./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor474218316 <...> no interfaces have a carrier [ 30.159850][ T4643] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.169686][ T4643] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: [ 30.602059][ T4735] sshd (4735) used greatest stack depth: 21432 bytes left OK syzkaller Warning: Permanently added '10.128.0.253' (ECDSA) to the list of known hosts. execve("./syz-executor474218316", ["./syz-executor474218316"], 0x7ffe92c32890 /* 10 vars */) = 0 brk(NULL) = 0x555557305000 brk(0x555557305c40) = 0x555557305c40 arch_prctl(ARCH_SET_FS, 0x555557305300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor474218316", 4096) = 27 brk(0x555557326c40) = 0x555557326c40 brk(0x555557327000) = 0x555557327000 mprotect(0x7f5ba656c000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f5b9e093000 write(3, "\xeb\x52\x90\x4e\x54\x46\x53\x20\x20\x20\x20\x00\x02\x02\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x80\x00\xff\x0f\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\xff\x03\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x04\x00\x00\x00\x8f\x24\x2d\x5f\x49\x6d\x50\x0b\x00\x00\x00\x00\x0e\x1f\xbe\x71\x7c\xac\x22\xc0\x74\x0b\x56\xb4\x0e\xbb\x07\x00"..., 2097152) = 2097152 munmap(0x7f5b9e093000, 2097152) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 mkdir("./file0", 0777) = 0 mount("/dev/loop0", "./file0", "ntfs3", 0, "discard,gid=0x0000000000000000,force,sparse,iocharset=cp855,gid=0x000000000000ee01,sparse,") = 0 openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 chdir("./file0") = 0 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 openat(AT_FDCWD, "./file0", O_RDONLY) = 4 ioctl(4, FS_IOC_FIEMAP, {fm_start=7, fm_length=9223372036854775807, fm_flags=FIEMAP_FLAG_SYNC, fm_extent_count=2} => {fm_flags=FIEMAP_FLAG_SYNC, fm_mapped_extents=1, ...}) = 1 creat("./bus", 000) = 5 ftruncate(5, 32768) = 0 open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_LARGEFILE|O_NOFOLLOW|O_NOATIME|O_CLOEXEC|FASYNC, 000) = 6 syzkaller login: [ 54.419692][ T5063] loop0: detected capacity change from 0 to 4096 [ 54.481217][ T5063] [ 54.483582][ T5063] ====================================================== [ 54.490617][ T5063] WARNING: possible circular locking dependency detected [ 54.497626][ T5063] 6.2.0-rc1-syzkaller-00084-gc8451c141e07 #0 Not tainted [ 54.504643][ T5063] ------------------------------------------------------ [ 54.511638][ T5063] syz-executor474/5063 is trying to acquire lock: [ 54.518028][ T5063] ffff88807660f700 (&ni->ni_lock/4){+.+.}-{3:3}, at: attr_data_get_block+0x32c/0x19f0 [ 54.527619][ T5063] [ 54.527619][ T5063] but task is already holding lock: [ 54.535155][ T5063] ffff88807aab0158 (&mm->mmap_lock){++++}-{3:3}, at: vm_mmap_pgoff+0x159/0x280 [ 54.544100][ T5063] [ 54.544100][ T5063] which lock already depends on the new lock. [ 54.544100][ T5063] [ 54.554502][ T5063] [ 54.554502][ T5063] the existing dependency chain (in reverse order) is: [ 54.563511][ T5063] [ 54.563511][ T5063] -> #1 (&mm->mmap_lock){++++}-{3:3}: [ 54.571066][ T5063] __might_fault+0x10c/0x180 [ 54.576206][ T5063] _copy_to_user+0x29/0x150 [ 54.581265][ T5063] fiemap_fill_next_extent+0x217/0x370 [ 54.587255][ T5063] ni_fiemap+0x2f9/0xc00 [ 54.592023][ T5063] ntfs_fiemap+0xcc/0x120 [ 54.596870][ T5063] do_vfs_ioctl+0x466/0x15b0 [ 54.601981][ T5063] __x64_sys_ioctl+0x10c/0x210 [ 54.607646][ T5063] do_syscall_64+0x39/0xb0 [ 54.612586][ T5063] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 54.619022][ T5063] [ 54.619022][ T5063] -> #0 (&ni->ni_lock/4){+.+.}-{3:3}: [ 54.626579][ T5063] __lock_acquire+0x2a43/0x56d0 [ 54.631954][ T5063] lock_acquire+0x1e3/0x630 [ 54.636988][ T5063] __mutex_lock+0x12f/0x1360 [ 54.642108][ T5063] attr_data_get_block+0x32c/0x19f0 [ 54.647832][ T5063] ntfs_file_mmap+0x478/0x6a0 [ 54.653019][ T5063] mmap_region+0x6c3/0x1dd0 [ 54.658063][ T5063] do_mmap+0x831/0xf60 [ 54.662662][ T5063] vm_mmap_pgoff+0x1af/0x280 [ 54.667850][ T5063] ksys_mmap_pgoff+0x41f/0x5a0 [ 54.673141][ T5063] do_syscall_64+0x39/0xb0 [ 54.678099][ T5063] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 54.684510][ T5063] [ 54.684510][ T5063] other info that might help us debug this: [ 54.684510][ T5063] [ 54.694913][ T5063] Possible unsafe locking scenario: [ 54.694913][ T5063] [ 54.702379][ T5063] CPU0 CPU1 [ 54.707733][ T5063] ---- ---- [ 54.713278][ T5063] lock(&mm->mmap_lock); [ 54.717625][ T5063] lock(&ni->ni_lock/4); [ 54.724588][ T5063] lock(&mm->mmap_lock); [ 54.731451][ T5063] lock(&ni->ni_lock/4); [ 54.735777][ T5063] [ 54.735777][ T5063] *** DEADLOCK *** [ 54.735777][ T5063] [ 54.743916][ T5063] 1 lock held by syz-executor474/5063: [ 54.749377][ T5063] #0: ffff88807aab0158 (&mm->mmap_lock){++++}-{3:3}, at: vm_mmap_pgoff+0x159/0x280 [ 54.758786][ T5063] [ 54.758786][ T5063] stack backtrace: [ 54.764673][ T5063] CPU: 0 PID: 5063 Comm: syz-executor474 Not tainted 6.2.0-rc1-syzkaller-00084-gc8451c141e07 #0 [ 54.775096][ T5063] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 54.785154][ T5063] Call Trace: [ 54.788420][ T5063] [ 54.791336][ T5063] dump_stack_lvl+0xd1/0x138 [ 54.795924][ T5063] check_noncircular+0x25f/0x2e0 [ 54.801054][ T5063] ? register_lock_class+0xbe/0x1120 [ 54.806334][ T5063] ? print_circular_bug+0x1e0/0x1e0 [ 54.811530][ T5063] ? stack_trace_save+0x90/0xc0 [ 54.816381][ T5063] __lock_acquire+0x2a43/0x56d0 [ 54.821231][ T5063] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 54.827200][ T5063] ? __lock_acquire+0x2567/0x56d0 [ 54.832226][ T5063] lock_acquire+0x1e3/0x630 [ 54.836738][ T5063] ? attr_data_get_block+0x32c/0x19f0 [ 54.842118][ T5063] ? lock_release+0x810/0x810 [ 54.846790][ T5063] __mutex_lock+0x12f/0x1360 [ 54.851381][ T5063] ? attr_data_get_block+0x32c/0x19f0 [ 54.856744][ T5063] ? attr_data_get_block+0x32c/0x19f0 [ 54.862115][ T5063] ? mutex_lock_io_nested+0x11a0/0x11a0 [ 54.867667][ T5063] ? __up_read+0x192/0x720 [ 54.872078][ T5063] ? up_write+0x520/0x520 [ 54.876400][ T5063] attr_data_get_block+0x32c/0x19f0 [ 54.881607][ T5063] ? kasan_addr_to_slab+0x11/0x90 [ 54.886627][ T5063] ? __kasan_slab_alloc+0x82/0x90 [ 54.891653][ T5063] ? kmem_cache_alloc+0x1e4/0x430 [ 54.896668][ T5063] ? vm_area_alloc+0x20/0x100 [ 54.901384][ T5063] ? do_mmap+0x831/0xf60 [ 54.905652][ T5063] ? vm_mmap_pgoff+0x1af/0x280 [ 54.910421][ T5063] ? ksys_mmap_pgoff+0x41f/0x5a0 [ 54.915383][ T5063] ? attr_set_size+0x2ac0/0x2ac0 [ 54.920867][ T5063] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 54.926850][ T5063] ? find_held_lock+0x2d/0x110 [ 54.931651][ T5063] ntfs_file_mmap+0x478/0x6a0 [ 54.936320][ T5063] ? ntfs3_setattr+0xd30/0xd30 [ 54.941095][ T5063] ? kmem_cache_alloc+0x234/0x430 [ 54.946131][ T5063] mmap_region+0x6c3/0x1dd0 [ 54.950669][ T5063] ? do_munmap+0x100/0x100 [ 54.955080][ T5063] ? security_mmap_addr+0x77/0xa0 [ 54.960105][ T5063] ? get_unmapped_area+0x1e8/0x3c0 [ 54.965210][ T5063] do_mmap+0x831/0xf60 [ 54.969293][ T5063] vm_mmap_pgoff+0x1af/0x280 [ 54.973885][ T5063] ? randomize_page+0xb0/0xb0 [ 54.978577][ T5063] ksys_mmap_pgoff+0x41f/0x5a0 [ 54.983353][ T5063] do_syscall_64+0x39/0xb0 [ 54.987767][ T5063] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 54.993657][ T5063] RIP: 0033:0x7f5ba64dfcf9 [ 54.998064][ T5063] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 55.017686][ T5063] RSP: 002b:00007ffe29c6bcc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 mmap(0x20001000, 40960, PROT_WRITE|PROT_EXEC|0x800000, MAP_SHARED|MAP_FIXED, 6, 0) = 0x20001000 exit_group(0) = ? +++ exited with 0 +++ [ 55.026093][ T5063] RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007f5ba64dfcf9