./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1779269048 <...> Warning: Permanently added '10.128.0.152' (ED25519) to the list of known hosts. execve("./syz-executor1779269048", ["./syz-executor1779269048"], 0x7fffdd6ec850 /* 10 vars */) = 0 brk(NULL) = 0x55555687a000 brk(0x55555687ad00) = 0x55555687ad00 arch_prctl(ARCH_SET_FS, 0x55555687a380) = 0 set_tid_address(0x55555687a650) = 5034 set_robust_list(0x55555687a660, 24) = 0 rseq(0x55555687aca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1779269048", 4096) = 28 getrandom("\x9d\x45\x75\x27\x4b\x30\x65\x96", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55555687ad00 brk(0x55555689bd00) = 0x55555689bd00 brk(0x55555689c000) = 0x55555689c000 mprotect(0x7fe768891000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe7603c2000 write(3, "\xeb\x52\x90\x4e\x54\x46\x53\x20\x20\x20\x20\x00\x08\x01\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x80\x00\xff\x03\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\xff\x01\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x02\x00\x00\x00\xbb\x02\x87\x1c\xc7\xbb\xb3\x5e\x00\x00\x00\x00\x0e\x1f\xbe\x71\x7c\xac\x22\xc0\x74\x0b\x56\xb4\x0e\xbb\x07\x00"..., 2097152) = 2097152 munmap(0x7fe7603c2000, 2097152) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 mkdir("./file1", 0777) = 0 [ 57.175175][ T5034] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=5034 'syz-executor177' [ 57.214725][ T5034] loop0: detected capacity change from 0 to 4096 mount("/dev/loop0", "./file1", "ntfs3", MS_NODEV|MS_SYNCHRONOUS, "") = 0 openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 chdir("./file1") = 0 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 [ 57.227121][ T5034] ntfs3: loop0: Different NTFS sector size (2048) and media sector size (512). [ 57.267955][ T5034] ntfs3: loop0: ino=1b, "file0" ntfs_iget5 [ 57.278011][ T5034] [ 57.280373][ T5034] ============================================ [ 57.286575][ T5034] WARNING: possible recursive locking detected [ 57.292725][ T5034] 6.5.0-rc2-next-20230721-syzkaller #0 Not tainted [ 57.299350][ T5034] -------------------------------------------- [ 57.305484][ T5034] syz-executor177/5034 is trying to acquire lock: [ 57.311970][ T5034] ffff888075300100 (&ni->ni_lock#2){+.+.}-{3:3}, at: ntfs_set_state+0x1d2/0x6e0 [ 57.321024][ T5034] [ 57.321024][ T5034] but task is already holding lock: [ 57.328375][ T5034] ffff88807506e0e0 (&ni->ni_lock#2){+.+.}-{3:3}, at: ni_write_inode+0x1c3/0x2810 [ 57.337583][ T5034] [ 57.337583][ T5034] other info that might help us debug this: [ 57.345657][ T5034] Possible unsafe locking scenario: [ 57.345657][ T5034] [ 57.353179][ T5034] CPU0 [ 57.356443][ T5034] ---- [ 57.359734][ T5034] lock(&ni->ni_lock#2); [ 57.364224][ T5034] lock(&ni->ni_lock#2); [ 57.368581][ T5034] [ 57.368581][ T5034] *** DEADLOCK *** [ 57.368581][ T5034] [ 57.376793][ T5034] May be due to missing lock nesting notation [ 57.376793][ T5034] [ 57.385368][ T5034] 3 locks held by syz-executor177/5034: [ 57.390924][ T5034] #0: ffff88807e348410 (sb_writers#9){.+.+}-{0:0}, at: vfs_truncate+0xea/0x4d0 [ 57.400877][ T5034] #1: ffff88807506e380 (&sb->s_type->i_mutex_key#15){+.+.}-{3:3}, at: do_truncate+0x14b/0x220 [ 57.411710][ T5034] #2: ffff88807506e0e0 (&ni->ni_lock#2){+.+.}-{3:3}, at: ni_write_inode+0x1c3/0x2810 [ 57.421305][ T5034] [ 57.421305][ T5034] stack backtrace: [ 57.427296][ T5034] CPU: 0 PID: 5034 Comm: syz-executor177 Not tainted 6.5.0-rc2-next-20230721-syzkaller #0 [ 57.437370][ T5034] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023 [ 57.447881][ T5034] Call Trace: [ 57.451275][ T5034] [ 57.454289][ T5034] dump_stack_lvl+0xd9/0x1b0 [ 57.459071][ T5034] __lock_acquire+0x2971/0x5de0 [ 57.463928][ T5034] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 57.469905][ T5034] ? lockdep_unlock+0x11b/0x290 [ 57.474873][ T5034] ? __lock_acquire+0x250f/0x5de0 [ 57.479920][ T5034] lock_acquire+0x1ae/0x510 [ 57.484439][ T5034] ? ntfs_set_state+0x1d2/0x6e0 [ 57.489395][ T5034] ? lock_sync+0x190/0x190 [ 57.493815][ T5034] ? preempt_count_sub+0x150/0x150 [ 57.498930][ T5034] __mutex_lock+0x181/0x1340 [ 57.503517][ T5034] ? ntfs_set_state+0x1d2/0x6e0 [ 57.508379][ T5034] ? ntfs_set_state+0x1d2/0x6e0 [ 57.513354][ T5034] ? reacquire_held_locks+0x4b0/0x4b0 [ 57.518726][ T5034] ? mutex_lock_io_nested+0x11a0/0x11a0 [ 57.524440][ T5034] ? mark_held_locks+0x9f/0xe0 [ 57.529306][ T5034] ? ktime_get_coarse_real_ts64+0x1a5/0x200 [ 57.535209][ T5034] ? ktime_get_coarse_real_ts64+0x147/0x200 [ 57.541290][ T5034] ? ntfs_set_state+0x1d2/0x6e0 [ 57.546140][ T5034] ntfs_set_state+0x1d2/0x6e0 [ 57.552747][ T5034] ? ntfs_update_mftmirr+0x6a0/0x6a0 [ 57.558037][ T5034] ? inode_set_ctime_current+0x1d/0xa0 [ 57.563523][ T5034] ? make_bad_inode+0xb5/0x1c0 [ 57.568463][ T5034] ntfs_iget5+0x241/0x3960 [ 57.572879][ T5034] ? mi_enum_attr+0x36b/0x710 [ 57.577740][ T5034] ? mi_find_attr+0x1dc/0x230 [ 57.582421][ T5034] ? ntfs_write_end+0x910/0x910 [ 57.587270][ T5034] ? ni_load_mi+0x100/0x100 [ 57.592115][ T5034] ni_write_inode+0x14fc/0x2810 [ 57.597045][ T5034] ? mark_held_locks+0x81/0xe0 [ 57.601986][ T5034] ? ni_is_dirty+0x180/0x180 [ 57.606590][ T5034] ntfs3_setattr+0x682/0xb20 [ 57.611172][ T5034] ? ktime_get_coarse_real_ts64+0x180/0x200 [ 57.617091][ T5034] ? ntfs_extend+0x520/0x520 [ 57.621676][ T5034] ? from_vfsuid+0x170/0x170 [ 57.626331][ T5034] ? ntfs_extend+0x520/0x520 [ 57.630914][ T5034] notify_change+0x742/0x11c0 [ 57.635592][ T5034] do_truncate+0x15c/0x220 [ 57.640005][ T5034] ? file_open_root+0x450/0x450 [ 57.644856][ T5034] ? common_perm_cond+0x242/0x850 [ 57.649882][ T5034] vfs_truncate+0x3eb/0x4d0 [ 57.654384][ T5034] do_sys_truncate+0x153/0x190 [ 57.659246][ T5034] ? vfs_truncate+0x4d0/0x4d0 [ 57.663920][ T5034] ? lockdep_hardirqs_on+0x7d/0x100 [ 57.669116][ T5034] ? _raw_spin_unlock_irq+0x2e/0x50 [ 57.674311][ T5034] ? ptrace_notify+0xf4/0x130 [ 57.678985][ T5034] do_syscall_64+0x38/0xb0 [ 57.683424][ T5034] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 57.689438][ T5034] RIP: 0033:0x7fe7687ff5f9 [ 57.693845][ T5034] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 57.713809][ T5034] RSP: 002b:00007fff23281d08 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 57.722230][ T5034] RAX: ffffffffffffffda RBX: 00007fff23281ee8 RCX: 00007fe7687ff5f9 [ 57.730556][ T5034] RDX: 00007fe7687fe8f0 RSI: 0000000000000003 RDI: 0000000020000000 [ 57.738616][ T5034] RBP: 00007fe768891610 R08: 000000000001f3d2 R09: 0000000000000000 [ 57.746756][ T5034] R10: 00007fff23281bd0 R11: 0000000000000246 R12: 0000000000000001 [ 57.754897][ T5034] R13: 00007fff23281ed8 R14: 0000000000000001 R15: 0000000000000001 [ 57.763055][ T5034] truncate("./file0/file0", 3) = 0 exit_group(0) = ? +++ exited with 0 +++ [ 57.766402][ T5034] ntfs3: loop0: Mark