./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2453581320 <...> Warning: Permanently added '10.128.0.57' (ED25519) to the list of known hosts. execve("./syz-executor2453581320", ["./syz-executor2453581320"], 0x7fff3b635420 /* 10 vars */) = 0 brk(NULL) = 0x5555874a6000 brk(0x5555874a6d00) = 0x5555874a6d00 arch_prctl(ARCH_SET_FS, 0x5555874a6380) = 0 set_tid_address(0x5555874a6650) = 5836 set_robust_list(0x5555874a6660, 24) = 0 rseq(0x5555874a6ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2453581320", 4096) = 28 getrandom("\x95\x5e\xb8\xf0\x25\x22\x03\xc1", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555874a6d00 brk(0x5555874c7d00) = 0x5555874c7d00 brk(0x5555874c8000) = 0x5555874c8000 mprotect(0x7f6436bcb000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 write(1, "executing program\n", 18executing program ) = 18 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f642e600000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 munmap(0x7f642e600000, 138412032) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 close(4) = 0 mkdir("./file0", 0777) = 0 [ 86.527520][ T5836] loop0: detected capacity change from 0 to 32768 [ 86.556903][ T5836] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop0 (7:0) scanned by syz-executor245 (5836) [ 86.586165][ T5836] BTRFS info (device loop0): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 86.597114][ T5836] BTRFS info (device loop0): using sha256 (sha256-x86_64) checksum algorithm [ 86.606935][ T5836] BTRFS info (device loop0): using free-space-tree [ 86.644730][ T5836] [ 86.647090][ T5836] ====================================================== [ 86.654117][ T5836] WARNING: possible circular locking dependency detected [ 86.661160][ T5836] 6.16.0-rc2-next-20250620-syzkaller #0 Not tainted [ 86.667758][ T5836] ------------------------------------------------------ [ 86.674789][ T5836] syz-executor245/5836 is trying to acquire lock: [ 86.681242][ T5836] ffffffff8e6e9fe8 (uuid_mutex){+.+.}-{4:4}, at: btrfs_read_chunk_tree+0xef/0x2170 [ 86.690628][ T5836] [ 86.690628][ T5836] but task is already holding lock: [ 86.697999][ T5836] ffff88823bfde0e0 (&type->s_umount_key#41/1){+.+.}-{4:4}, at: alloc_super+0x204/0x970 [ 86.707685][ T5836] [ 86.707685][ T5836] which lock already depends on the new lock. [ 86.707685][ T5836] [ 86.718093][ T5836] [ 86.718093][ T5836] the existing dependency chain (in reverse order) is: [ 86.727107][ T5836] [ 86.727107][ T5836] -> #1 (&type->s_umount_key#41/1){+.+.}-{4:4}: [ 86.735583][ T5836] lock_acquire+0x120/0x360 [ 86.740628][ T5836] down_write_nested+0x9d/0x200 [ 86.745999][ T5836] alloc_super+0x204/0x970 [ 86.750943][ T5836] sget_fc+0x329/0xa40 [ 86.755555][ T5836] btrfs_get_tree+0x4c6/0x12d0 [ 86.760842][ T5836] vfs_get_tree+0x8f/0x2b0 [ 86.765787][ T5836] do_new_mount+0x24a/0xa40 [ 86.770810][ T5836] __se_sys_mount+0x317/0x410 [ 86.776008][ T5836] do_syscall_64+0xfa/0x3b0 [ 86.781044][ T5836] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.787456][ T5836] [ 86.787456][ T5836] -> #0 (uuid_mutex){+.+.}-{4:4}: [ 86.794686][ T5836] validate_chain+0xb9b/0x2140 [ 86.800000][ T5836] __lock_acquire+0xab9/0xd20 [ 86.805196][ T5836] lock_acquire+0x120/0x360 [ 86.810235][ T5836] __mutex_lock+0x182/0xe80 [ 86.815258][ T5836] btrfs_read_chunk_tree+0xef/0x2170 [ 86.821065][ T5836] open_ctree+0x17f2/0x3a10 [ 86.826087][ T5836] btrfs_get_tree+0xc6f/0x12d0 [ 86.831372][ T5836] vfs_get_tree+0x8f/0x2b0 [ 86.836317][ T5836] do_new_mount+0x24a/0xa40 [ 86.841352][ T5836] __se_sys_mount+0x317/0x410 [ 86.846554][ T5836] do_syscall_64+0xfa/0x3b0 [ 86.851582][ T5836] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.857995][ T5836] [ 86.857995][ T5836] other info that might help us debug this: [ 86.857995][ T5836] [ 86.868226][ T5836] Possible unsafe locking scenario: [ 86.868226][ T5836] [ 86.875667][ T5836] CPU0 CPU1 [ 86.881037][ T5836] ---- ---- [ 86.886396][ T5836] lock(&type->s_umount_key#41/1); [ 86.891604][ T5836] lock(uuid_mutex); [ 86.898107][ T5836] lock(&type->s_umount_key#41/1); [ 86.905825][ T5836] lock(uuid_mutex); [ 86.909803][ T5836] [ 86.909803][ T5836] *** DEADLOCK *** [ 86.909803][ T5836] [ 86.917939][ T5836] 1 lock held by syz-executor245/5836: [ 86.923383][ T5836] #0: ffff88823bfde0e0 (&type->s_umount_key#41/1){+.+.}-{4:4}, at: alloc_super+0x204/0x970 [ 86.933490][ T5836] [ 86.933490][ T5836] stack backtrace: [ 86.939399][ T5836] CPU: 0 UID: 0 PID: 5836 Comm: syz-executor245 Not tainted 6.16.0-rc2-next-20250620-syzkaller #0 PREEMPT(full) [ 86.939418][ T5836] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 86.939434][ T5836] Call Trace: [ 86.939443][ T5836] [ 86.939451][ T5836] dump_stack_lvl+0x189/0x250 [ 86.939478][ T5836] ? __pfx_dump_stack_lvl+0x10/0x10 [ 86.939500][ T5836] ? __pfx__printk+0x10/0x10 [ 86.939517][ T5836] ? print_lock_name+0xde/0x100 [ 86.939533][ T5836] print_circular_bug+0x2ee/0x310 [ 86.939549][ T5836] check_noncircular+0x134/0x160 [ 86.939576][ T5836] validate_chain+0xb9b/0x2140 [ 86.939613][ T5836] __lock_acquire+0xab9/0xd20 [ 86.939635][ T5836] ? btrfs_read_chunk_tree+0xef/0x2170 [ 86.939651][ T5836] lock_acquire+0x120/0x360 [ 86.939670][ T5836] ? btrfs_read_chunk_tree+0xef/0x2170 [ 86.939692][ T5836] __mutex_lock+0x182/0xe80 [ 86.939707][ T5836] ? btrfs_read_chunk_tree+0xef/0x2170 [ 86.939727][ T5836] ? btrfs_read_chunk_tree+0xef/0x2170 [ 86.939744][ T5836] ? __pfx___mutex_lock+0x10/0x10 [ 86.939761][ T5836] ? rcu_is_watching+0x15/0xb0 [ 86.939783][ T5836] ? trace_kmem_cache_alloc+0x1f/0xc0 [ 86.939804][ T5836] ? btrfs_read_chunk_tree+0xcd/0x2170 [ 86.939822][ T5836] btrfs_read_chunk_tree+0xef/0x2170 [ 86.939841][ T5836] ? btrfs_root_node+0xae/0x4a0 [ 86.939862][ T5836] ? btrfs_root_node+0x459/0x4a0 [ 86.939879][ T5836] ? btrfs_root_node+0xae/0x4a0 [ 86.939897][ T5836] ? __pfx_btrfs_root_node+0x10/0x10 [ 86.939917][ T5836] ? __pfx_btrfs_read_chunk_tree+0x10/0x10 [ 86.939934][ T5836] ? load_super_root+0x2b2/0x3f0 [ 86.939952][ T5836] ? __pfx_load_super_root+0x10/0x10 [ 86.939970][ T5836] ? read_extent_buffer+0x120/0x5e0 [ 86.939986][ T5836] ? open_ctree+0x17ea/0x3a10 [ 86.940004][ T5836] open_ctree+0x17f2/0x3a10 [ 86.940020][ T5836] ? bdi_register_va+0x58d/0x740 [ 86.940036][ T5836] ? open_ctree+0xa1a/0x3a10 [ 86.940058][ T5836] ? __pfx_open_ctree+0x10/0x10 [ 86.940077][ T5836] btrfs_get_tree+0xc6f/0x12d0 [ 86.940100][ T5836] vfs_get_tree+0x8f/0x2b0 [ 86.940123][ T5836] do_new_mount+0x24a/0xa40 [ 86.940139][ T5836] __se_sys_mount+0x317/0x410 [ 86.940156][ T5836] ? __pfx___se_sys_mount+0x10/0x10 [ 86.940170][ T5836] ? rcu_is_watching+0x15/0xb0 [ 86.940205][ T5836] ? __x64_sys_mount+0x20/0xc0 [ 86.940219][ T5836] do_syscall_64+0xfa/0x3b0 [ 86.940233][ T5836] ? lockdep_hardirqs_on+0x9c/0x150 [ 86.940245][ T5836] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.940258][ T5836] ? clear_bhb_loop+0x60/0xb0 [ 86.940273][ T5836] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.940287][ T5836] RIP: 0033:0x7f6436b54bca [ 86.940304][ T5836] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 86.940320][ T5836] RSP: 002b:00007ffd68bb4e08 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5 [ 86.940334][ T5836] RAX: ffffffffffffffda RBX: 00007ffd68bb4e20 RCX: 00007f6436b54bca [ 86.940345][ T5836] RDX: 0000200000000000 RSI: 00002000000015c0 RDI: 00007ffd68bb4e20 [ 86.940355][ T5836] RBP: 0000200000000000 R08: 00007ffd68bb4e60 R09: 0000000000005598 [ 86.940364][ T5836] R10: 0000000000000000 R11: 0000000000000282 R12: 00002000000015c0 [ 86.940373][ T5836] R13: 00007ffd68bb4e60 R14: 0000000000000003 R15: 0000000000000000 [ 86.940387][ T5836] mount("/dev/loop0", "./file0", "btrfs", 0, "clear_cache,metadata_ratio=0x0000000000000000,ssd_spread,") = 0 openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_CLR_FD) = 0 [ 87.304962][ T5836] BTRFS info (device loop0): rebuilding free space tree close(4) = 0 exit_group(0) = ? +++ exited with 0 +++