./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor975165473 <...> Warning: Permanently added '10.128.0.2' (ED25519) to the list of known hosts. execve("./syz-executor975165473", ["./syz-executor975165473"], 0x7ffc8ec75d60 /* 10 vars */) = 0 brk(NULL) = 0x55555718b000 brk(0x55555718bd00) = 0x55555718bd00 arch_prctl(ARCH_SET_FS, 0x55555718b380) = 0 set_tid_address(0x55555718b650) = 5068 set_robust_list(0x55555718b660, 24) = 0 rseq(0x55555718bca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor975165473", 4096) = 27 getrandom("\xb5\xe6\x3f\xdc\x51\xb4\x9c\xbb", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55555718bd00 brk(0x5555571acd00) = 0x5555571acd00 brk(0x5555571ad000) = 0x5555571ad000 mprotect(0x7f692caf0000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f692463f000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 4194304) = 4194304 munmap(0x7f692463f000, 138412032) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 mkdir("./file0", 0777) = 0 [ 73.995212][ T5068] loop0: detected capacity change from 0 to 8192 [ 74.018443][ T5068] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 74.031563][ T5068] REISERFS (device loop0): found reiserfs format "3.6" with non-standard journal [ 74.041669][ T5068] REISERFS (device loop0): using ordered data mode [ 74.048247][ T5068] reiserfs: using flush barriers [ 74.059380][ T5068] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 74.076048][ T5068] REISERFS (device loop0): checking transaction log (loop0) [ 74.086097][ T5068] REISERFS (device loop0): Using tea hash to sort names mount("/dev/loop0", "./file0", "reiserfs", 0, "") = 0 openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 ioctl(3, FS_IOC_SETVERSION, 0) = -1 EFAULT (Bad address) [ 74.094645][ T5068] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. [ 74.118880][ T5068] [ 74.121412][ T5068] ====================================================== [ 74.128523][ T5068] WARNING: possible circular locking dependency detected [ 74.135544][ T5068] 6.6.0-next-20231103-syzkaller #0 Not tainted [ 74.141695][ T5068] ------------------------------------------------------ [ 74.148715][ T5068] syz-executor975/5068 is trying to acquire lock: [ 74.155140][ T5068] ffff888078ea02e0 (&type->i_mutex_dir_key#6){+.+.}-{3:3}, at: vfs_setxattr+0x123/0x350 [ 74.164932][ T5068] [ 74.164932][ T5068] but task is already holding lock: [ 74.172276][ T5068] ffff8880798aa418 (sb_writers#9){.+.+}-{0:0}, at: path_setxattr+0xc3/0x1d0 [ 74.181053][ T5068] [ 74.181053][ T5068] which lock already depends on the new lock. [ 74.181053][ T5068] [ 74.191542][ T5068] [ 74.191542][ T5068] the existing dependency chain (in reverse order) is: [ 74.200533][ T5068] [ 74.200533][ T5068] -> #2 (sb_writers#9){.+.+}-{0:0}: [ 74.207908][ T5068] mnt_want_write_file+0x98/0x600 [ 74.213559][ T5068] reiserfs_ioctl+0x194/0x2e0 [ 74.218762][ T5068] __x64_sys_ioctl+0x18f/0x210 [ 74.224053][ T5068] do_syscall_64+0x3f/0x110 [ 74.229092][ T5068] entry_SYSCALL_64_after_hwframe+0x62/0x6a [ 74.235673][ T5068] [ 74.235673][ T5068] -> #1 (&sbi->lock){+.+.}-{3:3}: [ 74.242881][ T5068] __mutex_lock+0x181/0x1330 [ 74.247986][ T5068] reiserfs_write_lock+0x78/0x100 [ 74.253529][ T5068] reiserfs_lookup+0x184/0x690 [ 74.258821][ T5068] __lookup_slow+0x24d/0x450 [ 74.263930][ T5068] lookup_one_len+0x17d/0x1b0 [ 74.269126][ T5068] reiserfs_lookup_privroot+0x94/0x200 [ 74.275335][ T5068] reiserfs_fill_super+0x20f9/0x3150 [ 74.281144][ T5068] mount_bdev+0x1df/0x2d0 [ 74.285989][ T5068] legacy_get_tree+0x109/0x220 [ 74.291285][ T5068] vfs_get_tree+0x8c/0x370 [ 74.296215][ T5068] path_mount+0x148e/0x1ed0 [ 74.301231][ T5068] __x64_sys_mount+0x293/0x310 [ 74.306612][ T5068] do_syscall_64+0x3f/0x110 [ 74.311710][ T5068] entry_SYSCALL_64_after_hwframe+0x62/0x6a [ 74.318122][ T5068] [ 74.318122][ T5068] -> #0 (&type->i_mutex_dir_key#6){+.+.}-{3:3}: [ 74.326560][ T5068] __lock_acquire+0x2e22/0x5dc0 [ 74.332023][ T5068] lock_acquire+0x1b1/0x530 [ 74.337045][ T5068] down_write+0x93/0x200 [ 74.341890][ T5068] vfs_setxattr+0x123/0x350 [ 74.346908][ T5068] do_setxattr+0x142/0x170 [ 74.351858][ T5068] setxattr+0x159/0x170 [ 74.356528][ T5068] path_setxattr+0x175/0x1d0 [ 74.361634][ T5068] __x64_sys_setxattr+0xc4/0x160 [ 74.367089][ T5068] do_syscall_64+0x3f/0x110 [ 74.372111][ T5068] entry_SYSCALL_64_after_hwframe+0x62/0x6a [ 74.378521][ T5068] [ 74.378521][ T5068] other info that might help us debug this: [ 74.378521][ T5068] [ 74.388753][ T5068] Chain exists of: [ 74.388753][ T5068] &type->i_mutex_dir_key#6 --> &sbi->lock --> sb_writers#9 [ 74.388753][ T5068] [ 74.401963][ T5068] Possible unsafe locking scenario: [ 74.401963][ T5068] [ 74.409657][ T5068] CPU0 CPU1 [ 74.415182][ T5068] ---- ---- [ 74.420556][ T5068] rlock(sb_writers#9); [ 74.424798][ T5068] lock(&sbi->lock); [ 74.431378][ T5068] lock(sb_writers#9); [ 74.438049][ T5068] lock(&type->i_mutex_dir_key#6); [ 74.443327][ T5068] [ 74.443327][ T5068] *** DEADLOCK *** [ 74.443327][ T5068] [ 74.451466][ T5068] 1 lock held by syz-executor975/5068: [ 74.456918][ T5068] #0: ffff8880798aa418 (sb_writers#9){.+.+}-{0:0}, at: path_setxattr+0xc3/0x1d0 [ 74.466073][ T5068] [ 74.466073][ T5068] stack backtrace: [ 74.471950][ T5068] CPU: 1 PID: 5068 Comm: syz-executor975 Not tainted 6.6.0-next-20231103-syzkaller #0 [ 74.481488][ T5068] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 74.491893][ T5068] Call Trace: [ 74.495174][ T5068] [ 74.498228][ T5068] dump_stack_lvl+0xd9/0x1b0 [ 74.502836][ T5068] check_noncircular+0x310/0x3f0 [ 74.507791][ T5068] ? print_circular_bug+0x750/0x750 [ 74.513192][ T5068] ? __bfs+0x2f7/0x660 [ 74.517268][ T5068] ? save_trace+0xb30/0xb30 [ 74.521776][ T5068] ? mark_lock+0x105/0x1950 [ 74.526289][ T5068] __lock_acquire+0x2e22/0x5dc0 [ 74.531152][ T5068] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 74.537138][ T5068] ? usage_match+0x100/0x100 [ 74.541729][ T5068] ? __module_address+0x55/0x3b0 [ 74.546671][ T5068] lock_acquire+0x1b1/0x530 [ 74.551179][ T5068] ? vfs_setxattr+0x123/0x350 [ 74.555855][ T5068] ? lock_sync+0x180/0x180 [ 74.560272][ T5068] ? __bfs+0x2f7/0x660 [ 74.564340][ T5068] ? preempt_count_sub+0x150/0x150 [ 74.569444][ T5068] ? _raw_spin_unlock_irqrestore+0x4e/0x70 [ 74.575469][ T5068] down_write+0x93/0x200 [ 74.579909][ T5068] ? vfs_setxattr+0x123/0x350 [ 74.584602][ T5068] ? rwsem_down_write_slowpath+0x1290/0x1290 [ 74.590609][ T5068] ? find_held_lock+0x2d/0x110 [ 74.595384][ T5068] vfs_setxattr+0x123/0x350 [ 74.599891][ T5068] ? entry_SYSCALL_64_after_hwframe+0x62/0x6a [ 74.606139][ T5068] ? __vfs_setxattr_locked+0x250/0x250 [ 74.611777][ T5068] do_setxattr+0x142/0x170 [ 74.616195][ T5068] setxattr+0x159/0x170 [ 74.620350][ T5068] ? do_setxattr+0x170/0x170 [ 74.624938][ T5068] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 74.630932][ T5068] ? mnt_get_write_access+0x20c/0x300 [ 74.636310][ T5068] path_setxattr+0x175/0x1d0 [ 74.640903][ T5068] ? setxattr+0x170/0x170 [ 74.645233][ T5068] ? _raw_spin_unlock_irq+0x23/0x50 [ 74.650466][ T5068] ? lockdep_hardirqs_on+0x7c/0x100 [ 74.655667][ T5068] __x64_sys_setxattr+0xc4/0x160 [ 74.660692][ T5068] do_syscall_64+0x3f/0x110 [ 74.665287][ T5068] entry_SYSCALL_64_after_hwframe+0x62/0x6a [ 74.671179][ T5068] RIP: 0033:0x7f692ca7c609 [ 74.675588][ T5068] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 setxattr("./file0", "user.incfs.size", NULL, 0, XATTR_CREATE) = -1 EOPNOTSUPP (Operation not supported) exit_group(0) = ? +++ exited with 0 +++ [ 74.695194][ T5068] RSP: 002b:0000