Hello, syzbot found the following issue on: HEAD commit: c21bb4193868 Merge tag 'for_linus' of git://git.kernel.org.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=113c53b9580000 kernel config: https://syzkaller.appspot.com/x/.config?x=145fa60d73086782 dashboard link: https://syzkaller.appspot.com/bug?extid=448c2e24b1ceff13ed2a compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 Unfortunately, I don't have any reproducer for this issue yet. Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/dde4460fa7fd/disk-c21bb419.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/e1fe13568a84/vmlinux-c21bb419.xz kernel image: https://storage.googleapis.com/syzbot-assets/283184100427/bzImage-c21bb419.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: <redacted> ====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Not tainted ------------------------------------------------------ syz.3.857/8643 is trying to acquire lock: ffff888037be2480 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: ima_reset_action_flags security/integrity/ima/ima_main.c:708 [inline] ffff888037be2480 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: ima_reset_action_flags security/integrity/ima/ima_main.c:697 [inline] ffff888037be2480 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: ima_file_truncate+0xe6/0x190 security/integrity/ima/ima_main.c:723 but task is already holding lock: ffff888035fc0450 (sb_writers#6){.+.+}-{0:0}, at: do_open fs/namei.c:4693 [inline] ffff888035fc0450 (sb_writers#6){.+.+}-{0:0}, at: path_openat+0x2929/0x4280 fs/namei.c:4863 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #4 (sb_writers#6){.+.+}-{0:0}:
[syzbot] [lsm?] [integrity?] possible deadlock in ima_file_truncate
Started by syzbot on Aug 9, 2026 · 6 messages from 3 authors · Last reply Aug 18, 2026
open the first message on its own page
On Sat, Aug 08, 2026 at 05:20:29PM -0700, syzbot wrote:
Hello, syzbot found the following issue on: HEAD commit: c21bb4193868 Merge tag 'for_linus' of git://git.kernel.org.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=113c53b9580000 kernel config: https://syzkaller.appspot.com/x/.config?x=145fa60d73086782 dashboard link: https://syzkaller.appspot.com/bug?extid=448c2e24b1ceff13ed2a compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 Unfortunately, I don't have any reproducer for this issue yet. Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/dde4460fa7fd/disk-c21bb419.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/e1fe13568a84/vmlinux-c21bb419.xz kernel image: https://storage.googleapis.com/syzbot-assets/283184100427/bzImage-c21bb419.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: <redacted> ====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Not tainted ------------------------------------------------------ syz.3.857/8643 is trying to acquire lock: ffff888037be2480 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: ima_reset_action_flags security/integrity/ima/ima_main.c:708 [inline] ffff888037be2480 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: ima_reset_action_flags security/integrity/ima/ima_main.c:697 [inline] ffff888037be2480 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: ima_file_truncate+0xe6/0x190 security/integrity/ima/ima_main.c:723 but task is already holding lock: ffff888035fc0450 (sb_writers#6){.+.+}-{0:0}, at: do_open fs/namei.c:4693 [inline] ffff888035fc0450 (sb_writers#6){.+.+}-{0:0}, at: path_openat+0x2929/0x4280 fs/namei.c:4863
I had AI whip up a reproducer for this, but it's not mutually exclusive to the
added patch. Tested by running reproducer, then unapplied patch, still
reproduced on v7.2-rc4.
I'll need to simplify it before I post it.
#syz dup: [syzbot] [integrity?] [lsm?] possible deadlock in process_measurement (6)
See below for un-applied repro result.
Best,
Fred
[ 23.443936] ======================================================
[ 23.443988] WARNING: possible circular locking dependency detected
[ 23.444028] 7.2.0-rc4 #11 Not tainted
[ 23.444062] ------------------------------------------------------
[ 23.444095] repro-deadlock./159 is trying to acquire lock:
[ 23.444121] ffff8881033da7b0 (&ima_iint_mutex_key[depth]#2){+.+.}-{4:4}, at: process_measurement+0x298/0xc10
[ 23.444184]
[ 23.444184] but task is already holding lock:
[ 23.444217] ffff88810210ac68 (&subsys->lock){+.+.}-{4:4}, at: nvmet_ns_enable+0x26/0x1e0
[ 23.444265]
[ 23.444265] which lock already depends on the new lock.
[ 23.444265]
[ 23.444302]
[ 23.444302] the existing dependency chain (in reverse order) is:
[ 23.444340]
[ 23.444340] -> #2 (&subsys->lock){+.+.}-{4:4}:
[ 23.444378] lock_acquire+0xc7/0x2e0
[ 23.444401] __mutex_lock+0xc7/0x1120
[ 23.444425] nvmet_ns_device_path_store+0x31/0xd0
[ 23.444454] configfs_write_iter+0xc8/0x140
[ 23.444484] vfs_write+0x2af/0x530
[ 23.444508] ksys_write+0x73/0xf0
[ 23.444531] do_syscall_64+0x121/0x630
[ 23.444568] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 23.444598]
[ 23.444598] -> #1 (&p->frag_sem){.+.+}-{4:4}:M Mimi Zohar replied to Frederick Lawler #
On Mon, 2026-08-17 at 15:43 -0500, Frederick Lawler wrote:
On Sat, Aug 08, 2026 at 05:20:29PM -0700, syzbot wrote:quoted
Hello, syzbot found the following issue on: HEAD commit: c21bb4193868 Merge tag 'for_linus' of git://git.kernel.org.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=113c53b9580000 kernel config: https://syzkaller.appspot.com/x/.config?x=145fa60d73086782 dashboard link: https://syzkaller.appspot.com/bug?extid=448c2e24b1ceff13ed2a compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 Unfortunately, I don't have any reproducer for this issue yet. Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/dde4460fa7fd/disk-c21bb419.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/e1fe13568a84/vmlinux-c21bb419.xz kernel image: https://storage.googleapis.com/syzbot-assets/283184100427/bzImage-c21bb419.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: <redacted> ====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Not tainted ------------------------------------------------------ syz.3.857/8643 is trying to acquire lock: ffff888037be2480 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: ima_reset_action_flags security/integrity/ima/ima_main.c:708 [inline] ffff888037be2480 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: ima_reset_action_flags security/integrity/ima/ima_main.c:697 [inline] ffff888037be2480 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: ima_file_truncate+0xe6/0x190 security/integrity/ima/ima_main.c:723 but task is already holding lock: ffff888035fc0450 (sb_writers#6){.+.+}-{0:0}, at: do_open fs/namei.c:4693 [inline] ffff888035fc0450 (sb_writers#6){.+.+}-{0:0}, at: path_openat+0x2929/0x4280 fs/namei.c:4863I had AI whip up a reproducer for this, but it's not mutually exclusive to the added patch. Tested by running reproducer, then unapplied patch, still reproduced on v7.2-rc4.
Hi Fred,
In response to this syzbot, I responded:
Like other pseudo filesystems, configfs files should not be measured by IMA. To
addresss this particular bug, please add a rule to the builtin
dont_measure_rules[] and default_appraise_rule[] policies.
Without the configfs filesystem being in policy, can you reproduce the deadlock?
thanks,
MimiF Frederick Lawler replied to Mimi Zohar #
On Mon, Aug 17, 2026 at 06:21:57PM -0400, Mimi Zohar wrote:
On Mon, 2026-08-17 at 15:43 -0500, Frederick Lawler wrote:quoted
On Sat, Aug 08, 2026 at 05:20:29PM -0700, syzbot wrote:quoted
Hello, syzbot found the following issue on: HEAD commit: c21bb4193868 Merge tag 'for_linus' of git://git.kernel.org.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=113c53b9580000 kernel config: https://syzkaller.appspot.com/x/.config?x=145fa60d73086782 dashboard link: https://syzkaller.appspot.com/bug?extid=448c2e24b1ceff13ed2a compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 Unfortunately, I don't have any reproducer for this issue yet. Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/dde4460fa7fd/disk-c21bb419.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/e1fe13568a84/vmlinux-c21bb419.xz kernel image: https://storage.googleapis.com/syzbot-assets/283184100427/bzImage-c21bb419.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: <redacted> ====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Not tainted ------------------------------------------------------ syz.3.857/8643 is trying to acquire lock: ffff888037be2480 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: ima_reset_action_flags security/integrity/ima/ima_main.c:708 [inline] ffff888037be2480 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: ima_reset_action_flags security/integrity/ima/ima_main.c:697 [inline] ffff888037be2480 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: ima_file_truncate+0xe6/0x190 security/integrity/ima/ima_main.c:723 but task is already holding lock: ffff888035fc0450 (sb_writers#6){.+.+}-{0:0}, at: do_open fs/namei.c:4693 [inline] ffff888035fc0450 (sb_writers#6){.+.+}-{0:0}, at: path_openat+0x2929/0x4280 fs/namei.c:4863I had AI whip up a reproducer for this, but it's not mutually exclusive to the added patch. Tested by running reproducer, then unapplied patch, still reproduced on v7.2-rc4.
Sorry, I must've missed that.
Like other pseudo filesystems, configfs files should not be measured by IMA. To addresss this particular bug, please add a rule to the builtin dont_measure_rules[] and default_appraise_rule[] policies. Without the configfs filesystem being in policy, can you reproduce the deadlock?
I was not able to. Best, Fred
M Mimi Zohar replied to Frederick Lawler #
On Mon, 2026-08-17 at 17:40 -0500, Frederick Lawler wrote:
On Mon, Aug 17, 2026 at 06:21:57PM -0400, Mimi Zohar wrote:quoted
On Mon, 2026-08-17 at 15:43 -0500, Frederick Lawler wrote:quoted
On Sat, Aug 08, 2026 at 05:20:29PM -0700, syzbot wrote:quoted
Hello, syzbot found the following issue on: HEAD commit: c21bb4193868 Merge tag 'for_linus' of git://git.kernel.org.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=113c53b9580000 kernel config: https://syzkaller.appspot.com/x/.config?x=145fa60d73086782 dashboard link: https://syzkaller.appspot.com/bug?extid=448c2e24b1ceff13ed2a compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 Unfortunately, I don't have any reproducer for this issue yet. Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/dde4460fa7fd/disk-c21bb419.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/e1fe13568a84/vmlinux-c21bb419.xz kernel image: https://storage.googleapis.com/syzbot-assets/283184100427/bzImage-c21bb419.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: <redacted> ====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Not tainted ------------------------------------------------------ syz.3.857/8643 is trying to acquire lock: ffff888037be2480 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: ima_reset_action_flags security/integrity/ima/ima_main.c:708 [inline] ffff888037be2480 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: ima_reset_action_flags security/integrity/ima/ima_main.c:697 [inline] ffff888037be2480 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: ima_file_truncate+0xe6/0x190 security/integrity/ima/ima_main.c:723 but task is already holding lock: ffff888035fc0450 (sb_writers#6){.+.+}-{0:0}, at: do_open fs/namei.c:4693 [inline] ffff888035fc0450 (sb_writers#6){.+.+}-{0:0}, at: path_openat+0x2929/0x4280 fs/namei.c:4863I had AI whip up a reproducer for this, but it's not mutually exclusive to the added patch. Tested by running reproducer, then unapplied patch, still
Do have time to post 2 patches - one to move the configfs magic number to
magic.h and the other to update the IMA builtin policies?
thanks,
MimiF Frederick Lawler replied to Mimi Zohar #
On Mon, Aug 17, 2026 at 07:32:43PM -0400, Mimi Zohar wrote:
On Mon, 2026-08-17 at 17:40 -0500, Frederick Lawler wrote:quoted
On Mon, Aug 17, 2026 at 06:21:57PM -0400, Mimi Zohar wrote:quoted
On Mon, 2026-08-17 at 15:43 -0500, Frederick Lawler wrote:quoted
On Sat, Aug 08, 2026 at 05:20:29PM -0700, syzbot wrote:quoted
Hello, syzbot found the following issue on: HEAD commit: c21bb4193868 Merge tag 'for_linus' of git://git.kernel.org.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=113c53b9580000 kernel config: https://syzkaller.appspot.com/x/.config?x=145fa60d73086782 dashboard link: https://syzkaller.appspot.com/bug?extid=448c2e24b1ceff13ed2a compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 Unfortunately, I don't have any reproducer for this issue yet. Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/dde4460fa7fd/disk-c21bb419.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/e1fe13568a84/vmlinux-c21bb419.xz kernel image: https://storage.googleapis.com/syzbot-assets/283184100427/bzImage-c21bb419.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: <redacted> ====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Not tainted ------------------------------------------------------ syz.3.857/8643 is trying to acquire lock: ffff888037be2480 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: ima_reset_action_flags security/integrity/ima/ima_main.c:708 [inline] ffff888037be2480 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: ima_reset_action_flags security/integrity/ima/ima_main.c:697 [inline] ffff888037be2480 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: ima_file_truncate+0xe6/0x190 security/integrity/ima/ima_main.c:723 but task is already holding lock: ffff888035fc0450 (sb_writers#6){.+.+}-{0:0}, at: do_open fs/namei.c:4693 [inline] ffff888035fc0450 (sb_writers#6){.+.+}-{0:0}, at: path_openat+0x2929/0x4280 fs/namei.c:4863I had AI whip up a reproducer for this, but it's not mutually exclusive to the
Sure thing. Here's the post[1]. I rebased on linux-integrity/next-integrity. (forgot to include that in cover) Best, Fred [1]: https://lore.kernel.org/all/20260818-configfs-v1-0-a2329043cf86@cloudflare.com/