./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1744753004 <...> Warning: Permanently added '10.128.1.46' (ECDSA) to the list of known hosts. execve("./syz-executor1744753004", ["./syz-executor1744753004"], 0x7ffeb9f8a0b0 /* 10 vars */) = 0 brk(NULL) = 0x555556cdb000 brk(0x555556cdbc40) = 0x555556cdbc40 arch_prctl(ARCH_SET_FS, 0x555556cdb300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor1744753004", 4096) = 28 brk(0x555556cfcc40) = 0x555556cfcc40 brk(0x555556cfd000) = 0x555556cfd000 mprotect(0x7f73aaea2000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556cdb5d0) = 4998 ./strace-static-x86_64: Process 4998 attached [pid 4998] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 4998] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 4998] setsid() = 1 [pid 4998] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 4998] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 4998] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 4998] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 4998] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 4998] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 4998] unshare(CLONE_NEWNS) = 0 [pid 4998] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 4998] unshare(CLONE_NEWIPC) = 0 [pid 4998] unshare(CLONE_NEWCGROUP) = 0 [pid 4998] unshare(CLONE_NEWUTS) = 0 [pid 4998] unshare(CLONE_SYSVSEM) = 0 [pid 4998] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 4998] write(3, "16777216", 8) = 8 [pid 4998] close(3) = 0 [pid 4998] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 4998] write(3, "536870912", 9) = 9 [pid 4998] close(3) = 0 [pid 4998] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 4998] write(3, "1024", 4) = 4 [pid 4998] close(3) = 0 [pid 4998] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 4998] write(3, "8192", 4) = 4 [pid 4998] close(3) = 0 [pid 4998] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 4998] write(3, "1024", 4) = 4 [pid 4998] close(3) = 0 [pid 4998] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 4998] write(3, "1024", 4) = 4 [pid 4998] close(3) = 0 [pid 4998] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 4998] write(3, "1024 1048576 500 1024", 21) = 21 [pid 4998] close(3) = 0 [pid 4998] getpid() = 1 [pid 4998] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<i_mutex_dir_key#6/2){+.+.}-{3:3}, at: delete_one_xattr+0x141/0x2d0 [ 43.176635][ T4998] [ 43.176635][ T4998] but task is already holding lock: [ 43.183974][ T4998] ffff888073d496c0 (&type->i_mutex_dir_key#6/3){+.+.}-{3:3}, at: reiserfs_for_each_xattr+0x6fd/0x9a0 [ 43.194946][ T4998] [ 43.194946][ T4998] which lock already depends on the new lock. [ 43.194946][ T4998] [ 43.205329][ T4998] [ 43.205329][ T4998] the existing dependency chain (in reverse order) is: [ 43.214328][ T4998] [ 43.214328][ T4998] -> #2 (&type->i_mutex_dir_key#6/3){+.+.}-{3:3}: [ 43.222941][ T4998] down_write_nested+0x96/0x200 [ 43.228304][ T4998] open_xa_dir+0x127/0x840 [ 43.233233][ T4998] xattr_lookup+0x21/0x3d0 [ 43.238174][ T4998] reiserfs_xattr_set_handle+0xfb/0xb00 [ 43.244230][ T4998] reiserfs_xattr_set+0x454/0x5b0 [ 43.249771][ T4998] trusted_set+0xa7/0xd0 [ 43.254522][ T4998] __vfs_setxattr+0x173/0x1e0 [ 43.259753][ T4998] __vfs_setxattr_noperm+0x129/0x5f0 [ 43.265559][ T4998] __vfs_setxattr_locked+0x1d3/0x260 [ 43.271387][ T4998] vfs_setxattr+0x143/0x340 [ 43.276404][ T4998] ovl_fill_super+0x2276/0x7270 [ 43.281858][ T4998] mount_nodev+0x64/0x120 [ 43.286693][ T4998] legacy_get_tree+0x109/0x220 [ 43.291974][ T4998] vfs_get_tree+0x8d/0x350 [ 43.296901][ T4998] path_mount+0x134b/0x1e40 [ 43.301915][ T4998] __x64_sys_mount+0x283/0x300 [ 43.307187][ T4998] do_syscall_64+0x39/0xb0 [ 43.312128][ T4998] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 43.318538][ T4998] [ 43.318538][ T4998] -> #1 (&type->i_mutex_dir_key#6){++++}-{3:3}: [ 43.326950][ T4998] down_write+0x92/0x200 [ 43.331725][ T4998] vfs_rename+0x4f9/0x17a0 [ 43.336650][ T4998] do_renameat2+0xc04/0xd40 [ 43.341662][ T4998] __x64_sys_rename+0x81/0xa0 [ 43.346853][ T4998] do_syscall_64+0x39/0xb0 [ 43.351780][ T4998] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 43.358183][ T4998] [ 43.358183][ T4998] -> #0 (&type->i_mutex_dir_key#6/2){+.+.}-{3:3}: [ 43.366770][ T4998] __lock_acquire+0x2f21/0x5df0 [ 43.372132][ T4998] lock_acquire+0x1b1/0x520 [ 43.377145][ T4998] down_write_nested+0x96/0x200 [ 43.382504][ T4998] delete_one_xattr+0x141/0x2d0 [ 43.387870][ T4998] reiserfs_for_each_xattr+0x70e/0x9a0 [ 43.393840][ T4998] reiserfs_delete_xattrs+0x20/0xa0 [ 43.399548][ T4998] reiserfs_evict_inode+0x2e7/0x540 [ 43.405277][ T4998] evict+0x2ed/0x6b0 [ 43.409690][ T4998] iput.part.0+0x50a/0x740 [ 43.414700][ T4998] iput+0x5c/0x80 [ 43.418860][ T4998] dentry_unlink_inode+0x2b1/0x460 [ 43.424471][ T4998] __dentry_kill+0x3c0/0x640 [ 43.429564][ T4998] dput+0x6ac/0xe10 [ 43.433876][ T4998] cleanup_mnt+0x286/0x3d0 [ 43.438797][ T4998] task_work_run+0x16f/0x270 [ 43.443908][ T4998] do_exit+0xad3/0x2960 [ 43.448566][ T4998] do_group_exit+0xd4/0x2a0 [ 43.453571][ T4998] __x64_sys_exit_group+0x3e/0x50 [ 43.459206][ T4998] do_syscall_64+0x39/0xb0 [ 43.464133][ T4998] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 43.470536][ T4998] [ 43.470536][ T4998] other info that might help us debug this: [ 43.470536][ T4998] [ 43.480741][ T4998] Chain exists of: [ 43.480741][ T4998] &type->i_mutex_dir_key#6/2 --> &type->i_mutex_dir_key#6 --> &type->i_mutex_dir_key#6/3 [ 43.480741][ T4998] [ 43.496467][ T4998] Possible unsafe locking scenario: [ 43.496467][ T4998] [ 43.504076][ T4998] CPU0 CPU1 [ 43.509422][ T4998] ---- ---- [ 43.514765][ T4998] lock(&type->i_mutex_dir_key#6/3); [ 43.520148][ T4998] lock(&type->i_mutex_dir_key#6); [ 43.527932][ T4998] lock(&type->i_mutex_dir_key#6/3); [ 43.535813][ T4998] lock(&type->i_mutex_dir_key#6/2); [ 43.541465][ T4998] [ 43.541465][ T4998] *** DEADLOCK *** [ 43.541465][ T4998] [ 43.549586][ T4998] 1 lock held by syz-executor174/4998: [ 43.555046][ T4998] #0: ffff888073d496c0 (&type->i_mutex_dir_key#6/3){+.+.}-{3:3}, at: reiserfs_for_each_xattr+0x6fd/0x9a0 [ 43.566374][ T4998] [ 43.566374][ T4998] stack backtrace: [ 43.572270][ T4998] CPU: 0 PID: 4998 Comm: syz-executor174 Not tainted 6.4.0-rc1-syzkaller #0 [ 43.580925][ T4998] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 [ 43.590965][ T4998] Call Trace: [ 43.594229][ T4998] [ 43.597142][ T4998] dump_stack_lvl+0xd9/0x150 [ 43.601727][ T4998] check_noncircular+0x25f/0x2e0 [ 43.606670][ T4998] ? register_lock_class+0xbe/0x1120 [ 43.611947][ T4998] ? print_circular_bug+0x730/0x730 [ 43.617154][ T4998] ? reacquire_held_locks+0x216/0x4e0 [ 43.622515][ T4998] ? is_dynamic_key.part.0+0x190/0x190 [ 43.627987][ T4998] __lock_acquire+0x2f21/0x5df0 [ 43.632831][ T4998] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 43.638818][ T4998] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 43.644805][ T4998] ? find_held_lock+0x2d/0x110 [ 43.649988][ T4998] lock_acquire+0x1b1/0x520 [ 43.654481][ T4998] ? delete_one_xattr+0x141/0x2d0 [ 43.659490][ T4998] ? lock_sync+0x190/0x190 [ 43.663926][ T4998] down_write_nested+0x96/0x200 [ 43.668772][ T4998] ? delete_one_xattr+0x141/0x2d0 [ 43.673778][ T4998] ? up_read+0x20/0x20 [ 43.677829][ T4998] ? down_write_nested+0x153/0x200 [ 43.683017][ T4998] ? up_read+0x20/0x20 [ 43.687108][ T4998] delete_one_xattr+0x141/0x2d0 [ 43.691950][ T4998] reiserfs_for_each_xattr+0x70e/0x9a0 [ 43.697395][ T4998] ? xattr_unlink+0x190/0x190 [ 43.702057][ T4998] ? open_xa_dir+0x840/0x840 [ 43.706631][ T4998] ? delete_one_xattr+0x2d0/0x2d0 [ 43.711641][ T4998] reiserfs_delete_xattrs+0x20/0xa0 [ 43.716825][ T4998] reiserfs_evict_inode+0x2e7/0x540 [ 43.722009][ T4998] ? reiserfs_bmap+0x1b0/0x1b0 [ 43.726758][ T4998] ? lock_downgrade+0x690/0x690 [ 43.731595][ T4998] ? cpuacct_css_alloc+0x160/0x160 [ 43.736693][ T4998] ? spin_bug+0x1c0/0x1c0 [ 43.741018][ T4998] ? reiserfs_bmap+0x1b0/0x1b0 [ 43.745766][ T4998] evict+0x2ed/0x6b0 [ 43.749648][ T4998] iput.part.0+0x50a/0x740 [ 43.754049][ T4998] iput+0x5c/0x80 [ 43.757665][ T4998] dentry_unlink_inode+0x2b1/0x460 [ 43.762760][ T4998] __dentry_kill+0x3c0/0x640 [ 43.767332][ T4998] ? dput+0x39/0xe10 [ 43.771204][ T4998] dput+0x6ac/0xe10 [ 43.774998][ T4998] cleanup_mnt+0x286/0x3d0 [ 43.779397][ T4998] task_work_run+0x16f/0x270 [ 43.783967][ T4998] ? task_work_cancel+0x30/0x30 [ 43.788803][ T4998] do_exit+0xad3/0x2960 [ 43.792941][ T4998] ? lock_downgrade+0x690/0x690 [ 43.797773][ T4998] ? do_raw_spin_lock+0x124/0x2b0 [ 43.802787][ T4998] ? mm_update_next_owner+0x7b0/0x7b0 [ 43.808138][ T4998] ? spin_bug+0x1c0/0x1c0 [ 43.812458][ T4998] ? _raw_spin_unlock_irq+0x23/0x50 [ 43.817641][ T4998] do_group_exit+0xd4/0x2a0 [ 43.822130][ T4998] __x64_sys_exit_group+0x3e/0x50 [ 43.827140][ T4998] do_syscall_64+0x39/0xb0 [ 43.831545][ T4998] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 43.837425][ T4998] RIP: 0033:0x7f73aae31bb9 [ 43.841832][ T4998] Code: Unable to access opcode bytes at 0x7f73aae31b8f. [ 43.848828][ T4998] RSP: 002b:00007fff0a6df368 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 43.857221][ T4998] RAX: ffffffffffffffda RBX: 00007f73aaea8330 RCX: 00007f73aae31bb9 [ 43.865174][ T4998] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 43.873132][ T4998] RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 00007f73aaea2e40 [pid 4998] +++ exited with 1 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4998, si_uid=0, si_status=1, si_utime=0, si_stime=20 /* 0.20 s */} --- exit_group(0) = ? +++ exited with 0 +++ [ 43.881084][ T4998] R10: 00007f73aaea2