./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4141418550 <...> Warning: Permanently added '10.128.1.65' (ED25519) to the list of known hosts. execve("./syz-executor4141418550", ["./syz-executor4141418550"], 0x7ffdc9e1a5a0 /* 10 vars */) = 0 brk(NULL) = 0x555555eb6000 brk(0x555555eb6d00) = 0x555555eb6d00 arch_prctl(ARCH_SET_FS, 0x555555eb6380) = 0 set_tid_address(0x555555eb6650) = 5058 set_robust_list(0x555555eb6660, 24) = 0 rseq(0x555555eb6ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor4141418550", 4096) = 28 getrandom("\x5f\x68\x9f\x96\x9d\x5e\xe2\x1c", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555555eb6d00 brk(0x555555ed7d00) = 0x555555ed7d00 brk(0x555555ed8000) = 0x555555ed8000 mprotect(0x7f04f191d000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f04e946c000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 4194304) = 4194304 munmap(0x7f04e946c000, 138412032) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 mkdir("./file0", 0777) = 0 [ 54.531310][ T5058] loop0: detected capacity change from 0 to 8192 [ 54.544179][ T5058] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 54.557263][ T5058] REISERFS (device loop0): found reiserfs format "3.6" with non-standard journal [ 54.566887][ T5058] REISERFS (device loop0): using ordered data mode [ 54.573435][ T5058] reiserfs: using flush barriers [ 54.579705][ T5058] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 54.596326][ T5058] REISERFS (device loop0): checking transaction log (loop0) mount("/dev/loop0", "./file0", "reiserfs", MS_SYNCHRONOUS, "") = 0 openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 chdir("./file0") = 0 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 [ 54.644798][ T5058] REISERFS (device loop0): Using rupasov hash to sort names [ 54.653146][ T5058] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. [ 54.673517][ T5058] [ 54.675864][ T5058] ====================================================== [ 54.682881][ T5058] WARNING: possible circular locking dependency detected [ 54.689900][ T5058] 6.7.0-rc8-syzkaller-00055-g5eff55d725a4 #0 Not tainted [ 54.696924][ T5058] ------------------------------------------------------ [ 54.703943][ T5058] syz-executor414/5058 is trying to acquire lock: [ 54.710352][ T5058] ffff888072e20980 (&type->i_mutex_dir_key#6/3){+.+.}-{3:3}, at: open_xa_dir+0x136/0x610 [ 54.720227][ T5058] [ 54.720227][ T5058] but task is already holding lock: [ 54.727565][ T5058] ffff88801771b090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock_nested+0x5f/0xd0 [ 54.737109][ T5058] [ 54.737109][ T5058] which lock already depends on the new lock. [ 54.737109][ T5058] [ 54.747487][ T5058] [ 54.747487][ T5058] the existing dependency chain (in reverse order) is: [ 54.756477][ T5058] [ 54.756477][ T5058] -> #1 (&sbi->lock){+.+.}-{3:3}: [ 54.763662][ T5058] lock_acquire+0x1e3/0x530 [ 54.768665][ T5058] __mutex_lock+0x136/0xd60 [ 54.773671][ T5058] reiserfs_write_lock+0x7a/0xd0 [ 54.779108][ T5058] reiserfs_mkdir+0x321/0x8f0 [ 54.784284][ T5058] open_xa_dir+0x2cd/0x610 [ 54.789197][ T5058] xattr_lookup+0x24/0x280 [ 54.794109][ T5058] reiserfs_xattr_set_handle+0xfc/0xe20 [ 54.800150][ T5058] reiserfs_security_write+0x157/0x1d0 [ 54.806109][ T5058] reiserfs_new_inode+0x15ab/0x1cb0 [ 54.811803][ T5058] reiserfs_create+0x3e7/0x6e0 [ 54.817063][ T5058] path_openat+0x13fa/0x3290 [ 54.822168][ T5058] do_filp_open+0x234/0x490 [ 54.827167][ T5058] do_sys_openat2+0x13e/0x1d0 [ 54.832339][ T5058] __x64_sys_openat+0x247/0x290 [ 54.837687][ T5058] do_syscall_64+0x45/0x110 [ 54.842695][ T5058] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 54.849082][ T5058] [ 54.849082][ T5058] -> #0 (&type->i_mutex_dir_key#6/3){+.+.}-{3:3}: [ 54.857664][ T5058] validate_chain+0x1909/0x5ab0 [ 54.863029][ T5058] __lock_acquire+0x1345/0x1fd0 [ 54.868377][ T5058] lock_acquire+0x1e3/0x530 [ 54.873376][ T5058] down_write_nested+0x3d/0x50 [ 54.878633][ T5058] open_xa_dir+0x136/0x610 [ 54.883549][ T5058] xattr_lookup+0x24/0x280 [ 54.888473][ T5058] reiserfs_xattr_get+0xfd/0x570 [ 54.893928][ T5058] __vfs_getxattr+0x436/0x470 [ 54.899102][ T5058] smk_fetch+0xb1/0x140 [ 54.903755][ T5058] smack_d_instantiate+0x744/0xa50 [ 54.909362][ T5058] security_d_instantiate+0x9b/0xf0 [ 54.915060][ T5058] d_instantiate_new+0x65/0x120 [ 54.920405][ T5058] reiserfs_create+0x5cf/0x6e0 [ 54.925668][ T5058] path_openat+0x13fa/0x3290 [ 54.930776][ T5058] do_filp_open+0x234/0x490 [ 54.935777][ T5058] do_sys_openat2+0x13e/0x1d0 [ 54.940953][ T5058] __x64_sys_openat+0x247/0x290 [ 54.946300][ T5058] do_syscall_64+0x45/0x110 [ 54.951308][ T5058] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 54.957695][ T5058] [ 54.957695][ T5058] other info that might help us debug this: [ 54.957695][ T5058] [ 54.967901][ T5058] Possible unsafe locking scenario: [ 54.967901][ T5058] [ 54.975326][ T5058] CPU0 CPU1 [ 54.980665][ T5058] ---- ---- [ 54.986006][ T5058] lock(&sbi->lock); [ 54.989965][ T5058] lock(&type->i_mutex_dir_key#6/3); [ 54.997841][ T5058] lock(&sbi->lock); [ 55.004320][ T5058] lock(&type->i_mutex_dir_key#6/3); [ 55.009675][ T5058] [ 55.009675][ T5058] *** DEADLOCK *** [ 55.009675][ T5058] [ 55.017810][ T5058] 3 locks held by syz-executor414/5058: [ 55.023345][ T5058] #0: ffff88801e304418 (sb_writers#9){.+.+}-{0:0}, at: mnt_want_write+0x3f/0x90 [ 55.032477][ T5058] #1: ffff888072e202e0 (&type->i_mutex_dir_key#6){+.+.}-{3:3}, at: path_openat+0x7bc/0x3290 [ 55.042647][ T5058] #2: ffff88801771b090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock_nested+0x5f/0xd0 [ 55.052627][ T5058] [ 55.052627][ T5058] stack backtrace: [ 55.058504][ T5058] CPU: 0 PID: 5058 Comm: syz-executor414 Not tainted 6.7.0-rc8-syzkaller-00055-g5eff55d725a4 #0 [ 55.068889][ T5058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 55.078921][ T5058] Call Trace: [ 55.082178][ T5058] [ 55.085095][ T5058] dump_stack_lvl+0x1e7/0x2d0 [ 55.089775][ T5058] ? nf_tcp_handle_invalid+0x650/0x650 [ 55.095221][ T5058] ? print_circular_bug+0x12b/0x1a0 [ 55.100401][ T5058] check_noncircular+0x366/0x490 [ 55.105338][ T5058] ? read_lock_is_recursive+0x20/0x20 [ 55.110688][ T5058] ? print_deadlock_bug+0x610/0x610 [ 55.115865][ T5058] ? lockdep_lock+0x123/0x2b0 [ 55.120520][ T5058] ? _find_first_zero_bit+0xd4/0x100 [ 55.125789][ T5058] validate_chain+0x1909/0x5ab0 [ 55.130618][ T5058] ? stack_trace_save+0x1c0/0x1c0 [ 55.135628][ T5058] ? reacquire_held_locks+0x690/0x690 [ 55.140981][ T5058] ? look_up_lock_class+0x77/0x160 [ 55.146071][ T5058] ? register_lock_class+0x102/0x970 [ 55.151333][ T5058] ? is_dynamic_key+0x260/0x260 [ 55.156161][ T5058] ? mark_lock+0x9a/0x350 [ 55.160469][ T5058] __lock_acquire+0x1345/0x1fd0 [ 55.165304][ T5058] lock_acquire+0x1e3/0x530 [ 55.169782][ T5058] ? open_xa_dir+0x136/0x610 [ 55.174353][ T5058] ? read_lock_is_recursive+0x20/0x20 [ 55.179702][ T5058] ? lockdep_hardirqs_on+0x98/0x140 [ 55.184879][ T5058] ? __might_sleep+0xe0/0xe0 [ 55.189463][ T5058] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 55.195334][ T5058] ? _raw_spin_unlock+0x40/0x40 [ 55.200159][ T5058] ? stack_trace_snprint+0xf0/0xf0 [ 55.205253][ T5058] down_write_nested+0x3d/0x50 [ 55.210009][ T5058] ? open_xa_dir+0x136/0x610 [ 55.214606][ T5058] open_xa_dir+0x136/0x610 [ 55.219005][ T5058] ? kasan_set_track+0x61/0x70 [ 55.223750][ T5058] ? kasan_set_track+0x4f/0x70 [ 55.228500][ T5058] ? security_d_instantiate+0x9b/0xf0 [ 55.233857][ T5058] ? listxattr_filler+0x500/0x500 [ 55.238861][ T5058] ? do_sys_openat2+0x13e/0x1d0 [ 55.243689][ T5058] ? __static_call_text_end+0x1cd1a0/0x1cd1a0 [ 55.249828][ T5058] xattr_lookup+0x24/0x280 [ 55.254232][ T5058] reiserfs_xattr_get+0xfd/0x570 [ 55.259149][ T5058] ? security_get+0x6d/0xc0 [ 55.263634][ T5058] ? security_list+0x80/0x80 [ 55.268200][ T5058] __vfs_getxattr+0x436/0x470 [ 55.272862][ T5058] smk_fetch+0xb1/0x140 [ 55.276998][ T5058] smack_d_instantiate+0x744/0xa50 [ 55.282113][ T5058] ? smack_sem_semop+0x230/0x230 [ 55.287032][ T5058] security_d_instantiate+0x9b/0xf0 [ 55.292223][ T5058] d_instantiate_new+0x65/0x120 [ 55.297068][ T5058] reiserfs_create+0x5cf/0x6e0 [ 55.301811][ T5058] ? reiserfs_lookup+0x580/0x580 [ 55.306729][ T5058] ? bpf_lsm_inode_create+0x9/0x10 [ 55.311819][ T5058] ? security_inode_create+0xb8/0x100 [ 55.317169][ T5058] ? reiserfs_lookup+0x580/0x580 [ 55.322083][ T5058] path_openat+0x13fa/0x3290 [ 55.326660][ T5058] ? do_filp_open+0x490/0x490 [ 55.331314][ T5058] do_filp_open+0x234/0x490 [ 55.335795][ T5058] ? vfs_tmpfile+0x500/0x500 [ 55.340368][ T5058] ? _raw_spin_unlock+0x28/0x40 [ 55.345211][ T5058] ? alloc_fd+0x59c/0x640 [ 55.349520][ T5058] do_sys_openat2+0x13e/0x1d0 [ 55.354178][ T5058] ? do_sys_open+0x230/0x230 [ 55.358744][ T5058] ? _raw_spin_unlock_irq+0x2e/0x50 [ 55.363922][ T5058] ? ptrace_notify+0x278/0x380 [ 55.368681][ T5058] __x64_sys_openat+0x247/0x290 [ 55.373513][ T5058] ? __ia32_sys_open+0x270/0x270 [ 55.378427][ T5058] ? syscall_enter_from_user_mode+0xa4/0x2d0 [ 55.384388][ T5058] ? syscall_enter_from_user_mode+0xf5/0x2d0 [ 55.390366][ T5058] do_syscall_64+0x45/0x110 [ 55.394851][ T5058] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 55.400722][ T5058] RIP: 0033:0x7f04f18a95f9 [ 55.405118][ T5058] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 55.424702][ T5058] RSP: 002b:00007fffcb198e68 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 55.433092][ T5058] RAX: ffffffffffffffda RBX: 00007fffcb199048 RCX: 00007f04f18a95f9 openat(AT_FDCWD, "./bus", O_RDWR|O_CREAT|O_SYNC|O_LARGEFILE|O_NOATIME|FASYNC, 000) = 4 exit_group(0) = ? +++ exited with 0 +++ [ 55.441038][ T5058] RDX: 000000000014b042 RSI: 0000000020000040 RDI: 00000000fffff