possible deadlock in mm_access

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 7fe05eed Merge 4.9.194 into android-4.9
git tree: android-4.9
console output: https://syzkaller.appspot.com/x/log.txt?x=16023672e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=c6d462552c77f021
dashboard link: https://syzkaller.appspot.com/bug?extid=0d014be916d18c349d99
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+0d014b...@syzkaller.appspotmail.com

======================================================
[ INFO: possible circular locking dependency detected ]
4.9.194+ #0 Not tainted
-------------------------------------------------------
syz-executor.4/2687 is trying to acquire lock:
(&sig->cred_guard_mutex){+.+.+.}, at: [<000000009cb348d7>]
mm_access+0x4f/0x140 kernel/fork.c:1030
but task is already holding lock:
(&sb->s_type->i_mutex_key){++++++}, at: [<0000000011782db3>]
inode_lock_shared include/linux/fs.h:781 [inline]
(&sb->s_type->i_mutex_key){++++++}, at: [<0000000011782db3>]
lookup_slow+0x160/0x480 fs/namei.c:1770
which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (&sb->s_type->i_mutex_key){++++++}:
lock_acquire+0x133/0x3d0 kernel/locking/lockdep.c:3756
down_read+0x44/0xb0 kernel/locking/rwsem.c:22
inode_lock_shared include/linux/fs.h:781 [inline]
do_last fs/namei.c:3439 [inline]
path_openat+0x16a8/0x2f60 fs/namei.c:3665
do_filp_open+0x1a1/0x280 fs/namei.c:3699
do_open_execat+0x10c/0x6a0 fs/exec.c:844
open_exec+0x37/0x70 fs/exec.c:876
load_script+0x572/0x710 fs/binfmt_script.c:100
search_binary_handler fs/exec.c:1621 [inline]
search_binary_handler+0x14f/0x700 fs/exec.c:1599
exec_binprm fs/exec.c:1663 [inline]
do_execveat_common.isra.0+0xf81/0x1db0 fs/exec.c:1785
do_execveat fs/exec.c:1840 [inline]
SYSC_execveat fs/exec.c:1921 [inline]
SyS_execveat+0x55/0x70 fs/exec.c:1913
do_syscall_64+0x1ad/0x5c0 arch/x86/entry/common.c:288
entry_SYSCALL_64_after_swapgs+0x5d/0xdb

-> #0 (&sig->cred_guard_mutex){+.+.+.}:
check_prev_add kernel/locking/lockdep.c:1828 [inline]
check_prevs_add kernel/locking/lockdep.c:1938 [inline]
validate_chain kernel/locking/lockdep.c:2265 [inline]
__lock_acquire+0x2d22/0x4390 kernel/locking/lockdep.c:3345
lock_acquire+0x133/0x3d0 kernel/locking/lockdep.c:3756
__mutex_lock_common kernel/locking/mutex.c:521 [inline]
mutex_lock_killable_nested+0xcd/0xa10 kernel/locking/mutex.c:641
mm_access+0x4f/0x140 kernel/fork.c:1030
map_files_d_revalidate+0xfa/0x6d0 fs/proc/base.c:1929
d_revalidate fs/namei.c:792 [inline]
lookup_slow+0x373/0x480 fs/namei.c:1781
walk_component+0x71e/0xce0 fs/namei.c:1909
lookup_last fs/namei.c:2391 [inline]
path_lookupat.isra.0+0x18f/0x3f0 fs/namei.c:2408
filename_lookup+0x1a1/0x3b0 fs/namei.c:2442
user_path_at_empty+0x43/0x50 fs/namei.c:2703
user_path_at include/linux/namei.h:55 [inline]
SYSC_quotactl fs/quota/quota.c:862 [inline]
SyS_quotactl+0x623/0x1170 fs/quota/quota.c:834
do_syscall_64+0x1ad/0x5c0 arch/x86/entry/common.c:288
entry_SYSCALL_64_after_swapgs+0x5d/0xdb

other info that might help us debug this:

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&sb->s_type->i_mutex_key);
lock(&sig->cred_guard_mutex);
lock(&sb->s_type->i_mutex_key);
lock(&sig->cred_guard_mutex);

*** DEADLOCK ***

1 lock held by syz-executor.4/2687:
#0: (&sb->s_type->i_mutex_key){++++++}, at: [<0000000011782db3>]
inode_lock_shared include/linux/fs.h:781 [inline]
#0: (&sb->s_type->i_mutex_key){++++++}, at: [<0000000011782db3>]
lookup_slow+0x160/0x480 fs/namei.c:1770

stack backtrace:
CPU: 0 PID: 2687 Comm: syz-executor.4 Not tainted 4.9.194+ #0
ffff8801a22073f8 ffffffff81b67001 ffffffff83cb0480 ffffffff83c80ed0
ffffffff83cb0480 ffffffff84252000 ffff8801a658df00 ffff8801a2207450
ffffffff81406d83 0000000000000050 ffff8801a2207540 ffff8801a658e7d8
Call Trace:
[<00000000f62ab783>] __dump_stack lib/dump_stack.c:15 [inline]
[<00000000f62ab783>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
[<00000000b38b0321>] print_circular_bug.cold+0x2f6/0x454
kernel/locking/lockdep.c:1202
[<0000000049487153>] check_prev_add kernel/locking/lockdep.c:1828 [inline]
[<0000000049487153>] check_prevs_add kernel/locking/lockdep.c:1938 [inline]
[<0000000049487153>] validate_chain kernel/locking/lockdep.c:2265 [inline]
[<0000000049487153>] __lock_acquire+0x2d22/0x4390
kernel/locking/lockdep.c:3345
[<0000000084e3a846>] lock_acquire+0x133/0x3d0 kernel/locking/lockdep.c:3756
[<000000008769934b>] __mutex_lock_common kernel/locking/mutex.c:521
[inline]
[<000000008769934b>] mutex_lock_killable_nested+0xcd/0xa10
kernel/locking/mutex.c:641
[<000000009cb348d7>] mm_access+0x4f/0x140 kernel/fork.c:1030
[<00000000ea8afdbc>] map_files_d_revalidate+0xfa/0x6d0 fs/proc/base.c:1929
[<0000000003ac7c99>] d_revalidate fs/namei.c:792 [inline]
[<0000000003ac7c99>] lookup_slow+0x373/0x480 fs/namei.c:1781
[<00000000a9a58107>] walk_component+0x71e/0xce0 fs/namei.c:1909
[<00000000c6da53cc>] lookup_last fs/namei.c:2391 [inline]
[<00000000c6da53cc>] path_lookupat.isra.0+0x18f/0x3f0 fs/namei.c:2408
[<00000000034da359>] filename_lookup+0x1a1/0x3b0 fs/namei.c:2442
[<000000002b0b669b>] user_path_at_empty+0x43/0x50 fs/namei.c:2703
[<00000000261f7758>] user_path_at include/linux/namei.h:55 [inline]
[<00000000261f7758>] SYSC_quotactl fs/quota/quota.c:862 [inline]
[<00000000261f7758>] SyS_quotactl+0x623/0x1170 fs/quota/quota.c:834
[<00000000f5ed5afc>] do_syscall_64+0x1ad/0x5c0 arch/x86/entry/common.c:288
[<000000006df35b18>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0
sclass=netlink_route_socket pig=2669 comm=syz-executor.0
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0
sclass=netlink_route_socket pig=2669 comm=syz-executor.0
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0
sclass=netlink_route_socket pig=2669 comm=syz-executor.0
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0
sclass=netlink_route_socket pig=2669 comm=syz-executor.0
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0
sclass=netlink_route_socket pig=2669 comm=syz-executor.0
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0
sclass=netlink_route_socket pig=2669 comm=syz-executor.0
audit: type=1400 audit(2000000062.090:3590): avc: denied { create } for
pid=2740 comm="syz-executor.4"
scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tclass=netlink_generic_socket permissive=1
audit: type=1400 audit(2000000062.310:3591): avc: denied { write } for
pid=2740 comm="syz-executor.4"
scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tclass=netlink_generic_socket permissive=1
audit: type=1400 audit(2000000062.630:3592): avc: denied { read } for
pid=2740 comm="syz-executor.4"
scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tclass=netlink_generic_socket permissive=1
audit: type=1400 audit(2000000062.740:3593): avc: denied { create } for
pid=2740 comm="syz-executor.4"
scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tclass=netlink_generic_socket permissive=1
devpts: called with bogus options
audit: type=1400 audit(2000000068.310:3594): avc: denied { create } for
pid=2952 comm="syz-executor.1"
scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tclass=netlink_generic_socket permissive=1
audit: type=1400 audit(2000000068.420:3595): avc: denied { write } for
pid=2952 comm="syz-executor.1"
scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tclass=netlink_generic_socket permissive=1
audit: type=1400 audit(2000000068.690:3596): avc: denied { read } for
pid=2952 comm="syz-executor.1"
scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tclass=netlink_generic_socket permissive=1
audit: type=1400 audit(2000000068.970:3597): avc: denied { create } for
pid=2952 comm="syz-executor.1"
scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tclass=netlink_generic_socket permissive=1
audit: type=1400 audit(2000000069.040:3598): avc: denied { write } for
pid=2952 comm="syz-executor.1"
scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tclass=netlink_generic_socket permissive=1
audit: type=1400 audit(2000000069.480:3599): avc: denied { create } for
pid=2999 comm="syz-executor.4"
scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tclass=netlink_generic_socket permissive=1
audit: type=1400 audit(2000000069.990:3600): avc: denied { create } for
pid=3035 comm="syz-executor.4"
scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tclass=netlink_generic_socket permissive=1
audit: type=1400 audit(2000000070.020:3601): avc: denied { write } for
pid=3035 comm="syz-executor.4"
scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tclass=netlink_generic_socket permissive=1
audit: type=1400 audit(2000000070.090:3602): avc: denied { read } for
pid=3035 comm="syz-executor.4"
scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tclass=netlink_generic_socket permissive=1


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.