./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1778087388 <...> Warning: Permanently added '10.128.0.56' (ED25519) to the list of known hosts. execve("./syz-executor1778087388", ["./syz-executor1778087388"], 0x7fffe7324690 /* 10 vars */) = 0 brk(NULL) = 0x5555566f0000 brk(0x5555566f0d00) = 0x5555566f0d00 arch_prctl(ARCH_SET_FS, 0x5555566f0380) = 0 set_tid_address(0x5555566f0650) = 5067 set_robust_list(0x5555566f0660, 24) = 0 rseq(0x5555566f0ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1778087388", 4096) = 28 getrandom("\xea\xa5\x32\x21\x97\xc3\x2c\x78", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555566f0d00 brk(0x555556711d00) = 0x555556711d00 brk(0x555556712000) = 0x555556712000 mprotect(0x7fb59ec58000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb5967a7000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 4194304) = 4194304 munmap(0x7fb5967a7000, 138412032) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 mkdir("./file0", 0777) = 0 [ 51.352660][ T5067] loop0: detected capacity change from 0 to 8192 [ 51.363427][ T5067] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 51.376483][ T5067] REISERFS (device loop0): found reiserfs format "3.5" with non-standard journal [ 51.385823][ T5067] REISERFS (device loop0): using ordered data mode [ 51.392408][ T5067] reiserfs: using flush barriers mount("/dev/loop0", "./file0", "reiserfs", MS_NODEV|MS_NOEXEC|MS_SILENT, "") = 0 openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 chdir("./file0") = 0 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 [ 51.398525][ T5067] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 51.414870][ T5067] REISERFS (device loop0): checking transaction log (loop0) [ 51.424023][ T5067] REISERFS (device loop0): Using tea hash to sort names [ 51.431712][ T5067] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. open("./file1", O_RDONLY|O_CREAT, 000) = 4 [ 51.456660][ T5067] [ 51.458987][ T5067] ====================================================== [ 51.465995][ T5067] WARNING: possible circular locking dependency detected [ 51.473001][ T5067] 6.7.0-rc7-syzkaller-00003-gfbafc3e621c3 #0 Not tainted [ 51.479992][ T5067] ------------------------------------------------------ [ 51.486978][ T5067] syz-executor177/5067 is trying to acquire lock: [ 51.493358][ T5067] ffff888017b58418 (sb_writers#9){.+.+}-{0:0}, at: reiserfs_ioctl+0x194/0x2e0 [ 51.502223][ T5067] [ 51.502223][ T5067] but task is already holding lock: [ 51.509557][ T5067] ffff88814827f090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock+0x79/0x100 [ 51.518566][ T5067] [ 51.518566][ T5067] which lock already depends on the new lock. [ 51.518566][ T5067] [ 51.528939][ T5067] [ 51.528939][ T5067] the existing dependency chain (in reverse order) is: [ 51.537921][ T5067] [ 51.537921][ T5067] -> #2 (&sbi->lock){+.+.}-{3:3}: [ 51.545096][ T5067] __mutex_lock+0x175/0x9d0 [ 51.550106][ T5067] reiserfs_write_lock+0x79/0x100 [ 51.555639][ T5067] reiserfs_lookup+0x184/0x690 [ 51.560914][ T5067] __lookup_slow+0x24d/0x450 [ 51.566011][ T5067] lookup_one_len+0x17d/0x1b0 [ 51.571196][ T5067] reiserfs_lookup_privroot+0x94/0x200 [ 51.577155][ T5067] reiserfs_fill_super+0x20f9/0x3160 [ 51.582944][ T5067] mount_bdev+0x1f3/0x2e0 [ 51.587781][ T5067] legacy_get_tree+0x109/0x220 [ 51.593055][ T5067] vfs_get_tree+0x8c/0x370 [ 51.597979][ T5067] path_mount+0x1492/0x1ed0 [ 51.602993][ T5067] __x64_sys_mount+0x293/0x310 [ 51.608263][ T5067] do_syscall_64+0x40/0x110 [ 51.613276][ T5067] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 51.619677][ T5067] [ 51.619677][ T5067] -> #1 (&type->i_mutex_dir_key#6){+.+.}-{3:3}: [ 51.628172][ T5067] down_write+0x3a/0x50 [ 51.632830][ T5067] path_openat+0x8bd/0x2c50 [ 51.637843][ T5067] do_filp_open+0x1de/0x430 [ 51.642855][ T5067] do_sys_openat2+0x176/0x1e0 [ 51.648042][ T5067] __x64_sys_open+0x154/0x1e0 [ 51.653315][ T5067] do_syscall_64+0x40/0x110 [ 51.658332][ T5067] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 51.664824][ T5067] [ 51.664824][ T5067] -> #0 (sb_writers#9){.+.+}-{0:0}: [ 51.672190][ T5067] __lock_acquire+0x2433/0x3b20 [ 51.677554][ T5067] lock_acquire+0x1ae/0x520 [ 51.682566][ T5067] mnt_want_write_file+0x98/0x600 [ 51.688098][ T5067] reiserfs_ioctl+0x194/0x2e0 [ 51.693289][ T5067] __x64_sys_ioctl+0x18f/0x210 [ 51.698565][ T5067] do_syscall_64+0x40/0x110 [ 51.703576][ T5067] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 51.709977][ T5067] [ 51.709977][ T5067] other info that might help us debug this: [ 51.709977][ T5067] [ 51.720182][ T5067] Chain exists of: [ 51.720182][ T5067] sb_writers#9 --> &type->i_mutex_dir_key#6 --> &sbi->lock [ 51.720182][ T5067] [ 51.733296][ T5067] Possible unsafe locking scenario: [ 51.733296][ T5067] [ 51.740724][ T5067] CPU0 CPU1 [ 51.746067][ T5067] ---- ---- [ 51.751410][ T5067] lock(&sbi->lock); [ 51.755374][ T5067] lock(&type->i_mutex_dir_key#6); [ 51.763078][ T5067] lock(&sbi->lock); [ 51.769559][ T5067] rlock(sb_writers#9); [ 51.773784][ T5067] [ 51.773784][ T5067] *** DEADLOCK *** [ 51.773784][ T5067] [ 51.781906][ T5067] 1 lock held by syz-executor177/5067: [ 51.787343][ T5067] #0: ffff88814827f090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock+0x79/0x100 [ 51.796805][ T5067] [ 51.796805][ T5067] stack backtrace: [ 51.802674][ T5067] CPU: 1 PID: 5067 Comm: syz-executor177 Not tainted 6.7.0-rc7-syzkaller-00003-gfbafc3e621c3 #0 [ 51.813065][ T5067] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 51.823105][ T5067] Call Trace: [ 51.826369][ T5067] [ 51.829288][ T5067] dump_stack_lvl+0xd9/0x1b0 [ 51.833869][ T5067] check_noncircular+0x317/0x400 [ 51.838804][ T5067] ? print_circular_bug+0x5c0/0x5c0 [ 51.843996][ T5067] ? lockdep_lock+0xc6/0x200 [ 51.848577][ T5067] ? hlock_class+0x130/0x130 [ 51.853156][ T5067] __lock_acquire+0x2433/0x3b20 [ 51.858003][ T5067] ? lockdep_hardirqs_on_prepare+0x420/0x420 [ 51.863975][ T5067] ? rcu_is_watching+0x12/0xb0 [ 51.868728][ T5067] lock_acquire+0x1ae/0x520 [ 51.873220][ T5067] ? reiserfs_ioctl+0x194/0x2e0 [ 51.878065][ T5067] ? lock_sync+0x190/0x190 [ 51.882472][ T5067] ? make_vfsuid+0x108/0x160 [ 51.887050][ T5067] ? preempt_count_sub+0x160/0x160 [ 51.892149][ T5067] mnt_want_write_file+0x98/0x600 [ 51.897165][ T5067] ? reiserfs_ioctl+0x194/0x2e0 [ 51.902008][ T5067] reiserfs_ioctl+0x194/0x2e0 [ 51.906677][ T5067] ? reiserfs_fileattr_set+0x4f0/0x4f0 [ 51.912129][ T5067] __x64_sys_ioctl+0x18f/0x210 [ 51.916889][ T5067] do_syscall_64+0x40/0x110 [ 51.921380][ T5067] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 51.927256][ T5067] RIP: 0033:0x7fb59ebe4639 [ 51.931652][ T5067] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 ioctl(4, FS_IOC_SETVERSION, 0) = -1 EFAULT (Bad address) exit_group(0) = ? +++ exited with 0 +++ [ 51.951244][ T5067] RSP: 002b:00007ffc4530d638 EFLAGS: 00000246 ORIG_RAX: 00000000000000