./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2001590253 <...> Warning: Permanently added '10.128.1.94' (ED25519) to the list of known hosts. execve("./syz-executor2001590253", ["./syz-executor2001590253"], 0x7fff82f1ece0 /* 10 vars */) = 0 brk(NULL) = 0x5555556d2000 brk(0x5555556d2d00) = 0x5555556d2d00 arch_prctl(ARCH_SET_FS, 0x5555556d2380) = 0 set_tid_address(0x5555556d2650) = 5016 set_robust_list(0x5555556d2660, 24) = 0 rseq(0x5555556d2ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2001590253", 4096) = 28 getrandom("\x17\x2c\x57\x63\x54\x17\x69\xbd", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555556d2d00 brk(0x5555556f3d00) = 0x5555556f3d00 brk(0x5555556f4000) = 0x5555556f4000 mprotect(0x7fe16f18d000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe166cd8000 [ 63.907788][ T5016] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=5016 'syz-executor200' write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 20699119) = 20699119 munmap(0x7fe166cd8000, 20699119) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 mkdir("./file0", 0777) = 0 [ 64.108909][ T5016] loop0: detected capacity change from 0 to 40427 [ 64.127532][ T5016] F2FS-fs (loop0): Found nat_bits in checkpoint mount("/dev/loop0", "./file0", "f2fs", MS_SILENT, "inline_dentry,lazytime,") = 0 openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 chdir("./file0") = 0 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 open(".", O_RDONLY) = 4 symlinkat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", 4, "./file0") = 0 mkdirat(4, "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", 000) = 0 [ 64.165886][ T5016] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 64.195784][ T5016] [ 64.198168][ T5016] ====================================================== [ 64.205215][ T5016] WARNING: possible circular locking dependency detected [ 64.212255][ T5016] 6.5.0-rc4-syzkaller-00009-g4b954598a47b #0 Not tainted [ 64.219296][ T5016] ------------------------------------------------------ [ 64.226309][ T5016] syz-executor200/5016 is trying to acquire lock: [ 64.232716][ T5016] ffff888075e80528 (&fi->i_sem){+.+.}-{3:3}, at: f2fs_add_inline_entry+0x3a8/0x760 [ 64.242054][ T5016] [ 64.242054][ T5016] but task is already holding lock: [ 64.249411][ T5016] ffff888075e810a0 (&fi->i_xattr_sem){.+.+}-{3:3}, at: f2fs_add_dentry+0x9f/0x1e0 [ 64.258635][ T5016] [ 64.258635][ T5016] which lock already depends on the new lock. [ 64.258635][ T5016] [ 64.269044][ T5016] [ 64.269044][ T5016] the existing dependency chain (in reverse order) is: [ 64.278048][ T5016] [ 64.278048][ T5016] -> #1 (&fi->i_xattr_sem){.+.+}-{3:3}: [ 64.285781][ T5016] down_read+0x47/0x2f0 [ 64.290457][ T5016] f2fs_getxattr+0xb8/0x1460 [ 64.295566][ T5016] __f2fs_get_acl+0x52/0x8e0 [ 64.300679][ T5016] f2fs_init_acl+0xd7/0x9a0 [ 64.305716][ T5016] f2fs_init_inode_metadata+0x824/0x1190 [ 64.311868][ T5016] f2fs_add_regular_entry+0x904/0xe30 [ 64.317784][ T5016] f2fs_add_dentry+0xf7/0x1e0 [ 64.322979][ T5016] f2fs_do_add_link+0x21e/0x340 [ 64.328345][ T5016] f2fs_mkdir+0x2f5/0x530 [ 64.333196][ T5016] vfs_mkdir+0x29d/0x450 [ 64.337955][ T5016] do_mkdirat+0x264/0x520 [ 64.342803][ T5016] __x64_sys_mkdirat+0x89/0xa0 [ 64.348106][ T5016] do_syscall_64+0x41/0xc0 [ 64.353040][ T5016] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 64.359459][ T5016] [ 64.359459][ T5016] -> #0 (&fi->i_sem){+.+.}-{3:3}: [ 64.366688][ T5016] __lock_acquire+0x39ff/0x7f70 [ 64.372082][ T5016] lock_acquire+0x1e3/0x520 [ 64.377109][ T5016] down_write+0x3a/0x50 [ 64.381796][ T5016] f2fs_add_inline_entry+0x3a8/0x760 [ 64.387602][ T5016] f2fs_add_dentry+0xba/0x1e0 [ 64.392804][ T5016] f2fs_do_add_link+0x21e/0x340 [ 64.398207][ T5016] f2fs_rename2+0x17ab/0x29b0 [ 64.403408][ T5016] vfs_rename+0xaba/0xde0 [ 64.408258][ T5016] do_renameat2+0xd78/0x1660 [ 64.413368][ T5016] __x64_sys_renameat2+0xd2/0xe0 [ 64.418828][ T5016] do_syscall_64+0x41/0xc0 [ 64.423800][ T5016] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 64.430230][ T5016] [ 64.430230][ T5016] other info that might help us debug this: [ 64.430230][ T5016] [ 64.440452][ T5016] Possible unsafe locking scenario: [ 64.440452][ T5016] [ 64.447897][ T5016] CPU0 CPU1 [ 64.453280][ T5016] ---- ---- [ 64.458638][ T5016] rlock(&fi->i_xattr_sem); [ 64.463227][ T5016] lock(&fi->i_sem); [ 64.469729][ T5016] lock(&fi->i_xattr_sem); [ 64.476755][ T5016] lock(&fi->i_sem); [ 64.480745][ T5016] [ 64.480745][ T5016] *** DEADLOCK *** [ 64.480745][ T5016] [ 64.488882][ T5016] 7 locks held by syz-executor200/5016: [ 64.494431][ T5016] #0: ffff88807e130410 (sb_writers#9){.+.+}-{0:0}, at: mnt_want_write+0x3f/0x90 [ 64.503604][ T5016] #1: ffff88807e1306f8 (&type->s_vfs_rename_key){+.+.}-{3:3}, at: do_renameat2+0x5c8/0x1660 [ 64.513787][ T5016] #2: ffff888079279300 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: lock_two_directories+0x66/0x150 [ 64.524875][ T5016] #3: ffff888075e80a28 (&type->i_mutex_dir_key#7/2){+.+.}-{3:3}, at: lock_two_directories+0x107/0x150 [ 64.535940][ T5016] #4: ffff888075e80150 (&sb->s_type->i_mutex_key#14){+.+.}-{3:3}, at: lock_two_inodes+0x100/0x180 [ 64.546652][ T5016] #5: ffff888079c603b0 (&sbi->cp_rwsem){.+.+}-{3:3}, at: f2fs_rename2+0x1799/0x29b0 [ 64.556146][ T5016] #6: ffff888075e810a0 (&fi->i_xattr_sem){.+.+}-{3:3}, at: f2fs_add_dentry+0x9f/0x1e0 [ 64.565817][ T5016] [ 64.565817][ T5016] stack backtrace: [ 64.571711][ T5016] CPU: 1 PID: 5016 Comm: syz-executor200 Not tainted 6.5.0-rc4-syzkaller-00009-g4b954598a47b #0 [ 64.582127][ T5016] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023 [ 64.592189][ T5016] Call Trace: [ 64.595471][ T5016] [ 64.598403][ T5016] dump_stack_lvl+0x1e7/0x2d0 [ 64.603083][ T5016] ? nf_tcp_handle_invalid+0x650/0x650 [ 64.608546][ T5016] ? print_circular_bug+0x12b/0x1a0 [ 64.613749][ T5016] check_noncircular+0x375/0x4a0 [ 64.618691][ T5016] ? __kernel_text_address+0xd/0x40 [ 64.623910][ T5016] ? print_deadlock_bug+0x600/0x600 [ 64.629120][ T5016] ? lockdep_lock+0x123/0x2b0 [ 64.633802][ T5016] ? mark_lock+0x9a/0x340 [ 64.638132][ T5016] ? _find_first_zero_bit+0xd4/0x100 [ 64.643442][ T5016] __lock_acquire+0x39ff/0x7f70 [ 64.648312][ T5016] ? verify_lock_unused+0x140/0x140 [ 64.653512][ T5016] ? rcu_lock_release+0x5/0x30 [ 64.658309][ T5016] ? f2fs_inode_chksum_verify+0xd9/0x360 [ 64.663958][ T5016] lock_acquire+0x1e3/0x520 [ 64.668497][ T5016] ? f2fs_add_inline_entry+0x3a8/0x760 [ 64.673972][ T5016] ? read_lock_is_recursive+0x20/0x20 [ 64.679358][ T5016] ? __might_sleep+0xc0/0xc0 [ 64.683954][ T5016] ? pagecache_get_page+0xeb/0x220 [ 64.689068][ T5016] ? f2fs_grab_cache_page+0x38/0x360 [ 64.694355][ T5016] ? _find_next_zero_bit+0x8c/0x140 [ 64.699556][ T5016] ? _find_next_bit+0xed/0x130 [ 64.704325][ T5016] down_write+0x3a/0x50 [ 64.708479][ T5016] ? f2fs_add_inline_entry+0x3a8/0x760 [ 64.714026][ T5016] f2fs_add_inline_entry+0x3a8/0x760 [ 64.719314][ T5016] ? f2fs_setup_filename+0x145/0x360 [ 64.724597][ T5016] ? do_convert_inline_dir+0x1cb0/0x1cb0 [ 64.730237][ T5016] ? down_read+0x1b5/0x2f0 [ 64.734754][ T5016] f2fs_add_dentry+0xba/0x1e0 [ 64.739455][ T5016] f2fs_do_add_link+0x21e/0x340 [ 64.744328][ T5016] ? __might_sleep+0xc0/0xc0 [ 64.748953][ T5016] ? f2fs_add_dentry+0x1e0/0x1e0 [ 64.753939][ T5016] ? f2fs_find_entry+0x1fd/0x210 [ 64.758903][ T5016] ? down_read+0x1b5/0x2f0 [ 64.763345][ T5016] ? f2fs_add_link+0x57/0x130 [ 64.768044][ T5016] f2fs_rename2+0x17ab/0x29b0 [ 64.772762][ T5016] ? f2fs_mknod+0x520/0x520 [ 64.777373][ T5016] ? __down_write_common+0x161/0x200 [ 64.782663][ T5016] ? __lock_acquire+0x7f70/0x7f70 [ 64.787692][ T5016] ? clear_nonspinnable+0x60/0x60 [ 64.792721][ T5016] ? lock_two_inodes+0x13c/0x180 [ 64.797768][ T5016] ? f2fs_mknod+0x520/0x520 [ 64.802305][ T5016] vfs_rename+0xaba/0xde0 [ 64.806754][ T5016] ? __ia32_sys_link+0x90/0x90 [ 64.811537][ T5016] ? security_path_rename+0x183/0x210 [ 64.816914][ T5016] do_renameat2+0xd78/0x1660 [ 64.821519][ T5016] ? fsnotify_move+0x4f0/0x4f0 [ 64.826283][ T5016] ? __virt_addr_valid+0x22f/0x2e0 [ 64.831394][ T5016] ? __check_object_size+0x4e1/0xa40 [ 64.836705][ T5016] ? getname_flags+0x1f0/0x4e0 [ 64.841467][ T5016] __x64_sys_renameat2+0xd2/0xe0 [ 64.846404][ T5016] do_syscall_64+0x41/0xc0 [ 64.850817][ T5016] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 64.856714][ T5016] RIP: 0033:0x7fe16f115739 [ 64.861143][ T5016] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 64.880748][ T5016] RSP: 002b:00007ffd9001dcd8 EFLAGS: 00000246 ORIG_RAX: 000000000000013c [ 64.889170][ T5016] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007fe16f115739 [ 64.897142][ T5016] RDX: 0000000000000004 RSI: 00000000200001c0 RDI: 0000000000000004 [ 64.905109][ T5016] RBP: 00007fe16f18d610 R08: 0000000000000000 R09: 00007ffd9001dea8 renameat2(4, "./file0", 4, "./file0/file0", 0) = 0 exit_group(0) = ? +++ exited with 0 +++ [ 64.913077][ T5016] R10: 00000000200002c0 R11: 0000000000000246 R12: