./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2053644723 <...> DUID 00:04:76:8b:f6:84:a4:3b:36:39:6c:68:e7:10:38:dd:b7:2c forked to background, child pid 4684 [ 30.400235][ T4685] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.414060][ T4685] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.135' (ED25519) to the list of known hosts. execve("./syz-executor2053644723", ["./syz-executor2053644723"], 0x7ffdcb648690 /* 10 vars */) = 0 brk(NULL) = 0x555556335000 brk(0x555556335d00) = 0x555556335d00 arch_prctl(ARCH_SET_FS, 0x555556335380) = 0 set_tid_address(0x555556335650) = 5015 set_robust_list(0x555556335660, 24) = 0 rseq(0x555556335ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2053644723", 4096) = 28 getrandom("\xd8\x22\xb2\xa2\x67\x10\x47\xca", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555556335d00 brk(0x555556356d00) = 0x555556356d00 brk(0x555556357000) = 0x555556357000 mprotect(0x7f6fb1ba1000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6fa96e9000 syzkaller login: [ 58.006976][ T5015] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=5015 'syz-executor205' write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32394836) = 32394836 munmap(0x7f6fa96e9000, 32394836) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 mkdir("./bus", 0777) = 0 [ 58.272922][ T5015] loop0: detected capacity change from 0 to 63271 [ 58.284966][ T5015] F2FS-fs (loop0): Mismatch start address, segment0(512) cp_blkaddr(605) [ 58.293564][ T5015] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 58.304240][ T5015] F2FS-fs (loop0): invalid crc value [ 58.313047][ T5015] F2FS-fs (loop0): Found nat_bits in checkpoint mount("/dev/loop0", "./bus", "f2fs", MS_SYNCHRONOUS, "") = 0 openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 chdir("./bus") = 0 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 mkdirat(AT_FDCWD, "./file0", 000) = 0 openat(AT_FDCWD, "./file0", O_RDONLY) = 4 [ 58.341566][ T5015] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 58.348962][ T5015] F2FS-fs (loop0): Mounted with checkpoint version = 753bd00b [ 58.382342][ T5015] [ 58.384793][ T5015] ====================================================== [ 58.391790][ T5015] WARNING: possible circular locking dependency detected [ 58.398791][ T5015] 6.5.0-rc5-syzkaller-00029-g14f9643dc90a #0 Not tainted [ 58.405790][ T5015] ------------------------------------------------------ [ 58.412784][ T5015] syz-executor205/5015 is trying to acquire lock: [ 58.419174][ T5015] ffff888078b39fb0 (&fi->i_sem){+.+.}-{3:3}, at: f2fs_add_inline_entry+0x3a8/0x760 [ 58.428495][ T5015] [ 58.428495][ T5015] but task is already holding lock: [ 58.435862][ T5015] ffff888078b39978 (&fi->i_xattr_sem){.+.+}-{3:3}, at: f2fs_add_dentry+0x9f/0x1e0 [ 58.445112][ T5015] [ 58.445112][ T5015] which lock already depends on the new lock. [ 58.445112][ T5015] [ 58.455502][ T5015] [ 58.455502][ T5015] the existing dependency chain (in reverse order) is: [ 58.464495][ T5015] [ 58.464495][ T5015] -> #1 (&fi->i_xattr_sem){.+.+}-{3:3}: [ 58.472231][ T5015] down_read+0x47/0x2f0 [ 58.476895][ T5015] f2fs_getxattr+0xb8/0x1460 [ 58.482008][ T5015] __f2fs_get_acl+0x52/0x8e0 [ 58.487110][ T5015] f2fs_init_acl+0xd7/0x9a0 [ 58.492143][ T5015] f2fs_init_inode_metadata+0x824/0x1190 [ 58.498279][ T5015] f2fs_add_regular_entry+0x904/0xe30 [ 58.504159][ T5015] f2fs_add_dentry+0xf7/0x1e0 [ 58.509456][ T5015] f2fs_do_add_link+0x21e/0x340 [ 58.514808][ T5015] f2fs_mkdir+0x2f5/0x530 [ 58.519638][ T5015] vfs_mkdir+0x29d/0x450 [ 58.524384][ T5015] do_mkdirat+0x264/0x520 [ 58.529214][ T5015] __x64_sys_mkdirat+0x89/0xa0 [ 58.534827][ T5015] do_syscall_64+0x41/0xc0 [ 58.539743][ T5015] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 58.546143][ T5015] [ 58.546143][ T5015] -> #0 (&fi->i_sem){+.+.}-{3:3}: [ 58.553350][ T5015] __lock_acquire+0x39ff/0x7f70 [ 58.558705][ T5015] lock_acquire+0x1e3/0x520 [ 58.563739][ T5015] down_write+0x3a/0x50 [ 58.568405][ T5015] f2fs_add_inline_entry+0x3a8/0x760 [ 58.574194][ T5015] f2fs_add_dentry+0xba/0x1e0 [ 58.579372][ T5015] f2fs_do_add_link+0x21e/0x340 [ 58.584729][ T5015] f2fs_create+0x32c/0x530 [ 58.589660][ T5015] vfs_create+0x1e2/0x330 [ 58.594491][ T5015] do_mknodat+0x3c6/0x6e0 [ 58.599931][ T5015] __x64_sys_mknodat+0xa9/0xc0 [ 58.605196][ T5015] do_syscall_64+0x41/0xc0 [ 58.610115][ T5015] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 58.616522][ T5015] [ 58.616522][ T5015] other info that might help us debug this: [ 58.616522][ T5015] [ 58.626729][ T5015] Possible unsafe locking scenario: [ 58.626729][ T5015] [ 58.634159][ T5015] CPU0 CPU1 [ 58.639504][ T5015] ---- ---- [ 58.644848][ T5015] rlock(&fi->i_xattr_sem); [ 58.649439][ T5015] lock(&fi->i_sem); [ 58.655941][ T5015] lock(&fi->i_xattr_sem); [ 58.662945][ T5015] lock(&fi->i_sem); [ 58.666905][ T5015] [ 58.666905][ T5015] *** DEADLOCK *** [ 58.666905][ T5015] [ 58.675034][ T5015] 4 locks held by syz-executor205/5015: [ 58.680556][ T5015] #0: ffff8880795d4410 (sb_writers#9){.+.+}-{0:0}, at: mnt_want_write+0x3f/0x90 [ 58.689783][ T5015] #1: ffff888078b39300 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: filename_create+0x260/0x530 [ 58.700386][ T5015] #2: ffff88802ccd83b0 (&sbi->cp_rwsem){++++}-{3:3}, at: f2fs_create+0x274/0x530 [ 58.709586][ T5015] #3: ffff888078b39978 (&fi->i_xattr_sem){.+.+}-{3:3}, at: f2fs_add_dentry+0x9f/0x1e0 [ 58.719649][ T5015] [ 58.719649][ T5015] stack backtrace: [ 58.725955][ T5015] CPU: 0 PID: 5015 Comm: syz-executor205 Not tainted 6.5.0-rc5-syzkaller-00029-g14f9643dc90a #0 [ 58.736350][ T5015] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 [ 58.746387][ T5015] Call Trace: [ 58.749645][ T5015] [ 58.752558][ T5015] dump_stack_lvl+0x1e7/0x2d0 [ 58.757218][ T5015] ? nf_tcp_handle_invalid+0x650/0x650 [ 58.762656][ T5015] ? print_circular_bug+0x12b/0x1a0 [ 58.767839][ T5015] check_noncircular+0x375/0x4a0 [ 58.772764][ T5015] ? __kernel_text_address+0xd/0x40 [ 58.777946][ T5015] ? print_deadlock_bug+0x600/0x600 [ 58.783128][ T5015] ? lockdep_lock+0x123/0x2b0 [ 58.787793][ T5015] ? mark_lock+0x9a/0x340 [ 58.792102][ T5015] ? _find_first_zero_bit+0xd4/0x100 [ 58.797371][ T5015] __lock_acquire+0x39ff/0x7f70 [ 58.802212][ T5015] ? verify_lock_unused+0x140/0x140 [ 58.807389][ T5015] ? rcu_lock_release+0x5/0x30 [ 58.812137][ T5015] ? f2fs_inode_chksum_verify+0xd9/0x360 [ 58.817757][ T5015] lock_acquire+0x1e3/0x520 [ 58.822252][ T5015] ? f2fs_add_inline_entry+0x3a8/0x760 [ 58.827695][ T5015] ? read_lock_is_recursive+0x20/0x20 [ 58.833047][ T5015] ? __might_sleep+0xc0/0xc0 [ 58.837620][ T5015] ? pagecache_get_page+0xeb/0x220 [ 58.842713][ T5015] ? f2fs_grab_cache_page+0x38/0x360 [ 58.847979][ T5015] ? _find_next_zero_bit+0x8c/0x140 [ 58.853159][ T5015] ? _find_next_bit+0xed/0x130 [ 58.857906][ T5015] down_write+0x3a/0x50 [ 58.862044][ T5015] ? f2fs_add_inline_entry+0x3a8/0x760 [ 58.867503][ T5015] f2fs_add_inline_entry+0x3a8/0x760 [ 58.872784][ T5015] ? f2fs_setup_filename+0x145/0x360 [ 58.878051][ T5015] ? do_convert_inline_dir+0x1cb0/0x1cb0 [ 58.883674][ T5015] ? down_read+0x1b5/0x2f0 [ 58.888068][ T5015] f2fs_add_dentry+0xba/0x1e0 [ 58.892725][ T5015] f2fs_do_add_link+0x21e/0x340 [ 58.897556][ T5015] ? __might_sleep+0xc0/0xc0 [ 58.902128][ T5015] ? f2fs_add_dentry+0x1e0/0x1e0 [ 58.907043][ T5015] ? f2fs_get_link+0x110/0x110 [ 58.911789][ T5015] ? down_read+0x1b5/0x2f0 [ 58.916189][ T5015] f2fs_create+0x32c/0x530 [ 58.920672][ T5015] vfs_create+0x1e2/0x330 [ 58.924982][ T5015] do_mknodat+0x3c6/0x6e0 [ 58.929301][ T5015] ? do_o_path+0x230/0x230 [ 58.933698][ T5015] ? syscall_enter_from_user_mode+0x32/0x230 [ 58.939670][ T5015] __x64_sys_mknodat+0xa9/0xc0 [ 58.944416][ T5015] do_syscall_64+0x41/0xc0 [ 58.948812][ T5015] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 58.954687][ T5015] RIP: 0033:0x7f6fb1b26639 [ 58.959167][ T5015] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 mknodat(4, "./file0", 000) = 0 exit_group(0) = ? +++ exited with 0 +++ [ 58.979014][ T5015] RSP: 002b:00007ffd6f2d3878 EFLAGS: 00000246 ORIG