./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor435981371 <...> Warning: Permanently added '10.128.10.5' (ED25519) to the list of known hosts. execve("./syz-executor435981371", ["./syz-executor435981371"], 0x7fff5ffbc340 /* 10 vars */) = 0 brk(NULL) = 0x555555d2a000 brk(0x555555d2ad00) = 0x555555d2ad00 arch_prctl(ARCH_SET_FS, 0x555555d2a380) = 0 set_tid_address(0x555555d2a650) = 5014 set_robust_list(0x555555d2a660, 24) = 0 rseq(0x555555d2aca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor435981371", 4096) = 27 getrandom("\x36\x2c\xf6\x5f\x30\x2c\x33\x5b", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555555d2ad00 brk(0x555555d4bd00) = 0x555555d4bd00 brk(0x555555d4c000) = 0x555555d4c000 mprotect(0x7fc5f37f4000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc5eb33c000 [ 53.653403][ T5014] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=5014 'syz-executor435' write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32394836) = 32394836 munmap(0x7fc5eb33c000, 32394836) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 mkdir("./bus", 0777) = 0 [ 53.925980][ T5014] loop0: detected capacity change from 0 to 63271 [ 53.937177][ T5014] F2FS-fs (loop0): Mismatch start address, segment0(512) cp_blkaddr(605) [ 53.947782][ T5014] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 53.957958][ T5014] F2FS-fs (loop0): invalid crc value [ 53.966858][ T5014] F2FS-fs (loop0): Found nat_bits in checkpoint mount("/dev/loop0", "./bus", "f2fs", MS_SYNCHRONOUS, "") = 0 openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 chdir("./bus") = 0 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 mkdirat(AT_FDCWD, "./file0", 000) = 0 openat(AT_FDCWD, "./file0", O_RDONLY) = 4 [ 53.994250][ T5014] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 54.001524][ T5014] F2FS-fs (loop0): Mounted with checkpoint version = 753bd00b [ 54.035980][ T5014] [ 54.038390][ T5014] ====================================================== [ 54.045500][ T5014] WARNING: possible circular locking dependency detected [ 54.052516][ T5014] 6.5.0-rc3-syzkaller-00275-gffabf7c73176 #0 Not tainted [ 54.059514][ T5014] ------------------------------------------------------ [ 54.067464][ T5014] syz-executor435/5014 is trying to acquire lock: [ 54.074721][ T5014] ffff888079af0528 (&fi->i_sem){+.+.}-{3:3}, at: f2fs_add_inline_entry+0x3a8/0x760 [ 54.084042][ T5014] [ 54.084042][ T5014] but task is already holding lock: [ 54.091398][ T5014] ffff888075f0a250 (&fi->i_xattr_sem){.+.+}-{3:3}, at: f2fs_add_dentry+0x9f/0x1e0 [ 54.100614][ T5014] [ 54.100614][ T5014] which lock already depends on the new lock. [ 54.100614][ T5014] [ 54.111167][ T5014] [ 54.111167][ T5014] the existing dependency chain (in reverse order) is: [ 54.120163][ T5014] [ 54.120163][ T5014] -> #1 (&fi->i_xattr_sem){.+.+}-{3:3}: [ 54.127879][ T5014] down_read+0x47/0x2f0 [ 54.132558][ T5014] f2fs_getxattr+0xb8/0x1460 [ 54.138771][ T5014] __f2fs_get_acl+0x52/0x8e0 [ 54.143959][ T5014] f2fs_init_acl+0xd7/0x9a0 [ 54.148971][ T5014] f2fs_init_inode_metadata+0x824/0x1190 [ 54.155368][ T5014] f2fs_add_regular_entry+0x904/0xe30 [ 54.161328][ T5014] f2fs_add_dentry+0xf7/0x1e0 [ 54.166509][ T5014] f2fs_do_add_link+0x21e/0x340 [ 54.171878][ T5014] f2fs_mkdir+0x2f5/0x530 [ 54.176716][ T5014] vfs_mkdir+0x29d/0x450 [ 54.181522][ T5014] do_mkdirat+0x264/0x520 [ 54.186354][ T5014] __x64_sys_mkdirat+0x89/0xa0 [ 54.191625][ T5014] do_syscall_64+0x41/0xc0 [ 54.196548][ T5014] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 54.202950][ T5014] [ 54.202950][ T5014] -> #0 (&fi->i_sem){+.+.}-{3:3}: [ 54.210233][ T5014] __lock_acquire+0x39ff/0x7f70 [ 54.215594][ T5014] lock_acquire+0x1e3/0x520 [ 54.220602][ T5014] down_write+0x3a/0x50 [ 54.225265][ T5014] f2fs_add_inline_entry+0x3a8/0x760 [ 54.231153][ T5014] f2fs_add_dentry+0xba/0x1e0 [ 54.236334][ T5014] f2fs_do_add_link+0x21e/0x340 [ 54.241690][ T5014] f2fs_symlink+0x42f/0x8f0 [ 54.246711][ T5014] vfs_symlink+0x12f/0x2a0 [ 54.251632][ T5014] do_symlinkat+0x201/0x610 [ 54.256646][ T5014] __x64_sys_symlinkat+0x99/0xb0 [ 54.262100][ T5014] do_syscall_64+0x41/0xc0 [ 54.267024][ T5014] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 54.273433][ T5014] [ 54.273433][ T5014] other info that might help us debug this: [ 54.273433][ T5014] [ 54.283648][ T5014] Possible unsafe locking scenario: [ 54.283648][ T5014] [ 54.291080][ T5014] CPU0 CPU1 [ 54.296721][ T5014] ---- ---- [ 54.302067][ T5014] rlock(&fi->i_xattr_sem); [ 54.306743][ T5014] lock(&fi->i_sem); [ 54.313228][ T5014] lock(&fi->i_xattr_sem); [ 54.320239][ T5014] lock(&fi->i_sem); [ 54.324211][ T5014] [ 54.324211][ T5014] *** DEADLOCK *** [ 54.324211][ T5014] [ 54.332423][ T5014] 4 locks held by syz-executor435/5014: [ 54.337947][ T5014] #0: ffff88807c9ec410 (sb_writers#9){.+.+}-{0:0}, at: mnt_want_write+0x3f/0x90 [ 54.347079][ T5014] #1: ffff888075f09bd8 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: filename_create+0x260/0x530 [ 54.357686][ T5014] #2: ffff8881456883b0 (&sbi->cp_rwsem){++++}-{3:3}, at: f2fs_symlink+0x357/0x8f0 [ 54.366992][ T5014] #3: ffff888075f0a250 (&fi->i_xattr_sem){.+.+}-{3:3}, at: f2fs_add_dentry+0x9f/0x1e0 [ 54.376634][ T5014] [ 54.376634][ T5014] stack backtrace: [ 54.382508][ T5014] CPU: 1 PID: 5014 Comm: syz-executor435 Not tainted 6.5.0-rc3-syzkaller-00275-gffabf7c73176 #0 [ 54.392900][ T5014] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023 [ 54.402944][ T5014] Call Trace: [ 54.406212][ T5014] [ 54.409131][ T5014] dump_stack_lvl+0x1e7/0x2d0 [ 54.413801][ T5014] ? nf_tcp_handle_invalid+0x650/0x650 [ 54.419248][ T5014] ? print_circular_bug+0x12b/0x1a0 [ 54.424529][ T5014] check_noncircular+0x375/0x4a0 [ 54.429462][ T5014] ? __kernel_text_address+0xd/0x40 [ 54.434661][ T5014] ? print_deadlock_bug+0x600/0x600 [ 54.439847][ T5014] ? lockdep_lock+0x123/0x2b0 [ 54.444519][ T5014] ? mark_lock+0x9a/0x340 [ 54.448834][ T5014] ? _find_first_zero_bit+0xd4/0x100 [ 54.454236][ T5014] __lock_acquire+0x39ff/0x7f70 [ 54.459087][ T5014] ? verify_lock_unused+0x140/0x140 [ 54.464281][ T5014] ? rcu_lock_release+0x5/0x30 [ 54.469037][ T5014] ? f2fs_inode_chksum_verify+0xd9/0x360 [ 54.474659][ T5014] lock_acquire+0x1e3/0x520 [ 54.479148][ T5014] ? f2fs_add_inline_entry+0x3a8/0x760 [ 54.484595][ T5014] ? read_lock_is_recursive+0x20/0x20 [ 54.489951][ T5014] ? __might_sleep+0xc0/0xc0 [ 54.494528][ T5014] ? pagecache_get_page+0xeb/0x220 [ 54.499624][ T5014] ? f2fs_grab_cache_page+0x38/0x360 [ 54.504898][ T5014] ? _find_next_zero_bit+0x8c/0x140 [ 54.510082][ T5014] ? _find_next_bit+0xed/0x130 [ 54.514834][ T5014] down_write+0x3a/0x50 [ 54.518979][ T5014] ? f2fs_add_inline_entry+0x3a8/0x760 [ 54.524423][ T5014] f2fs_add_inline_entry+0x3a8/0x760 [ 54.529693][ T5014] ? f2fs_setup_filename+0x145/0x360 [ 54.535248][ T5014] ? do_convert_inline_dir+0x1cb0/0x1cb0 [ 54.540894][ T5014] ? down_read+0x1b5/0x2f0 [ 54.545325][ T5014] f2fs_add_dentry+0xba/0x1e0 [ 54.550002][ T5014] f2fs_do_add_link+0x21e/0x340 [ 54.554844][ T5014] ? __might_sleep+0xc0/0xc0 [ 54.559464][ T5014] ? f2fs_add_dentry+0x1e0/0x1e0 [ 54.564402][ T5014] ? f2fs_get_link+0x110/0x110 [ 54.569158][ T5014] ? down_read+0x1b5/0x2f0 [ 54.573563][ T5014] f2fs_symlink+0x42f/0x8f0 [ 54.578060][ T5014] ? f2fs_unlink+0x900/0x900 [ 54.582654][ T5014] ? bpf_lsm_inode_symlink+0x9/0x10 [ 54.588187][ T5014] ? security_inode_symlink+0xb3/0x100 [ 54.593637][ T5014] vfs_symlink+0x12f/0x2a0 [ 54.598152][ T5014] do_symlinkat+0x201/0x610 [ 54.602644][ T5014] ? vfs_symlink+0x2a0/0x2a0 [ 54.607229][ T5014] ? getname_flags+0x1f0/0x4e0 [ 54.611982][ T5014] __x64_sys_symlinkat+0x99/0xb0 [ 54.616927][ T5014] do_syscall_64+0x41/0xc0 [ 54.621330][ T5014] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 54.627224][ T5014] RIP: 0033:0x7fc5f3779639 [ 54.631627][ T5014] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 54.651668][ T5014] RSP: 002b:00007ffc91e9a0c8 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 54.660082][ T5014] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007fc5f3779639 [ 54.668042][ T5014] RDX: 0000000020000240 RSI: 0000000000000004 RDI: 0000000020000180 [ 54.676002][ T5014] RBP: 00007fc5f37f4610 R08: 0000000000000000 R09: 00007ffc91e9a298 symlinkat("./bus", 4, "./bus") = 0 exit_group(0) = ? +++ exited with 0 +++ [ 54.683961][ T5014] R10: 0000000000000000 R11: 000000