./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3431621559 <...> Warning: Permanently added '10.128.0.107' (ED25519) to the list of known hosts. execve("./syz-executor3431621559", ["./syz-executor3431621559"], 0x7ffd7d2e7bb0 /* 10 vars */) = 0 brk(NULL) = 0x555579b8e000 brk(0x555579b8ed00) = 0x555579b8ed00 arch_prctl(ARCH_SET_FS, 0x555579b8e380) = 0 set_tid_address(0x555579b8e650) = 5074 set_robust_list(0x555579b8e660, 24) = 0 rseq(0x555579b8eca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3431621559", 4096) = 28 getrandom("\x3e\xb4\x19\xd9\x33\xd7\xb5\x37", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555579b8ed00 brk(0x555579bafd00) = 0x555579bafd00 brk(0x555579bb0000) = 0x555579bb0000 mprotect(0x7f72e516c000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f72dcc00000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 munmap(0x7f72dcc00000, 138412032) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 close(4) = 0 mkdir("./bus", 0777) = 0 mount("/dev/loop0", "./bus", "hfsplus", MS_SYNCHRONOUS|MS_RELATIME|MS_I_VERSION|MS_LAZYTIME, "force") = 0 openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 chdir("./bus") = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [ 76.277388][ T5074] loop0: detected capacity change from 0 to 1024 creat("./bus", 000) = 4 openat(AT_FDCWD, "./file0", O_RDONLY) = 5 unlinkat(5, "./file0", 0) = 0 creat("./file2aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 000) = 6 [ 76.381037][ T5074] [ 76.383396][ T5074] ====================================================== [ 76.390427][ T5074] WARNING: possible circular locking dependency detected [ 76.397432][ T5074] 6.9.0-rc5-syzkaller-00036-g9d1ddab261f3 #0 Not tainted [ 76.404445][ T5074] ------------------------------------------------------ [ 76.411465][ T5074] syz-executor343/5074 is trying to acquire lock: [ 76.417869][ T5074] ffff8880482187c8 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}, at: hfsplus_file_extend+0x21b/0x1b70 [ 76.428944][ T5074] [ 76.428944][ T5074] but task is already holding lock: [ 76.436300][ T5074] ffff88807dadc0b0 (&tree->tree_lock){+.+.}-{3:3}, at: hfsplus_find_init+0x14a/0x1c0 [ 76.445796][ T5074] [ 76.445796][ T5074] which lock already depends on the new lock. [ 76.445796][ T5074] [ 76.456196][ T5074] [ 76.456196][ T5074] the existing dependency chain (in reverse order) is: [ 76.465214][ T5074] [ 76.465214][ T5074] -> #1 (&tree->tree_lock){+.+.}-{3:3}: [ 76.472955][ T5074] lock_acquire+0x1ed/0x550 [ 76.477985][ T5074] __mutex_lock+0x136/0xd70 [ 76.483023][ T5074] hfsplus_file_truncate+0x811/0xb50 [ 76.488832][ T5074] hfsplus_delete_inode+0x174/0x220 [ 76.494562][ T5074] hfsplus_unlink+0x512/0x790 [ 76.499787][ T5074] vfs_unlink+0x365/0x600 [ 76.504644][ T5074] do_unlinkat+0x4ae/0x830 [ 76.509599][ T5074] __x64_sys_unlinkat+0xce/0xf0 [ 76.514977][ T5074] do_syscall_64+0xf5/0x240 [ 76.520013][ T5074] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.526434][ T5074] [ 76.526434][ T5074] -> #0 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}: [ 76.535477][ T5074] validate_chain+0x18cb/0x58e0 [ 76.540870][ T5074] __lock_acquire+0x1346/0x1fd0 [ 76.546263][ T5074] lock_acquire+0x1ed/0x550 [ 76.551296][ T5074] __mutex_lock+0x136/0xd70 [ 76.556321][ T5074] hfsplus_file_extend+0x21b/0x1b70 [ 76.562043][ T5074] hfsplus_bmap_reserve+0x105/0x4e0 [ 76.567766][ T5074] hfsplus_rename_cat+0x1d0/0x1050 [ 76.573403][ T5074] hfsplus_rename+0x12e/0x1c0 [ 76.578602][ T5074] vfs_rename+0xbdb/0xf00 [ 76.583459][ T5074] do_renameat2+0xd94/0x13f0 [ 76.588577][ T5074] __x64_sys_rename+0x86/0xa0 [ 76.593782][ T5074] do_syscall_64+0xf5/0x240 [ 76.598820][ T5074] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.605239][ T5074] [ 76.605239][ T5074] other info that might help us debug this: [ 76.605239][ T5074] [ 76.615485][ T5074] Possible unsafe locking scenario: [ 76.615485][ T5074] [ 76.622931][ T5074] CPU0 CPU1 [ 76.628303][ T5074] ---- ---- [ 76.633770][ T5074] lock(&tree->tree_lock); [ 76.638301][ T5074] lock(&HFSPLUS_I(inode)->extents_lock); [ 76.646717][ T5074] lock(&tree->tree_lock); [ 76.653770][ T5074] lock(&HFSPLUS_I(inode)->extents_lock); [ 76.659588][ T5074] [ 76.659588][ T5074] *** DEADLOCK *** [ 76.659588][ T5074] [ 76.667738][ T5074] 5 locks held by syz-executor343/5074: [ 76.673285][ T5074] #0: ffff88807dad8420 (sb_writers#9){.+.+}-{0:0}, at: mnt_want_write+0x3f/0x90 [ 76.682470][ T5074] #1: ffff888048219e00 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: do_renameat2+0x62c/0x13f0 [ 76.692958][ T5074] #2: ffff88804821ab80 (&sb->s_type->i_mutex_key#14){+.+.}-{3:3}, at: lock_two_nondirectories+0xe1/0x170 [ 76.704385][ T5074] #3: ffff88804821bfc0 (&sb->s_type->i_mutex_key#14/4){+.+.}-{3:3}, at: vfs_rename+0x6a2/0xf00 [ 76.714946][ T5074] #4: ffff88807dadc0b0 (&tree->tree_lock){+.+.}-{3:3}, at: hfsplus_find_init+0x14a/0x1c0 [ 76.724902][ T5074] [ 76.724902][ T5074] stack backtrace: [ 76.730808][ T5074] CPU: 1 PID: 5074 Comm: syz-executor343 Not tainted 6.9.0-rc5-syzkaller-00036-g9d1ddab261f3 #0 [ 76.741262][ T5074] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 76.751340][ T5074] Call Trace: [ 76.754625][ T5074] [ 76.757564][ T5074] dump_stack_lvl+0x241/0x360 [ 76.762266][ T5074] ? __pfx_dump_stack_lvl+0x10/0x10 [ 76.767497][ T5074] ? print_circular_bug+0x130/0x1a0 [ 76.772717][ T5074] check_noncircular+0x36a/0x4a0 [ 76.777668][ T5074] ? __read_once_word_nocheck+0x9/0x20 [ 76.783161][ T5074] ? __pfx_check_noncircular+0x10/0x10 [ 76.788639][ T5074] ? lockdep_lock+0x123/0x2b0 [ 76.793335][ T5074] ? is_bpf_text_address+0x28d/0x2b0 [ 76.798642][ T5074] ? is_bpf_text_address+0x26/0x2b0 [ 76.803880][ T5074] ? _find_first_zero_bit+0xd4/0x100 [ 76.809288][ T5074] validate_chain+0x18cb/0x58e0 [ 76.814237][ T5074] ? check_noncircular+0x259/0x4a0 [ 76.819377][ T5074] ? __pfx_validate_chain+0x10/0x10 [ 76.824610][ T5074] ? __pfx_check_noncircular+0x10/0x10 [ 76.830094][ T5074] ? lockdep_unlock+0x16a/0x300 [ 76.834957][ T5074] ? __pfx_lockdep_unlock+0x10/0x10 [ 76.840347][ T5074] ? add_lock_to_list+0x1de/0x2e0 [ 76.845389][ T5074] ? look_up_lock_class+0x77/0x160 [ 76.850517][ T5074] ? register_lock_class+0x102/0x980 [ 76.855832][ T5074] ? validate_chain+0x15a2/0x58e0 [ 76.860990][ T5074] ? __pfx_register_lock_class+0x10/0x10 [ 76.866637][ T5074] ? mark_lock+0x9a/0x350 [ 76.870982][ T5074] __lock_acquire+0x1346/0x1fd0 [ 76.875864][ T5074] lock_acquire+0x1ed/0x550 [ 76.880465][ T5074] ? hfsplus_file_extend+0x21b/0x1b70 [ 76.885842][ T5074] ? __pfx_lock_acquire+0x10/0x10 [ 76.890902][ T5074] ? __pfx___might_resched+0x10/0x10 [ 76.896219][ T5074] __mutex_lock+0x136/0xd70 [ 76.900751][ T5074] ? hfsplus_file_extend+0x21b/0x1b70 [ 76.906161][ T5074] ? hfsplus_file_extend+0x21b/0x1b70 [ 76.911582][ T5074] ? __pfx___mutex_lock+0x10/0x10 [ 76.916624][ T5074] hfsplus_file_extend+0x21b/0x1b70 [ 76.921853][ T5074] ? __pfx_hfsplus_file_extend+0x10/0x10 [ 76.927637][ T5074] ? rcu_is_watching+0x15/0xb0 [ 76.932447][ T5074] ? trace_contention_end+0x3c/0x120 [ 76.937757][ T5074] ? __mutex_lock+0x2ef/0xd70 [ 76.942453][ T5074] ? hfsplus_find_init+0x14a/0x1c0 [ 76.947613][ T5074] ? __pfx___mutex_lock+0x10/0x10 [ 76.952648][ T5074] ? rcu_is_watching+0x15/0xb0 [ 76.957421][ T5074] hfsplus_bmap_reserve+0x105/0x4e0 [ 76.962637][ T5074] hfsplus_rename_cat+0x1d0/0x1050 [ 76.967756][ T5074] ? number+0xb5e/0xf90 [ 76.971948][ T5074] ? __pfx_hfsplus_rename_cat+0x10/0x10 [ 76.977996][ T5074] ? __pfx_hfsplus_unlink+0x10/0x10 [ 76.983205][ T5074] ? __pfx___down_write_common+0x10/0x10 [ 76.988855][ T5074] ? __pfx___down_write_common+0x10/0x10 [ 76.994501][ T5074] hfsplus_rename+0x12e/0x1c0 [ 76.999186][ T5074] ? __pfx_hfsplus_rename+0x10/0x10 [ 77.004398][ T5074] vfs_rename+0xbdb/0xf00 [ 77.008745][ T5074] ? __pfx_vfs_rename+0x10/0x10 [ 77.013610][ T5074] ? security_path_rename+0x18b/0x220 [ 77.018988][ T5074] do_renameat2+0xd94/0x13f0 [ 77.023608][ T5074] ? __pfx_do_renameat2+0x10/0x10 [ 77.028818][ T5074] ? __virt_addr_valid+0x183/0x520 [ 77.033947][ T5074] ? __virt_addr_valid+0x183/0x520 [ 77.039080][ T5074] ? __check_object_size+0x4bc/0xa00 [ 77.044389][ T5074] ? getname_flags+0x1fe/0x4f0 [ 77.049189][ T5074] __x64_sys_rename+0x86/0xa0 [ 77.053905][ T5074] do_syscall_64+0xf5/0x240 [ 77.058430][ T5074] ? clear_bhb_loop+0x35/0x90 [ 77.063157][ T5074] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.069153][ T5074] RIP: 0033:0x7f72e50f8839 [ 77.073586][ T5074] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 77.093205][ T5074] RSP: 002b:00007ffd059a1fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000052 [ 77.101632][ T5074] RAX: ffffffffffffffda RBX: 00007ffd059a2188 RCX: 00007f72e50f8839 [ 77.109608][ T5074] RDX: 00007f72e50f8839 RSI: 0000000020000300 RDI: 0000000020000b00 [ 77.117597][ T5074] RBP: 00007f72e516c610 R08: 00007ffd059a2188 R09: 00007ffd059a2188 [ 77.125585][ T5074] R10: 00007ffd059a2188 R11: 0000000000000246 R12: 0000000000000001 rename("./bus", "./file2aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa") = 0 exit_group(0) = ? +++ exited with 0 +++ [ 77.133567]