====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Tainted: G L ------------------------------------------------------ syz.5.1427/11078 is trying to acquire lock: ffff888075832080 (&buffer->mutex#2){+.+.}-{4:4}, at: configfs_read_iter+0x70/0x620 fs/configfs/file.c:86 but task is already holding lock: ffff888071001168 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: process_measurement+0x7d0/0x1c10 security/integrity/ima/ima_main.c:319 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #4 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}: __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x197/0x15a0 kernel/locking/mutex.c:821 process_measurement+0x7d0/0x1c10 security/integrity/ima/ima_main.c:319 ima_file_check+0xdc/0x130 security/integrity/ima/ima_main.c:686 security_file_post_open+0xb3/0x260 security/security.c:2776 do_open fs/namei.c:4847 [inline] path_openat+0x1748/0x20f0 fs/namei.c:5010 do_file_open+0x23e/0x4a0 fs/namei.c:5039 do_sys_openat2+0x115/0x200 fs/open.c:1442 do_sys_open fs/open.c:1448 [inline] __do_sys_openat fs/open.c:1788 [inline] __se_sys_openat fs/open.c:1783 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1783 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #3 (sb_writers#5){.+.+}-{0:0}: percpu_down_read_internal include/linux/percpu-rwsem.h:53 [inline] percpu_down_read_freezable include/linux/percpu-rwsem.h:83 [inline] __sb_start_write include/linux/fs/super.h:19 [inline] sb_start_write+0x48/0x1c0 include/linux/fs/super.h:125 mnt_want_write+0x41/0x90 fs/namespace.c:531 lookup_open+0x1f7/0x1970 fs/namei.c:4453 open_last_lookups fs/namei.c:4768 [inline] path_openat+0x70c/0x20f0 fs/namei.c:5007 do_file_open+0x23e/0x4a0 fs/namei.c:5039 file_open_name fs/open.c:1400 [inline] filp_open+0x16d/0x1d0 fs/open.c:1417 fsg_lun_open+0x6c/0xdf0 drivers/usb/gadget/function/storage_common.c:194 fsg_store_file+0x19e/0x400 drivers/usb/gadget/function/storage_common.c:455 flush_write_buffer fs/configfs/file.c:207 [inline] configfs_write_iter+0x337/0x430 fs/configfs/file.c:229 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x612/0xba0 fs/read_write.c:687 ksys_write+0x150/0x270 fs/read_write.c:1036 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #2 (&common->filesem){+.+.}-{4:4}: down_write+0x91/0x200 kernel/locking/rwsem.c:1631 fsg_store_file+0x163/0x400 drivers/usb/gadget/function/storage_common.c:452 flush_write_buffer fs/configfs/file.c:207 [inline] configfs_write_iter+0x337/0x430 fs/configfs/file.c:229 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x612/0xba0 fs/read_write.c:687 ksys_write+0x150/0x270 fs/read_write.c:1036 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #1 (&p->frag_sem){.+.+}-{4:4}: down_read+0x45/0x320 kernel/locking/rwsem.c:1574 flush_write_buffer fs/configfs/file.c:205 [inline] configfs_write_iter+0x238/0x430 fs/configfs/file.c:229 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x612/0xba0 fs/read_write.c:687 ksys_write+0x150/0x270 fs/read_write.c:1036 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (&buffer->mutex#2){+.+.}-{4:4}: check_prev_add kernel/locking/lockdep.c:3209 [inline] check_prevs_add kernel/locking/lockdep.c:3328 [inline] validate_chain kernel/locking/lockdep.c:3952 [inline] __lock_acquire+0x164c/0x2de0 kernel/locking/lockdep.c:5288 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x197/0x15a0 kernel/locking/mutex.c:821 configfs_read_iter+0x70/0x620 fs/configfs/file.c:86 __kernel_read+0x4ca/0x960 fs/read_write.c:532 integrity_kernel_read+0x89/0xd0 security/integrity/iint.c:28 ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:222 [inline] ima_calc_file_hash+0x451/0x890 security/integrity/ima/ima_crypto.c:280 ima_collect_measurement+0x51b/0xa00 security/integrity/ima/ima_api.c:300 process_measurement+0x1272/0x1c10 security/integrity/ima/ima_main.c:425 ima_file_check+0xdc/0x130 security/integrity/ima/ima_main.c:686 security_file_post_open+0xb3/0x260 security/security.c:2776 do_open fs/namei.c:4847 [inline] path_openat+0x1748/0x20f0 fs/namei.c:5010 do_file_open+0x23e/0x4a0 fs/namei.c:5039 do_sys_openat2+0x115/0x200 fs/open.c:1442 do_sys_open fs/open.c:1448 [inline] __do_sys_openat fs/open.c:1788 [inline] __se_sys_openat fs/open.c:1783 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1783 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Chain exists of: &buffer->mutex#2 --> sb_writers#5 --> &ima_iint_mutex_key[depth] Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&ima_iint_mutex_key[depth]); lock(sb_writers#5); lock(&ima_iint_mutex_key[depth]); lock(&buffer->mutex#2); *** DEADLOCK *** locks held by syz.5.1427/11078: 1, last CPU#1: #0: ffff888071001168 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: process_measurement+0x7d0/0x1c10 security/integrity/ima/ima_main.c:319 stack backtrace: CPU: 1 UID: 0 PID: 11078 Comm: syz.5.1427 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_circular_bug+0x2e2/0x300 kernel/locking/lockdep.c:2087 check_noncircular+0x12f/0x150 kernel/locking/lockdep.c:2219 check_prev_add kernel/locking/lockdep.c:3209 [inline] check_prevs_add kernel/locking/lockdep.c:3328 [inline] validate_chain kernel/locking/lockdep.c:3952 [inline] __lock_acquire+0x164c/0x2de0 kernel/locking/lockdep.c:5288 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x197/0x15a0 kernel/locking/mutex.c:821 configfs_read_iter+0x70/0x620 fs/configfs/file.c:86 __kernel_read+0x4ca/0x960 fs/read_write.c:532 integrity_kernel_read+0x89/0xd0 security/integrity/iint.c:28 ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:222 [inline] ima_calc_file_hash+0x451/0x890 security/integrity/ima/ima_crypto.c:280 ima_collect_measurement+0x51b/0xa00 security/integrity/ima/ima_api.c:300 process_measurement+0x1272/0x1c10 security/integrity/ima/ima_main.c:425 ima_file_check+0xdc/0x130 security/integrity/ima/ima_main.c:686 security_file_post_open+0xb3/0x260 security/security.c:2776 do_open fs/namei.c:4847 [inline] path_openat+0x1748/0x20f0 fs/namei.c:5010 do_file_open+0x23e/0x4a0 fs/namei.c:5039 do_sys_openat2+0x115/0x200 fs/open.c:1442 do_sys_open fs/open.c:1448 [inline] __do_sys_openat fs/open.c:1788 [inline] __se_sys_openat fs/open.c:1783 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1783 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2437d9f559 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f2438bcc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f2438025fa0 RCX: 00007f2437d9f559 RDX: 0000000000000002 RSI: 00002000000001c0 RDI: ffffffffffffff9c RBP: 00007f2437e36b20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2438026038 R14: 00007f2438025fa0 R15: 00007ffdc3915a68 configfs: configfs_read_iter: count = 4096, pos = 0, buf = kcov: kcov_task_exit: t = ffff88802a1cddc0, kcov->t = ffff88802a1cddc0 ffff8880683a8000 name hci1 bus 0 hci1: Updating devcoredump state from IDLE to IDLE. hci1: err 0x13 hci1 ffff8880683a8000 hci1: hci1: err 0x13 hci1: cancelling interleave scan All LE pending actions cleared hdev hci1 hdev hci1 event 4 hdev 0000000000000000 len 8 hci1: Cleanup of MSFT extension hdev hci1 event 8 hci1 orig refcnt 6 channel 3 len 6 channel 3 len 8 hdev hci1 event 2 hdev 0000000000000000 len 8 kernfs runtime_status: removing kernfs control: removing kernfs runtime_suspended_time: removing kernfs runtime_active_time: removing kernfs autosuspend_delay_ms: removing kernfs power: removing kernfs device: removing kernfs subsystem: removing kernfs rfkill20: removing kernfs uevent: removing kernfs name: removing kernfs type: removing kernfs index: removing kernfs persistent: removing kernfs state: removing kernfs soft: removing kernfs hard: removing kernfs hard_block_reasons: removing PM: Removing info for No Bus:rfkill20 kobject: 'rfkill20' (ffff888077696118): kobject_uevent_env kobject: 'rfkill20' (ffff888077696118): fill_kobj_path: path = '/devices/virtual/bluetooth/hci1/rfkill20' kernfs rfkill20: removing kobject: 'rfkill20' (ffff888077696118): kobject_cleanup, parent 0000000000000000 kobject: 'rfkill20' (ffff888077696118): calling ktype release kobject: 'rfkill20': free name kernfs runtime_status: removing kernfs control: removing kernfs runtime_suspended_time: removing kernfs runtime_active_time: removing kernfs autosuspend_delay_ms: removing kernfs power: removing kernfs subsystem: removing kernfs hci1: removing kernfs uevent: removing kernfs reset: removing PM: Removing info for No Bus:hci1 kobject: 'hci1' (ffff8880683a95c0): kobject_uevent_env kobject: 'hci1' (ffff8880683a95c0): fill_kobj_path: path = '/devices/virtual/bluetooth/hci1' kernfs hci1: removing hci1 orig refcnt 2 kobject: 'hci1' (ffff8880683a95c0): kobject_cleanup, parent 0000000000000000 kobject: 'hci1' (ffff8880683a95c0): calling ktype release All LE connection parameters were removed hci1: Unregister MSFT extension kobject: 'hci1': free name syz_tun: bond_netdev_event received NETDEV_GOING_DOWN net syz_tun: siw: event 10 In tnode_resize ffff888078f1a320 inflate_threshold=50 threshold=25 In tnode_resize ffff888067dab820 inflate_threshold=50 threshold=25 In tnode_resize ffff888068a7a420 inflate_threshold=50 threshold=25 In tnode_resize ffff888057563320 inflate_threshold=50 threshold=25 In tnode_resize ffff888021384220 inflate_threshold=50 threshold=25 In tnode_resize ffff8880278033a0 inflate_threshold=50 threshold=25 In tnode_resize ffff888027803920 inflate_threshold=50 threshold=25 trie_flush found=1 In tnode_resize ffff888078f1a320 inflate_threshold=50 threshold=25 In tnode_resize ffff888067dab820 inflate_threshold=50 threshold=25 In tnode_resize ffff888068a7a420 inflate_threshold=50 threshold=25 In tnode_resize ffff888057563320 inflate_threshold=50 threshold=25 In tnode_resize ffff888021384220 inflate_threshold=50 threshold=25 In tnode_resize ffff8880278033a0 inflate_threshold=50 threshold=25 In tnode_resize ffff888027803920 inflate_threshold=50 threshold=25 trie_flush found=1 IPv6: walker ffffc90004cb7140 adjusted by delroute IPv6: walker ffffc90004cb7140 adjusted by delroute IPv6: walker ffffc90004cb7140 adjusted by delroute IPv6: fixing tree: plen=128 iter=0 IPv6: W ffffc90004cb7140 adjusted by delnode 1, s=4/2 IPv6: fixing tree: plen=120 iter=1 IPv6: W ffffc90004cb7140 adjusted by delnode 2, s=2 IPv6: fixing tree: plen=97 iter=2 IPv6: walker ffffc90004cb7140 adjusted by delroute IPv6: fixing tree: plen=128 iter=0 IPv6: W ffffc90004cb7140 adjusted by delnode 1, s=4/2 IPv6: fixing tree: plen=120 iter=1 IPv6: W ffffc90004cb7140 adjusted by delnode 2, s=2 IPv6: fixing tree: plen=67 iter=2 IPv6: walker ffffc90004cb7140 adjusted by delroute syz_tun: bond_netdev_event received NETDEV_DOWN net syz_tun: siw: event 2 Deleting ac141400/24 dsfield=0x00 t=ffff888069171eb8 Deleting ac1414ff/32 dsfield=0x00 t=ffff888069171eb8 Deleting ac1414aa/32 dsfield=0x00 t=ffff888069171eb8 In tnode_resize ffff888057563320 inflate_threshold=50 threshold=25 In tnode_resize ffff888027803920 inflate_threshold=50 threshold=25 syz_tun (unregistering): left allmulticast mode syz_tun (unregistering): bond_netdev_event received NETDEV_UNREGISTER net syz_tun: siw: event 6 syz_tun (unregistering): bond_netdev_event received NETDEV_PRE_UNINIT net syz_tun: siw: event 18 kernfs rps_cpus: removing kernfs rps_flow_cnt: removing kobject: 'rx-0' (ffff88805758ae50): kobject_cleanup, parent ffff88802bf6bb50 kobject: 'rx-0' (ffff88805758ae50): auto cleanup kobject_del kobject: 'rx-0' (ffff88805758ae50): auto cleanup 'remove' event kobject: 'rx-0' (ffff88805758ae50): kobject_uevent_env kobject: 'rx-0' (ffff88805758ae50): fill_kobj_path: path = '/devices/virtual/net/syz_tun/queues/rx-0' kernfs rx-0: removing kobject: 'rx-0' (ffff88805758ae50): calling ktype release kobject: 'rx-0': free name kernfs tx_timeout: removing kernfs traffic_class: removing kernfs xps_cpus: removing kernfs xps_rxqs: removing kernfs tx_maxrate: removing kobject: 'tx-0' (ffff88802d9a8420): kobject_cleanup, parent ffff88802bf6bb50 kobject: 'tx-0' (ffff88802d9a8420): auto cleanup kobject_del kobject: 'tx-0' (ffff88802d9a8420): auto cleanup 'remove' event kobject: 'tx-0' (ffff88802d9a8420): kobject_uevent_env kobject: 'tx-0' (ffff88802d9a8420): fill_kobj_path: path = '/devices/virtual/net/syz_tun/queues/tx-0' kernfs tx-0: removing kobject: 'tx-0' (ffff88802d9a8420): calling ktype release kobject: 'tx-0': free name kernfs queues: removing kobject: 'queues' (ffff88802bf6bb50): kobject_cleanup, parent 0000000000000000 kobject: 'queues' (ffff88802bf6bb50): calling ktype release kobject: 'queues' (ffff88802bf6bb50): kset_release kobject: 'queues': free name kernfs runtime_status: removing kernfs control: removing kernfs runtime_suspended_time: removing kernfs runtime_active_time: removing kernfs autosuspend_delay_ms: removing kernfs power: removing kernfs subsystem: removing kernfs syz_tun: removing kernfs uevent: removing kernfs tun_flags: removing kernfs owner: removing kernfs group: removing kernfs rx_packets: removing kernfs tx_packets: removing kernfs rx_bytes: removing kernfs tx_bytes: removing kernfs rx_errors: removing kernfs tx_errors: removing kernfs rx_dropped: removing kernfs tx_dropped: removing kernfs multicast: removing kernfs collisions: removing kernfs rx_length_errors: removing kernfs rx_over_errors: removing kernfs rx_crc_errors: removing kernfs rx_frame_errors: removing kernfs rx_fifo_errors: removing kernfs rx_missed_errors: removing kernfs tx_aborted_errors: removing kernfs tx_carrier_errors: removing kernfs tx_fifo_errors: removing kernfs tx_heartbeat_errors: removing kernfs tx_window_errors: removing kernfs rx_compressed: removing kernfs tx_compressed: removing kernfs rx_nohandler: removing kernfs statistics: removing kernfs netdev_group: removing kernfs type: removing kernfs dev_id: removing kernfs dev_port: removing kernfs iflink: removing kernfs ifindex: removing kernfs name_assign_type: removing kernfs addr_assign_type: removing kernfs addr_len: removing kernfs link_mode: removing kernfs address: removing kernfs broadcast: removing kernfs speed: removing kernfs duplex: removing