./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3458462569 <...> Warning: Permanently added '10.128.10.7' (ED25519) to the list of known hosts. execve("./syz-executor3458462569", ["./syz-executor3458462569"], 0x7ffc396da0a0 /* 10 vars */) = 0 brk(NULL) = 0x55555684c000 brk(0x55555684cd00) = 0x55555684cd00 arch_prctl(ARCH_SET_FS, 0x55555684c380) = 0 set_tid_address(0x55555684c650) = 5028 set_robust_list(0x55555684c660, 24) = 0 rseq(0x55555684cca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3458462569", 4096) = 28 getrandom("\x09\x3c\xb6\xa8\x3d\xe3\x84\x74", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55555684cd00 brk(0x55555686dd00) = 0x55555686dd00 brk(0x55555686e000) = 0x55555686e000 mprotect(0x7f90fea76000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f90f65c5000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 4194304) = 4194304 munmap(0x7f90f65c5000, 138412032) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 54.820136][ T5028] syz-executor345[5028]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 mkdir("./file1", 0777) = 0 [ 54.872728][ T5028] loop0: detected capacity change from 0 to 8192 [ 54.885593][ T5028] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 54.898897][ T5028] REISERFS (device loop0): found reiserfs format "3.5" with non-standard journal [ 54.908405][ T5028] REISERFS (device loop0): using ordered data mode [ 54.914936][ T5028] reiserfs: using flush barriers mount("/dev/loop0", "./file1", "reiserfs", 0, "") = 0 openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 chdir("./file1") = 0 ioctl(4, LOOP_CLR_FD) = 0 [ 54.921484][ T5028] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 16414, max trans age 30 [ 54.938432][ T5028] REISERFS (device loop0): checking transaction log (loop0) [ 54.948690][ T5028] REISERFS (device loop0): Using r5 hash to sort names [ 54.955816][ T5028] REISERFS (device loop0): using 3.5.x disk format [ 54.963988][ T5028] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. close(4) = 0 creat("./bus", 000) = 4 [ 54.981234][ T5028] [ 54.983604][ T5028] ====================================================== [ 54.990636][ T5028] WARNING: possible circular locking dependency detected [ 54.997673][ T5028] 6.6.0-rc5-syzkaller-00250-g70f8c6f8f880 #0 Not tainted [ 55.004727][ T5028] ------------------------------------------------------ [ 55.011758][ T5028] syz-executor345/5028 is trying to acquire lock: [ 55.018172][ T5028] ffff88801fe1e410 (sb_writers#9){.+.+}-{0:0}, at: mnt_want_write_file+0x61/0x200 [ 55.027397][ T5028] [ 55.027397][ T5028] but task is already holding lock: [ 55.034738][ T5028] ffff88807f411090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock+0x7a/0xd0 [ 55.043678][ T5028] [ 55.043678][ T5028] which lock already depends on the new lock. [ 55.043678][ T5028] [ 55.054086][ T5028] [ 55.054086][ T5028] the existing dependency chain (in reverse order) is: [ 55.063103][ T5028] [ 55.063103][ T5028] -> #2 (&sbi->lock){+.+.}-{3:3}: [ 55.070303][ T5028] __mutex_lock+0x136/0xd60 [ 55.075319][ T5028] reiserfs_write_lock+0x7a/0xd0 [ 55.080784][ T5028] reiserfs_lookup+0x162/0x580 [ 55.086056][ T5028] __lookup_slow+0x282/0x3e0 [ 55.091168][ T5028] lookup_one_len+0x18b/0x2d0 [ 55.096352][ T5028] reiserfs_lookup_privroot+0x89/0x180 [ 55.102332][ T5028] reiserfs_fill_super+0x21c1/0x2620 [ 55.108317][ T5028] mount_bdev+0x237/0x300 [ 55.113161][ T5028] legacy_get_tree+0xef/0x190 [ 55.118348][ T5028] vfs_get_tree+0x8c/0x280 [ 55.123291][ T5028] do_new_mount+0x28f/0xae0 [ 55.128299][ T5028] __se_sys_mount+0x2d9/0x3c0 [ 55.133484][ T5028] do_syscall_64+0x41/0xc0 [ 55.138408][ T5028] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 55.144813][ T5028] [ 55.144813][ T5028] -> #1 (&type->i_mutex_dir_key#6){+.+.}-{3:3}: [ 55.153231][ T5028] down_write+0x3a/0x50 [ 55.157987][ T5028] path_openat+0x7c2/0x3180 [ 55.163873][ T5028] do_filp_open+0x234/0x490 [ 55.168982][ T5028] do_sys_openat2+0x13e/0x1d0 [ 55.174301][ T5028] __x64_sys_creat+0x123/0x160 [ 55.179592][ T5028] do_syscall_64+0x41/0xc0 [ 55.184539][ T5028] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 55.191828][ T5028] [ 55.191828][ T5028] -> #0 (sb_writers#9){.+.+}-{0:0}: [ 55.199210][ T5028] __lock_acquire+0x39ff/0x7f70 [ 55.204916][ T5028] lock_acquire+0x1e3/0x520 [ 55.209923][ T5028] sb_start_write+0x4d/0x1c0 [ 55.215019][ T5028] mnt_want_write_file+0x61/0x200 [ 55.220545][ T5028] reiserfs_ioctl+0x178/0x2f0 [ 55.225751][ T5028] __se_sys_ioctl+0xf8/0x170 [ 55.230869][ T5028] do_syscall_64+0x41/0xc0 [ 55.235794][ T5028] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 55.242192][ T5028] [ 55.242192][ T5028] other info that might help us debug this: [ 55.242192][ T5028] [ 55.252663][ T5028] Chain exists of: [ 55.252663][ T5028] sb_writers#9 --> &type->i_mutex_dir_key#6 --> &sbi->lock [ 55.252663][ T5028] [ 55.265877][ T5028] Possible unsafe locking scenario: [ 55.265877][ T5028] [ 55.273314][ T5028] CPU0 CPU1 [ 55.278663][ T5028] ---- ---- [ 55.284004][ T5028] lock(&sbi->lock); [ 55.287984][ T5028] lock(&type->i_mutex_dir_key#6); [ 55.295686][ T5028] lock(&sbi->lock); [ 55.302169][ T5028] rlock(sb_writers#9); [ 55.306406][ T5028] [ 55.306406][ T5028] *** DEADLOCK *** [ 55.306406][ T5028] [ 55.314531][ T5028] 1 lock held by syz-executor345/5028: [ 55.319974][ T5028] #0: ffff88807f411090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock+0x7a/0xd0 [ 55.329360][ T5028] [ 55.329360][ T5028] stack backtrace: [ 55.335230][ T5028] CPU: 1 PID: 5028 Comm: syz-executor345 Not tainted 6.6.0-rc5-syzkaller-00250-g70f8c6f8f880 #0 [ 55.345621][ T5028] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 [ 55.355752][ T5028] Call Trace: [ 55.359044][ T5028] [ 55.362138][ T5028] dump_stack_lvl+0x1e7/0x2d0 [ 55.366810][ T5028] ? nf_tcp_handle_invalid+0x650/0x650 [ 55.372346][ T5028] ? print_circular_bug+0x12b/0x1a0 [ 55.377535][ T5028] check_noncircular+0x375/0x4a0 [ 55.382634][ T5028] ? print_deadlock_bug+0x600/0x600 [ 55.387820][ T5028] ? lockdep_lock+0x123/0x2b0 [ 55.392481][ T5028] ? mark_lock+0x9a/0x340 [ 55.396796][ T5028] ? _find_first_zero_bit+0xd4/0x100 [ 55.402092][ T5028] __lock_acquire+0x39ff/0x7f70 [ 55.406955][ T5028] ? verify_lock_unused+0x140/0x140 [ 55.412145][ T5028] ? lockdep_hardirqs_on+0x98/0x140 [ 55.418551][ T5028] ? __mutex_trylock_common+0x182/0x2e0 [ 55.424087][ T5028] ? __might_sleep+0xc0/0xc0 [ 55.428664][ T5028] ? trace_raw_output_contention_end+0xd0/0xd0 [ 55.434804][ T5028] lock_acquire+0x1e3/0x520 [ 55.439426][ T5028] ? mnt_want_write_file+0x61/0x200 [ 55.444665][ T5028] ? read_lock_is_recursive+0x20/0x20 [ 55.450024][ T5028] ? __might_sleep+0xc0/0xc0 [ 55.454601][ T5028] ? mutex_lock_nested+0x20/0x20 [ 55.459965][ T5028] sb_start_write+0x4d/0x1c0 [ 55.464543][ T5028] ? mnt_want_write_file+0x61/0x200 [ 55.469813][ T5028] mnt_want_write_file+0x61/0x200 [ 55.474821][ T5028] reiserfs_ioctl+0x178/0x2f0 [ 55.479489][ T5028] ? __se_sys_ioctl+0xed/0x170 [ 55.484262][ T5028] ? reiserfs_unpack+0x610/0x610 [ 55.489189][ T5028] __se_sys_ioctl+0xf8/0x170 [ 55.493798][ T5028] do_syscall_64+0x41/0xc0 [ 55.498215][ T5028] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 55.504270][ T5028] RIP: 0033:0x7f90fea025f9 [ 55.508675][ T5028] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 ioctl(4, FS_IOC_SETVERSION, 0) = -1 EFAULT (Bad address) exit_group(0) = ? +++ exited with 0 +++ [ 55.53269