5967] ? check_path+0x21/0x40 [ 109.493174][ T5967] ? check_noncircular+0xdb/0x150 [ 109.498461][ T5967] ? add_lock_to_list+0xc7/0x100 [ 109.503414][ T5967] ? lockdep_unlock+0x5c/0xd0 [ 109.508091][ T5967] ? __lock_acquire+0x1511/0x2de0 [ 109.513138][ T5967] ? ovl_permission+0x187/0x300 [ 109.517985][ T5967] ? __pfx_ovl_permission+0x10/0x10 [ 109.523180][ T5967] ovl_xattr_set+0x395/0x5e0 [ 109.527852][ T5967] ? __pfx_ovl_xattr_set+0x10/0x10 [ 109.532961][ T5967] ? __pfx_evm_protect_xattr+0x10/0x10 [ 109.538419][ T5967] ? ovl_other_xattr_set+0x28/0x50 [ 109.543868][ T5967] ? __pfx_ovl_other_xattr_set+0x10/0x10 [ 109.549687][ T5967] __vfs_setxattr+0x442/0x480 [ 109.554384][ T5967] __vfs_setxattr_noperm+0x12a/0x660 [ 109.559945][ T5967] vfs_setxattr+0x151/0x370 [ 109.564462][ T5967] ? __pfx_vfs_setxattr+0x10/0x10 [ 109.569484][ T5967] filename_setxattr+0x296/0x630 [ 109.574437][ T5967] ? __pfx_filename_setxattr+0x10/0x10 [ 109.579896][ T5967] ? do_getname+0x151/0x250 [ 109.584574][ T5967] path_setxattrat+0x408/0x450 [ 109.589428][ T5967] ? __pfx_path_setxattrat+0x10/0x10 [ 109.594730][ T5967] ? ksys_write+0x1fc/0x270 [ 109.599235][ T5967] ? __pfx_ksys_write+0x10/0x10 [ 109.604108][ T5967] __x64_sys_lsetxattr+0xbf/0xe0 [ 109.609057][ T5967] do_syscall_64+0x171/0x540 [ 109.613866][ T5967] ? trace_irq_disable+0x3b/0x140 [ 109.618997][ T5967] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.625072][ T5967] ? clear_bhb_loop+0x70/0xc0 [ 109.629748][ T5967] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.635914][ T5967] RIP: 0033:0x00007f823a4ea8ea [ 109.640737][ T5967] Code: 48 c7 c2 d8 ff ff ff f7 d8 64 89 02 ba ff ff ff ff eb d1 e8 b8 0b 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 bd 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 109.660932][ T5967] RSP: 002b:00007ffd80584f68 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd [ 109.670061][ T5967] RAX: ffffffffffffffda RBX: 00007ffd80584f80 RCX: 00007f823a4ea8ea [ 109.678335][ T5967] RDX: 00007f823a54677a RSI: 00007f823a54677e RDI: 00007ffd80584f80 [ 109.686306][ T5967] RBP: 00007f823a573ae0 R08: 0000000000000000 R09: 00000000ffffffff [+] lsetxattr user.test on /root/ovl_repro/m2_merged/dir_trigger2 succeeded. [+] lsetxattr user.test on /root/ovl_repro/m2_merged/dir_trigger2_sub/sub succeeded. [+] lsetxattr user.test on /root/ovl_repro/m1_merged/dir_trigger1 succeeded. [+] lsetxattr user.test on /root/ovl_repro/m1_merged/dir_trigger1_sub/sub succeeded. [+] Trigger operations executed. [+] Sleeping 2 seconds to allow lockdep reports to flush... [ 109.694449][ T5967] R10: 0000000000000003 R11: 0000000000000246 R12: 00007f823a54677e [ 109.702613][ T5967] R13: 00007f823a54677a R14: 00007f823a546581 R15: 00007f823a546574 [ 109.710765][ T5967] [ 109.767920][ T34] audit: type=1800 audit(1794746323.331:5): pid=5002 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="udevd" name="uevent" dev="sysfs" ino=4823 res=0 errno=-22 [+] Unmounting filesystems... [+] Cleanup complete. Reproducer finished.