./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2007050328 <...> Warning: Permanently added '10.128.0.179' (ED25519) to the list of known hosts. execve("./syz-executor2007050328", ["./syz-executor2007050328"], 0x7ffdc12d3380 /* 10 vars */) = 0 brk(NULL) = 0x555556beb000 brk(0x555556bebd00) = 0x555556bebd00 arch_prctl(ARCH_SET_FS, 0x555556beb380) = 0 set_tid_address(0x555556beb650) = 5031 set_robust_list(0x555556beb660, 24) = 0 rseq(0x555556bebca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2007050328", 4096) = 28 getrandom("\xdc\x4f\xab\x84\x26\xd5\x92\x6f", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555556bebd00 brk(0x555556c0cd00) = 0x555556c0cd00 brk(0x555556c0d000) = 0x555556c0d000 mprotect(0x7f1cdaade000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1cd262d000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 4194304) = 4194304 munmap(0x7f1cd262d000, 138412032) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 55.475512][ T5031] syz-executor200[5031]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 mkdir("./file0", 0777) = 0 [ 55.527362][ T5031] loop0: detected capacity change from 0 to 8192 [ 55.540236][ T5031] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 55.553357][ T5031] REISERFS (device loop0): found reiserfs format "3.5" with non-standard journal [ 55.562821][ T5031] REISERFS (device loop0): using ordered data mode [ 55.569395][ T5031] reiserfs: using flush barriers mount("/dev/loop0", "./file0", "reiserfs", MS_RDONLY|MS_DIRSYNC|MS_REC|MS_SILENT|MS_RELATIME|MS_STRICTATIME, "") = 0 openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 chdir("./file0") = 0 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 mkdir(".", 0777) = -1 EEXIST (File exists) [ 55.575651][ T5031] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 55.592461][ T5031] REISERFS (device loop0): checking transaction log (loop0) [ 55.602270][ T5031] REISERFS (device loop0): Using r5 hash to sort names [ 55.618563][ T5031] reiserfs: enabling write barrier flush mode mount(NULL, ".", 0x200000c0, MS_NODEV|MS_NOEXEC|MS_REMOUNT|MS_DIRSYNC|MS_NOATIME|MS_NODIRATIME|MS_SILENT|MS_UNBINDABLE|MS_PRIVATE|MS_RELATIME|MS_I_VERSION|MS_STRICTATIME, "") = 0 openat(AT_FDCWD, ".", O_RDONLY|O_DIRECTORY) = 4 chdir(".") = 0 openat(AT_FDCWD, ".", O_RDONLY) = 5 ioctl(5, FS_IOC_SETVERSION, 0) = -1 EFAULT (Bad address) [ 55.632012][ T5031] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. [ 55.648328][ T5031] [ 55.650675][ T5031] ====================================================== [ 55.657680][ T5031] WARNING: possible circular locking dependency detected [ 55.664702][ T5031] 6.6.0-rc5-syzkaller-00055-g1c8b86a3799f #0 Not tainted [ 55.671719][ T5031] ------------------------------------------------------ [ 55.678715][ T5031] syz-executor200/5031 is trying to acquire lock: [ 55.685102][ T5031] ffff88814af56090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock+0x7a/0xd0 [ 55.694059][ T5031] [ 55.694059][ T5031] but task is already holding lock: [ 55.701399][ T5031] ffff8880793702e0 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: do_unlinkat+0x26a/0x950 [ 55.711211][ T5031] [ 55.711211][ T5031] which lock already depends on the new lock. [ 55.711211][ T5031] [ 55.721588][ T5031] [ 55.721588][ T5031] the existing dependency chain (in reverse order) is: [ 55.730577][ T5031] [ 55.730577][ T5031] -> #2 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}: [ 55.739162][ T5031] down_write_nested+0x3d/0x50 [ 55.744426][ T5031] do_unlinkat+0x26a/0x950 [ 55.749361][ T5031] __x64_sys_unlinkat+0xce/0xf0 [ 55.754710][ T5031] do_syscall_64+0x41/0xc0 [ 55.759629][ T5031] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 55.766031][ T5031] [ 55.766031][ T5031] -> #1 (sb_writers#9){.+.+}-{0:0}: [ 55.773407][ T5031] sb_start_write+0x4d/0x1c0 [ 55.778506][ T5031] mnt_want_write_file+0x61/0x200 [ 55.784034][ T5031] reiserfs_ioctl+0x178/0x2f0 [ 55.789220][ T5031] __se_sys_ioctl+0xf8/0x170 [ 55.794319][ T5031] do_syscall_64+0x41/0xc0 [ 55.799241][ T5031] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 55.805639][ T5031] [ 55.805639][ T5031] -> #0 (&sbi->lock){+.+.}-{3:3}: [ 55.812835][ T5031] __lock_acquire+0x39ff/0x7f70 [ 55.818194][ T5031] lock_acquire+0x1e3/0x520 [ 55.823200][ T5031] __mutex_lock+0x136/0xd60 [ 55.828213][ T5031] reiserfs_write_lock+0x7a/0xd0 [ 55.833661][ T5031] reiserfs_lookup+0x162/0x580 [ 55.838933][ T5031] lookup_one_qstr_excl+0x11b/0x250 [ 55.844639][ T5031] do_unlinkat+0x298/0x950 [ 55.849562][ T5031] __x64_sys_unlinkat+0xce/0xf0 [ 55.854920][ T5031] do_syscall_64+0x41/0xc0 [ 55.859843][ T5031] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 55.866256][ T5031] [ 55.866256][ T5031] other info that might help us debug this: [ 55.866256][ T5031] [ 55.876468][ T5031] Chain exists of: [ 55.876468][ T5031] &sbi->lock --> sb_writers#9 --> &type->i_mutex_dir_key#6/1 [ 55.876468][ T5031] [ 55.889762][ T5031] Possible unsafe locking scenario: [ 55.889762][ T5031] [ 55.897193][ T5031] CPU0 CPU1 [ 55.902544][ T5031] ---- ---- [ 55.907893][ T5031] lock(&type->i_mutex_dir_key#6/1); [ 55.913259][ T5031] lock(sb_writers#9); [ 55.919924][ T5031] lock(&type->i_mutex_dir_key#6/1); [ 55.927816][ T5031] lock(&sbi->lock); [ 55.931790][ T5031] [ 55.931790][ T5031] *** DEADLOCK *** [ 55.931790][ T5031] [ 55.939916][ T5031] 2 locks held by syz-executor200/5031: [ 55.945442][ T5031] #0: ffff88801fb36410 (sb_writers#9){.+.+}-{0:0}, at: mnt_want_write+0x3f/0x90 [ 55.954579][ T5031] #1: ffff8880793702e0 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: do_unlinkat+0x26a/0x950 [ 55.964857][ T5031] [ 55.964857][ T5031] stack backtrace: [ 55.970738][ T5031] CPU: 0 PID: 5031 Comm: syz-executor200 Not tainted 6.6.0-rc5-syzkaller-00055-g1c8b86a3799f #0 [ 55.981142][ T5031] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 [ 55.991183][ T5031] Call Trace: [ 55.994449][ T5031] [ 55.997366][ T5031] dump_stack_lvl+0x1e7/0x2d0 [ 56.002034][ T5031] ? nf_tcp_handle_invalid+0x650/0x650 [ 56.007486][ T5031] ? print_circular_bug+0x12b/0x1a0 [ 56.012676][ T5031] check_noncircular+0x375/0x4a0 [ 56.017607][ T5031] ? print_deadlock_bug+0x600/0x600 [ 56.022813][ T5031] ? lockdep_lock+0x123/0x2b0 [ 56.027499][ T5031] ? mark_lock+0x9a/0x340 [ 56.031831][ T5031] ? _find_first_zero_bit+0xd4/0x100 [ 56.037117][ T5031] __lock_acquire+0x39ff/0x7f70 [ 56.041962][ T5031] ? kernel_text_address+0xa3/0xe0 [ 56.047067][ T5031] ? entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 56.053122][ T5031] ? arch_stack_walk+0x162/0x1a0 [ 56.058045][ T5031] ? verify_lock_unused+0x140/0x140 [ 56.063240][ T5031] ? stack_trace_save+0x117/0x1c0 [ 56.068258][ T5031] ? stack_trace_snprint+0xf0/0xf0 [ 56.073362][ T5031] ? check_noncircular+0x205/0x4a0 [ 56.078461][ T5031] ? print_deadlock_bug+0x600/0x600 [ 56.083646][ T5031] ? lockdep_unlock+0x169/0x300 [ 56.088484][ T5031] ? lockdep_lock+0x2b0/0x2b0 [ 56.093145][ T5031] lock_acquire+0x1e3/0x520 [ 56.097634][ T5031] ? reiserfs_write_lock+0x7a/0xd0 [ 56.102740][ T5031] ? read_lock_is_recursive+0x20/0x20 [ 56.108101][ T5031] ? __might_sleep+0xc0/0xc0 [ 56.112687][ T5031] __mutex_lock+0x136/0xd60 [ 56.117178][ T5031] ? reiserfs_write_lock+0x7a/0xd0 [ 56.122282][ T5031] ? do_syscall_64+0x41/0xc0 [ 56.126859][ T5031] ? reiserfs_write_lock+0x7a/0xd0 [ 56.131962][ T5031] ? mutex_lock_nested+0x20/0x20 [ 56.136891][ T5031] reiserfs_write_lock+0x7a/0xd0 [ 56.141818][ T5031] reiserfs_lookup+0x162/0x580 [ 56.146572][ T5031] ? reiserfs_init_priv_inode+0x150/0x150 [ 56.152304][ T5031] ? __lock_acquire+0x7f70/0x7f70 [ 56.157336][ T5031] ? do_raw_spin_lock+0x14d/0x3a0 [ 56.162365][ T5031] ? _raw_spin_unlock+0x28/0x40 [ 56.167221][ T5031] ? d_alloc+0x198/0x1d0 [ 56.171458][ T5031] lookup_one_qstr_excl+0x11b/0x250 [ 56.176650][ T5031] do_unlinkat+0x298/0x950 [ 56.181058][ T5031] ? fsnotify_link_count+0xf0/0xf0 [ 56.186163][ T5031] ? strncpy_from_user+0x1a5/0x2e0 [ 56.191271][ T5031] ? syscall_enter_from_user_mode+0x32/0x230 [ 56.197243][ T5031] __x64_sys_unlinkat+0xce/0xf0 [ 56.202082][ T5031] do_syscall_64+0x41/0xc0 [ 56.206486][ T5031] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 56.212369][ T5031] RIP: 0033:0x7f1cdaa6a779 [ 56.216782][ T5031] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 56.236460][ T5031] RSP: 002b:00007fff7b55afd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000107 [ 56.244862][ T5031] RAX: ffffffffffffffda RBX: 00007fff7b55b1a8 RCX: 00007f1cdaa6a779 [ 56.252820][ T5031] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000005 [ 56.260778][ T5031] RBP: 00007f1cdaade610 R08: 00007fff7b55b1a8 R09: 00007fff7b55b1a8 [ 56.268736][ T5031] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 56.276693][ T5031] R13: 00007fff7b55b198 R14: 0000000000000001 R15: 0000000000000001 unlinkat(5, "./file0", 0) = -1 ENOENT (No such file or directory) exit_group(0) = ? +++ exited with 0 +++ [ 56.