./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3386624513 <...> Warning: Permanently added '10.128.1.42' (ED25519) to the list of known hosts. execve("./syz-executor3386624513", ["./syz-executor3386624513"], 0x7fff63dc6a10 /* 10 vars */) = 0 brk(NULL) = 0x555556bb4000 brk(0x555556bb4d00) = 0x555556bb4d00 arch_prctl(ARCH_SET_FS, 0x555556bb4380) = 0 set_tid_address(0x555556bb4650) = 5054 set_robust_list(0x555556bb4660, 24) = 0 rseq(0x555556bb4ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3386624513", 4096) = 28 getrandom("\x69\x09\xbe\xec\xa3\x82\xec\x78", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555556bb4d00 brk(0x555556bd5d00) = 0x555556bd5d00 brk(0x555556bd6000) = 0x555556bd6000 mprotect(0x7f6692712000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f668a261000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 4194304) = 4194304 munmap(0x7f668a261000, 138412032) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 mkdir("./file1", 0777) = 0 [ 55.580585][ T5054] loop0: detected capacity change from 0 to 8192 [ 55.602901][ T5054] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 55.616012][ T5054] REISERFS (device loop0): found reiserfs format "3.6" with non-standard journal [ 55.626068][ T5054] REISERFS (device loop0): using ordered data mode [ 55.632590][ T5054] reiserfs: using flush barriers [ 55.642380][ T5054] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 55.658910][ T5054] REISERFS (device loop0): checking transaction log (loop0) [ 55.668501][ T5054] REISERFS (device loop0): Using tea hash to sort names mount("/dev/loop0", "./file1", "reiserfs", 0, "") = 0 openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 setxattr("./file1", "security.SMACK64", NULL, 0, XATTR_CREATE|XATTR_REPLACE) = -1 EINVAL (Invalid argument) [ 55.676608][ T5054] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. [ 55.710286][ T5054] [ 55.712646][ T5054] ====================================================== [ 55.719668][ T5054] WARNING: possible circular locking dependency detected [ 55.726666][ T5054] 6.7.0-rc4-syzkaller-00039-g9ace34a8e446 #0 Not tainted [ 55.733664][ T5054] ------------------------------------------------------ [ 55.740659][ T5054] syz-executor338/5054 is trying to acquire lock: [ 55.747048][ T5054] ffff888028afe418 (sb_writers#9){.+.+}-{0:0}, at: mnt_want_write_file+0x61/0x200 [ 55.756310][ T5054] [ 55.756310][ T5054] but task is already holding lock: [ 55.763648][ T5054] ffff88814b49e090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock+0x7a/0xd0 [ 55.772583][ T5054] [ 55.772583][ T5054] which lock already depends on the new lock. [ 55.772583][ T5054] [ 55.782962][ T5054] [ 55.782962][ T5054] the existing dependency chain (in reverse order) is: [ 55.791952][ T5054] [ 55.791952][ T5054] -> #2 (&sbi->lock){+.+.}-{3:3}: [ 55.799150][ T5054] lock_acquire+0x1e3/0x530 [ 55.804154][ T5054] __mutex_lock+0x136/0xd60 [ 55.809203][ T5054] reiserfs_write_lock+0x7a/0xd0 [ 55.814818][ T5054] reiserfs_lookup+0x162/0x580 [ 55.820115][ T5054] __lookup_slow+0x282/0x3e0 [ 55.825210][ T5054] lookup_one_len+0x188/0x2c0 [ 55.830382][ T5054] reiserfs_lookup_privroot+0x89/0x180 [ 55.836349][ T5054] reiserfs_fill_super+0x21c1/0x2620 [ 55.842141][ T5054] mount_bdev+0x237/0x300 [ 55.846968][ T5054] legacy_get_tree+0xef/0x190 [ 55.852147][ T5054] vfs_get_tree+0x8c/0x2a0 [ 55.857065][ T5054] do_new_mount+0x28f/0xae0 [ 55.862064][ T5054] __se_sys_mount+0x2d9/0x3c0 [ 55.867238][ T5054] do_syscall_64+0x45/0x110 [ 55.872686][ T5054] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 55.879083][ T5054] [ 55.879083][ T5054] -> #1 (&type->i_mutex_dir_key#6){+.+.}-{3:3}: [ 55.887494][ T5054] lock_acquire+0x1e3/0x530 [ 55.892507][ T5054] down_write+0x3a/0x50 [ 55.897174][ T5054] vfs_setxattr+0x1e1/0x420 [ 55.902180][ T5054] setxattr+0x25d/0x2f0 [ 55.906838][ T5054] path_setxattr+0x1c0/0x2a0 [ 55.912016][ T5054] __x64_sys_setxattr+0xbb/0xd0 [ 55.917370][ T5054] do_syscall_64+0x45/0x110 [ 55.922376][ T5054] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 55.928792][ T5054] [ 55.928792][ T5054] -> #0 (sb_writers#9){.+.+}-{0:0}: [ 55.936161][ T5054] validate_chain+0x1909/0x5ab0 [ 55.941544][ T5054] __lock_acquire+0x1345/0x1fd0 [ 55.946926][ T5054] lock_acquire+0x1e3/0x530 [ 55.951939][ T5054] sb_start_write+0x4d/0x1c0 [ 55.957051][ T5054] mnt_want_write_file+0x61/0x200 [ 55.962582][ T5054] reiserfs_ioctl+0x178/0x2f0 [ 55.967764][ T5054] __se_sys_ioctl+0xf8/0x170 [ 55.972858][ T5054] do_syscall_64+0x45/0x110 [ 55.977865][ T5054] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 55.984262][ T5054] [ 55.984262][ T5054] other info that might help us debug this: [ 55.984262][ T5054] [ 55.994469][ T5054] Chain exists of: [ 55.994469][ T5054] sb_writers#9 --> &type->i_mutex_dir_key#6 --> &sbi->lock [ 55.994469][ T5054] [ 56.007574][ T5054] Possible unsafe locking scenario: [ 56.007574][ T5054] [ 56.015000][ T5054] CPU0 CPU1 [ 56.020341][ T5054] ---- ---- [ 56.025685][ T5054] lock(&sbi->lock); [ 56.029648][ T5054] lock(&type->i_mutex_dir_key#6); [ 56.037348][ T5054] lock(&sbi->lock); [ 56.043837][ T5054] rlock(sb_writers#9); [ 56.048061][ T5054] [ 56.048061][ T5054] *** DEADLOCK *** [ 56.048061][ T5054] [ 56.056181][ T5054] 1 lock held by syz-executor338/5054: [ 56.061629][ T5054] #0: ffff88814b49e090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock+0x7a/0xd0 [ 56.071034][ T5054] [ 56.071034][ T5054] stack backtrace: [ 56.076899][ T5054] CPU: 0 PID: 5054 Comm: syz-executor338 Not tainted 6.7.0-rc4-syzkaller-00039-g9ace34a8e446 #0 [ 56.087284][ T5054] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 56.097316][ T5054] Call Trace: [ 56.100597][ T5054] [ 56.103511][ T5054] dump_stack_lvl+0x1e7/0x2d0 [ 56.108179][ T5054] ? nf_tcp_handle_invalid+0x650/0x650 [ 56.113640][ T5054] ? print_circular_bug+0x12b/0x1a0 [ 56.118823][ T5054] check_noncircular+0x366/0x490 [ 56.124010][ T5054] ? print_deadlock_bug+0x610/0x610 [ 56.129192][ T5054] ? lockdep_lock+0x123/0x2b0 [ 56.133850][ T5054] ? _find_first_zero_bit+0xd4/0x100 [ 56.139134][ T5054] validate_chain+0x1909/0x5ab0 [ 56.143970][ T5054] ? reacquire_held_locks+0x690/0x690 [ 56.149326][ T5054] ? mark_lock+0x9a/0x350 [ 56.153636][ T5054] ? mark_lock+0x9a/0x350 [ 56.157948][ T5054] ? __lock_acquire+0x1345/0x1fd0 [ 56.162968][ T5054] ? mark_lock+0x9a/0x350 [ 56.167279][ T5054] __lock_acquire+0x1345/0x1fd0 [ 56.172116][ T5054] lock_acquire+0x1e3/0x530 [ 56.176602][ T5054] ? mnt_want_write_file+0x61/0x200 [ 56.181793][ T5054] ? read_lock_is_recursive+0x20/0x20 [ 56.187150][ T5054] ? __might_sleep+0xe0/0xe0 [ 56.191721][ T5054] ? mutex_lock_nested+0x20/0x20 [ 56.196649][ T5054] ? from_kuid+0x191/0x6f0 [ 56.201057][ T5054] ? cap_capable+0x1b4/0x240 [ 56.205639][ T5054] ? bpf_lsm_capable+0x9/0x10 [ 56.210393][ T5054] ? security_capable+0x8a/0xb0 [ 56.215229][ T5054] sb_start_write+0x4d/0x1c0 [ 56.219801][ T5054] ? mnt_want_write_file+0x61/0x200 [ 56.224982][ T5054] mnt_want_write_file+0x61/0x200 [ 56.230000][ T5054] reiserfs_ioctl+0x178/0x2f0 [ 56.234668][ T5054] ? __se_sys_ioctl+0xed/0x170 [ 56.239410][ T5054] ? reiserfs_unpack+0x610/0x610 [ 56.244334][ T5054] __se_sys_ioctl+0xf8/0x170 [ 56.248918][ T5054] do_syscall_64+0x45/0x110 [ 56.253404][ T5054] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 56.259287][ T5054] RIP: 0033:0x7f669269e609 [ 56.263693][ T5054] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 56.283281][ T5054] RSP: 002b:00007ffc2c2400c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 56.291679][ T5054] RAX: ffffffffffffffda RBX: 00007ffc2c240298 RCX: 00007f669269e609 [ 56.299631][ T5054] RDX: 0000000000000000 RSI: 0000000040087602 RDI: 0000000000000003 ioctl(3, FS_IOC_SETVERSION, 0) = -1 EFAULT (Bad address) exit_group(0) = ? +++ exited with 0 +++ [ 56.307583][ T5054] RBP: 00007f6692712610 R08: 00007ffc2c24