./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3533732699 <...> Warning: Permanently added '10.128.0.232' (ECDSA) to the list of known hosts. execve("./syz-executor3533732699", ["./syz-executor3533732699"], 0x7ffead54d940 /* 10 vars */) = 0 brk(NULL) = 0x555556982000 brk(0x555556982c40) = 0x555556982c40 arch_prctl(ARCH_SET_FS, 0x555556982300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor3533732699", 4096) = 28 brk(0x5555569a3c40) = 0x5555569a3c40 brk(0x5555569a4000) = 0x5555569a4000 mprotect(0x7fb7e8ebd000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb7e0a03000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 4194304) = 4194304 munmap(0x7fb7e0a03000, 4194304) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 mkdir("./file0", 0777) = 0 syzkaller login: [ 42.493509][ T4998] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=4998 'syz-executor353' [ 42.529160][ T4998] loop0: detected capacity change from 0 to 8192 [ 42.541070][ T4998] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 42.554168][ T4998] REISERFS (device loop0): found reiserfs format "3.6" with non-standard journal [ 42.563894][ T4998] REISERFS (device loop0): using ordered data mode [ 42.570446][ T4998] reiserfs: using flush barriers [ 42.577860][ T4998] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 mount("/dev/loop0", "./file0", "reiserfs", MS_RDONLY|MS_NOSUID|MS_SYNCHRONOUS|MS_REC, "") = 0 openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 chdir("./file0") = 0 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 openat(AT_FDCWD, ".", O_RDONLY) = 4 ioctl(4, FS_IOC_SETVERSION, 0) = -1 EROFS (Read-only file system) mkdir(".", 0777) = -1 EEXIST (File exists) [ 42.594189][ T4998] REISERFS (device loop0): checking transaction log (loop0) [ 42.603202][ T4998] REISERFS (device loop0): Using tea hash to sort names [ 42.616019][ T4998] ======================================================= [ 42.616019][ T4998] WARNING: The mand mount option has been deprecated and [ 42.616019][ T4998] and is ignored by this kernel. Remove the mand [ 42.616019][ T4998] option from the mount to silence this warning. mount(NULL, ".", 0x200001c0, MS_NODEV|MS_NOEXEC|MS_SYNCHRONOUS|MS_REMOUNT|MS_MANDLOCK|MS_DIRSYNC|MS_NOATIME|MS_SILENT|MS_PRIVATE|MS_I_VERSION|MS_STRICTATIME, "") = 0 openat(AT_FDCWD, ".", O_RDONLY|O_DIRECTORY) = 5 chdir(".") = 0 [ 42.616019][ T4998] ======================================================= [ 42.651197][ T4998] reiserfs: enabling write barrier flush mode [ 42.661152][ T4998] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. [ 42.672223][ T4998] [ 42.674554][ T4998] ====================================================== [ 42.681547][ T4998] WARNING: possible circular locking dependency detected [ 42.688553][ T4998] 6.4.0-rc7-syzkaller-00194-g8a28a0b6f1a1 #0 Not tainted [ 42.695558][ T4998] ------------------------------------------------------ [ 42.702550][ T4998] syz-executor353/4998 is trying to acquire lock: [ 42.708937][ T4998] ffff888077ef82e0 (&type->i_mutex_dir_key#6){+.+.}-{3:3}, at: path_openat+0x90f/0x2750 [ 42.718698][ T4998] [ 42.718698][ T4998] but task is already holding lock: [ 42.726051][ T4998] ffff888079680460 (sb_writers#9){.+.+}-{0:0}, at: path_openat+0x2716/0x2750 [ 42.734822][ T4998] [ 42.734822][ T4998] which lock already depends on the new lock. [ 42.734822][ T4998] [ 42.745210][ T4998] [ 42.745210][ T4998] the existing dependency chain (in reverse order) is: [ 42.754243][ T4998] [ 42.754243][ T4998] -> #2 (sb_writers#9){.+.+}-{0:0}: [ 42.761621][ T4998] mnt_want_write_file+0x92/0x5d0 [ 42.767160][ T4998] reiserfs_ioctl+0x1a2/0x330 [ 42.772345][ T4998] __x64_sys_ioctl+0x197/0x210 [ 42.777639][ T4998] do_syscall_64+0x39/0xb0 [ 42.782582][ T4998] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 42.788987][ T4998] [ 42.788987][ T4998] -> #1 (&sbi->lock){+.+.}-{3:3}: [ 42.796167][ T4998] __mutex_lock+0x12f/0x1350 [ 42.801260][ T4998] reiserfs_write_lock+0x79/0x100 [ 42.806788][ T4998] reiserfs_lookup+0x175/0x610 [ 42.812049][ T4998] __lookup_slow+0x24c/0x460 [ 42.817153][ T4998] lookup_one_len+0x16e/0x1a0 [ 42.822532][ T4998] reiserfs_lookup_privroot+0x96/0x210 [ 42.828510][ T4998] reiserfs_fill_super+0x1a8d/0x2eb0 [ 42.834295][ T4998] mount_bdev+0x358/0x420 [ 42.839121][ T4998] legacy_get_tree+0x109/0x220 [ 42.844382][ T4998] vfs_get_tree+0x8d/0x350 [ 42.849294][ T4998] path_mount+0x134b/0x1e40 [ 42.854315][ T4998] __x64_sys_mount+0x283/0x300 [ 42.859577][ T4998] do_syscall_64+0x39/0xb0 [ 42.864590][ T4998] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 42.870986][ T4998] [ 42.870986][ T4998] -> #0 (&type->i_mutex_dir_key#6){+.+.}-{3:3}: [ 42.879389][ T4998] __lock_acquire+0x2fcd/0x5f30 [ 42.884755][ T4998] lock_acquire+0x1b1/0x520 [ 42.889778][ T4998] down_write+0x92/0x200 [ 42.894523][ T4998] path_openat+0x90f/0x2750 [ 42.899529][ T4998] do_filp_open+0x1ba/0x410 [ 42.904531][ T4998] do_sys_openat2+0x16d/0x4c0 [ 42.909707][ T4998] __x64_sys_openat+0x143/0x1f0 [ 42.915069][ T4998] do_syscall_64+0x39/0xb0 [ 42.919978][ T4998] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 42.926386][ T4998] [ 42.926386][ T4998] other info that might help us debug this: [ 42.926386][ T4998] [ 42.936592][ T4998] Chain exists of: [ 42.936592][ T4998] &type->i_mutex_dir_key#6 --> &sbi->lock --> sb_writers#9 [ 42.936592][ T4998] [ 42.949873][ T4998] Possible unsafe locking scenario: [ 42.949873][ T4998] [ 42.957312][ T4998] CPU0 CPU1 [ 42.962649][ T4998] ---- ---- [ 42.967988][ T4998] rlock(sb_writers#9); [ 42.972207][ T4998] lock(&sbi->lock); [ 42.978693][ T4998] lock(sb_writers#9); [ 42.985375][ T4998] lock(&type->i_mutex_dir_key#6); [ 42.990564][ T4998] [ 42.990564][ T4998] *** DEADLOCK *** [ 42.990564][ T4998] [ 42.998769][ T4998] 1 lock held by syz-executor353/4998: [ 43.004200][ T4998] #0: ffff888079680460 (sb_writers#9){.+.+}-{0:0}, at: path_openat+0x2716/0x2750 [ 43.013415][ T4998] [ 43.013415][ T4998] stack backtrace: [ 43.019303][ T4998] CPU: 1 PID: 4998 Comm: syz-executor353 Not tainted 6.4.0-rc7-syzkaller-00194-g8a28a0b6f1a1 #0 [ 43.029785][ T4998] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 [ 43.039930][ T4998] Call Trace: [ 43.043194][ T4998] [ 43.046110][ T4998] dump_stack_lvl+0xd9/0x150 [ 43.050690][ T4998] check_noncircular+0x25f/0x2e0 [ 43.055609][ T4998] ? print_circular_bug+0x730/0x730 [ 43.060886][ T4998] ? print_circular_bug+0x730/0x730 [ 43.066093][ T4998] ? __stack_depot_save+0x39/0x510 [ 43.071196][ T4998] __lock_acquire+0x2fcd/0x5f30 [ 43.076237][ T4998] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 43.082223][ T4998] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 43.088191][ T4998] lock_acquire+0x1b1/0x520 [ 43.092680][ T4998] ? path_openat+0x90f/0x2750 [ 43.097357][ T4998] ? lock_sync+0x190/0x190 [ 43.101845][ T4998] down_write+0x92/0x200 [ 43.106168][ T4998] ? path_openat+0x90f/0x2750 [ 43.110826][ T4998] ? rwsem_down_write_slowpath+0x1220/0x1220 [ 43.116785][ T4998] ? __mnt_want_write+0x1fe/0x2e0 [ 43.121788][ T4998] ? mnt_want_write+0x15b/0x420 [ 43.126624][ T4998] path_openat+0x90f/0x2750 [ 43.131107][ T4998] ? path_lookupat+0x840/0x840 [ 43.135863][ T4998] do_filp_open+0x1ba/0x410 [ 43.140348][ T4998] ? may_open_dev+0xf0/0xf0 [ 43.144826][ T4998] ? find_held_lock+0x2d/0x110 [ 43.149606][ T4998] ? do_raw_spin_lock+0x124/0x2b0 [ 43.154637][ T4998] ? spin_bug+0x1c0/0x1c0 [ 43.158947][ T4998] ? _raw_spin_unlock+0x28/0x40 [ 43.163783][ T4998] ? alloc_fd+0x2e4/0x750 [ 43.168094][ T4998] do_sys_openat2+0x16d/0x4c0 [ 43.172751][ T4998] ? ptrace_stop.part.0+0x60f/0x8e0 [ 43.177933][ T4998] ? build_open_flags+0x720/0x720 [ 43.183108][ T4998] ? ptrace_notify+0xfe/0x140 [ 43.187760][ T4998] ? lock_downgrade+0x690/0x690 [ 43.192593][ T4998] __x64_sys_openat+0x143/0x1f0 [ 43.197428][ T4998] ? __ia32_sys_open+0x1c0/0x1c0 [ 43.202357][ T4998] ? _raw_spin_unlock_irq+0x23/0x50 [ 43.207552][ T4998] ? lockdep_hardirqs_on+0x7d/0x100 [ 43.212729][ T4998] ? _raw_spin_unlock_irq+0x2e/0x50 [ 43.217915][ T4998] ? ptrace_notify+0xfe/0x140 [ 43.222575][ T4998] do_syscall_64+0x39/0xb0 [ 43.226970][ T4998] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 43.232847][ T4998] RIP: 0033:0x7fb7e8e4f8f9 [ 43.237241][ T4998] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 43.256846][ T4998] RSP: 002b:00007ffecde0f678 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 43.265241][ T4998] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb7e8e4f8f9 [ 43.273199][ T4998] RDX: 000000000000275a RSI: 0000000020000280 RDI: 00000000ffffff9c [ 43.281172][ T4998] RBP: 00007fb7e8e0f190 R08: 00000000200000c0 R09: 0000000000000000 [ 43.289128][ T4998] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb7e8e0f220 openat(AT_FDCWD, "cgroup.controllers", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 6 exit_group(0) = ? +++ exited with 0 +++ [