Re: [syzbot] [lsm?] [integrity?] possible deadlock in ima_file_truncate

On Mon, 2026-08-17 at 17:40 -0500, Frederick Lawler wrote:

On Mon, Aug 17, 2026 at 06:21:57PM -0400, Mimi Zohar wrote:

quoted

On Mon, 2026-08-17 at 15:43 -0500, Frederick Lawler wrote:

quoted

On Sat, Aug 08, 2026 at 05:20:29PM -0700, syzbot wrote:

quoted

Hello,

syzbot found the following issue on:

HEAD commit:    c21bb4193868 Merge tag 'for_linus' of git://git.kernel.org..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=113c53b9580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=145fa60d73086782
dashboard link: https://syzkaller.appspot.com/bug?extid=448c2e24b1ceff13ed2a
compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/dde4460fa7fd/disk-c21bb419.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e1fe13568a84/vmlinux-c21bb419.xz
kernel image: https://storage.googleapis.com/syzbot-assets/283184100427/bzImage-c21bb419.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+448c2e24b1ceff13ed2a@syzkaller.appspotmail.com

======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.3.857/8643 is trying to acquire lock:
ffff888037be2480 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: ima_reset_action_flags security/integrity/ima/ima_main.c:708 [inline]
ffff888037be2480 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: ima_reset_action_flags security/integrity/ima/ima_main.c:697 [inline]
ffff888037be2480 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: ima_file_truncate+0xe6/0x190 security/integrity/ima/ima_main.c:723

but task is already holding lock:
ffff888035fc0450 (sb_writers#6){.+.+}-{0:0}, at: do_open fs/namei.c:4693 [inline]
ffff888035fc0450 (sb_writers#6){.+.+}-{0:0}, at: path_openat+0x2929/0x4280 fs/namei.c:4863

I had AI whip up a reproducer for this, but it's not mutually exclusive to the
added patch. Tested by running reproducer, then unapplied patch, still
reproduced on v7.2-rc4.

I'll need to simplify it before I post it.

#syz dup: [syzbot] [integrity?] [lsm?] possible deadlock in process_measurement (6)

See below for un-applied repro result.

Hi Fred,

In response to this syzbot, I responded:

Sorry, I must've missed that.

quoted

Like other pseudo filesystems, configfs files should not be measured by IMA.  To
addresss this particular bug, please add a rule to the builtin
dont_measure_rules[] and default_appraise_rule[] policies.

Without the configfs filesystem being in policy, can you reproduce the deadlock?

I was not able to.

Do have time to post 2 patches - one to move the configfs magic number to
magic.h and the other to update the IMA builtin policies?

thanks,

Mimi