On Sat, Aug 08, 2026 at 05:20:29PM -0700, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: c21bb4193868 Merge tag 'for_linus' of git://git.kernel.org..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=113c53b9580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=145fa60d73086782
> dashboard link: https://syzkaller.appspot.com/bug?extid=448c2e24b1ceff13ed2a
> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for
> Debian) 2.44
>
> Unfortunately, I don't have any reproducer for this issue yet.
>
> Downloadable assets:
> disk image:
> https://storage.googleapis.com/syzbot-assets/dde4460fa7fd/disk-c21bb419.raw.xz
> vmlinux:
> https://storage.googleapis.com/syzbot-assets/e1fe13568a84/vmlinux-c21bb419.xz
> kernel image:
> https://storage.googleapis.com/syzbot-assets/283184100427/bzImage-c21bb419.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: [email protected]
>
> ======================================================
> WARNING: possible circular locking dependency detected
> syzkaller #0 Not tainted
> ------------------------------------------------------
> syz.3.857/8643 is trying to acquire lock:
> ffff888037be2480 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at:
> ima_reset_action_flags security/integrity/ima/ima_main.c:708 [inline]
> ffff888037be2480 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at:
> ima_reset_action_flags security/integrity/ima/ima_main.c:697 [inline]
> ffff888037be2480 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at:
> ima_file_truncate+0xe6/0x190 security/integrity/ima/ima_main.c:723
>
> but task is already holding lock:
> ffff888035fc0450 (sb_writers#6){.+.+}-{0:0}, at: do_open fs/namei.c:4693
> [inline]
> ffff888035fc0450 (sb_writers#6){.+.+}-{0:0}, at: path_openat+0x2929/0x4280
> fs/namei.c:4863
>
I had AI whip up a reproducer for this, but it's not mutually exclusive to the
added patch. Tested by running reproducer, then unapplied patch, still
reproduced on v7.2-rc4.
I'll need to simplify it before I post it.
#syz dup: [syzbot] [integrity?] [lsm?] possible deadlock in process_measurement
(6)
See below for un-applied repro result.
Best,
Fred
[ 23.443936] ======================================================
[ 23.443988] WARNING: possible circular locking dependency detected
[ 23.444028] 7.2.0-rc4 #11 Not tainted
[ 23.444062] ------------------------------------------------------
[ 23.444095] repro-deadlock./159 is trying to acquire lock:
[ 23.444121] ffff8881033da7b0 (&ima_iint_mutex_key[depth]#2){+.+.}-{4:4}, at:
process_measurement+0x298/0xc10
[ 23.444184]
[ 23.444184] but task is already holding lock:
[ 23.444217] ffff88810210ac68 (&subsys->lock){+.+.}-{4:4}, at:
nvmet_ns_enable+0x26/0x1e0
[ 23.444265]
[ 23.444265] which lock already depends on the new lock.
[ 23.444265]
[ 23.444302]
[ 23.444302] the existing dependency chain (in reverse order) is:
[ 23.444340]
[ 23.444340] -> #2 (&subsys->lock){+.+.}-{4:4}:
[ 23.444378] lock_acquire+0xc7/0x2e0
[ 23.444401] __mutex_lock+0xc7/0x1120
[ 23.444425] nvmet_ns_device_path_store+0x31/0xd0
[ 23.444454] configfs_write_iter+0xc8/0x140
[ 23.444484] vfs_write+0x2af/0x530
[ 23.444508] ksys_write+0x73/0xf0
[ 23.444531] do_syscall_64+0x121/0x630
[ 23.444568] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 23.444598]
[ 23.444598] -> #1 (&p->frag_sem){.+.+}-{4:4}:
[ 23.444634] lock_acquire+0xc7/0x2e0
[ 23.444653] down_read+0x31/0x150
[ 23.444678] __configfs_open_file+0x5d/0x1f0
[ 23.444708] do_dentry_open+0x136/0x4a0
[ 23.444740] vfs_open+0x34/0xf0
[ 23.444763] dentry_open+0x34/0x60
[ 23.444786] ima_calc_file_hash+0x8a/0xe0
[ 23.444816] ima_collect_measurement+0x2eb/0x3a0
[ 23.444845] process_measurement+0x4e4/0xc10
[ 23.444874] ima_file_check+0x60/0x90
[ 23.444899] security_file_post_open+0x2e/0x40
[ 23.444928] path_openat+0x51f/0x1140
[ 23.444950] do_file_open+0xe4/0x1a0
[ 23.444976] do_sys_openat2+0x7f/0xe0
[ 23.445003] __x64_sys_openat+0x56/0xa0
[ 23.445040] do_syscall_64+0x121/0x630
[ 23.445075] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 23.445112]
[ 23.445112] -> #0 (&ima_iint_mutex_key[depth]#2){+.+.}-{4:4}:
[ 23.445163] check_prev_add+0xeb/0xe80
[ 23.445199] __lock_acquire+0x149d/0x1d10
[ 23.445233] lock_acquire+0xc7/0x2e0
[ 23.445257] __mutex_lock+0xc7/0x1120
[ 23.445288] process_measurement+0x298/0xc10
[ 23.445323] ima_file_check+0x60/0x90
[ 23.445354] security_file_post_open+0x2e/0x40
[ 23.445396] path_openat+0x51f/0x1140
[ 23.445424] do_file_open+0xe4/0x1a0
[ 23.445452] file_open_name+0xd1/0x1a0
[ 23.445488] filp_open+0x28/0x40
[ 23.445516] nvmet_file_ns_enable+0x2b/0xf0
[ 23.445553] nvmet_ns_enable+0x13c/0x1e0
[ 23.445590] nvmet_ns_enable_store+0x8a/0xb0
[ 23.445626] configfs_write_iter+0xc8/0x140
[ 23.445662] vfs_write+0x2af/0x530
[ 23.445691] ksys_write+0x73/0xf0
[ 23.445719] do_syscall_64+0x121/0x630
[ 23.445755] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 23.445790]
[ 23.445790] other info that might help us debug this:
[ 23.445790]
[ 23.445839] Chain exists of:
[ 23.445839] &ima_iint_mutex_key[depth]#2 --> &p->frag_sem --> &subsys->lock
[ 23.445839]
[ 23.445918] Possible unsafe locking scenario:
[ 23.445918]
[ 23.445958] CPU0 CPU1
[ 23.446004] ---- ----
[ 23.446035] lock(&subsys->lock);
[ 23.446066] lock(&p->frag_sem);
[ 23.446109] lock(&subsys->lock);
[ 23.446153] lock(&ima_iint_mutex_key[depth]#2);
[ 23.446190]
[ 23.446190] *** DEADLOCK ***
[ 23.446190]
[ 23.446230] 5 locks held by repro-deadlock./159:
[ 23.446268] #0: ffff888101ce6428 (sb_writers#10){.+.+}-{0:0}, at:
ksys_write+0x73/0xf0
[ 23.446325] #1: ffff888101f19080 (&buffer->mutex){+.+.}-{4:4}, at:
configfs_write_iter+0x2e/0x140
[ 23.446382] #2: ffff88810221faf0 (&p->frag_sem){.+.+}-{4:4}, at:
configfs_write_iter+0xa0/0x140
[ 23.446439] #3: ffffffff82e80be8 (nvmet_config_sem){+.+.}-{4:4}, at:
nvmet_ns_enable_store+0x4d/0xb0
[ 23.446496] #4: ffff88810210ac68 (&subsys->lock){+.+.}-{4:4}, at:
nvmet_ns_enable+0x26/0x1e0
[ 23.446553]
[ 23.446553] stack backtrace:
[ 23.446583] CPU: 0 UID: 0 PID: 159 Comm: repro-deadlock. Not tainted
7.2.0-rc4 #11 PREEMPT(lazy)
[ 23.446585] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps
fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 23.446586] Call Trace:
[ 23.446587] <TASK>
[ 23.446588] dump_stack_lvl+0x78/0xe0
[ 23.446591] print_circular_bug+0x2ca/0x400
[ 23.446593] check_noncircular+0x161/0x180
[ 23.446597] check_prev_add+0xeb/0xe80
[ 23.446600] __lock_acquire+0x149d/0x1d10
[ 23.446602] lock_acquire+0xc7/0x2e0
[ 23.446603] ? process_measurement+0x298/0xc10
[ 23.446605] ? lock_acquire+0xc7/0x2e0
[ 23.446607] __mutex_lock+0xc7/0x1120
[ 23.446608] ? process_measurement+0x298/0xc10
[ 23.446610] ? fs_reclaim_acquire+0x4c/0xd0
[ 23.446612] ? process_measurement+0x298/0xc10
[ 23.446614] ? find_held_lock+0x2b/0x80
[ 23.446617] ? process_measurement+0x298/0xc10
[ 23.446618] process_measurement+0x298/0xc10
[ 23.446625] ima_file_check+0x60/0x90
[ 23.446627] security_file_post_open+0x2e/0x40
[ 23.446629] path_openat+0x51f/0x1140
[ 23.446632] ? __lock_acquire+0x5df/0x1d10
[ 23.446633] do_file_open+0xe4/0x1a0
[ 23.446639] file_open_name+0xd1/0x1a0
[ 23.446640] filp_open+0x28/0x40
[ 23.446642] nvmet_file_ns_enable+0x2b/0xf0
[ 23.446644] nvmet_ns_enable+0x13c/0x1e0
[ 23.446646] nvmet_ns_enable_store+0x8a/0xb0
[ 23.446647] configfs_write_iter+0xc8/0x140
[ 23.446650] vfs_write+0x2af/0x530
[ 23.446653] ksys_write+0x73/0xf0
[ 23.446655] do_syscall_64+0x121/0x630
[ 23.446657] ? clear_bhb_loop+0x40/0x90
[ 23.446659] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 23.446660] RIP: 0033:0x7f6d63b105a4
[ 23.446662] Code: c7 00 16 00 00 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00
00 00 00 f3 0f 1e fa 80 3d a5 ea 0e 00 00 74 13 b8 01 00 00 00 0f 05 <48> 3d 00
f0 ff ff 77 54 c3 0f 1f 00 55 48 89 e5 48 83 ec 20 48 89
[ 23.446663] RSP: 002b:00007ffdbeb92468 EFLAGS: 00000202 ORIG_RAX:
0000000000000001
[ 23.446665] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f6d63b105a4
[ 23.446666] RDX: 0000000000000002 RSI: 000055be1939cba0 RDI: 0000000000000001
[ 23.446666] RBP: 00007ffdbeb92490 R08: 0000000000000073 R09: 0000000000000000
[ 23.446667] R10: 00000000ffffffff R11: 0000000000000202 R12: 0000000000000002
[ 23.446667] R13: 000055be1939cba0 R14: 00007f6d63bf85c0 R15: 00007f6d63bf5ee0
[ 23.446670] </TASK>
