./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3626985173 <...> Warning: Permanently added '10.128.1.45' (ED25519) to the list of known hosts. execve("./syz-executor3626985173", ["./syz-executor3626985173"], 0x7ffd7b8e7750 /* 10 vars */) = 0 brk(NULL) = 0x5555566c5000 brk(0x5555566c5d00) = 0x5555566c5d00 arch_prctl(ARCH_SET_FS, 0x5555566c5380) = 0 set_tid_address(0x5555566c5650) = 5071 set_robust_list(0x5555566c5660, 24) = 0 rseq(0x5555566c5ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3626985173", 4096) = 28 getrandom("\xae\xfe\x31\x6f\xe9\xb3\x9b\x73", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555566c5d00 brk(0x5555566e6d00) = 0x5555566e6d00 brk(0x5555566e7000) = 0x5555566e7000 mprotect(0x7f61df4ee000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f61d703d000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 4194304) = 4194304 munmap(0x7f61d703d000, 138412032) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 mkdir("./file1", 0777) = 0 [ 58.812798][ T5071] loop0: detected capacity change from 0 to 8192 [ 58.825294][ T5071] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 58.838409][ T5071] REISERFS (device loop0): found reiserfs format "3.5" with non-standard journal [ 58.847688][ T5071] REISERFS (device loop0): using ordered data mode [ 58.854231][ T5071] reiserfs: using flush barriers mount("/dev/loop0", "./file1", "reiserfs", 0, "") = 0 openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 chdir("./file1") = 0 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 creat("./bus", 000) = 4 [ 58.860584][ T5071] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 16414, max trans age 30 [ 58.877478][ T5071] REISERFS (device loop0): checking transaction log (loop0) [ 58.886965][ T5071] REISERFS (device loop0): Using r5 hash to sort names [ 58.893966][ T5071] REISERFS (device loop0): using 3.5.x disk format [ 58.901334][ T5071] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. [ 58.922931][ T5071] [ 58.925267][ T5071] ====================================================== [ 58.932274][ T5071] WARNING: possible circular locking dependency detected [ 58.939388][ T5071] 6.7.0-rc7-syzkaller-00016-gf5837722ffec #0 Not tainted [ 58.946409][ T5071] ------------------------------------------------------ [ 58.955350][ T5071] syz-executor362/5071 is trying to acquire lock: [ 58.961763][ T5071] ffff88807982e418 (sb_writers#9){.+.+}-{0:0}, at: reiserfs_ioctl+0x194/0x2e0 [ 58.970636][ T5071] [ 58.970636][ T5071] but task is already holding lock: [ 58.977974][ T5071] ffff888017bc0090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock+0x79/0x100 [ 58.987000][ T5071] [ 58.987000][ T5071] which lock already depends on the new lock. [ 58.987000][ T5071] [ 58.997377][ T5071] [ 58.997377][ T5071] the existing dependency chain (in reverse order) is: [ 59.006363][ T5071] [ 59.006363][ T5071] -> #2 (&sbi->lock){+.+.}-{3:3}: [ 59.013542][ T5071] __mutex_lock+0x175/0x9d0 [ 59.018644][ T5071] reiserfs_write_lock+0x79/0x100 [ 59.024180][ T5071] reiserfs_lookup+0x184/0x690 [ 59.029469][ T5071] __lookup_slow+0x24d/0x450 [ 59.034560][ T5071] lookup_one_len+0x17d/0x1b0 [ 59.039735][ T5071] reiserfs_lookup_privroot+0x94/0x200 [ 59.045688][ T5071] reiserfs_fill_super+0x20f9/0x3160 [ 59.051472][ T5071] mount_bdev+0x1f3/0x2e0 [ 59.056319][ T5071] legacy_get_tree+0x109/0x220 [ 59.064539][ T5071] vfs_get_tree+0x8c/0x370 [ 59.069464][ T5071] path_mount+0x1492/0x1ed0 [ 59.074580][ T5071] __x64_sys_mount+0x293/0x310 [ 59.079869][ T5071] do_syscall_64+0x40/0x110 [ 59.084894][ T5071] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 59.091303][ T5071] [ 59.091303][ T5071] -> #1 (&type->i_mutex_dir_key#6){+.+.}-{3:3}: [ 59.099717][ T5071] down_write+0x3a/0x50 [ 59.104383][ T5071] path_openat+0x8bd/0x2c50 [ 59.109487][ T5071] do_filp_open+0x1de/0x430 [ 59.114513][ T5071] do_sys_openat2+0x176/0x1e0 [ 59.119713][ T5071] __x64_sys_creat+0xcd/0x120 [ 59.124905][ T5071] do_syscall_64+0x40/0x110 [ 59.129923][ T5071] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 59.136324][ T5071] [ 59.136324][ T5071] -> #0 (sb_writers#9){.+.+}-{0:0}: [ 59.143714][ T5071] __lock_acquire+0x2433/0x3b20 [ 59.149090][ T5071] lock_acquire+0x1ae/0x520 [ 59.154108][ T5071] mnt_want_write_file+0x98/0x600 [ 59.159639][ T5071] reiserfs_ioctl+0x194/0x2e0 [ 59.165176][ T5071] __x64_sys_ioctl+0x18f/0x210 [ 59.170716][ T5071] do_syscall_64+0x40/0x110 [ 59.175732][ T5071] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 59.182164][ T5071] [ 59.182164][ T5071] other info that might help us debug this: [ 59.182164][ T5071] [ 59.192664][ T5071] Chain exists of: [ 59.192664][ T5071] sb_writers#9 --> &type->i_mutex_dir_key#6 --> &sbi->lock [ 59.192664][ T5071] [ 59.205780][ T5071] Possible unsafe locking scenario: [ 59.205780][ T5071] [ 59.213558][ T5071] CPU0 CPU1 [ 59.218906][ T5071] ---- ---- [ 59.224249][ T5071] lock(&sbi->lock); [ 59.228212][ T5071] lock(&type->i_mutex_dir_key#6); [ 59.235920][ T5071] lock(&sbi->lock); [ 59.242405][ T5071] rlock(sb_writers#9); [ 59.246636][ T5071] [ 59.246636][ T5071] *** DEADLOCK *** [ 59.246636][ T5071] [ 59.254757][ T5071] 1 lock held by syz-executor362/5071: [ 59.260191][ T5071] #0: ffff888017bc0090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock+0x79/0x100 [ 59.269692][ T5071] [ 59.269692][ T5071] stack backtrace: [ 59.275560][ T5071] CPU: 0 PID: 5071 Comm: syz-executor362 Not tainted 6.7.0-rc7-syzkaller-00016-gf5837722ffec #0 [ 59.285954][ T5071] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 59.296102][ T5071] Call Trace: [ 59.299371][ T5071] [ 59.302304][ T5071] dump_stack_lvl+0xd9/0x1b0 [ 59.306888][ T5071] check_noncircular+0x317/0x400 [ 59.311824][ T5071] ? print_circular_bug+0x5c0/0x5c0 [ 59.317016][ T5071] ? lockdep_lock+0xc6/0x200 [ 59.321598][ T5071] ? hlock_class+0x130/0x130 [ 59.326185][ T5071] __lock_acquire+0x2433/0x3b20 [ 59.331036][ T5071] ? lockdep_hardirqs_on_prepare+0x420/0x420 [ 59.337008][ T5071] ? rcu_is_watching+0x12/0xb0 [ 59.341760][ T5071] lock_acquire+0x1ae/0x520 [ 59.346256][ T5071] ? reiserfs_ioctl+0x194/0x2e0 [ 59.351111][ T5071] ? lock_sync+0x190/0x190 [ 59.355522][ T5071] ? make_vfsuid+0x108/0x160 [ 59.360112][ T5071] ? preempt_count_sub+0x160/0x160 [ 59.365213][ T5071] mnt_want_write_file+0x98/0x600 [ 59.370229][ T5071] ? reiserfs_ioctl+0x194/0x2e0 [ 59.375079][ T5071] reiserfs_ioctl+0x194/0x2e0 [ 59.379751][ T5071] ? reiserfs_fileattr_set+0x4f0/0x4f0 [ 59.385206][ T5071] __x64_sys_ioctl+0x18f/0x210 [ 59.389969][ T5071] do_syscall_64+0x40/0x110 [ 59.394988][ T5071] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 59.400879][ T5071] RIP: 0033:0x7f61df47a5f9 [ 59.405285][ T5071] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 59.424883][ T5071] RSP: 002b:00007ffd76e9ecf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 59.433281][ T5071] RAX: ffffffffffffffda RBX: 00007ffd76e9eec8 RCX: 00007f61df47a5f9 [ 59.441239][ T5071] RDX: 0000000000000000 RSI: 0000000040087602 RDI: 0000000000000004 [ 59.449289][ T5071] RBP: 00007f61df4ee610 R08: 0000000000000000 R09: 00007ffd76e9eec8 [ 59.457244][ T5071] R10: 0000000000001112 R11: 0000000000000246 R12: 0000000000000001 [ 59.465198][ T5071] R13: 00007ffd76e9eeb8 R14: 0000000000000001 R15: 0000000000000001 ioctl(4, FS_IOC_SETVERSION, 0) = -1 EFAULT (Bad address) exit_group(0) = ? +++ exited with 0 +++ [ 59.473163][ T5071]