program: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x200000, &(0x7f0000000b80), 0xfe, 0x54d, &(0x7f0000000400)="$eJzs3d9rW1UcAPDvTdv96nQdjKE+SGEPTubStfXHBB/mo+hwoO8ztHdlNFlGk461Dtwe3IsvMgQRB+If4LuPw3/Av2KggyGj6IMvkZvedNmatFmXrZn5fOC259x703NPzv2enpOTkACG1mT2oxDxakR8m0Qcajs2GvnByfXz1h5cm8u2JBqNz/5KIsn3tc5P8t/jeeaViPjt64gThc3l1lZWF0vlcrqU56fqlctTtZXVkxcrpYV0Ib00Mzt7+p3Zmfffe7dvdX3z3D8/fHrno9PfHFv7/pd7h28lcSYO5sfa6/EUrrdnJmMyf07G4sxjJ073obBBkuz2BbAjI3mcj0XWBxyKkTzqgf+/ryKiAQypRPzDkGqNA1pz+z7Ng18Y9z9cnwBtrv/o+msjsa85NzqwljwyM8rmuxN9KD8r49c/b9/Ktujf6xAA27p+IyJOjY5u7v+SvP/buVM9nPN4Gfo/eH7uZOOftzqNfwob45/oMP4Z7xC7O7F9/Bfu9aGYrrLx3wcdx78bi1YTI3nupeaYbyy5cLGcZn3byxFxPMb2Zvmt1nNOr91tdDvWPv7Ltqz81lgwv457o3sffcx8qV56mjq3u38j4rWO499ko/2TDu2fPR/neizjaHr79W7Htq//s9X4OeKNju3/cEUr2Xp9cqp5P0y17orN/r559Pdu5e92/bP2P7B1/SeS9vXa2pOX8dO+f9Nux3Z6/+9JPm+m9+T7rpbq9aXpiD3JJ5v3zzx8bCvfOj+r//FjW/d/ne7//RHxRY/1v3nkZtdTB6H955+o/Z88cffjL3/sVn5v7f92M3U839NL/9frBT7NcwcAAAAAAACDphARByMpFDfShUKxuP7+jiNxoFCu1uonLlSXL81H87OyEzFWaK10j7e9H2I6fz9sKz/zWH42Ig5HxHcj+5v54ly1PL/blQcAAAAAAAAAAAAAAAAAAIABMd7l8/+ZP0Z2++qAZ85XfsPw2jb++/FNT8BA8v8fhpf4h+El/mF4iX8YXuIfhpf4h+El/mF4iX8AAAAAAAAAAAAAAAAAAAAAAAAAAADoq3Nnz2ZbY+3BtbksP39lZXmxeuXkfFpbLFaW54pz1aXLxYVqdaGcFueqle3+XrlavTw9E8tXp+pprT5VW1k9X6kuX6qfv1gpLaTn07HnUisAAAAAAAAAAAAAAAAAAAB4sdRWVhdL5XK6JCGxo8ToYFyGRJ8Tu90zAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBD/wUAAP//y284sw==") mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testnqn\x00', 0x1ed) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testnqn/attr_allow_any_host\x00', 0x2, 0x0) write(r0, &(0x7f0000000340)='1', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testnqn/namespaces/1\x00', 0x1ed) openat(0xffffffffffffff9c, &(0x7f0000000400)='./backing_file\x00', 0x42, 0x1ed) r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testnqn/namespaces/1/device_path\x00', 0x2, 0x0) write(r1, &(0x7f0000000480)='./backing_file', 0xe) r2 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/subsystems/testnqn/namespaces/1/enable\x00', 0x2, 0x0) write(r2, &(0x7f0000000580)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1\x00', 0x1ed) r3 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_trtype\x00', 0x2, 0x0) write(r3, &(0x7f0000000680)='loop', 0x4) symlinkat(&(0x7f00000006c0)='./config/nvmet/subsystems/testnqn\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/nvmet/ports/1/subsystems/testnqn\x00') r4 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) write(r4, &(0x7f0000000780)='transport=loop,nqn=testnqn', 0x1a) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000009c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r5 = socket(0x10, 0x80002, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@bridge_newneigh={0x28, 0x1c, 0x401, 0x70bd29, 0x25dfdbff, {0x7, 0x0, 0x0, r7, 0x40, 0x4c, 0x6}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}}]}, 0x28}, 0x1, 0x0, 0x0, 0x44801}, 0x840) sendmmsg$alg(r5, &(0x7f00000000c0), 0x492492492492627, 0x0) r8 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r9 = open(&(0x7f0000000780)='./bus\x00', 0x14507e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r9, 0x0) fallocate(r8, 0x0, 0x0, 0x1000f4) [ 105.400883][ T5289] Bluetooth: hci0: command tx timeout [ 105.577451][ T5330] loop0: detected capacity change from 0 to 1024 [ 105.675574][ T5330] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 105.694173][ T24] audit: type=1800 audit(1785988830.924:2): pid=5330 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="attr_allow_any_host" dev="configfs" ino=4250 res=0 errno=0 [ 105.706091][ T5330] nvmet: adding nsid 1 to subsystem testnqn [ 105.712668][ T24] audit: type=1800 audit(1785988830.944:3): pid=5330 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="device_path" dev="configfs" ino=4252 res=0 errno=0 [ 105.725914][ T5330] [ 105.727032][ T5330] ====================================================== [ 105.729883][ T5330] WARNING: possible circular locking dependency detected [ 105.732910][ T5330] syzkaller #0 Not tainted [ 105.734831][ T5330] ------------------------------------------------------ [ 105.737718][ T5330] syz.0.0/5330 is trying to acquire lock: [ 105.740148][ T5330] ffff888043eb48a0 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: process_measurement+0x7d0/0x1c10 [ 105.748265][ T5330] [ 105.748265][ T5330] but task is already holding lock: [ 105.751462][ T5330] ffff888052064868 (&subsys->lock){+.+.}-{4:4}, at: nvmet_ns_enable+0x4d/0x780 [ 105.755269][ T5330] [ 105.755269][ T5330] which lock already depends on the new lock. [ 105.755269][ T5330] [ 105.759587][ T5330] [ 105.759587][ T5330] the existing dependency chain (in reverse order) is: [ 105.763386][ T5330] [ 105.763386][ T5330] -> #3 (&subsys->lock){+.+.}-{4:4}: [ 105.766676][ T5330] __mutex_lock+0x19d/0x1550 [ 105.768996][ T5330] nvmet_ns_device_path_store+0x54/0x160 [ 105.771674][ T5330] configfs_write_iter+0x337/0x430 [ 105.774126][ T5330] vfs_write+0x612/0xba0 [ 105.776304][ T5330] ksys_write+0x150/0x270 [ 105.778519][ T5330] do_syscall_64+0x174/0x580 [ 105.780932][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.783747][ T5330] [ 105.783747][ T5330] -> #2 (&p->frag_sem){.+.+}-{4:4}: [ 105.787017][ T5330] down_read+0x4a/0x330 [ 105.789104][ T5330] configfs_read_iter+0x1cc/0x620 [ 105.791512][ T5330] __kernel_read+0x4ca/0x960 [ 105.793696][ T5330] integrity_kernel_read+0x89/0xd0 [ 105.796158][ T5330] ima_calc_file_hash+0x451/0x890 [ 105.798526][ T5330] ima_collect_measurement+0x51b/0xa00 [ 105.801021][ T5330] process_measurement+0x1272/0x1c10 [ 105.803559][ T5330] ima_file_check+0xe1/0x130 [ 105.805957][ T5330] security_file_post_open+0xb3/0x260 [ 105.808889][ T5330] path_openat+0x2e90/0x3830 [ 105.811161][ T5330] do_file_open+0x23e/0x4a0 [ 105.813348][ T5330] do_sys_openat2+0x115/0x200 [ 105.815451][ T5330] __x64_sys_openat+0x138/0x170 [ 105.817747][ T5330] do_syscall_64+0x174/0x580 [ 105.820014][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.822953][ T5330] [ 105.822953][ T5330] -> #1 (&buffer->mutex){+.+.}-{4:4}: [ 105.826222][ T5330] __mutex_lock+0x19d/0x1550 [ 105.828487][ T5330] configfs_read_iter+0x70/0x620 [ 105.830838][ T5330] __kernel_read+0x4ca/0x960 [ 105.833117][ T5330] integrity_kernel_read+0x89/0xd0 [ 105.835516][ T5330] ima_calc_file_hash+0x451/0x890 [ 105.837789][ T5330] ima_collect_measurement+0x51b/0xa00 [ 105.840282][ T5330] process_measurement+0x1272/0x1c10 [ 105.842723][ T5330] ima_file_check+0xe1/0x130 [ 105.844850][ T5330] security_file_post_open+0xb3/0x260 [ 105.847281][ T5330] path_openat+0x2e90/0x3830 [ 105.849307][ T5330] do_file_open+0x23e/0x4a0 [ 105.851356][ T5330] do_sys_openat2+0x115/0x200 [ 105.853466][ T5330] __x64_sys_openat+0x138/0x170 [ 105.855553][ T5330] do_syscall_64+0x174/0x580 [ 105.857589][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.860070][ T5330] [ 105.860070][ T5330] -> #0 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}: [ 105.863319][ T5330] __lock_acquire+0x1520/0x2cf0 [ 105.865636][ T5330] lock_acquire+0x106/0x350 [ 105.868129][ T5330] __mutex_lock+0x19d/0x1550 [ 105.870487][ T5330] process_measurement+0x7d0/0x1c10 [ 105.872921][ T5330] ima_file_check+0xe1/0x130 [ 105.875207][ T5330] security_file_post_open+0xb3/0x260 [ 105.878250][ T5330] path_openat+0x2e90/0x3830 [ 105.881116][ T5330] do_file_open+0x23e/0x4a0 [ 105.883624][ T5330] filp_open+0x16d/0x1d0 [ 105.885764][ T5330] nvmet_file_ns_enable+0x74/0x350 [ 105.888199][ T5330] nvmet_ns_enable+0xaa/0x780 [ 105.890341][ T5330] nvmet_ns_enable_store+0xd7/0x170 [ 105.892816][ T5330] configfs_write_iter+0x337/0x430 [ 105.895435][ T5330] vfs_write+0x612/0xba0 [ 105.897996][ T5330] ksys_write+0x150/0x270 [ 105.900221][ T5330] do_syscall_64+0x174/0x580 [ 105.902395][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.905153][ T5330] [ 105.905153][ T5330] other info that might help us debug this: [ 105.905153][ T5330] [ 105.909518][ T5330] Chain exists of: [ 105.909518][ T5330] &ima_iint_mutex_key[depth] --> &p->frag_sem --> &subsys->lock [ 105.909518][ T5330] [ 105.915296][ T5330] Possible unsafe locking scenario: [ 105.915296][ T5330] [ 105.918359][ T5330] CPU0 CPU1 [ 105.921365][ T5330] ---- ---- [ 105.924772][ T5330] lock(&subsys->lock); [ 105.927246][ T5330] lock(&p->frag_sem); [ 105.929964][ T5330] lock(&subsys->lock); [ 105.932803][ T5330] lock(&ima_iint_mutex_key[depth]); [ 105.935123][ T5330] [ 105.935123][ T5330] *** DEADLOCK *** [ 105.935123][ T5330] [ 105.938455][ T5330] 6 locks held by syz.0.0/5330: [ 105.940849][ T5330] #0: ffff88803f0c92b0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x246/0x320 [ 105.945046][ T5330] #1: ffff888000e3e450 (sb_writers#12){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 105.948678][ T5330] #2: ffff888033660880 (&buffer->mutex){+.+.}-{4:4}, at: configfs_write_iter+0x7e/0x430 [ 105.952639][ T5330] #3: ffff88801fbd0370 (&p->frag_sem){.+.+}-{4:4}, at: configfs_write_iter+0x238/0x430 [ 105.957012][ T5330] #4: ffffffff8f6dbbe8 (nvmet_config_sem){+.+.}-{4:4}, at: nvmet_ns_enable_store+0xc8/0x170 [ 105.961925][ T5330] #5: ffff888052064868 (&subsys->lock){+.+.}-{4:4}, at: nvmet_ns_enable+0x4d/0x780 [ 105.966111][ T5330] [ 105.966111][ T5330] stack backtrace: [ 105.968648][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 105.968665][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 105.968672][ T5330] Call Trace: [ 105.968681][ T5330] [ 105.968687][ T5330] dump_stack_lvl+0xe8/0x150 [ 105.968710][ T5330] print_circular_bug+0x2e1/0x300 [ 105.968725][ T5330] check_noncircular+0x12e/0x150 [ 105.968739][ T5330] __lock_acquire+0x1520/0x2cf0 [ 105.968754][ T5330] ? __pfx_stack_trace_save+0x10/0x10 [ 105.968769][ T5330] ? check_path+0x21/0x40 [ 105.968778][ T5330] ? check_noncircular+0xda/0x150 [ 105.968788][ T5330] ? add_lock_to_list+0xc7/0x100 [ 105.968798][ T5330] ? process_measurement+0x7d0/0x1c10 [ 105.968812][ T5330] lock_acquire+0x106/0x350 [ 105.968826][ T5330] ? process_measurement+0x7d0/0x1c10 [ 105.968843][ T5330] __mutex_lock+0x19d/0x1550 [ 105.968857][ T5330] ? process_measurement+0x7d0/0x1c10 [ 105.968871][ T5330] ? process_measurement+0x443/0x1c10 [ 105.968885][ T5330] ? process_measurement+0x443/0x1c10 [ 105.968899][ T5330] ? process_measurement+0x7d0/0x1c10 [ 105.968914][ T5330] ? __pfx___mutex_lock+0x10/0x10 [ 105.968929][ T5330] ? ima_inode_get+0xcb/0x4d0 [ 105.968940][ T5330] process_measurement+0x7d0/0x1c10 [ 105.968954][ T5330] ? kasan_quarantine_put+0xbb/0x1f0 [ 105.968967][ T5330] ? __pfx_process_measurement+0x10/0x10 [ 105.968979][ T5330] ? __dquot_initialize+0x236/0xd40 [ 105.969000][ T5330] ima_file_check+0xe1/0x130 [ 105.969013][ T5330] ? do_dentry_open+0xd6d/0x1380 [ 105.969023][ T5330] ? __pfx_ima_file_check+0x10/0x10 [ 105.969037][ T5330] security_file_post_open+0xb3/0x260 [ 105.969052][ T5330] path_openat+0x2e90/0x3830 [ 105.969067][ T5330] ? kasan_save_track+0x3e/0x80 [ 105.969078][ T5330] ? filp_open+0x87/0x1d0 [ 105.969090][ T5330] ? nvmet_ns_enable_store+0xd7/0x170 [ 105.969104][ T5330] ? configfs_write_iter+0x337/0x430 [ 105.969118][ T5330] ? vfs_write+0x612/0xba0 [ 105.969134][ T5330] do_file_open+0x23e/0x4a0 [ 105.969149][ T5330] ? __pfx_do_file_open+0x10/0x10 [ 105.969166][ T5330] ? do_getname_kernel+0x54/0x230 [ 105.969175][ T5330] ? do_getname_kernel+0x54/0x230 [ 105.969185][ T5330] ? do_getname_kernel+0x97/0x230 [ 105.969197][ T5330] ? __asan_memcpy+0x40/0x70 [ 105.969207][ T5330] filp_open+0x16d/0x1d0 [ 105.969219][ T5330] ? __pfx_filp_open+0x10/0x10 [ 105.969230][ T5330] ? nvmet_ns_enable_store+0xc8/0x170 [ 105.969247][ T5330] nvmet_file_ns_enable+0x74/0x350 [ 105.969262][ T5330] nvmet_ns_enable+0xaa/0x780 [ 105.969273][ T5330] ? configfs_write_iter+0x238/0x430 [ 105.969288][ T5330] nvmet_ns_enable_store+0xd7/0x170 [ 105.969303][ T5330] ? __pfx_nvmet_ns_enable_store+0x10/0x10 [ 105.969319][ T5330] ? down_read+0x2be/0x330 [ 105.969333][ T5330] ? __pfx_nvmet_ns_enable_store+0x10/0x10 [ 105.969347][ T5330] configfs_write_iter+0x337/0x430 [ 105.969362][ T5330] vfs_write+0x612/0xba0 [ 105.969379][ T5330] ? __pfx_vfs_write+0x10/0x10 [ 105.969393][ T5330] ? __fget_files+0x2a/0x420 [ 105.969407][ T5330] ksys_write+0x150/0x270 [ 105.969421][ T5330] ? __pfx_ksys_write+0x10/0x10 [ 105.969436][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.969447][ T5330] do_syscall_64+0x174/0x580 [ 105.969459][ T5330] ? trace_irq_disable+0x3b/0x140 [ 105.969473][ T5330] ? clear_bhb_loop+0x40/0x90 [ 105.969497][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.969508][ T5330] RIP: 0033:0x7f9ebfd9e0d9 [ 105.969522][ T5330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 105.969533][ T5330] RSP: 002b:00007f9ec0bcefe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 105.969546][ T5330] RAX: ffffffffffffffda RBX: 00007f9ec0025fa0 RCX: 00007f9ebfd9e0d9 [ 105.969553][ T5330] RDX: 0000000000000001 RSI: 0000200000000580 RDI: 0000000000000007 [ 105.969560][ T5330] RBP: 00007f9ebfe35024 R08: 0000000000000000 R09: 0000000000000000 [ 105.969566][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 105.969573][ T5330] R13: 00007f9ec0026038 R14: 00007f9ec0025fa0 R15: 00007ffc3bcab518 [ 105.969583][ T5330] [ 106.150246][ T24] audit: type=1800 audit(1785988830.954:4): pid=5330 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="enable" dev="configfs" ino=4253 res=0 errno=0 [ 106.175961][ T24] audit: type=1800 audit(1785988831.404:5): pid=5330 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="addr_trtype" dev="configfs" ino=4259 res=0 errno=0 [ 106.207537][ T13] nvmet: Created nvm controller 1 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:26f800d1-30a2-4289-a3b7-c4b5a7e505cd. [ 106.215976][ T5330] nvme nvme0: creating 1 I/O queues. [ 106.225110][ T5330] nvme nvme0: new ctrl: "testnqn" [ 106.240286][ T24] audit: type=1800 audit(1785988831.474:6): pid=5330 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.0" name="bus" dev="overlay" ino=22 res=0 errno=0 [ 106.250831][ T24] audit: type=1800 audit(1785988831.484:7): pid=5330 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.0" name="bus" dev="overlay" ino=22 res=0 errno=0