./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor600459789 <...> Warning: Permanently added '10.128.0.29' (ED25519) to the list of known hosts. execve("./syz-executor600459789", ["./syz-executor600459789"], 0x7ffe5bbff7b0 /* 10 vars */) = 0 brk(NULL) = 0x555556320000 brk(0x555556320d00) = 0x555556320d00 arch_prctl(ARCH_SET_FS, 0x555556320380) = 0 set_tid_address(0x555556320650) = 5014 set_robust_list(0x555556320660, 24) = 0 rseq(0x555556320ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor600459789", 4096) = 27 getrandom("\x7d\x0f\x76\x4d\x6a\xe1\xa3\x73", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555556320d00 brk(0x555556341d00) = 0x555556341d00 brk(0x555556342000) = 0x555556342000 mprotect(0x7fe0dd0b2000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5015 attached , child_tidptr=0x555556320650) = 5015 [pid 5015] set_robust_list(0x555556320660, 24) = 0 [pid 5015] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 5015] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5015] setsid() = 1 [pid 5015] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5015] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5015] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5015] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5015] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5015] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5015] unshare(CLONE_NEWNS) = 0 [pid 5015] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5015] unshare(CLONE_NEWIPC) = 0 [pid 5015] unshare(CLONE_NEWCGROUP) = 0 [pid 5015] unshare(CLONE_NEWUTS) = 0 [pid 5015] unshare(CLONE_SYSVSEM) = 0 [pid 5015] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5015] write(3, "16777216", 8) = 8 [pid 5015] close(3) = 0 [pid 5015] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5015] write(3, "536870912", 9) = 9 [pid 5015] close(3) = 0 [pid 5015] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5015] write(3, "1024", 4) = 4 [pid 5015] close(3) = 0 [pid 5015] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5015] write(3, "8192", 4) = 4 [pid 5015] close(3) = 0 [pid 5015] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5015] write(3, "1024", 4) = 4 [pid 5015] close(3) = 0 [pid 5015] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5015] write(3, "1024", 4) = 4 [pid 5015] close(3) = 0 [pid 5015] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5015] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5015] close(3) = 0 [pid 5015] getpid() = 1 [pid 5015] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<tree_lock/1){+.+.}-{3:3}, at: hfs_find_init+0x16e/0x1f0 [ 54.061855][ T12] [ 54.061855][ T12] but task is already holding lock: [ 54.069202][ T12] ffff88801e8740b0 (&tree->tree_lock/1){+.+.}-{3:3}, at: hfs_find_init+0x16e/0x1f0 [ 54.078496][ T12] [ 54.078496][ T12] other info that might help us debug this: [ 54.086530][ T12] Possible unsafe locking scenario: [ 54.086530][ T12] [ 54.093955][ T12] CPU0 [ 54.097214][ T12] ---- [ 54.100472][ T12] lock(&tree->tree_lock/1); [ 54.105131][ T12] lock(&tree->tree_lock/1); [ 54.109799][ T12] [ 54.109799][ T12] *** DEADLOCK *** [ 54.109799][ T12] [ 54.117921][ T12] May be due to missing lock nesting notation [ 54.117921][ T12] [ 54.126304][ T12] 4 locks held by kworker/u4:1/12: [ 54.131386][ T12] #0: ffff888012ede938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work+0x7e3/0x12c0 [ 54.141986][ T12] #1: ffffc90000117d00 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work+0x82b/0x12c0 [ 54.153800][ T12] #2: ffff88801e8740b0 (&tree->tree_lock/1){+.+.}-{3:3}, at: hfs_find_init+0x16e/0x1f0 [ 54.163538][ T12] #3: ffff88807d4800f8 (&HFS_I(tree->inode)->extents_lock){+.+.}-{3:3}, at: hfs_extend_file+0xff/0x1440 [ 54.174729][ T12] [ 54.174729][ T12] stack backtrace: [ 54.180592][ T12] CPU: 1 PID: 12 Comm: kworker/u4:1 Not tainted 6.5.0-rc3-syzkaller-00123-g57012c57536f #0 [ 54.190547][ T12] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023 [ 54.200580][ T12] Workqueue: writeback wb_workfn (flush-7:0) [ 54.206550][ T12] Call Trace: [ 54.209812][ T12] [ 54.212727][ T12] dump_stack_lvl+0x1e7/0x2d0 [ 54.217383][ T12] ? nf_tcp_handle_invalid+0x650/0x650 [ 54.222820][ T12] ? print_deadlock_bug+0x462/0x600 [ 54.227998][ T12] ? _find_first_zero_bit+0xd4/0x100 [ 54.233266][ T12] __lock_acquire+0x6a81/0x7f70 [ 54.238100][ T12] ? unwind_next_frame+0x1a0d/0x2390 [ 54.243364][ T12] ? verify_lock_unused+0x140/0x140 [ 54.248559][ T12] ? mark_lock+0x9a/0x340 [ 54.252879][ T12] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 54.258845][ T12] ? print_irqtrace_events+0x220/0x220 [ 54.264293][ T12] ? _raw_spin_unlock_irqrestore+0x8f/0x140 [ 54.270195][ T12] ? lockdep_hardirqs_on+0x98/0x140 [ 54.275380][ T12] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 54.281256][ T12] ? _raw_spin_unlock+0x40/0x40 [ 54.286089][ T12] ? stack_trace_snprint+0xf0/0xf0 [ 54.291204][ T12] lock_acquire+0x1e3/0x520 [ 54.295777][ T12] ? hfs_find_init+0x16e/0x1f0 [ 54.300522][ T12] ? read_lock_is_recursive+0x20/0x20 [ 54.305876][ T12] ? hfs_find_init+0x90/0x1f0 [ 54.310532][ T12] ? hfs_extend_file+0x31b/0x1440 [ 54.315550][ T12] ? __might_sleep+0xc0/0xc0 [ 54.320171][ T12] ? __writeback_single_inode+0x69b/0xfa0 [ 54.325885][ T12] ? writeback_sb_inodes+0x8e3/0x11d0 [ 54.331245][ T12] ? wb_writeback+0x44d/0xc60 [ 54.335911][ T12] ? wb_workfn+0x400/0xff0 [ 54.340311][ T12] ? process_one_work+0x92c/0x12c0 [ 54.345405][ T12] ? worker_thread+0xa63/0x1210 [ 54.350233][ T12] ? kthread+0x2b8/0x350 [ 54.354464][ T12] ? ret_from_fork+0x2e/0x60 [ 54.359038][ T12] ? ret_from_fork_asm+0x11/0x20 [ 54.363964][ T12] __mutex_lock_common+0x1d8/0x2530 [ 54.369171][ T12] ? hfs_find_init+0x16e/0x1f0 [ 54.373947][ T12] ? hfs_find_init+0x16e/0x1f0 [ 54.378717][ T12] ? mutex_lock_io_nested+0x60/0x60 [ 54.383929][ T12] ? rcu_is_watching+0x15/0xb0 [ 54.388679][ T12] ? hfs_find_init+0x90/0x1f0 [ 54.393368][ T12] ? __kmalloc+0xe6/0x230 [ 54.397681][ T12] mutex_lock_nested+0x1b/0x20 [ 54.402431][ T12] hfs_find_init+0x16e/0x1f0 [ 54.407002][ T12] hfs_extend_file+0x31b/0x1440 [ 54.411854][ T12] ? hfs_get_block+0xb60/0xb60 [ 54.416601][ T12] ? rcu_is_watching+0x15/0xb0 [ 54.421343][ T12] ? __mutex_lock_common+0x42d/0x2530 [ 54.426697][ T12] ? hfs_brec_find+0x197/0x570 [ 54.431441][ T12] ? mutex_lock_io_nested+0x60/0x60 [ 54.436620][ T12] hfs_bmap_reserve+0xd9/0x3f0 [ 54.441374][ T12] __hfs_ext_write_extent+0x22e/0x4f0 [ 54.446727][ T12] hfs_ext_write_extent+0x154/0x1d0 [ 54.452009][ T12] ? hfs_ext_keycmp+0x310/0x310 [ 54.456851][ T12] ? do_raw_spin_unlock+0x13b/0x8b0 [ 54.462038][ T12] hfs_write_inode+0xbc/0xec0 [ 54.466728][ T12] ? hfs_inode_write_fork+0x1a0/0x1a0 [ 54.472176][ T12] ? __writeback_single_inode+0x4ac/0xfa0 [ 54.477885][ T12] ? do_raw_spin_unlock+0x13b/0x8b0 [ 54.483070][ T12] __writeback_single_inode+0x69b/0xfa0 [ 54.488602][ T12] writeback_sb_inodes+0x8e3/0x11d0 [ 54.493798][ T12] ? queue_io+0x570/0x570 [ 54.498132][ T12] ? __writeback_inodes_wb+0x260/0x260 [ 54.503598][ T12] ? queue_io+0x3d5/0x570 [ 54.507922][ T12] wb_writeback+0x44d/0xc60 [ 54.512414][ T12] ? rcu_lock_release+0x30/0x30 [ 54.517272][ T12] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 54.523237][ T12] wb_workfn+0x400/0xff0 [ 54.527471][ T12] ? inode_wait_for_writeback+0x290/0x290 [ 54.533349][ T12] ? read_lock_is_recursive+0x20/0x20 [ 54.538701][ T12] ? lockdep_hardirqs_on_prepare+0x43c/0x7a0 [ 54.544661][ T12] ? print_irqtrace_events+0x220/0x220 [ 54.550098][ T12] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 54.555973][ T12] process_one_work+0x92c/0x12c0 [ 54.560897][ T12] ? worker_detach_from_pool+0x290/0x290 [ 54.566510][ T12] ? _raw_spin_lock_irqsave+0x120/0x120 [ 54.572386][ T12] ? wq_worker_running+0xa1/0x200 [ 54.577388][ T12] worker_thread+0xa63/0x1210 [ 54.582049][ T12] kthread+0x2b8/0x350 [ 54.586119][ T12] ? pr_cont_work+0x5e0/0x5e0 [ 54.590780][ T12] ? kthread_blkcg+0xd0/0xd0 [ 54.595350][ T12] ret_from_fork+0x2e/0x60 [ 54.599747][ T12] ? kthread_blkcg+0xd0/0xd0 [ 54.604324][ T12] ret_from_fork_asm+0x11/0x20 [ 54.609067][ T12] RIP: 0000:0x0 [ 54.612511][ T12] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 54.619875][ T12] RSP: 0000:0000000000000000 EFLAGS: 00000000 ORIG_RAX: 0000000000000000 [ 54.628378][ T12] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 54.636339][ T12] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 54.644303][ T12] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 54.652254][ T12] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 54.660212][ T12] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 54.668171][ T12]