./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1632810657 <...> Warning: Permanently added '10.128.1.91' (ECDSA) to the list of known hosts. execve("./syz-executor1632810657", ["./syz-executor1632810657"], 0x7ffcaa4c2a50 /* 10 vars */) = 0 brk(NULL) = 0x5555574f3000 brk(0x5555574f3c40) = 0x5555574f3c40 arch_prctl(ARCH_SET_FS, 0x5555574f3300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor1632810657", 4096) = 28 brk(0x555557514c40) = 0x555557514c40 brk(0x555557515000) = 0x555557515000 mprotect(0x7fd6365f2000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd62e138000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 4194304) = 4194304 munmap(0x7fd62e138000, 4194304) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 mkdir("./file0", 0777) = 0 syzkaller login: [ 61.679834][ T3636] loop0: detected capacity change from 0 to 8192 [ 61.690832][ T3636] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 61.704063][ T3636] REISERFS (device loop0): found reiserfs format "3.6" with non-standard journal [ 61.713302][ T3636] REISERFS (device loop0): using ordered data mode [ 61.719901][ T3636] reiserfs: using flush barriers [ 61.725783][ T3636] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 61.742266][ T3636] REISERFS (device loop0): checking transaction log (loop0) mount("/dev/loop0", "./file0", "reiserfs", 0, "") = 0 openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 chdir("./file0") = 0 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 openat(AT_FDCWD, "cpuset.effective_mems", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 openat(AT_FDCWD, "cpuset.effective_mems", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 5 dup2(4, 5) = 5 [ 61.780468][ T3636] REISERFS (device loop0): Using r5 hash to sort names [ 61.788320][ T3636] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. [ 61.808671][ T3636] [ 61.811087][ T3636] ====================================================== [ 61.818110][ T3636] WARNING: possible circular locking dependency detected [ 61.825135][ T3636] 6.1.0-rc8-syzkaller-00154-g296a7b7eb792 #0 Not tainted [ 61.832134][ T3636] ------------------------------------------------------ [ 61.839167][ T3636] syz-executor163/3636 is trying to acquire lock: [ 61.845577][ T3636] ffff8880264fc460 (sb_writers#9){.+.+}-{0:0}, at: reiserfs_ioctl+0x1a2/0x330 [ 61.854562][ T3636] [ 61.854562][ T3636] but task is already holding lock: [ 61.861918][ T3636] ffff888018227090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock+0x79/0x100 [ 61.870971][ T3636] [ 61.870971][ T3636] which lock already depends on the new lock. [ 61.870971][ T3636] [ 61.881464][ T3636] [ 61.881464][ T3636] the existing dependency chain (in reverse order) is: [ 61.890473][ T3636] [ 61.890473][ T3636] -> #2 (&sbi->lock){+.+.}-{3:3}: [ 61.897767][ T3636] __mutex_lock+0x12f/0x1360 [ 61.902973][ T3636] reiserfs_write_lock+0x79/0x100 [ 61.908522][ T3636] reiserfs_lookup+0x175/0x490 [ 61.913803][ T3636] __lookup_slow+0x24c/0x460 [ 61.918994][ T3636] lookup_one_len+0x16e/0x1a0 [ 61.924188][ T3636] reiserfs_lookup_privroot+0x96/0x290 [ 61.930159][ T3636] reiserfs_fill_super+0x20e9/0x2e90 [ 61.935965][ T3636] mount_bdev+0x351/0x410 [ 61.940813][ T3636] legacy_get_tree+0x109/0x220 [ 61.946085][ T3636] vfs_get_tree+0x8d/0x2f0 [ 61.951014][ T3636] path_mount+0x132a/0x1e20 [ 61.956039][ T3636] __x64_sys_mount+0x283/0x300 [ 61.961324][ T3636] do_syscall_64+0x39/0xb0 [ 61.966258][ T3636] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 61.972666][ T3636] [ 61.972666][ T3636] -> #1 (&type->i_mutex_dir_key#6){+.+.}-{3:3}: [ 61.981089][ T3636] down_write+0x94/0x220 [ 61.986018][ T3636] path_openat+0x930/0x2860 [ 61.991302][ T3636] do_filp_open+0x1ba/0x410 [ 61.996318][ T3636] do_sys_openat2+0x16d/0x4c0 [ 62.001533][ T3636] __x64_sys_openat+0x143/0x1f0 [ 62.006900][ T3636] do_syscall_64+0x39/0xb0 [ 62.011858][ T3636] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 62.018277][ T3636] [ 62.018277][ T3636] -> #0 (sb_writers#9){.+.+}-{0:0}: [ 62.025668][ T3636] __lock_acquire+0x2a43/0x56d0 [ 62.031042][ T3636] lock_acquire+0x1e3/0x630 [ 62.036071][ T3636] mnt_want_write_file+0x92/0x590 [ 62.041701][ T3636] reiserfs_ioctl+0x1a2/0x330 [ 62.046898][ T3636] __x64_sys_ioctl+0x197/0x210 [ 62.052183][ T3636] do_syscall_64+0x39/0xb0 [ 62.057119][ T3636] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 62.063532][ T3636] [ 62.063532][ T3636] other info that might help us debug this: [ 62.063532][ T3636] [ 62.073752][ T3636] Chain exists of: [ 62.073752][ T3636] sb_writers#9 --> &type->i_mutex_dir_key#6 --> &sbi->lock [ 62.073752][ T3636] [ 62.086876][ T3636] Possible unsafe locking scenario: [ 62.086876][ T3636] [ 62.094311][ T3636] CPU0 CPU1 [ 62.099659][ T3636] ---- ---- [ 62.105028][ T3636] lock(&sbi->lock); [ 62.109012][ T3636] lock(&type->i_mutex_dir_key#6); [ 62.116740][ T3636] lock(&sbi->lock); [ 62.123233][ T3636] lock(sb_writers#9); [ 62.127380][ T3636] [ 62.127380][ T3636] *** DEADLOCK *** [ 62.127380][ T3636] [ 62.135508][ T3636] 1 lock held by syz-executor163/3636: [ 62.141475][ T3636] #0: ffff888018227090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock+0x79/0x100 [ 62.151143][ T3636] [ 62.151143][ T3636] stack backtrace: [ 62.157112][ T3636] CPU: 1 PID: 3636 Comm: syz-executor163 Not tainted 6.1.0-rc8-syzkaller-00154-g296a7b7eb792 #0 [ 62.167513][ T3636] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 62.177647][ T3636] Call Trace: [ 62.180917][ T3636] [ 62.183923][ T3636] dump_stack_lvl+0xd1/0x138 [ 62.188520][ T3636] check_noncircular+0x25f/0x2e0 [ 62.193519][ T3636] ? print_circular_bug+0x1e0/0x1e0 [ 62.198719][ T3636] ? tomoyo_path_number_perm+0x234/0x550 [ 62.204351][ T3636] __lock_acquire+0x2a43/0x56d0 [ 62.209212][ T3636] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 62.215193][ T3636] ? rcu_read_lock_sched_held+0x3e/0x70 [ 62.220740][ T3636] lock_acquire+0x1e3/0x630 [ 62.225327][ T3636] ? reiserfs_ioctl+0x1a2/0x330 [ 62.230172][ T3636] ? lock_release+0x810/0x810 [ 62.234849][ T3636] ? find_held_lock+0x2d/0x110 [ 62.239610][ T3636] mnt_want_write_file+0x92/0x590 [ 62.244628][ T3636] ? reiserfs_ioctl+0x1a2/0x330 [ 62.249478][ T3636] reiserfs_ioctl+0x1a2/0x330 [ 62.254149][ T3636] ? reiserfs_fileattr_set+0x570/0x570 [ 62.259597][ T3636] __x64_sys_ioctl+0x197/0x210 [ 62.264351][ T3636] do_syscall_64+0x39/0xb0 [ 62.268879][ T3636] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 62.274766][ T3636] RIP: 0033:0x7fd636584ad9 [ 62.279254][ T3636] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 62.298864][ T3636] RSP: 002b:00007ffe8d904b88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 62.307275][ T3636] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fd636584ad9 [ 62.315237][ T3636] RDX: 0000000000000000 RSI: 0000000040087602 RDI: 0000000000000005 [ 62.323195][ T3636] RBP: 00007fd6365440e0 R08: 0000000000000000 R09: 0000000000000000 ioctl(5, FS_IOC_SETVERSION, 0) = -1 EFAULT (Bad address) exit_group(0) = ? +++ exited with 0 +++ [ 62.331153][ T3636