./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2681744984 <...> forked to background, child pid 4658 [ 50.536944][ T4659] 8021q: adding VLAN 0 to HW filter on device bond0 [ 50.547613][ T4659] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: [ 51.266367][ T4760] sshd (4760) used greatest stack depth: 22304 bytes left OK syzkaller Warning: Permanently added '10.128.10.16' (ECDSA) to the list of known hosts. execve("./syz-executor2681744984", ["./syz-executor2681744984"], 0x7ffc37b3f460 /* 10 vars */) = 0 brk(NULL) = 0x555555e02000 brk(0x555555e02c40) = 0x555555e02c40 arch_prctl(ARCH_SET_FS, 0x555555e02300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor2681744984", 4096) = 28 brk(0x555555e23c40) = 0x555555e23c40 brk(0x555555e24000) = 0x555555e24000 mprotect(0x7f81c3c16000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5096 attached , child_tidptr=0x555555e025d0) = 5096 [pid 5096] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 5096] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5096] setsid() = 1 [pid 5096] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5096] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5096] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5096] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5096] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5096] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5096] unshare(CLONE_NEWNS) = 0 [pid 5096] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5096] unshare(CLONE_NEWIPC) = 0 [pid 5096] unshare(CLONE_NEWCGROUP) = 0 [pid 5096] unshare(CLONE_NEWUTS) = 0 [pid 5096] unshare(CLONE_SYSVSEM) = 0 [pid 5096] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5096] write(3, "16777216", 8) = 8 [pid 5096] close(3) = 0 [pid 5096] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5096] write(3, "536870912", 9) = 9 [pid 5096] close(3) = 0 [pid 5096] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5096] write(3, "1024", 4) = 4 [pid 5096] close(3) = 0 [pid 5096] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5096] write(3, "8192", 4) = 4 [pid 5096] close(3) = 0 [pid 5096] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5096] write(3, "1024", 4) = 4 [pid 5096] close(3) = 0 [pid 5096] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5096] write(3, "1024", 4) = 4 [pid 5096] close(3) = 0 [pid 5096] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5096] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5096] close(3) = 0 [pid 5096] getpid() = 1 [pid 5096] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<lcnbmp_lock){+.+.}-{3:3}, at: ntfs_put_super+0x39c/0x1700 [ 76.220839][ T5096] [ 76.220839][ T5096] which lock already depends on the new lock. [ 76.220839][ T5096] [ 76.231234][ T5096] [ 76.231234][ T5096] the existing dependency chain (in reverse order) is: [ 76.240251][ T5096] [ 76.240251][ T5096] -> #1 (&vol->lcnbmp_lock){+.+.}-{3:3}: [ 76.248079][ T5096] down_write+0x92/0x200 [ 76.252876][ T5096] __ntfs_cluster_free+0x12d/0xbe0 [ 76.258525][ T5096] ntfs_truncate+0x16c1/0x2a50 [ 76.263823][ T5096] ntfs_setattr+0x397/0x560 [ 76.268864][ T5096] notify_change+0xb2c/0x1180 [ 76.274078][ T5096] do_truncate+0x143/0x200 [ 76.279111][ T5096] path_openat+0x2083/0x2750 [ 76.284232][ T5096] do_file_open_root+0x2cc/0x590 [ 76.289702][ T5096] file_open_root+0x2e2/0x460 [ 76.294914][ T5096] do_handle_open+0x327/0x8b0 [ 76.300133][ T5096] do_syscall_64+0x39/0xb0 [ 76.305082][ T5096] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 76.311523][ T5096] [ 76.311523][ T5096] -> #0 (&lcnbmp_mrec_lock_key){+.+.}-{3:3}: [ 76.319703][ T5096] __lock_acquire+0x2f21/0x5df0 [ 76.325086][ T5096] lock_acquire.part.0+0x11c/0x370 [ 76.330731][ T5096] __mutex_lock+0x12f/0x1350 [ 76.335857][ T5096] map_mft_record+0x40/0x6c0 [ 76.340981][ T5096] __ntfs_write_inode+0x88/0xc40 [ 76.346443][ T5096] ntfs_put_super+0xf43/0x1700 [ 76.351747][ T5096] generic_shutdown_super+0x158/0x480 [ 76.357666][ T5096] kill_block_super+0x9b/0xf0 [ 76.362886][ T5096] deactivate_locked_super+0x98/0x160 [ 76.368786][ T5096] deactivate_super+0xb1/0xd0 [ 76.373991][ T5096] cleanup_mnt+0x2ae/0x3d0 [ 76.378945][ T5096] task_work_run+0x16f/0x270 [ 76.384077][ T5096] do_exit+0xb0d/0x29f0 [ 76.388774][ T5096] do_group_exit+0xd4/0x2a0 [ 76.393806][ T5096] __x64_sys_exit_group+0x3e/0x50 [ 76.399358][ T5096] do_syscall_64+0x39/0xb0 [ 76.404308][ T5096] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 76.410745][ T5096] [ 76.410745][ T5096] other info that might help us debug this: [ 76.410745][ T5096] [ 76.420971][ T5096] Possible unsafe locking scenario: [ 76.420971][ T5096] [ 76.428415][ T5096] CPU0 CPU1 [ 76.433775][ T5096] ---- ---- [ 76.439223][ T5096] lock(&vol->lcnbmp_lock); [ 76.443826][ T5096] lock(&lcnbmp_mrec_lock_key); [ 76.451301][ T5096] lock(&vol->lcnbmp_lock); [ 76.458415][ T5096] lock(&lcnbmp_mrec_lock_key); [ 76.463354][ T5096] [ 76.463354][ T5096] *** DEADLOCK *** [ 76.463354][ T5096] [ 76.471509][ T5096] 2 locks held by syz-executor268/5096: [ 76.477051][ T5096] #0: ffff8880291640e0 (&type->s_umount_key#45){+.+.}-{3:3}, at: deactivate_super+0xa9/0xd0 [ 76.487264][ T5096] #1: ffff888146ebd9f8 (&vol->lcnbmp_lock){+.+.}-{3:3}, at: ntfs_put_super+0x39c/0x1700 [ 76.497117][ T5096] [ 76.497117][ T5096] stack backtrace: [ 76.503006][ T5096] CPU: 0 PID: 5096 Comm: syz-executor268 Not tainted 6.3.0-rc3-next-20230324-syzkaller #0 [ 76.512932][ T5096] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 [ 76.523098][ T5096] Call Trace: [ 76.526385][ T5096] [ 76.529320][ T5096] dump_stack_lvl+0xd9/0x150 [ 76.533994][ T5096] check_noncircular+0x25f/0x2e0 [ 76.538951][ T5096] ? print_circular_bug+0x730/0x730 [ 76.544174][ T5096] ? is_bpf_text_address+0x4/0x1b0 [ 76.549299][ T5096] ? is_bpf_text_address+0x4/0x1b0 [ 76.554445][ T5096] ? is_bpf_text_address+0x9d/0x1b0 [ 76.559660][ T5096] __lock_acquire+0x2f21/0x5df0 [ 76.564535][ T5096] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 76.570533][ T5096] ? filter_irq_stacks+0x90/0x90 [ 76.575487][ T5096] ? kmem_cache_free+0xe9/0x480 [ 76.580358][ T5096] lock_acquire.part.0+0x11c/0x370 [ 76.585500][ T5096] ? map_mft_record+0x40/0x6c0 [ 76.590276][ T5096] ? lock_sync+0x190/0x190 [ 76.594710][ T5096] ? rcu_is_watching+0x12/0xb0 [ 76.599502][ T5096] ? trace_lock_acquire+0x12d/0x180 [ 76.604715][ T5096] ? map_mft_record+0x40/0x6c0 [ 76.609489][ T5096] ? lock_acquire+0x32/0xc0 [ 76.614005][ T5096] ? map_mft_record+0x40/0x6c0 [ 76.618781][ T5096] __mutex_lock+0x12f/0x1350 [ 76.623391][ T5096] ? map_mft_record+0x40/0x6c0 [ 76.628177][ T5096] ? rcu_is_watching+0x12/0xb0 [ 76.632960][ T5096] ? map_mft_record+0x40/0x6c0 [ 76.637739][ T5096] ? mutex_lock_io_nested+0x11a0/0x11a0 [ 76.643307][ T5096] ? lock_sync+0x190/0x190 [ 76.647876][ T5096] ? rcu_is_watching+0x12/0xb0 [ 76.652686][ T5096] ? trace_lock_acquire+0x12d/0x180 [ 76.657909][ T5096] map_mft_record+0x40/0x6c0 [ 76.662517][ T5096] ? ntfs_put_super+0x39c/0x1700 [ 76.667582][ T5096] __ntfs_write_inode+0x88/0xc40 [ 76.672540][ T5096] ntfs_put_super+0xf43/0x1700 [ 76.677320][ T5096] ? fscrypt_destroy_keyring+0x1a/0x350 [ 76.682899][ T5096] ? ntfs_fill_super+0x9400/0x9400 [ 76.688032][ T5096] generic_shutdown_super+0x158/0x480 [ 76.693519][ T5096] kill_block_super+0x9b/0xf0 [ 76.698220][ T5096] deactivate_locked_super+0x98/0x160 [ 76.703612][ T5096] deactivate_super+0xb1/0xd0 [ 76.708308][ T5096] cleanup_mnt+0x2ae/0x3d0 [ 76.712764][ T5096] task_work_run+0x16f/0x270 [ 76.717397][ T5096] ? task_work_cancel+0x30/0x30 [ 76.722295][ T5096] do_exit+0xb0d/0x29f0 [ 76.726475][ T5096] ? lock_downgrade+0x690/0x690 [ 76.731357][ T5096] ? do_raw_spin_lock+0x124/0x2b0 [ 76.736398][ T5096] ? mm_update_next_owner+0x7b0/0x7b0 [ 76.741792][ T5096] ? spin_bug+0x1c0/0x1c0 [ 76.746140][ T5096] ? _raw_spin_unlock_irq+0x23/0x50 [ 76.751349][ T5096] do_group_exit+0xd4/0x2a0 [ 76.755867][ T5096] __x64_sys_exit_group+0x3e/0x50 [ 76.760901][ T5096] do_syscall_64+0x39/0xb0 [ 76.765334][ T5096] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 76.771254][ T5096] RIP: 0033:0x7f81c3b87a29 [ 76.775689][ T5096] Code: Unable to access opcode bytes at 0x7f81c3b879ff. [ 76.782730][ T5096] RSP: 002b:00007fff4088e008 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 76.791168][ T5096] RAX: ffffffffffffffda RBX: 00007f81c3c1c330 RCX: 00007f81c3b87a29 [ 76.799161][ T5096] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [pid 5096] +++ exited with 1 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5096, si_uid=0, si_status=1, si_utime=0, si_stime=14 /* 0.14 s */} --- exit_group(0) = ? +++ exited with 0 +++ [ 76.807226][ T5096] RBP: 0000000000000001