possible deadlock in iterate_dir (4)

Status: upstream: reported on 2026/10/02 20:11
Subsystems: overlayfs
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+7c4b3d05083880a09cdd@syzkaller.appspotmail.com
First crash: 11d, last: 1h17m
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
ebe83c0d repro-c Reproduced: ✅ ❓ possible deadlock in iterate_dir (4) 2026/10/03 10:25 2026/10/03 10:25 2026/10/03 11:41 57bbd979
0c1e46f7 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ possible deadlock in iterate_dir (4) 2026/09/30 03:10 2026/09/30 03:10 2026/09/30 03:50 69537153
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [overlayfs?] possible deadlock in iterate_dir (4) 0 (1) 2026/10/02 20:11
▶ ▼ Similar bugs (11)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 possible deadlock in iterate_dir (3) origin:lts-only 4 syz, C inconclusive 12 129d 631d 0/3 upstream: reported C repro on 2025/01/16 11:46
linux-5.15 possible deadlock in iterate_dir (3) missing-backport origin:upstream 4 syz, C error 26 93d 920d 0/3 upstream: reported C repro on 2024/04/03 07:56
upstream possible deadlock in iterate_dir (2) fs 4 1 645d 637d 0/29 auto-obsoleted due to no activity on 2025/04/12 17:38
linux-6.1 possible deadlock in iterate_dir (2) 4 2 898d 923d 0/3 auto-obsoleted due to no activity on 2024/08/02 17:42
linux-6.1 possible deadlock in iterate_dir 4 2 1178d 1184d 0/3 auto-obsoleted due to no activity on 2023/10/27 20:39
upstream possible deadlock in iterate_dir (3) prio:high btrfs 4 21 178d 391d 0/29 auto-obsoleted due to no activity on 2026/07/23 09:18
linux-4.14 possible deadlock in iterate_dir ubifs 4 syz, C 11375 1313d 2308d 0/1 upstream: reported C repro on 2020/06/15 06:16
linux-5.15 possible deadlock in iterate_dir (2) 4 2 1045d 1138d 0/3 auto-obsoleted due to no activity on 2024/03/08 13:21
linux-4.19 possible deadlock in iterate_dir 4 1 2479d 2479d 0/1 auto-closed as invalid on 2020/04/24 15:06
upstream possible deadlock in iterate_dir fs 4 23 1143d 1385d 0/29 auto-obsoleted due to no activity on 2023/12/01 22:38
linux-5.15 possible deadlock in iterate_dir 4 1 1292d 1292d 0/3 auto-obsoleted due to no activity on 2023/07/25 13:55
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2026/10/03 17:58 4h28m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git f0406245cb9855e6318335a8a223551354291a46 report job log log

Sample crash report:
         option from the mount to silence this warning.
==========
=======================================================
WARNING: The mand mount option has been deprecated and
         and is ignored by this kernel. Remove the mand
         option from the mount to silence this warning.
=======================================================
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Tainted: G             L      
------------------------------------------------------
syz.1.123/6063 is trying to acquire lock:
ffff8880237bd7d8 (&type->i_mutex_dir_key#5){++++}-{4:4}, at: iterate_dir+0x287/0x880 fs/readdir.c:106

but task is already holding lock:
ffff88805ac4de58 (&ovl_i_mutex_dir_key[depth]){++++}-{4:4}, at: inode_lock include/linux/fs.h:1024 [inline]
ffff88805ac4de58 (&ovl_i_mutex_dir_key[depth]){++++}-{4:4}, at: vfs_rmdir+0xf8/0x6a0 fs/namei.c:5542

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (&ovl_i_mutex_dir_key[depth]){++++}-{4:4}:
       down_read+0x45/0x320 kernel/locking/rwsem.c:1574
       inode_lock_shared include/linux/fs.h:1039 [inline]
       lookup_slow+0x46/0x80 fs/namei.c:1935
       ovl_lookup_positive_unlocked fs/overlayfs/namei.c:216 [inline]
       ovl_lookup_single+0x323/0xe90 fs/overlayfs/namei.c:260
       ovl_lookup_layer+0x377/0x440 fs/overlayfs/namei.c:365
       ovl_lookup_layers fs/overlayfs/namei.c:1168 [inline]
       ovl_lookup+0x9ae/0x1c80 fs/overlayfs/namei.c:1403
       lookup_open+0x94b/0x1970 fs/namei.c:4559
       open_last_lookups fs/namei.c:4798 [inline]
       path_openat+0x673/0x1da0 fs/namei.c:5037
       do_file_open+0x23e/0x4a0 fs/namei.c:5069
       do_sys_openat2+0x115/0x200 fs/open.c:1442
       do_sys_open fs/open.c:1448 [inline]
       __do_sys_openat fs/open.c:1788 [inline]
       __se_sys_openat fs/open.c:1783 [inline]
       __x64_sys_openat+0x138/0x170 fs/open.c:1783
       do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
       do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #1 (DCACHE_PAR_LOOKUP){+.+.}-{0:0}:
       d_wait_lookup fs/dcache.c:2840 [inline]
       __d_alloc_parallel+0xc32/0x1700 fs/dcache.c:2944
       __lookup_slow+0x82/0x2f0 fs/namei.c:1904
       lookup_slow+0x59/0x80 fs/namei.c:1936
       walk_component fs/namei.c:2311 [inline]
       link_path_walk+0xd22/0x1910 fs/namei.c:2685
       path_parentat fs/namei.c:2889 [inline]
       __filename_parentat+0x287/0x6f0 fs/namei.c:2913
       filename_parentat fs/namei.c:2931 [inline]
       filename_unlinkat+0x104/0x610 fs/namei.c:5730
       __do_sys_unlink fs/namei.c:5796 [inline]
       __se_sys_unlink+0x2e/0x140 fs/namei.c:5793
       do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
       do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #0 (&type->i_mutex_dir_key#5){++++}-{4:4}:
       check_prev_add kernel/locking/lockdep.c:3209 [inline]
       check_prevs_add kernel/locking/lockdep.c:3328 [inline]
       validate_chain kernel/locking/lockdep.c:3952 [inline]
       __lock_acquire+0x164c/0x2de0 kernel/locking/lockdep.c:5288
       lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
       down_read_killable+0x4b/0x3b0 kernel/locking/rwsem.c:1599
       iterate_dir+0x287/0x880 fs/readdir.c:106
       ovl_dir_read+0x141/0x4a0 fs/overlayfs/readdir.c:388
       ovl_dir_read_merged+0x402/0x520 fs/overlayfs/readdir.c:461
       ovl_check_empty_dir+0xbd/0x500 fs/overlayfs/readdir.c:1083
       ovl_do_remove+0x1ad/0xdc0 fs/overlayfs/dir.c:944
       vfs_rmdir+0x3e6/0x6a0 fs/namei.c:5557
       filename_rmdir+0x292/0x520 fs/namei.c:5614
       __do_sys_unlinkat fs/namei.c:5789 [inline]
       __se_sys_unlinkat+0x71/0x1a0 fs/namei.c:5782
       do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
       do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

Chain exists of:
  &type->i_mutex_dir_key#5 --> DCACHE_PAR_LOOKUP --> &ovl_i_mutex_dir_key[depth]

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&ovl_i_mutex_dir_key[depth]);
                               lock(DCACHE_PAR_LOOKUP);
                               lock(&ovl_i_mutex_dir_key[depth]);
  rlock(&type->i_mutex_dir_key#5);

 *** DEADLOCK ***

locks held by syz.1.123/6063: 3, last CPU#1:
 #0: ffff88802d47c460 (sb_writers#19){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:527
 #1: ffff88805ac4e3d0 (&ovl_i_mutex_dir_key[depth]/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1069 [inline]
 #1: ffff88805ac4e3d0 (&ovl_i_mutex_dir_key[depth]/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2947 [inline]
 #1: ffff88805ac4e3d0 (&ovl_i_mutex_dir_key[depth]/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2971 [inline]
 #1: ffff88805ac4e3d0 (&ovl_i_mutex_dir_key[depth]/1){+.+.}-{4:4}, at: filename_rmdir+0x1cd/0x520 fs/namei.c:5607
 #2: ffff88805ac4de58 (&ovl_i_mutex_dir_key[depth]){++++}-{4:4}, at: inode_lock include/linux/fs.h:1024 [inline]
 #2: ffff88805ac4de58 (&ovl_i_mutex_dir_key[depth]){++++}-{4:4}, at: vfs_rmdir+0xf8/0x6a0 fs/namei.c:5542

stack backtrace:
CPU: 1 UID: 0 PID: 6063 Comm: syz.1.123 Tainted: G             L       syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_circular_bug+0x2e2/0x300 kernel/locking/lockdep.c:2087
 check_noncircular+0x12f/0x150 kernel/locking/lockdep.c:2219
 check_prev_add kernel/locking/lockdep.c:3209 [inline]
 check_prevs_add kernel/locking/lockdep.c:3328 [inline]
 validate_chain kernel/locking/lockdep.c:3952 [inline]
 __lock_acquire+0x164c/0x2de0 kernel/locking/lockdep.c:5288
 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
 down_read_killable+0x4b/0x3b0 kernel/locking/rwsem.c:1599
 iterate_dir+0x287/0x880 fs/readdir.c:106
 ovl_dir_read+0x141/0x4a0 fs/overlayfs/readdir.c:388
 ovl_dir_read_merged+0x402/0x520 fs/overlayfs/readdir.c:461
 ovl_check_empty_dir+0xbd/0x500 fs/overlayfs/readdir.c:1083
 ovl_do_remove+0x1ad/0xdc0 fs/overlayfs/dir.c:944
 vfs_rmdir+0x3e6/0x6a0 fs/namei.c:5557
 filename_rmdir+0x292/0x520 fs/namei.c:5614
 __do_sys_unlinkat fs/namei.c:5789 [inline]
 __se_sys_unlinkat+0x71/0x1a0 fs/namei.c:5782
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f07d0d9e1d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f07d1caf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000107
RAX: ffffffffffffffda RBX: 00007f07d1025fa0 RCX: 00007f07d0d9e1d9
RDX: 0000000000000200 RSI: 0000200000000000 RDI: ffffffffffffff9c
RBP: 00007f07d0e35888 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f07d1026038 R14: 00007f07d1025fa0 R15: 00007ffc264bc2e8
 </TASK>

Crashes (46):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/10 06:47 linux-next becb95e45ef0 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce possible deadlock in iterate_dir
2026/10/09 13:47 linux-next aac26bee2287 a8add9cd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in iterate_dir
2026/10/09 12:20 linux-next aac26bee2287 a8add9cd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce possible deadlock in iterate_dir
2026/10/09 10:04 linux-next aac26bee2287 b2734a59 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in iterate_dir
2026/10/09 06:10 linux-next aac26bee2287 b2734a59 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce possible deadlock in iterate_dir
2026/10/09 06:09 linux-next aac26bee2287 b2734a59 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce possible deadlock in iterate_dir
2026/10/09 06:09 linux-next aac26bee2287 b2734a59 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce possible deadlock in iterate_dir
2026/10/09 03:34 linux-next b01868671970 b2734a59 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce possible deadlock in iterate_dir
2026/10/09 03:09 linux-next b01868671970 b2734a59 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in iterate_dir
2026/10/09 03:09 linux-next b01868671970 b2734a59 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in iterate_dir
2026/10/08 23:35 linux-next b01868671970 b2734a59 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce possible deadlock in iterate_dir
2026/10/08 23:24 linux-next b01868671970 b2734a59 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce possible deadlock in iterate_dir
2026/10/08 12:13 linux-next b01868671970 4f6a9fcf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in iterate_dir
2026/10/08 12:11 linux-next b01868671970 4f6a9fcf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in iterate_dir
2026/10/08 00:24 linux-next b01868671970 6520ecdb .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce possible deadlock in iterate_dir
2026/10/08 00:03 linux-next b01868671970 6520ecdb .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce possible deadlock in iterate_dir
2026/10/07 14:44 linux-next eea3fef32a9c 6520ecdb .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in iterate_dir
2026/10/07 14:39 linux-next eea3fef32a9c 6520ecdb .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in iterate_dir
2026/10/07 12:22 linux-next eea3fef32a9c f7710056 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce possible deadlock in iterate_dir
2026/10/07 09:38 linux-next eea3fef32a9c f7710056 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in iterate_dir
2026/10/07 08:35 linux-next eea3fef32a9c f7710056 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in iterate_dir
2026/10/07 08:35 linux-next eea3fef32a9c f7710056 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in iterate_dir
2026/10/06 14:58 linux-next eea3fef32a9c f7710056 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in iterate_dir
2026/10/06 14:58 linux-next eea3fef32a9c f7710056 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in iterate_dir
2026/10/06 03:34 linux-next bf1ee2bd5c2d f7710056 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in iterate_dir
2026/10/06 03:25 linux-next bf1ee2bd5c2d f7710056 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in iterate_dir
2026/10/06 03:24 linux-next bf1ee2bd5c2d f7710056 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in iterate_dir
2026/10/01 12:38 linux-next 6474fa070f2b 38f7f0d1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce possible deadlock in iterate_dir
2026/10/01 12:35 linux-next 6474fa070f2b 38f7f0d1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce possible deadlock in iterate_dir
2026/10/01 12:20 linux-next 6474fa070f2b 38f7f0d1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce possible deadlock in iterate_dir
2026/10/01 11:35 linux-next 6c2cb8b8b843 38f7f0d1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in iterate_dir
2026/10/01 11:33 linux-next 6474fa070f2b 38f7f0d1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce possible deadlock in iterate_dir
2026/10/01 11:28 linux-next 6474fa070f2b 38f7f0d1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce possible deadlock in iterate_dir
2026/10/01 10:47 linux-next 6474fa070f2b 38f7f0d1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce possible deadlock in iterate_dir
2026/10/01 10:14 linux-next 6474fa070f2b 38f7f0d1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce possible deadlock in iterate_dir
2026/10/01 10:07 linux-next 6474fa070f2b 38f7f0d1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce possible deadlock in iterate_dir
2026/09/30 13:22 linux-next 6474fa070f2b 892a21ec .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in iterate_dir
2026/09/30 13:21 linux-next 6474fa070f2b 892a21ec .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in iterate_dir
2026/09/30 13:21 linux-next 6474fa070f2b 892a21ec .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in iterate_dir
2026/09/29 21:11 linux-next 6474fa070f2b 7808aef4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in iterate_dir
2026/09/29 17:56 linux-next 6375e61c01e9 7bf4ea23 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce possible deadlock in iterate_dir
2026/09/29 05:59 linux-next 6375e61c01e9 7bf4ea23 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce possible deadlock in iterate_dir
2026/09/28 20:08 linux-next 6375e61c01e9 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in iterate_dir
2026/09/28 20:08 linux-next 6375e61c01e9 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in iterate_dir
* Struck through repros no longer work on HEAD.