./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2035332153 <...> Warning: Permanently added '10.128.1.201' (ED25519) to the list of known hosts. execve("./syz-executor2035332153", ["./syz-executor2035332153"], 0x7ffeb73c1350 /* 10 vars */) = 0 brk(NULL) = 0x555570f37000 brk(0x555570f37d00) = 0x555570f37d00 arch_prctl(ARCH_SET_FS, 0x555570f37380) = 0 set_tid_address(0x555570f37650) = 5082 set_robust_list(0x555570f37660, 24) = 0 rseq(0x555570f37ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2035332153", 4096) = 28 getrandom("\x9e\x8f\x1c\x2d\xd5\xbc\x2d\x7c", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555570f37d00 brk(0x555570f58d00) = 0x555570f58d00 brk(0x555570f59000) = 0x555570f59000 mprotect(0x7f9e4bc79000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 write(1, "executing program\n", 18executing program ) = 18 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9e43600000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 munmap(0x7f9e43600000, 138412032) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 close(4) = 0 mkdir("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 0777) = 0 mount("/dev/loop0", "./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "hfsplus", MS_SYNCHRONOUS|MS_I_VERSION, "") = 0 openat(AT_FDCWD, "./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", O_RDONLY|O_DIRECTORY) = 3 chdir("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa") = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) creat("./bus", 000) = 4 [ 58.670563][ T5082] loop0: detected capacity change from 0 to 1024 write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 64788) = 64788 [ 58.738816][ T5082] [ 58.741168][ T5082] ====================================================== [ 58.748177][ T5082] WARNING: possible circular locking dependency detected [ 58.755200][ T5082] 6.10.0-rc4-syzkaller-00164-g66cc544fd75c #0 Not tainted [ 58.762296][ T5082] ------------------------------------------------------ [ 58.769296][ T5082] syz-executor203/5082 is trying to acquire lock: [ 58.775685][ T5082] ffff8880115ee0b0 (&tree->tree_lock/1){+.+.}-{3:3}, at: hfsplus_find_init+0x14a/0x1c0 [ 58.785343][ T5082] [ 58.785343][ T5082] but task is already holding lock: [ 58.792682][ T5082] ffff8880241087c8 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}, at: hfsplus_file_truncate+0x2da/0xb50 [ 58.803781][ T5082] [ 58.803781][ T5082] which lock already depends on the new lock. [ 58.803781][ T5082] [ 58.814156][ T5082] [ 58.814156][ T5082] the existing dependency chain (in reverse order) is: [ 58.823143][ T5082] [ 58.823143][ T5082] -> #1 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}: [ 58.832155][ T5082] lock_acquire+0x1ed/0x550 [ 58.837168][ T5082] __mutex_lock+0x136/0xd70 [ 58.842178][ T5082] hfsplus_file_extend+0x21b/0x1b70 [ 58.847893][ T5082] hfsplus_bmap_reserve+0x105/0x4e0 [ 58.853618][ T5082] __hfsplus_ext_write_extent+0x2a4/0x5c0 [ 58.859862][ T5082] hfsplus_ext_write_extent+0x16a/0x1f0 [ 58.865940][ T5082] hfsplus_write_inode+0x22/0x5e0 [ 58.871472][ T5082] __writeback_single_inode+0x6b9/0x10b0 [ 58.877605][ T5082] writeback_single_inode+0x21b/0x7a0 [ 58.883474][ T5082] sync_inode_metadata+0xca/0x130 [ 58.888996][ T5082] hfsplus_file_fsync+0xf8/0x4d0 [ 58.894439][ T5082] generic_file_write_iter+0x2a1/0x310 [ 58.900393][ T5082] vfs_write+0xa72/0xc90 [ 58.905149][ T5082] ksys_write+0x1a0/0x2c0 [ 58.909992][ T5082] do_syscall_64+0xf3/0x230 [ 58.915017][ T5082] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 58.921429][ T5082] [ 58.921429][ T5082] -> #0 (&tree->tree_lock/1){+.+.}-{3:3}: [ 58.929321][ T5082] validate_chain+0x18e0/0x5900 [ 58.934673][ T5082] __lock_acquire+0x1346/0x1fd0 [ 58.940017][ T5082] lock_acquire+0x1ed/0x550 [ 58.945102][ T5082] __mutex_lock+0x136/0xd70 [ 58.950100][ T5082] hfsplus_find_init+0x14a/0x1c0 [ 58.955549][ T5082] hfsplus_file_truncate+0x3fa/0xb50 [ 58.961333][ T5082] hfsplus_delete_inode+0x174/0x220 [ 58.967028][ T5082] hfsplus_unlink+0x512/0x790 [ 58.972200][ T5082] vfs_unlink+0x365/0x650 [ 58.977110][ T5082] do_unlinkat+0x4ae/0x830 [ 58.982022][ T5082] __x64_sys_unlink+0x49/0x60 [ 58.987196][ T5082] do_syscall_64+0xf3/0x230 [ 58.992196][ T5082] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 58.998677][ T5082] [ 58.998677][ T5082] other info that might help us debug this: [ 58.998677][ T5082] [ 59.008880][ T5082] Possible unsafe locking scenario: [ 59.008880][ T5082] [ 59.016305][ T5082] CPU0 CPU1 [ 59.021646][ T5082] ---- ---- [ 59.026988][ T5082] lock(&HFSPLUS_I(inode)->extents_lock); [ 59.032774][ T5082] lock(&tree->tree_lock/1); [ 59.039952][ T5082] lock(&HFSPLUS_I(inode)->extents_lock); [ 59.048254][ T5082] lock(&tree->tree_lock/1); [ 59.052913][ T5082] [ 59.052913][ T5082] *** DEADLOCK *** [ 59.052913][ T5082] [ 59.061041][ T5082] 5 locks held by syz-executor203/5082: [ 59.066759][ T5082] #0: ffff8880234bc420 (sb_writers#9){.+.+}-{0:0}, at: mnt_want_write+0x3f/0x90 [ 59.075895][ T5082] #1: ffff888077739e00 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: do_unlinkat+0x26a/0x830 [ 59.086137][ T5082] #2: ffff8880241089c0 (&sb->s_type->i_mutex_key#14){+.+.}-{3:3}, at: vfs_unlink+0xe4/0x650 [ 59.096287][ T5082] #3: ffff88802eac1998 (&sbi->vh_mutex){+.+.}-{3:3}, at: hfsplus_unlink+0x161/0x790 [ 59.105742][ T5082] #4: ffff8880241087c8 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}, at: hfsplus_file_truncate+0x2da/0xb50 [ 59.117284][ T5082] [ 59.117284][ T5082] stack backtrace: [ 59.123154][ T5082] CPU: 1 PID: 5082 Comm: syz-executor203 Not tainted 6.10.0-rc4-syzkaller-00164-g66cc544fd75c #0 [ 59.133637][ T5082] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 59.143706][ T5082] Call Trace: [ 59.146966][ T5082] [ 59.149878][ T5082] dump_stack_lvl+0x241/0x360 [ 59.154538][ T5082] ? __pfx_dump_stack_lvl+0x10/0x10 [ 59.159907][ T5082] ? print_circular_bug+0x130/0x1a0 [ 59.165085][ T5082] check_noncircular+0x36a/0x4a0 [ 59.170001][ T5082] ? __pfx_check_noncircular+0x10/0x10 [ 59.175441][ T5082] ? lockdep_lock+0x123/0x2b0 [ 59.180099][ T5082] validate_chain+0x18e0/0x5900 [ 59.184937][ T5082] ? __pfx_validate_chain+0x10/0x10 [ 59.190115][ T5082] ? mark_lock+0x9a/0x350 [ 59.194421][ T5082] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 59.200392][ T5082] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 59.206724][ T5082] ? mark_lock+0x9a/0x350 [ 59.211051][ T5082] ? lockdep_hardirqs_on+0x99/0x150 [ 59.216232][ T5082] __lock_acquire+0x1346/0x1fd0 [ 59.221149][ T5082] lock_acquire+0x1ed/0x550 [ 59.225657][ T5082] ? hfsplus_find_init+0x14a/0x1c0 [ 59.230866][ T5082] ? __pfx_lock_acquire+0x10/0x10 [ 59.235904][ T5082] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 59.242059][ T5082] ? __pfx___might_resched+0x10/0x10 [ 59.247333][ T5082] __mutex_lock+0x136/0xd70 [ 59.251817][ T5082] ? hfsplus_find_init+0x14a/0x1c0 [ 59.256912][ T5082] ? hfsplus_find_init+0x14a/0x1c0 [ 59.262020][ T5082] ? __pfx___mutex_lock+0x10/0x10 [ 59.267028][ T5082] ? hfsplus_find_init+0x85/0x1c0 [ 59.272028][ T5082] ? rcu_is_watching+0x15/0xb0 [ 59.276771][ T5082] ? trace_kmalloc+0x1f/0xd0 [ 59.281341][ T5082] ? __kmalloc_noprof+0x217/0x400 [ 59.286361][ T5082] hfsplus_find_init+0x14a/0x1c0 [ 59.291278][ T5082] hfsplus_file_truncate+0x3fa/0xb50 [ 59.296560][ T5082] ? hfsplus_delete_cat+0xb55/0xf70 [ 59.301762][ T5082] ? __pfx_hfsplus_file_truncate+0x10/0x10 [ 59.307549][ T5082] ? smk_access+0x4ab/0x4e0 [ 59.312053][ T5082] ? hfsplus_unlink+0x161/0x790 [ 59.316882][ T5082] hfsplus_delete_inode+0x174/0x220 [ 59.322065][ T5082] hfsplus_unlink+0x512/0x790 [ 59.326720][ T5082] ? __pfx_smack_inode_unlink+0x10/0x10 [ 59.332245][ T5082] ? __pfx_hfsplus_unlink+0x10/0x10 [ 59.337503][ T5082] ? __down_write_common+0x162/0x200 [ 59.342768][ T5082] ? bpf_lsm_inode_unlink+0x9/0x10 [ 59.347854][ T5082] ? security_inode_unlink+0xd5/0x120 [ 59.353222][ T5082] vfs_unlink+0x365/0x650 [ 59.357533][ T5082] do_unlinkat+0x4ae/0x830 [ 59.361928][ T5082] ? __pfx_do_unlinkat+0x10/0x10 [ 59.366843][ T5082] ? __might_fault+0xc6/0x120 [ 59.371497][ T5082] ? strncpy_from_user+0x1a4/0x2f0 [ 59.376606][ T5082] __x64_sys_unlink+0x49/0x60 [ 59.381275][ T5082] do_syscall_64+0xf3/0x230 [ 59.385771][ T5082] ? clear_bhb_loop+0x35/0x90 [ 59.390427][ T5082] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 59.396305][ T5082] RIP: 0033:0x7f9e4bc066f9 [ 59.400703][ T5082] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 59.420290][ T5082] RSP: 002b:00007fff1da5b618 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 [ 59.428680][ T5082] RAX: ffffffffffffffda RBX: 00007fff1da5b7e8 RCX: 00007f9e4bc066f9 unlink("./file1") = 0 exit_group(0) = ? +++ exited with 0 +++ [ 59.436734][ T5082] RDX: 00007f9e4bc066f9 RSI: 0000000000