./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2578174886 <...> Warning: Permanently added '10.128.0.102' (ED25519) to the list of known hosts. execve("./syz-executor2578174886", ["./syz-executor2578174886"], 0x7fffd780e460 /* 10 vars */) = 0 brk(NULL) = 0x5555566d5000 brk(0x5555566d5d00) = 0x5555566d5d00 arch_prctl(ARCH_SET_FS, 0x5555566d5380) = 0 set_tid_address(0x5555566d5650) = 5020 set_robust_list(0x5555566d5660, 24) = 0 rseq(0x5555566d5ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2578174886", 4096) = 28 getrandom("\x1a\xc0\x24\x3b\xbf\x53\xd2\x06", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555566d5d00 brk(0x5555566f6d00) = 0x5555566f6d00 brk(0x5555566f7000) = 0x5555566f7000 mprotect(0x7f9b85f57000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9b7daa7000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 munmap(0x7f9b7daa7000, 524288) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 mkdir("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 0777) = 0 mount("/dev/loop0", "./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "hfsplus", MS_SILENT, "") = 0 openat(AT_FDCWD, "./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", O_RDONLY|O_DIRECTORY) = 3 chdir("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa") = 0 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 mknodat(AT_FDCWD, "./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 000) = 0 open("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", O_RDONLY) = 4 unlink("./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa") = 0 [ 41.740867][ T5020] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=5020 'syz-executor257' [ 41.757631][ T5020] loop0: detected capacity change from 0 to 1024 [ 41.787683][ T5020] [ 41.790045][ T5020] ====================================================== [ 41.797058][ T5020] WARNING: possible circular locking dependency detected [ 41.804058][ T5020] 6.5.0-rc1-syzkaller-00259-g831fe284d827 #0 Not tainted [ 41.811119][ T5020] ------------------------------------------------------ [ 41.818110][ T5020] syz-executor257/5020 is trying to acquire lock: [ 41.824497][ T5020] ffff88807d0720b0 (&tree->tree_lock){+.+.}-{3:3}, at: hfsplus_file_truncate+0xecf/0x1120 [ 41.834403][ T5020] [ 41.834403][ T5020] but task is already holding lock: [ 41.841843][ T5020] ffff88807d9487c8 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}, at: hfsplus_file_truncate+0x226/0x1120 [ 41.853053][ T5020] [ 41.853053][ T5020] which lock already depends on the new lock. [ 41.853053][ T5020] [ 41.863529][ T5020] [ 41.863529][ T5020] the existing dependency chain (in reverse order) is: [ 41.872526][ T5020] [ 41.872526][ T5020] -> #1 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}: [ 41.881549][ T5020] __mutex_lock+0x181/0x1340 [ 41.886671][ T5020] hfsplus_file_extend+0x1c5/0xf90 [ 41.892310][ T5020] hfsplus_bmap_reserve+0x318/0x410 [ 41.898020][ T5020] hfsplus_rename_cat+0x2ad/0x1240 [ 41.903639][ T5020] hfsplus_unlink+0x4dc/0x850 [ 41.908861][ T5020] vfs_unlink+0x2f1/0x900 [ 41.913701][ T5020] do_unlinkat+0x3da/0x6d0 [ 41.918625][ T5020] __x64_sys_unlink+0xc8/0x110 [ 41.923926][ T5020] do_syscall_64+0x38/0xb0 [ 41.928872][ T5020] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 41.935286][ T5020] [ 41.935286][ T5020] -> #0 (&tree->tree_lock){+.+.}-{3:3}: [ 41.943010][ T5020] __lock_acquire+0x2e3d/0x5de0 [ 41.948372][ T5020] lock_acquire+0x1ae/0x510 [ 41.953393][ T5020] __mutex_lock+0x181/0x1340 [ 41.958499][ T5020] hfsplus_file_truncate+0xecf/0x1120 [ 41.964553][ T5020] hfsplus_setattr+0x1eb/0x310 [ 41.969820][ T5020] notify_change+0x670/0x1160 [ 41.975008][ T5020] do_truncate+0x15c/0x220 [ 41.979933][ T5020] path_openat+0x23f1/0x29c0 [ 41.985038][ T5020] do_filp_open+0x1de/0x430 [ 41.990051][ T5020] do_sys_openat2+0x176/0x1e0 [ 41.995243][ T5020] __x64_sys_creat+0xcd/0x120 [ 42.000435][ T5020] do_syscall_64+0x38/0xb0 [ 42.005359][ T5020] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 42.011773][ T5020] [ 42.011773][ T5020] other info that might help us debug this: [ 42.011773][ T5020] [ 42.021993][ T5020] Possible unsafe locking scenario: [ 42.021993][ T5020] [ 42.029424][ T5020] CPU0 CPU1 [ 42.034769][ T5020] ---- ---- [ 42.040119][ T5020] lock(&HFSPLUS_I(inode)->extents_lock); [ 42.045909][ T5020] lock(&tree->tree_lock); [ 42.052911][ T5020] lock(&HFSPLUS_I(inode)->extents_lock); [ 42.061218][ T5020] lock(&tree->tree_lock); [ 42.065703][ T5020] [ 42.065703][ T5020] *** DEADLOCK *** [ 42.065703][ T5020] [ 42.073826][ T5020] 3 locks held by syz-executor257/5020: [ 42.079382][ T5020] #0: ffff88807d052410 (sb_writers#9){.+.+}-{0:0}, at: path_openat+0x1e7c/0x29c0 [ 42.088604][ T5020] #1: ffff88807d9489c0 (&sb->s_type->i_mutex_key#15){+.+.}-{3:3}, at: do_truncate+0x14b/0x220 [ 42.098978][ T5020] #2: ffff88807d9487c8 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}, at: hfsplus_file_truncate+0x226/0x1120 [ 42.110624][ T5020] [ 42.110624][ T5020] stack backtrace: [ 42.116491][ T5020] CPU: 1 PID: 5020 Comm: syz-executor257 Not tainted 6.5.0-rc1-syzkaller-00259-g831fe284d827 #0 [ 42.126887][ T5020] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023 [ 42.136929][ T5020] Call Trace: [ 42.140234][ T5020] [ 42.143155][ T5020] dump_stack_lvl+0xd9/0x1b0 [ 42.147763][ T5020] check_noncircular+0x311/0x3f0 [ 42.152702][ T5020] ? print_circular_bug+0x750/0x750 [ 42.157940][ T5020] __lock_acquire+0x2e3d/0x5de0 [ 42.162806][ T5020] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 42.168814][ T5020] lock_acquire+0x1ae/0x510 [ 42.173343][ T5020] ? hfsplus_file_truncate+0xecf/0x1120 [ 42.178895][ T5020] ? lock_sync+0x190/0x190 [ 42.183319][ T5020] ? preempt_count_sub+0x150/0x150 [ 42.188436][ T5020] ? __mutex_unlock_slowpath+0x165/0x640 [ 42.194078][ T5020] __mutex_lock+0x181/0x1340 [ 42.198673][ T5020] ? hfsplus_file_truncate+0xecf/0x1120 [ 42.204213][ T5020] ? hfsplus_file_truncate+0xecf/0x1120 [ 42.209747][ T5020] ? mutex_lock_io_nested+0x11a0/0x11a0 [ 42.215314][ T5020] ? hfsplus_file_truncate+0xecf/0x1120 [ 42.220851][ T5020] hfsplus_file_truncate+0xecf/0x1120 [ 42.226218][ T5020] ? hfsplus_get_block+0x9e0/0x9e0 [ 42.231329][ T5020] ? inode_newsize_ok+0x13c/0x200 [ 42.236352][ T5020] hfsplus_setattr+0x1eb/0x310 [ 42.241111][ T5020] ? hfsplus_file_fsync+0x5d0/0x5d0 [ 42.246301][ T5020] notify_change+0x670/0x1160 [ 42.251009][ T5020] do_truncate+0x15c/0x220 [ 42.255421][ T5020] ? file_open_root+0x450/0x450 [ 42.260269][ T5020] ? common_perm_cond+0x242/0x850 [ 42.265287][ T5020] path_openat+0x23f1/0x29c0 [ 42.269874][ T5020] ? path_lookupat+0x770/0x770 [ 42.274640][ T5020] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 42.280633][ T5020] do_filp_open+0x1de/0x430 [ 42.285131][ T5020] ? may_open_dev+0xf0/0xf0 [ 42.289625][ T5020] ? find_held_lock+0x2d/0x110 [ 42.294388][ T5020] ? _raw_spin_unlock+0x28/0x40 [ 42.299283][ T5020] ? alloc_fd+0x2da/0x6c0 [ 42.303612][ T5020] do_sys_openat2+0x176/0x1e0 [ 42.308286][ T5020] ? build_open_flags+0x690/0x690 [ 42.313306][ T5020] ? ptrace_notify+0xf4/0x130 [ 42.318096][ T5020] ? reacquire_held_locks+0x4b0/0x4b0 [ 42.323475][ T5020] __x64_sys_creat+0xcd/0x120 [ 42.328159][ T5020] ? __x64_compat_sys_openat+0x200/0x200 [ 42.333787][ T5020] ? _raw_spin_unlock_irq+0x2e/0x50 [ 42.338991][ T5020] ? ptrace_notify+0xf4/0x130 [ 42.343658][ T5020] ? syscall_trace_enter.constprop.0+0xaf/0x1e0 [ 42.349921][ T5020] do_syscall_64+0x38/0xb0 [ 42.354345][ T5020] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 42.360243][ T5020] RIP: 0033:0x7f9b85ee4879 [ 42.364646][ T5020] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 creat("./file1", 0332) = 5 exit_group(0) = ? +++ exited with 0 +++ [ 42.384604][ T5020] RSP: 002b:00007ffec4317078 EFLAGS: 00000246 O