======================================================
WARNING: possible circular locking dependency detected
4.14.151+ #0 Not tainted
------------------------------------------------------
syz-executor.2/13669 is trying to acquire lock:
(pmus_lock){+.+.}, at: [<000000006bb7a69a>] swevent_hlist_get kernel/events/core.c:7896 [inline]
(pmus_lock){+.+.}, at: [<000000006bb7a69a>] perf_swevent_init+0x123/0x4f0 kernel/events/core.c:7956
but task is already holding lock:
(&cpuctx_mutex/1){+.+.}, at: [<00000000f87a48a7>] perf_event_ctx_lock_nested+0x15a/0x2d0 kernel/events/core.c:1240
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&cpuctx_mutex/1){+.+.}:
__mutex_lock_common kernel/locking/mutex.c:756 [inline]
__mutex_lock+0xf7/0x13e0 kernel/locking/mutex.c:893
mutex_lock_double kernel/events/core.c:9909 [inline]
__perf_event_ctx_lock_double kernel/events/core.c:9968 [inline]
SYSC_perf_event_open kernel/events/core.c:10233 [inline]
SyS_perf_event_open+0x12cf/0x2560 kernel/events/core.c:9988
do_syscall_64+0x19b/0x520 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
-> #1 (&cpuctx_mutex){+.+.}:
__mutex_lock_common kernel/locking/mutex.c:756 [inline]
__mutex_lock+0xf7/0x13e0 kernel/locking/mutex.c:893
perf_event_init_cpu+0xa8/0x150 kernel/events/core.c:11231
perf_event_init+0x289/0x2c5 kernel/events/core.c:11278
start_kernel+0x583/0x890 init/main.c:645
secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:240
-> #0 (pmus_lock){+.+.}:
lock_acquire+0x12b/0x360 kernel/locking/lockdep.c:3994
__mutex_lock_common kernel/locking/mutex.c:756 [inline]
__mutex_lock+0xf7/0x13e0 kernel/locking/mutex.c:893
swevent_hlist_get kernel/events/core.c:7896 [inline]
perf_swevent_init+0x123/0x4f0 kernel/events/core.c:7956
perf_try_init_event+0xe5/0x200 kernel/events/core.c:9347
perf_init_event kernel/events/core.c:9385 [inline]
perf_event_alloc.part.0+0xd13/0x1ff0 kernel/events/core.c:9645
perf_event_alloc kernel/events/core.c:9998 [inline]
SYSC_perf_event_open kernel/events/core.c:10105 [inline]
SyS_perf_event_open+0x6eb/0x2560 kernel/events/core.c:9988
do_syscall_64+0x19b/0x520 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
other info that might help us debug this:
Chain exists of:
pmus_lock --> &cpuctx_mutex --> &cpuctx_mutex/1
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&cpuctx_mutex/1);
lock(&cpuctx_mutex);
lock(&cpuctx_mutex/1);
lock(pmus_lock);
*** DEADLOCK ***
2 locks held by syz-executor.2/13669:
#0: (&pmus_srcu){....}, at: [<00000000bf38a48a>] perf_event_alloc.part.0+0xb2b/0x1ff0 kernel/events/core.c:9639
#1: (&cpuctx_mutex/1){+.+.}, at: [<00000000f87a48a7>] perf_event_ctx_lock_nested+0x15a/0x2d0 kernel/events/core.c:1240
stack backtrace:
CPU: 1 PID: 13669 Comm: syz-executor.2 Not tainted 4.14.151+ #0
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0xca/0x134 lib/dump_stack.c:53
print_circular_bug.isra.0.cold+0x2dc/0x425 kernel/locking/lockdep.c:1258
check_prev_add kernel/locking/lockdep.c:1901 [inline]
check_prevs_add kernel/locking/lockdep.c:2018 [inline]
validate_chain kernel/locking/lockdep.c:2460 [inline]
__lock_acquire+0x2f5f/0x4320 kernel/locking/lockdep.c:3487
lock_acquire+0x12b/0x360 kernel/locking/lockdep.c:3994
__mutex_lock_common kernel/locking/mutex.c:756 [inline]
__mutex_lock+0xf7/0x13e0 kernel/locking/mutex.c:893
swevent_hlist_get kernel/events/core.c:7896 [inline]
perf_swevent_init+0x123/0x4f0 kernel/events/core.c:7956
perf_try_init_event+0xe5/0x200 kernel/events/core.c:9347
perf_init_event kernel/events/core.c:9385 [inline]
perf_event_alloc.part.0+0xd13/0x1ff0 kernel/events/core.c:9645
perf_event_alloc kernel/events/core.c:9998 [inline]
SYSC_perf_event_open kernel/events/core.c:10105 [inline]
SyS_perf_event_open+0x6eb/0x2560 kernel/events/core.c:9988
do_syscall_64+0x19b/0x520 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x45a219
RSP: 002b:00007ff41eddcc78 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000045a219
RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000020000200
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000246 R12: 00007ff41eddd6d4
R13: 00000000004c75c7 R14: 00000000004dd348 R15: 00000000ffffffff
audit: type=1400 audit(1573025983.274:38): avc: denied { lock } for pid=13759 comm="syz-executor.1" path="socket:[47571]" dev="sockfs" ino=47571 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13844 comm=syz-executor.1
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13865 comm=syz-executor.1
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8 sclass=netlink_route_socket pig=14089 comm=syz-executor.3
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14423 comm=syz-executor.4
audit: type=1400 audit(1573025989.694:39): avc: denied { ioctl } for pid=14522 comm="syz-executor.3" path="socket:[51242]" dev="sockfs" ino=51242 ioctlcmd=0x8981 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1
audit: type=1400 audit(1573025989.994:40): avc: denied { setopt } for pid=14577 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1