program: syz_mount_image$hfs(&(0x7f0000000080), &(0x7f0000000040)='./bus\x00', 0x808808, &(0x7f0000000380)=ANY=[@ANYBLOB="636f6465706167653d757466382c66696c655f756d61736b3d30303030303030303030303030303030303030303030332c696f636861727365743d63703737352c71756965742c008f7881d185c35a6a28ef06c5b85628f12a02248de249c2a338d049166371583781680d171f47"], 0x1, 0x2df, &(0x7f0000000400)="$eJzs3T9v004cx/HPOUmb/lF//rVFSCygQiVYKgoMiCUIZWVnQkCTShVREW2RgIWCGBEPgJ2nwINgAfEEYGLiAXQzuvPZdVLHaaCJ2/J+SYmc893569oX39dSagH4Z91pfv94/ad9GamiiqRbUiCpLlUlndHZ+rPNnY2dTrtV1FHFtbAvo7ilOVBnbbOd19S2cy280H6qajZbhtGIouj2j7KDQOnc6M8RSJN+HLr19THHNSq70vmyYxi37AE2e9rTc82VGA4A4Bjw1//AXyZmXZFREEjL/rJ/qq7/e2UHcLRudA4URYUNMtd/N7uLjD2+/7lV+/meS+Hs+iDJEg8TTK3n84TiM6trgmkGZZUulmBqfaOqlbXXagV6o4aXqbbo3lvxqZsYEO1STm5aoH9vNd2djvfGzSh7JSGtb3Tak3YhJ/6F4bb498xn89XcN6E+qJXO/6qRsYfJHamw50gFNRv/1f49zrhWtpZ82t9oNIKuKv+7jZzzW/AG7GU9PyPJ9pncINhNIyiK0217Xt23FeK9Wx3QaiGvVZh+6tNqsatVxZ8JK2tPOoW3UkYj2UXz3twzS/qlT2pm5v+BjW9ZmZFZ9FVvXE1/ZsT7M5FfM/3b9HS3P1wu9NacHGq/4A13t+ydHumm5rZfvHxc6XTaW3bhYc7C09kt40tqb6XcOqNfqKigjnb3SyLrVRQdtudolMFfOdIO7fdHWmKHT15lO8rSkmDch+nULdiRkrOq+UVFJ+TJWYgiqc+qUX1N4TjZNslB9wVTJQeEcbPzLhPnf24m72d1LkWyb2HBPL04yVRXj6tpBtc9FZx379NDZXAz/TO4zBav9ckZXc518bJ0KVNoVLjF0Md5SpimvukB9/8BAAAAAAAAAAAAAAAAAABOmiP8OUHyS8YDq0reRQAAAAAAAAAAAAAAAAAAAAAATrw/ev5v3v+Id8//Dcf1/N/iJwMBOJTfAQAA//+YznN8") r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='file0\x00', 0x42, 0x1ff) ftruncate(r1, 0xf4240) mkdir(&(0x7f0000000140)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1bd) mkdir(&(0x7f0000000280)='./config/usb_gadget/g1/functions/mass_storage.0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/mass_storage.0/lun.0/file\x00', 0x2, 0x0) write(r2, &(0x7f0000000380)='file0', 0x5) utimes(&(0x7f0000000700)='./file1\x00', &(0x7f0000000740)={{}, {0x0, 0xea60}}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1e, 0xd0be, 0x8, 0x3, 0x800, 0x1, 0x4, '\x00', 0x0, r0, 0x1, 0x4, 0x4}, 0x50) ioctl$BTRFS_IOC_LOGICAL_INO_V2(r3, 0xc038943b, &(0x7f0000000280)={0x49, 0x0, '\x00', 0x1, &(0x7f00000001c0)}) r4 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r4, &(0x7f00000000c0)={0x1d, r5}, 0x10) sendmsg$can_bcm(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)={0x1, 0x0, 0x0, {0x0, 0x2710}, {0x77359400}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "a5976ac6acd41fd8"}}, 0x48}}, 0x0) sendmsg$can_bcm(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="01000000220900"/16, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYBLOB="0000000001"], 0x80}}, 0x0) sendmsg$can_bcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x2, 0x0, 0xfffffffe, {0x0, 0x2710}, {0x77359400}, {}, 0x1, @can={{}, 0x8, 0x2, 0x0, 0x0, "ee6a491530f05065"}}, 0x48}}, 0x40000) r6 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x2, 0x0) write(r6, &(0x7f0000000240)="01", 0x2001) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0xc4042, 0x1ff) sendfile(r7, r7, 0x0, 0xfffe80) [ 119.510944][ T4645] Bluetooth: hci0: command tx timeout [ 119.604781][ T5327] loop0: detected capacity change from 0 to 64 [ 119.774416][ T5327] Mass Storage Function, version: 2009/09/11 [ 119.777731][ T5327] LUN: removable file: (no medium) [ 119.784790][ T25] audit: type=1800 audit(1786305800.358:2): pid=5327 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="file" dev="configfs" ino=4234 res=0 errno=0 [ 119.802238][ T5327] [ 119.803516][ T5327] ====================================================== [ 119.807034][ T5327] WARNING: possible circular locking dependency detected [ 119.810414][ T5327] syzkaller #0 Not tainted [ 119.812639][ T5327] ------------------------------------------------------ [ 119.816193][ T5327] syz.0.0/5327 is trying to acquire lock: [ 119.819355][ T5327] ffff888012a78bb8 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: process_measurement+0x7d0/0x1c10 [ 119.825327][ T5327] [ 119.825327][ T5327] but task is already holding lock: [ 119.828799][ T5327] ffff888050b8b120 (&common->filesem){++++}-{4:4}, at: fsg_store_file+0x163/0x400 [ 119.833381][ T5327] [ 119.833381][ T5327] which lock already depends on the new lock. [ 119.833381][ T5327] [ 119.838739][ T5327] [ 119.838739][ T5327] the existing dependency chain (in reverse order) is: [ 119.843411][ T5327] [ 119.843411][ T5327] -> #3 (&common->filesem){++++}-{4:4}: [ 119.847367][ T5327] down_read+0x4a/0x330 [ 119.849892][ T5327] fsg_show_file+0x2d/0x140 [ 119.852517][ T5327] configfs_read_iter+0x2b7/0x620 [ 119.855412][ T5327] __kernel_read+0x4ca/0x960 [ 119.858288][ T5327] integrity_kernel_read+0x89/0xd0 [ 119.861215][ T5327] ima_calc_file_hash+0x451/0x890 [ 119.863897][ T5327] ima_collect_measurement+0x51b/0xa00 [ 119.867313][ T5327] process_measurement+0x1272/0x1c10 [ 119.870695][ T5327] ima_file_check+0xe1/0x130 [ 119.873337][ T5327] security_file_post_open+0xb3/0x260 [ 119.876116][ T5327] path_openat+0x2e90/0x3830 [ 119.878615][ T5327] do_file_open+0x23e/0x4a0 [ 119.881601][ T5327] do_sys_openat2+0x115/0x200 [ 119.884589][ T5327] __x64_sys_openat+0x138/0x170 [ 119.886879][ T5327] do_syscall_64+0x174/0x580 [ 119.889073][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.892236][ T5327] [ 119.892236][ T5327] -> #2 (&p->frag_sem){.+.+}-{4:4}: [ 119.896735][ T5327] down_read+0x4a/0x330 [ 119.899142][ T5327] configfs_read_iter+0x1cc/0x620 [ 119.901689][ T5327] __kernel_read+0x4ca/0x960 [ 119.904256][ T5327] integrity_kernel_read+0x89/0xd0 [ 119.907497][ T5327] ima_calc_file_hash+0x451/0x890 [ 119.910758][ T5327] ima_collect_measurement+0x51b/0xa00 [ 119.913844][ T5327] process_measurement+0x1272/0x1c10 [ 119.916614][ T5327] ima_file_check+0xe1/0x130 [ 119.919453][ T5327] security_file_post_open+0xb3/0x260 [ 119.923022][ T5327] path_openat+0x2e90/0x3830 [ 119.925828][ T5327] do_file_open+0x23e/0x4a0 [ 119.928318][ T5327] do_sys_openat2+0x115/0x200 [ 119.931280][ T5327] __x64_sys_openat+0x138/0x170 [ 119.934252][ T5327] do_syscall_64+0x174/0x580 [ 119.936959][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.940091][ T5327] [ 119.940091][ T5327] -> #1 (&buffer->mutex){+.+.}-{4:4}: [ 119.944199][ T5327] __mutex_lock+0x19d/0x1550 [ 119.946885][ T5327] configfs_read_iter+0x70/0x620 [ 119.949705][ T5327] __kernel_read+0x4ca/0x960 [ 119.952592][ T5327] integrity_kernel_read+0x89/0xd0 [ 119.955656][ T5327] ima_calc_file_hash+0x451/0x890 [ 119.958549][ T5327] ima_collect_measurement+0x51b/0xa00 [ 119.961758][ T5327] process_measurement+0x1272/0x1c10 [ 119.964839][ T5327] ima_file_check+0xe1/0x130 [ 119.967874][ T5327] security_file_post_open+0xb3/0x260 [ 119.971094][ T5327] path_openat+0x2e90/0x3830 [ 119.973549][ T5327] do_file_open+0x23e/0x4a0 [ 119.976136][ T5327] do_sys_openat2+0x115/0x200 [ 119.979114][ T5327] __x64_sys_openat+0x138/0x170 [ 119.981879][ T5327] do_syscall_64+0x174/0x580 [ 119.984758][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.988142][ T5327] [ 119.988142][ T5327] -> #0 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}: [ 119.993062][ T5327] __lock_acquire+0x1520/0x2cf0 [ 119.995418][ T5327] lock_acquire+0x106/0x350 [ 119.997721][ T5327] __mutex_lock+0x19d/0x1550 [ 120.000528][ T5327] process_measurement+0x7d0/0x1c10 [ 120.004579][ T5327] ima_file_check+0xe1/0x130 [ 120.007698][ T5327] security_file_post_open+0xb3/0x260 [ 120.010798][ T5327] path_openat+0x2e90/0x3830 [ 120.013614][ T5327] do_file_open+0x23e/0x4a0 [ 120.017036][ T5327] filp_open+0x16d/0x1d0 [ 120.019833][ T5327] fsg_lun_open+0x6c/0xdf0 [ 120.021970][ T5327] fsg_store_file+0x19e/0x400 [ 120.024359][ T5327] configfs_write_iter+0x337/0x430 [ 120.027488][ T5327] vfs_write+0x612/0xba0 [ 120.030845][ T5327] ksys_write+0x150/0x270 [ 120.033520][ T5327] do_syscall_64+0x174/0x580 [ 120.035988][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 120.039469][ T5327] [ 120.039469][ T5327] other info that might help us debug this: [ 120.039469][ T5327] [ 120.046148][ T5327] Chain exists of: [ 120.046148][ T5327] &ima_iint_mutex_key[depth] --> &p->frag_sem --> &common->filesem [ 120.046148][ T5327] [ 120.052293][ T5327] Possible unsafe locking scenario: [ 120.052293][ T5327] [ 120.056198][ T5327] CPU0 CPU1 [ 120.060097][ T5327] ---- ---- [ 120.062869][ T5327] lock(&common->filesem); [ 120.064968][ T5327] lock(&p->frag_sem); [ 120.068124][ T5327] lock(&common->filesem); [ 120.072090][ T5327] lock(&ima_iint_mutex_key[depth]); [ 120.075274][ T5327] [ 120.075274][ T5327] *** DEADLOCK *** [ 120.075274][ T5327] [ 120.079143][ T5327] 5 locks held by syz.0.0/5327: [ 120.081583][ T5327] #0: ffff888040119d30 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x246/0x320 [ 120.086560][ T5327] #1: ffff8880003ce450 (sb_writers#13){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 120.091011][ T5327] #2: ffff8880409a7280 (&buffer->mutex){+.+.}-{4:4}, at: configfs_write_iter+0x7e/0x430 [ 120.096149][ T5327] #3: ffff88803d626c70 (&p->frag_sem){.+.+}-{4:4}, at: configfs_write_iter+0x238/0x430 [ 120.101264][ T5327] #4: ffff888050b8b120 (&common->filesem){++++}-{4:4}, at: fsg_store_file+0x163/0x400 [ 120.106116][ T5327] [ 120.106116][ T5327] stack backtrace: [ 120.109727][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 120.109755][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 120.109763][ T5327] Call Trace: [ 120.109771][ T5327] [ 120.109777][ T5327] dump_stack_lvl+0xe8/0x150 [ 120.109805][ T5327] print_circular_bug+0x2e1/0x300 [ 120.109826][ T5327] check_noncircular+0x12e/0x150 [ 120.109847][ T5327] __lock_acquire+0x1520/0x2cf0 [ 120.109866][ T5327] ? ktime_get+0x1f5/0x220 [ 120.109882][ T5327] ? lapic_next_event+0x11/0x20 [ 120.109900][ T5327] ? clockevents_program_event+0x491/0x630 [ 120.109919][ T5327] ? __hrtimer_rearm_deferred+0x99/0x420 [ 120.109931][ T5327] ? __pfx_clockevents_program_event+0x10/0x10 [ 120.109951][ T5327] ? process_measurement+0x7d0/0x1c10 [ 120.109964][ T5327] lock_acquire+0x106/0x350 [ 120.109978][ T5327] ? process_measurement+0x7d0/0x1c10 [ 120.109994][ T5327] __mutex_lock+0x19d/0x1550 [ 120.110009][ T5327] ? process_measurement+0x7d0/0x1c10 [ 120.110022][ T5327] ? process_measurement+0x443/0x1c10 [ 120.110035][ T5327] ? process_measurement+0x7d0/0x1c10 [ 120.110051][ T5327] ? __pfx___mutex_lock+0x10/0x10 [ 120.110077][ T5327] ? ima_inode_get+0xcb/0x4d0 [ 120.110095][ T5327] process_measurement+0x7d0/0x1c10 [ 120.110117][ T5327] ? kasan_quarantine_put+0xbb/0x1f0 [ 120.110140][ T5327] ? __pfx_process_measurement+0x10/0x10 [ 120.110161][ T5327] ? tomoyo_check_open_permission+0x38e/0x470 [ 120.110192][ T5327] ? apparmor_file_open+0x523/0x6c0 [ 120.110220][ T5327] ima_file_check+0xe1/0x130 [ 120.110239][ T5327] ? do_dentry_open+0xd21/0x1380 [ 120.110257][ T5327] ? __pfx_ima_file_check+0x10/0x10 [ 120.110279][ T5327] security_file_post_open+0xb3/0x260 [ 120.110303][ T5327] path_openat+0x2e90/0x3830 [ 120.110329][ T5327] ? kasan_save_track+0x3e/0x80 [ 120.110347][ T5327] ? filp_open+0x87/0x1d0 [ 120.110365][ T5327] ? configfs_write_iter+0x337/0x430 [ 120.110388][ T5327] ? vfs_write+0x612/0xba0 [ 120.110410][ T5327] ? ksys_write+0x150/0x270 [ 120.110437][ T5327] do_file_open+0x23e/0x4a0 [ 120.110463][ T5327] ? __pfx_do_file_open+0x10/0x10 [ 120.110493][ T5327] ? do_getname_kernel+0x54/0x230 [ 120.110509][ T5327] ? do_getname_kernel+0x54/0x230 [ 120.110525][ T5327] ? do_getname_kernel+0x97/0x230 [ 120.110543][ T5327] ? __asan_memcpy+0x40/0x70 [ 120.110562][ T5327] filp_open+0x16d/0x1d0 [ 120.110581][ T5327] ? __pfx_filp_open+0x10/0x10 [ 120.110603][ T5327] fsg_lun_open+0x6c/0xdf0 [ 120.110628][ T5327] fsg_store_file+0x19e/0x400 [ 120.110649][ T5327] ? __pfx_fsg_lun_opts_file_store+0x10/0x10 [ 120.110668][ T5327] configfs_write_iter+0x337/0x430 [ 120.110693][ T5327] vfs_write+0x612/0xba0 [ 120.110718][ T5327] ? __pfx_vfs_write+0x10/0x10 [ 120.110757][ T5327] ? __fget_files+0x2a/0x420 [ 120.110782][ T5327] ksys_write+0x150/0x270 [ 120.110809][ T5327] ? __pfx_ksys_write+0x10/0x10 [ 120.110836][ T5327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 120.110856][ T5327] do_syscall_64+0x174/0x580 [ 120.110879][ T5327] ? trace_irq_disable+0x3b/0x140 [ 120.110901][ T5327] ? clear_bhb_loop+0x70/0xc0 [ 120.110920][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 120.110941][ T5327] RIP: 0033:0x7f8ef6f9e0d9 [ 120.110961][ T5327] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 120.110978][ T5327] RSP: 002b:00007f8ef7e04fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 120.111000][ T5327] RAX: ffffffffffffffda RBX: 00007f8ef7225fa0 RCX: 00007f8ef6f9e0d9 [ 120.111015][ T5327] RDX: 0000000000000005 RSI: 0000200000000380 RDI: 0000000000000006 [ 120.111028][ T5327] RBP: 00007f8ef7035024 R08: 0000000000000000 R09: 0000000000000000 [ 120.111041][ T5327] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 120.111052][ T5327] R13: 00007f8ef7226038 R14: 00007f8ef7225fa0 R15: 00007ffc47c36a98 [ 120.111071][ T5327]