Warning: Permanently added '10.128.0.164' (ED25519) to the list of known hosts. [*] Starting reproducer... [-] splice returned error (expected): Invalid argument [+] Step 1 complete. [+] autofs mounted. [ 81.898518][ T31] audit: type=1400 audit(1791829369.777:201): avc: denied { mount } for pid=5938 comm="syz-executor215" name="/" dev="autofs" ino=8163 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 81.900661][ T5939] [ 81.925612][ T5939] ====================================================== [ 81.932599][ T5939] WARNING: possible circular locking dependency detected [ 81.939583][ T5939] syzkaller #0 Not tainted [ 81.943983][ T5939] ------------------------------------------------------ [ 81.950976][ T5939] syz-executor215/5939 is trying to acquire lock: [ 81.957363][ T5939] ffff88806fa91460 (&pipe->mutex){+.+.}-{4:4}, at: anon_pipe_prefill_and_lock+0x16c/0x580 [ 81.967290][ T5939] [ 81.967290][ T5939] but task is already holding lock: [ 81.974631][ T5939] ffff888037f2e138 (&sbi->pipe_mutex){+.+.}-{4:4}, at: autofs_notify_daemon+0x4f8/0xd90 [ 81.984354][ T5939] [ 81.984354][ T5939] which lock already depends on the new lock. [ 81.984354][ T5939] [ 81.994732][ T5939] [ 81.994732][ T5939] the existing dependency chain (in reverse order) is: [ 82.003724][ T5939] [ 82.003724][ T5939] -> #2 (&sbi->pipe_mutex){+.+.}-{4:4}: [ 82.011437][ T5939] lock_acquire+0x1d1/0x380 [ 82.016460][ T5939] __mutex_lock+0x1a4/0x1bd0 [ 82.021562][ T5939] autofs_notify_daemon+0x4f8/0xd90 [ 82.027272][ T5939] autofs_wait+0x10fd/0x1b50 [ 82.032363][ T5939] autofs_mount_wait+0x132/0x3b0 [ 82.037800][ T5939] autofs_d_automount+0x490/0x950 [ 82.043323][ T5939] __traverse_mounts+0x1b9/0x8a0 [ 82.048758][ T5939] step_into_slowpath+0xcb4/0x1150 [ 82.054383][ T5939] path_lookupat+0x58b/0xc40 [ 82.059479][ T5939] filename_lookup+0x202/0x590 [ 82.064747][ T5939] kern_path+0x37/0x50 [ 82.069317][ T5939] lookup_bdev+0xd8/0x2a0 [ 82.074154][ T5939] resume_store+0x1d6/0x460 [ 82.079181][ T5939] kobj_attr_store+0x58/0x80 [ 82.084294][ T5939] sysfs_kf_write+0xf2/0x150 [ 82.089398][ T5939] kernfs_fop_write_iter+0x3e0/0x5f0 [ 82.095194][ T5939] vfs_write+0x6af/0x1050 [ 82.100030][ T5939] ksys_write+0x12a/0x250 [ 82.104862][ T5939] do_syscall_64+0x123/0x790 [ 82.109973][ T5939] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.116375][ T5939] [ 82.116375][ T5939] -> #1 (&of->mutex){+.+.}-{4:4}: [ 82.123564][ T5939] lock_acquire+0x1d1/0x380 [ 82.128568][ T5939] __mutex_lock+0x1a4/0x1bd0 [ 82.133664][ T5939] kernfs_fop_write_iter+0x2c2/0x5f0 [ 82.139452][ T5939] iter_file_splice_write+0x830/0x10b0 [ 82.145418][ T5939] do_splice+0x109c/0x1fa0 [ 82.150349][ T5939] __do_splice+0x33b/0x370 [ 82.155265][ T5939] __x64_sys_splice+0x187/0x250 [ 82.160626][ T5939] do_syscall_64+0x123/0x790 [ 82.165721][ T5939] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.172113][ T5939] [ 82.172113][ T5939] -> #0 (&pipe->mutex){+.+.}-{4:4}: [ 82.179488][ T5939] check_prev_add+0xeb/0xe60 [ 82.184579][ T5939] __lock_acquire+0x1528/0x1f40 [ 82.189932][ T5939] lock_acquire+0x1d1/0x380 [ 82.194950][ T5939] __mutex_lock+0x1a4/0x1bd0 [ 82.200045][ T5939] anon_pipe_prefill_and_lock+0x16c/0x580 [ 82.206268][ T5939] anon_pipe_write+0x164/0x1b50 [ 82.211625][ T5939] __kernel_write_iter+0x6bb/0x930 [ 82.217240][ T5939] __kernel_write+0xf6/0x140 [ 82.222333][ T5939] autofs_notify_daemon+0x50d/0xd90 [ 82.228033][ T5939] autofs_wait+0x10fd/0x1b50 [ 82.233124][ T5939] autofs_mount_wait+0x132/0x3b0 [ 82.238560][ T5939] autofs_d_automount+0x490/0x950 [ 82.244087][ T5939] __traverse_mounts+0x1b9/0x8a0 [ 82.249522][ T5939] step_into_slowpath+0xcb4/0x1150 [ 82.255136][ T5939] path_lookupat+0x58b/0xc40 [ 82.260234][ T5939] filename_lookup+0x202/0x590 [ 82.265509][ T5939] kern_path+0x37/0x50 [ 82.270081][ T5939] lookup_bdev+0xd8/0x2a0 [ 82.274999][ T5939] resume_store+0x1d6/0x460 [ 82.280008][ T5939] kobj_attr_store+0x58/0x80 [ 82.285097][ T5939] sysfs_kf_write+0xf2/0x150 [ 82.290193][ T5939] kernfs_fop_write_iter+0x3e0/0x5f0 [ 82.295981][ T5939] vfs_write+0x6af/0x1050 [ 82.300816][ T5939] ksys_write+0x12a/0x250 [ 82.305647][ T5939] do_syscall_64+0x123/0x790 [ 82.310744][ T5939] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.317142][ T5939] [ 82.317142][ T5939] other info that might help us debug this: [ 82.317142][ T5939] [ 82.327345][ T5939] Chain exists of: [ 82.327345][ T5939] &pipe->mutex --> &of->mutex --> &sbi->pipe_mutex [ 82.327345][ T5939] [ 82.339758][ T5939] Possible unsafe locking scenario: [ 82.339758][ T5939] [ 82.347791][ T5939] CPU0 CPU1 [ 82.353131][ T5939] ---- ---- [ 82.358471][ T5939] lock(&sbi->pipe_mutex); [ 82.362952][ T5939] lock(&of->mutex); [ 82.369429][ T5939] lock(&sbi->pipe_mutex); [ 82.376442][ T5939] lock(&pipe->mutex); [ 82.380587][ T5939] [ 82.380587][ T5939] *** DEADLOCK *** [ 82.380587][ T5939] [ 82.388710][ T5939] locks held by syz-executor215/5939: 4, last CPU#1: [ 82.395369][ T5939] #0: ffff888036338460 (sb_writers#8){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 82.404316][ T5939] #1: ffff888033f1a080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 [ 82.414039][ T5939] #2: ffff888021ad9e18 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 [ 82.424026][ T5939] #3: ffff888037f2e138 (&sbi->pipe_mutex){+.+.}-{4:4}, at: autofs_notify_daemon+0x4f8/0xd90 [ 82.434181][ T5939] [ 82.434181][ T5939] stack backtrace: [ 82.440050][ T5939] CPU: 1 UID: 0 PID: 5939 Comm: syz-executor215 Not tainted syzkaller #0 PREEMPT(full) [ 82.449744][ T5939] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 82.459778][ T5939] Call Trace: [ 82.463038][ T5939] [ 82.465949][ T5939] dump_stack_lvl+0x100/0x190 [ 82.470614][ T5939] print_circular_bug.cold+0x178/0x1be [ 82.476060][ T5939] check_noncircular+0x146/0x160 [ 82.480981][ T5939] ? check_prev_add+0x354/0xe60 [ 82.485814][ T5939] check_prev_add+0xeb/0xe60 [ 82.490387][ T5939] ? __lock_acquire+0xe8b/0x1f40 [ 82.495306][ T5939] __lock_acquire+0x1528/0x1f40 [ 82.500154][ T5939] ? __lock_acquire+0x5c0/0x1f40 [ 82.505073][ T5939] lock_acquire+0x1d1/0x380 [ 82.509556][ T5939] ? anon_pipe_prefill_and_lock+0x16c/0x580 [ 82.515438][ T5939] ? __pfx___might_resched+0x10/0x10 [ 82.520705][ T5939] ? __kasan_check_byte+0x13/0x50 [ 82.525730][ T5939] __mutex_lock+0x1a4/0x1bd0 [ 82.530308][ T5939] ? anon_pipe_prefill_and_lock+0x16c/0x580 [ 82.536186][ T5939] ? anon_pipe_prefill_and_lock+0x16c/0x580 [ 82.542071][ T5939] ? is_bpf_text_address+0x8a/0x1a0 [ 82.547266][ T5939] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 82.553401][ T5939] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 82.559292][ T5939] ? __pfx___mutex_lock+0x10/0x10 [ 82.564396][ T5939] ? policy_nodemask+0xed/0x4f0 [ 82.569238][ T5939] ? __bfs+0x150/0x2a0 [ 82.573301][ T5939] ? anon_pipe_prefill_and_lock+0x16c/0x580 [ 82.579189][ T5939] anon_pipe_prefill_and_lock+0x16c/0x580 [ 82.584897][ T5939] ? stack_trace_save+0x8e/0xc0 [ 82.589731][ T5939] ? __pfx_anon_pipe_prefill_and_lock+0x10/0x10 [ 82.595961][ T5939] ? add_lock_to_list+0x9d/0x1d0 [ 82.600898][ T5939] anon_pipe_write+0x164/0x1b50 [ 82.605739][ T5939] ? __lock_acquire+0xe8b/0x1f40 [ 82.610663][ T5939] ? __pfx_anon_pipe_write+0x10/0x10 [ 82.615946][ T5939] ? lock_acquire+0x1d1/0x380 [ 82.620605][ T5939] ? autofs_notify_daemon+0x4f8/0xd90 [ 82.625959][ T5939] ? __pfx_anon_pipe_write+0x10/0x10 [ 82.631233][ T5939] __kernel_write_iter+0x6bb/0x930 [ 82.636343][ T5939] ? __pfx___kernel_write_iter+0x10/0x10 [ 82.641959][ T5939] ? find_held_lock+0x2b/0x80 [ 82.646622][ T5939] ? autofs_notify_daemon+0x4a0/0xd90 [ 82.651975][ T5939] ? autofs_notify_daemon+0x4a0/0xd90 [ 82.657331][ T5939] __kernel_write+0xf6/0x140 [ 82.661905][ T5939] ? __pfx___kernel_write+0x10/0x10 [ 82.667087][ T5939] ? __pfx_from_kgid_munged+0x10/0x10 [ 82.672455][ T5939] ? path_lookupat+0x58b/0xc40 [ 82.677217][ T5939] autofs_notify_daemon+0x50d/0xd90 [ 82.682397][ T5939] ? __pfx_autofs_notify_daemon+0x10/0x10 [ 82.688105][ T5939] ? lockdep_init_map_type+0x5c/0x250 [ 82.693460][ T5939] ? lockdep_init_map_type+0x5c/0x250 [ 82.698826][ T5939] autofs_wait+0x10fd/0x1b50 [ 82.703399][ T5939] ? __pfx_autofs_wait+0x10/0x10 [ 82.708321][ T5939] ? find_held_lock+0x2b/0x80 [ 82.712986][ T5939] ? path_has_submounts+0xcf/0x120 [ 82.718080][ T5939] ? do_raw_spin_unlock+0x145/0x1e0 [ 82.723279][ T5939] ? find_held_lock+0x2b/0x80 [ 82.727944][ T5939] autofs_mount_wait+0x132/0x3b0 [ 82.732862][ T5939] autofs_d_automount+0x490/0x950 [ 82.737872][ T5939] __traverse_mounts+0x1b9/0x8a0 [ 82.742793][ T5939] step_into_slowpath+0xcb4/0x1150 [ 82.747886][ T5939] ? rcu_is_watching+0x13/0xc0 [ 82.752639][ T5939] ? __pfx_step_into_slowpath+0x10/0x10 [ 82.758167][ T5939] ? lookup_slow+0x5b/0x70 [ 82.762562][ T5939] ? lookup_slow+0x5b/0x70 [ 82.766958][ T5939] path_lookupat+0x58b/0xc40 [ 82.771534][ T5939] filename_lookup+0x202/0x590 [ 82.776282][ T5939] ? __pfx_filename_lookup+0x10/0x10 [ 82.781555][ T5939] ? do_getname_kernel+0x5d/0x250 [ 82.786560][ T5939] ? __asan_memcpy+0x3c/0x60 [ 82.791132][ T5939] kern_path+0x37/0x50 [ 82.795199][ T5939] lookup_bdev+0xd8/0x2a0 [ 82.799525][ T5939] ? __pfx_lookup_bdev+0x10/0x10 [ 82.804442][ T5939] ? __asan_memcpy+0x3c/0x60 [ 82.809023][ T5939] resume_store+0x1d6/0x460 [ 82.813511][ T5939] ? __pfx_resume_store+0x10/0x10 [ 82.818520][ T5939] ? lock_acquire+0x1d1/0x380 [ 82.823177][ T5939] ? sysfs_file_kobj+0x21/0x290 [ 82.828012][ T5939] ? find_held_lock+0x2b/0x80 [ 82.832674][ T5939] ? sysfs_file_kobj+0xe4/0x290 [ 82.837509][ T5939] ? sysfs_file_kobj+0xe4/0x290 [ 82.842343][ T5939] ? __pfx_resume_store+0x10/0x10 [ 82.847353][ T5939] kobj_attr_store+0x58/0x80 [ 82.851924][ T5939] ? __pfx_kobj_attr_store+0x10/0x10 [ 82.857191][ T5939] sysfs_kf_write+0xf2/0x150 [ 82.861771][ T5939] kernfs_fop_write_iter+0x3e0/0x5f0 [ 82.867037][ T5939] ? __pfx_sysfs_kf_write+0x10/0x10 [ 82.872220][ T5939] vfs_write+0x6af/0x1050 [ 82.876545][ T5939] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 82.882334][ T5939] ? __pfx_vfs_write+0x10/0x10 [ 82.887079][ T5939] ? __pfx_do_sys_openat2+0x10/0x10 [ 82.892270][ T5939] ? find_held_lock+0x2b/0x80 [ 82.896939][ T5939] ksys_write+0x12a/0x250 [ 82.901251][ T5939] ? __pfx_ksys_write+0x10/0x10 [ 82.906094][ T5939] do_syscall_64+0x123/0x790 [ 82.910695][ T5939] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.916586][ T5939] RIP: 0033:0x7f043296edb7 [ 82.920990][ T5939] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 82.940579][ T5939] RSP: 002b:00007fff43b5d780 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 [ 82.948973][ T5939] RAX: ffffffffffffffda RBX: 0000555582316400 RCX: 00007f043296edb7 [ 82.956926][ T5939] RDX: 0000000000000014 RSI: 00007f04329a9138 RDI: 0000000000000005 [ 82.964891][ T5939] RBP: 00007f04329a9040 R08: 0000000000000000 R09: 0000000000000000 [ 82.972861][ T5939] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 82.980814][ T5939] R13: 0000000000000002 R14: 00007f04329d4c80 R15: 0000000000000002 [ 82.988772][ T5939] [+] Reproducer complete.