Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.114' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 26.289597] REISERFS (device loop0): found reiserfs format "3.6" with non-standard journal [ 26.298104] REISERFS (device loop0): using ordered data mode [ 26.304119] reiserfs: using flush barriers [ 26.309160] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 26.324913] REISERFS (device loop0): checking transaction log (loop0) [ 26.332684] REISERFS (device loop0): Using rupasov hash to sort names [ 26.339880] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. [ 26.349058] [ 26.350682] ====================================================== [ 26.356981] WARNING: possible circular locking dependency detected [ 26.363283] 4.14.299-syzkaller #0 Not tainted [ 26.367760] ------------------------------------------------------ [ 26.374054] syz-executor330/7979 is trying to acquire lock: [ 26.379734] (&journal->j_mutex){+.+.}, at: [] do_journal_begin_r+0x26b/0xde0 [ 26.388556] [ 26.388556] but task is already holding lock: [ 26.394498] (sb_writers#10){.+.+}, at: [] mnt_want_write_file+0xfd/0x3b0 [ 26.402963] [ 26.402963] which lock already depends on the new lock. [ 26.402963] [ 26.411245] [ 26.411245] the existing dependency chain (in reverse order) is: [ 26.418833] [ 26.418833] -> #2 (sb_writers#10){.+.+}: [ 26.424348] __sb_start_write+0x64/0x260 [ 26.428898] mnt_want_write_file+0xfd/0x3b0 [ 26.433710] reiserfs_ioctl+0x18e/0x8b0 [ 26.438172] do_vfs_ioctl+0x75a/0xff0 [ 26.442463] SyS_ioctl+0x7f/0xb0 [ 26.446322] do_syscall_64+0x1d5/0x640 [ 26.450701] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 26.456376] [ 26.456376] -> #1 (&sbi->lock){+.+.}: [ 26.461628] __mutex_lock+0xc4/0x1310 [ 26.465921] reiserfs_write_lock_nested+0x59/0xd0 [ 26.471252] do_journal_begin_r+0x276/0xde0 [ 26.476063] journal_begin+0x162/0x3d0 [ 26.480440] reiserfs_fill_super+0x18f4/0x2990 [ 26.485513] mount_bdev+0x2b3/0x360 [ 26.489629] mount_fs+0x92/0x2a0 [ 26.493487] vfs_kern_mount.part.0+0x5b/0x470 [ 26.498473] do_mount+0xe65/0x2a30 [ 26.502504] SyS_mount+0xa8/0x120 [ 26.506447] do_syscall_64+0x1d5/0x640 [ 26.510823] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 26.516497] [ 26.516497] -> #0 (&journal->j_mutex){+.+.}: [ 26.522359] lock_acquire+0x170/0x3f0 [ 26.526649] __mutex_lock+0xc4/0x1310 [ 26.530940] do_journal_begin_r+0x26b/0xde0 [ 26.535753] journal_begin+0x162/0x3d0 [ 26.540132] reiserfs_dirty_inode+0xd9/0x200 [ 26.545030] __mark_inode_dirty+0x11e/0xf40 [ 26.549842] reiserfs_ioctl+0x6f6/0x8b0 [ 26.554305] do_vfs_ioctl+0x75a/0xff0 [ 26.558593] SyS_ioctl+0x7f/0xb0 [ 26.562462] do_syscall_64+0x1d5/0x640 [ 26.566855] entry_SYSCALL_64_after_hwframe+0x5e/0xd3 [ 26.572535] [ 26.572535] other info that might help us debug this: [ 26.572535] [ 26.580647] Chain exists of: [ 26.580647] &journal->j_mutex --> &sbi->lock --> sb_writers#10 [ 26.580647] [ 26.591111] Possible unsafe locking scenario: [ 26.591111] [ 26.597135] CPU0 CPU1 [ 26.601769] ---- ---- [ 26.606402] lock(sb_writers#10); [ 26.609912] lock(&sbi->lock); [ 26.615675] lock(sb_writers#10); [ 26.621701] lock(&journal->j_mutex); [ 26.625559] [ 26.625559] *** DEADLOCK *** [ 26.625559] [ 26.631673] 1 lock held by syz-executor330/7979: [ 26.636394] #0: (sb_writers#10){.+.+}, at: [] mnt_want_write_file+0xfd/0x3b0 [ 26.645294] [ 26.645294] stack backtrace: [ 26.649765] CPU: 0 PID: 7979 Comm: syz-executor330 Not tainted 4.14.299-syzkaller #0 [ 26.657611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 26.666933] Call Trace: [ 26.669493] dump_stack+0x1b2/0x281 [ 26.673092] print_circular_bug.constprop.0.cold+0x2d7/0x41e [ 26.678860] __lock_acquire+0x2e0e/0x3f20 [ 26.682979] ? trace_hardirqs_on+0x10/0x10 [ 26.687186] ? __read_once_size_nocheck.constprop.0+0x10/0x10 [ 26.693038] ? unwind_next_frame+0xe54/0x17d0 [ 26.697505] ? unwind_next_frame+0xe54/0x17d0 [ 26.701969] ? deref_stack_reg+0x124/0x1a0 [ 26.706171] lock_acquire+0x170/0x3f0 [ 26.709942] ? do_journal_begin_r+0x26b/0xde0 [ 26.714408] ? do_journal_begin_r+0x26b/0xde0 [ 26.718878] __mutex_lock+0xc4/0x1310 [ 26.722649] ? do_journal_begin_r+0x26b/0xde0 [ 26.727112] ? do_journal_begin_r+0x26b/0xde0 [ 26.731577] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 26.736999] ? __mutex_unlock_slowpath+0x75/0x770 [ 26.741811] ? wait_for_completion_io+0x10/0x10 [ 26.746449] ? __lock_acquire+0x2190/0x3f20 [ 26.750738] do_journal_begin_r+0x26b/0xde0 [ 26.755037] ? do_journal_end+0x4310/0x4310 [ 26.759328] ? trace_hardirqs_on+0x10/0x10 [ 26.763533] ? reiserfs_write_lock+0x75/0xf0 [ 26.767909] ? __mutex_lock+0x360/0x1310 [ 26.771940] journal_begin+0x162/0x3d0 [ 26.775797] reiserfs_dirty_inode+0xd9/0x200 [ 26.780175] ? reiserfs_unfreeze+0xa0/0xa0 [ 26.784380] ? mark_held_locks+0xa6/0xf0 [ 26.788414] ? rcu_lockdep_current_cpu_online+0xed/0x140 [ 26.793919] ? reiserfs_unfreeze+0xa0/0xa0 [ 26.798122] __mark_inode_dirty+0x11e/0xf40 [ 26.802413] reiserfs_ioctl+0x6f6/0x8b0 [ 26.806354] ? reiserfs_unpack+0x510/0x510 [ 26.810560] do_vfs_ioctl+0x75a/0xff0 [ 26.814330] ? rcu_lockdep_current_cpu_online+0xed/0x140 [ 26.819758] ? ioctl_preallocate+0x1a0/0x1a0 [ 26.824142] ? kmem_cache_free+0x23a/0x2b0 [ 26.828353] ? putname+0xcd/0x110 [ 26.831785] ? do_sys_open+0x208/0x410 [ 26.835646] ? filp_open+0x60/0x60 [ 26.839161] ? security_file_ioctl+