./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2474994768 <...> Warning: Permanently added '10.128.15.208' (ED25519) to the list of known hosts. execve("./syz-executor2474994768", ["./syz-executor2474994768"], 0x7ffd8d1a7bf0 /* 10 vars */) = 0 brk(NULL) = 0x5555678a0000 brk(0x5555678a0d00) = 0x5555678a0d00 arch_prctl(ARCH_SET_FS, 0x5555678a0380) = 0 set_tid_address(0x5555678a0650) = 5839 set_robust_list(0x5555678a0660, 24) = 0 rseq(0x5555678a0ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2474994768", 4096) = 28 getrandom("\x54\x00\xcc\x7f\x25\x60\x1c\x4b", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555678a0d00 brk(0x5555678c1d00) = 0x5555678c1d00 brk(0x5555678c2000) = 0x5555678c2000 mprotect(0x7f16f54ef000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 write(1, "executing program\n", 18executing program ) = 18 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f16ed000000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 munmap(0x7f16ed000000, 138412032) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 92.089570][ T10] cfg80211: failed to load regulatory.db ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 close(4) = 0 mkdir("./file1", 0777) = 0 [ 92.131812][ T5839] loop0: detected capacity change from 0 to 32768 [ 92.158812][ T5839] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 (7:0) scanned by syz-executor247 (5839) [ 92.188990][ T5839] BTRFS info (device loop0): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 92.200140][ T5839] BTRFS info (device loop0): using crc32c (crc32c-lib) checksum algorithm [ 92.209150][ T5839] BTRFS info (device loop0): disk space caching is enabled [ 92.216626][ T5839] BTRFS warning (device loop0): space cache v1 is being deprecated and will be removed in a future release, please use -o space_cache=v2 [ 92.263443][ T5839] [ 92.265829][ T5839] ====================================================== [ 92.272864][ T5839] WARNING: possible circular locking dependency detected [ 92.279897][ T5839] 6.16.0-rc2-next-20250620-syzkaller #0 Not tainted [ 92.286496][ T5839] ------------------------------------------------------ [ 92.293525][ T5839] syz-executor247/5839 is trying to acquire lock: [ 92.302471][ T5839] ffffffff8e6e9fe8 (uuid_mutex){+.+.}-{4:4}, at: btrfs_read_chunk_tree+0xef/0x2170 [ 92.311848][ T5839] [ 92.311848][ T5839] but task is already holding lock: [ 92.319229][ T5839] ffff888026a4a0e0 (&type->s_umount_key#41/1){+.+.}-{4:4}, at: alloc_super+0x204/0x970 [ 92.328942][ T5839] [ 92.328942][ T5839] which lock already depends on the new lock. [ 92.328942][ T5839] [ 92.339488][ T5839] [ 92.339488][ T5839] the existing dependency chain (in reverse order) is: [ 92.348512][ T5839] [ 92.348512][ T5839] -> #1 (&type->s_umount_key#41/1){+.+.}-{4:4}: [ 92.356958][ T5839] lock_acquire+0x120/0x360 [ 92.361991][ T5839] down_write_nested+0x9d/0x200 [ 92.367361][ T5839] alloc_super+0x204/0x970 [ 92.372303][ T5839] sget_fc+0x329/0xa40 [ 92.376892][ T5839] btrfs_get_tree+0x4c6/0x12d0 [ 92.382185][ T5839] vfs_get_tree+0x8f/0x2b0 [ 92.387126][ T5839] do_new_mount+0x24a/0xa40 [ 92.392927][ T5839] __se_sys_mount+0x317/0x410 [ 92.398126][ T5839] do_syscall_64+0xfa/0x3b0 [ 92.403158][ T5839] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.409575][ T5839] [ 92.409575][ T5839] -> #0 (uuid_mutex){+.+.}-{4:4}: [ 92.416789][ T5839] validate_chain+0xb9b/0x2140 [ 92.422075][ T5839] __lock_acquire+0xab9/0xd20 [ 92.427271][ T5839] lock_acquire+0x120/0x360 [ 92.432295][ T5839] __mutex_lock+0x182/0xe80 [ 92.437314][ T5839] btrfs_read_chunk_tree+0xef/0x2170 [ 92.443118][ T5839] open_ctree+0x17f2/0x3a10 [ 92.448139][ T5839] btrfs_get_tree+0xc6f/0x12d0 [ 92.453423][ T5839] vfs_get_tree+0x8f/0x2b0 [ 92.458364][ T5839] do_new_mount+0x24a/0xa40 [ 92.463403][ T5839] __se_sys_mount+0x317/0x410 [ 92.468614][ T5839] do_syscall_64+0xfa/0x3b0 [ 92.473639][ T5839] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.480048][ T5839] [ 92.480048][ T5839] other info that might help us debug this: [ 92.480048][ T5839] [ 92.490273][ T5839] Possible unsafe locking scenario: [ 92.490273][ T5839] [ 92.497889][ T5839] CPU0 CPU1 [ 92.503259][ T5839] ---- ---- [ 92.508620][ T5839] lock(&type->s_umount_key#41/1); [ 92.513841][ T5839] lock(uuid_mutex); [ 92.520361][ T5839] lock(&type->s_umount_key#41/1); [ 92.528098][ T5839] lock(uuid_mutex); [ 92.532087][ T5839] [ 92.532087][ T5839] *** DEADLOCK *** [ 92.532087][ T5839] [ 92.540235][ T5839] 1 lock held by syz-executor247/5839: [ 92.545688][ T5839] #0: ffff888026a4a0e0 (&type->s_umount_key#41/1){+.+.}-{4:4}, at: alloc_super+0x204/0x970 [ 92.555803][ T5839] [ 92.555803][ T5839] stack backtrace: [ 92.561777][ T5839] CPU: 0 UID: 0 PID: 5839 Comm: syz-executor247 Not tainted 6.16.0-rc2-next-20250620-syzkaller #0 PREEMPT(full) [ 92.561794][ T5839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 92.561803][ T5839] Call Trace: [ 92.561811][ T5839] [ 92.561818][ T5839] dump_stack_lvl+0x189/0x250 [ 92.561842][ T5839] ? __pfx_dump_stack_lvl+0x10/0x10 [ 92.561861][ T5839] ? __pfx__printk+0x10/0x10 [ 92.561876][ T5839] ? print_lock_name+0xde/0x100 [ 92.561890][ T5839] print_circular_bug+0x2ee/0x310 [ 92.561904][ T5839] check_noncircular+0x134/0x160 [ 92.561926][ T5839] validate_chain+0xb9b/0x2140 [ 92.561953][ T5839] __lock_acquire+0xab9/0xd20 [ 92.561971][ T5839] ? btrfs_read_chunk_tree+0xef/0x2170 [ 92.561986][ T5839] lock_acquire+0x120/0x360 [ 92.562001][ T5839] ? btrfs_read_chunk_tree+0xef/0x2170 [ 92.562020][ T5839] __mutex_lock+0x182/0xe80 [ 92.562033][ T5839] ? btrfs_read_chunk_tree+0xef/0x2170 [ 92.562050][ T5839] ? btrfs_read_chunk_tree+0xef/0x2170 [ 92.562065][ T5839] ? __pfx___mutex_lock+0x10/0x10 [ 92.562079][ T5839] ? rcu_is_watching+0x15/0xb0 [ 92.562098][ T5839] ? trace_kmem_cache_alloc+0x1f/0xc0 [ 92.562117][ T5839] ? btrfs_read_chunk_tree+0xcd/0x2170 [ 92.562133][ T5839] btrfs_read_chunk_tree+0xef/0x2170 [ 92.562149][ T5839] ? btrfs_root_node+0xae/0x4a0 [ 92.562166][ T5839] ? btrfs_root_node+0x459/0x4a0 [ 92.562181][ T5839] ? btrfs_root_node+0xae/0x4a0 [ 92.562197][ T5839] ? __pfx_btrfs_root_node+0x10/0x10 [ 92.562214][ T5839] ? __pfx_btrfs_read_chunk_tree+0x10/0x10 [ 92.562228][ T5839] ? load_super_root+0x2b2/0x3f0 [ 92.562243][ T5839] ? __pfx_load_super_root+0x10/0x10 [ 92.562259][ T5839] ? read_extent_buffer+0x120/0x5e0 [ 92.562274][ T5839] ? open_ctree+0x17ea/0x3a10 [ 92.562289][ T5839] open_ctree+0x17f2/0x3a10 [ 92.562303][ T5839] ? bdi_register_va+0x58d/0x740 [ 92.562317][ T5839] ? open_ctree+0xa1a/0x3a10 [ 92.562335][ T5839] ? __pfx_open_ctree+0x10/0x10 [ 92.562352][ T5839] btrfs_get_tree+0xc6f/0x12d0 [ 92.562371][ T5839] vfs_get_tree+0x8f/0x2b0 [ 92.562391][ T5839] do_new_mount+0x24a/0xa40 [ 92.562406][ T5839] __se_sys_mount+0x317/0x410 [ 92.562420][ T5839] ? __pfx___se_sys_mount+0x10/0x10 [ 92.562432][ T5839] ? rcu_is_watching+0x15/0xb0 [ 92.562452][ T5839] ? __x64_sys_mount+0x20/0xc0 [ 92.562465][ T5839] do_syscall_64+0xfa/0x3b0 [ 92.562478][ T5839] ? lockdep_hardirqs_on+0x9c/0x150 [ 92.562490][ T5839] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.562503][ T5839] ? clear_bhb_loop+0x60/0xb0 [ 92.562517][ T5839] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.562530][ T5839] RIP: 0033:0x7f16f5478d7a [ 92.562544][ T5839] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 92.562555][ T5839] RSP: 002b:00007ffd5ce5d2a8 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5 [ 92.562569][ T5839] RAX: ffffffffffffffda RBX: 00007ffd5ce5d2c0 RCX: 00007f16f5478d7a [ 92.562579][ T5839] RDX: 0000200000005100 RSI: 0000200000000000 RDI: 00007ffd5ce5d2c0 [ 92.562594][ T5839] RBP: 0000200000000000 R08: 00007ffd5ce5d300 R09: 00000000000050ed [ 92.562603][ T5839] R10: 0000000000000810 R11: 0000000000000282 R12: 0000200000005100 [ 92.562612][ T5839] R13: 00007ffd5ce5d300 R14: 0000000000000003 R15: 0000000000000810 [ 92.562626][ T5839] [ 92.892501][ T5839] BTRFS info (device loop0): rebuilding free space tree [ 92.904041][ T5839] BTRFS info (device loop0): disabling free space tree mount("/dev/loop0", "./file1", "btrfs", MS_SYNCHRONOUS|MS_NODIRATIME, "treelog,nodatacow,max_inline=m3x9e6,space_cache,nodatasum,nobarrier,flushoncommit,noautodefrag,ref_v"...) = 0 openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 chdir("./file1") = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 exit_group(0) = ? +++ exited with 0 +++ [ 92.911039][ T5839] BTRFS info (device loop0): clearing com