./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor890044065 <...> Warning: Permanently added '10.128.0.143' (ED25519) to the list of known hosts. execve("./syz-executor890044065", ["./syz-executor890044065"], 0x7ffdf7223a40 /* 10 vars */) = 0 brk(NULL) = 0x555578d3e000 brk(0x555578d3ed00) = 0x555578d3ed00 arch_prctl(ARCH_SET_FS, 0x555578d3e380) = 0 set_tid_address(0x555578d3e650) = 5069 set_robust_list(0x555578d3e660, 24) = 0 rseq(0x555578d3eca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor890044065", 4096) = 27 getrandom("\xa9\x27\xc6\x97\x05\x59\x9b\x6d", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555578d3ed00 brk(0x555578d5fd00) = 0x555578d5fd00 brk(0x555578d60000) = 0x555578d60000 mprotect(0x7fa93f8e1000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa937400000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 524288) = 524288 munmap(0x7fa937400000, 138412032) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 close(4) = 0 mkdir("./file1", 0777) = 0 mount("/dev/loop0", "./file1", "hfsplus", MS_NOATIME, "") = 0 openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 chdir("./file1") = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [ 59.111099][ T5069] loop0: detected capacity change from 0 to 1024 open("./file1", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_DIRECT|O_NOATIME, 000) = 4 ftruncate(4, 33587195) = 0 symlink("./bus", "./bus") = 0 creat("./file2aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", 000) = 5 [ 59.173772][ T28] audit: type=1800 audit(1715575831.907:2): pid=5069 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor890" name="file1" dev="loop0" ino=20 res=0 errno=0 [ 59.221501][ T5069] [ 59.223855][ T5069] ====================================================== [ 59.230856][ T5069] WARNING: possible circular locking dependency detected [ 59.237957][ T5069] 6.9.0-rc7-syzkaller-00188-gba16c1cf11c9 #0 Not tainted [ 59.244978][ T5069] ------------------------------------------------------ [ 59.251980][ T5069] syz-executor890/5069 is trying to acquire lock: [ 59.258373][ T5069] ffff8880239007c8 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}, at: hfsplus_file_extend+0x21b/0x1b70 [ 59.269419][ T5069] [ 59.269419][ T5069] but task is already holding lock: [ 59.276780][ T5069] ffff8880243640b0 (&tree->tree_lock){+.+.}-{3:3}, at: hfsplus_find_init+0x14a/0x1c0 [ 59.286253][ T5069] [ 59.286253][ T5069] which lock already depends on the new lock. [ 59.286253][ T5069] [ 59.296653][ T5069] [ 59.296653][ T5069] the existing dependency chain (in reverse order) is: [ 59.305651][ T5069] [ 59.305651][ T5069] -> #1 (&tree->tree_lock){+.+.}-{3:3}: [ 59.313366][ T5069] lock_acquire+0x1ed/0x550 [ 59.318377][ T5069] __mutex_lock+0x136/0xd70 [ 59.323394][ T5069] hfsplus_file_truncate+0x811/0xb50 [ 59.329186][ T5069] hfsplus_setattr+0x1ce/0x280 [ 59.334474][ T5069] notify_change+0xb9d/0xe70 [ 59.339569][ T5069] do_ftruncate+0x46b/0x590 [ 59.344572][ T5069] __x64_sys_ftruncate+0x95/0xf0 [ 59.350016][ T5069] do_syscall_64+0xf5/0x240 [ 59.355035][ T5069] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 59.361433][ T5069] [ 59.361433][ T5069] -> #0 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}: [ 59.370442][ T5069] validate_chain+0x18cb/0x58e0 [ 59.375809][ T5069] __lock_acquire+0x1346/0x1fd0 [ 59.381170][ T5069] lock_acquire+0x1ed/0x550 [ 59.386257][ T5069] __mutex_lock+0x136/0xd70 [ 59.391260][ T5069] hfsplus_file_extend+0x21b/0x1b70 [ 59.396969][ T5069] hfsplus_bmap_reserve+0x105/0x4e0 [ 59.402681][ T5069] hfsplus_rename_cat+0x1d0/0x1050 [ 59.408290][ T5069] hfsplus_rename+0x12e/0x1c0 [ 59.413466][ T5069] vfs_rename+0xbdb/0xf00 [ 59.418299][ T5069] do_renameat2+0xd94/0x13f0 [ 59.423390][ T5069] __x64_sys_rename+0x86/0xa0 [ 59.428568][ T5069] do_syscall_64+0xf5/0x240 [ 59.433593][ T5069] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 59.439984][ T5069] [ 59.439984][ T5069] other info that might help us debug this: [ 59.439984][ T5069] [ 59.450228][ T5069] Possible unsafe locking scenario: [ 59.450228][ T5069] [ 59.457667][ T5069] CPU0 CPU1 [ 59.463036][ T5069] ---- ---- [ 59.468423][ T5069] lock(&tree->tree_lock); [ 59.472917][ T5069] lock(&HFSPLUS_I(inode)->extents_lock); [ 59.481232][ T5069] lock(&tree->tree_lock); [ 59.488270][ T5069] lock(&HFSPLUS_I(inode)->extents_lock); [ 59.494058][ T5069] [ 59.494058][ T5069] *** DEADLOCK *** [ 59.494058][ T5069] [ 59.502197][ T5069] 5 locks held by syz-executor890/5069: [ 59.507721][ T5069] #0: ffff888024348420 (sb_writers#9){.+.+}-{0:0}, at: mnt_want_write+0x3f/0x90 [ 59.516839][ T5069] #1: ffff888023901e00 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: do_renameat2+0x62c/0x13f0 [ 59.527353][ T5069] #2: ffff888024500300 (&sb->s_type->i_mutex_key#14){+.+.}-{3:3}, at: lock_two_nondirectories+0xe1/0x170 [ 59.538636][ T5069] #3: ffff888024501080 (&sb->s_type->i_mutex_key#14/4){+.+.}-{3:3}, at: vfs_rename+0x6a2/0xf00 [ 59.549318][ T5069] #4: ffff8880243640b0 (&tree->tree_lock){+.+.}-{3:3}, at: hfsplus_find_init+0x14a/0x1c0 [ 59.559223][ T5069] [ 59.559223][ T5069] stack backtrace: [ 59.565100][ T5069] CPU: 0 PID: 5069 Comm: syz-executor890 Not tainted 6.9.0-rc7-syzkaller-00188-gba16c1cf11c9 #0 [ 59.575522][ T5069] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 [ 59.585566][ T5069] Call Trace: [ 59.588853][ T5069] [ 59.591774][ T5069] dump_stack_lvl+0x241/0x360 [ 59.596442][ T5069] ? __pfx_dump_stack_lvl+0x10/0x10 [ 59.601629][ T5069] ? print_circular_bug+0x130/0x1a0 [ 59.606819][ T5069] check_noncircular+0x36a/0x4a0 [ 59.611739][ T5069] ? __read_once_word_nocheck+0x9/0x20 [ 59.617199][ T5069] ? __pfx_check_noncircular+0x10/0x10 [ 59.622648][ T5069] ? lockdep_lock+0x123/0x2b0 [ 59.627303][ T5069] ? is_bpf_text_address+0x28d/0x2b0 [ 59.632586][ T5069] ? is_bpf_text_address+0x26/0x2b0 [ 59.637765][ T5069] ? _find_first_zero_bit+0xd4/0x100 [ 59.643044][ T5069] validate_chain+0x18cb/0x58e0 [ 59.647883][ T5069] ? check_noncircular+0x259/0x4a0 [ 59.652988][ T5069] ? __pfx_validate_chain+0x10/0x10 [ 59.658193][ T5069] ? __pfx_check_noncircular+0x10/0x10 [ 59.663633][ T5069] ? lockdep_unlock+0x16a/0x300 [ 59.668460][ T5069] ? __pfx_lockdep_unlock+0x10/0x10 [ 59.673644][ T5069] ? add_lock_to_list+0x1de/0x2e0 [ 59.678740][ T5069] ? look_up_lock_class+0x77/0x160 [ 59.683863][ T5069] ? register_lock_class+0x102/0x980 [ 59.689143][ T5069] ? validate_chain+0x15a2/0x58e0 [ 59.694153][ T5069] ? __pfx_register_lock_class+0x10/0x10 [ 59.699851][ T5069] ? mark_lock+0x9a/0x350 [ 59.704169][ T5069] __lock_acquire+0x1346/0x1fd0 [ 59.709013][ T5069] lock_acquire+0x1ed/0x550 [ 59.713501][ T5069] ? hfsplus_file_extend+0x21b/0x1b70 [ 59.718951][ T5069] ? __pfx_lock_acquire+0x10/0x10 [ 59.723957][ T5069] ? __pfx___might_resched+0x10/0x10 [ 59.729233][ T5069] __mutex_lock+0x136/0xd70 [ 59.733722][ T5069] ? hfsplus_file_extend+0x21b/0x1b70 [ 59.739091][ T5069] ? hfsplus_file_extend+0x21b/0x1b70 [ 59.744464][ T5069] ? __pfx___mutex_lock+0x10/0x10 [ 59.749496][ T5069] hfsplus_file_extend+0x21b/0x1b70 [ 59.754684][ T5069] ? __pfx_hfsplus_file_extend+0x10/0x10 [ 59.760307][ T5069] ? rcu_is_watching+0x15/0xb0 [ 59.765056][ T5069] ? trace_contention_end+0x3c/0x120 [ 59.770336][ T5069] ? __mutex_lock+0x2ef/0xd70 [ 59.775013][ T5069] ? hfsplus_find_init+0x14a/0x1c0 [ 59.780146][ T5069] ? __pfx___mutex_lock+0x10/0x10 [ 59.785213][ T5069] ? rcu_is_watching+0x15/0xb0 [ 59.790006][ T5069] hfsplus_bmap_reserve+0x105/0x4e0 [ 59.795194][ T5069] hfsplus_rename_cat+0x1d0/0x1050 [ 59.800286][ T5069] ? reacquire_held_locks+0x3eb/0x690 [ 59.805640][ T5069] ? __mark_inode_dirty+0x516/0xe20 [ 59.810820][ T5069] ? __pfx_hfsplus_rename_cat+0x10/0x10 [ 59.816346][ T5069] ? __pfx_reacquire_held_locks+0x10/0x10 [ 59.822058][ T5069] ? __pfx_hfsplus_unlink+0x10/0x10 [ 59.827235][ T5069] ? __pfx___down_write_common+0x10/0x10 [ 59.832852][ T5069] ? __pfx___down_write_common+0x10/0x10 [ 59.838464][ T5069] hfsplus_rename+0x12e/0x1c0 [ 59.843123][ T5069] ? __pfx_hfsplus_rename+0x10/0x10 [ 59.848303][ T5069] vfs_rename+0xbdb/0xf00 [ 59.852626][ T5069] ? __pfx_vfs_rename+0x10/0x10 [ 59.857479][ T5069] ? security_path_rename+0x18b/0x220 [ 59.862850][ T5069] do_renameat2+0xd94/0x13f0 [ 59.867428][ T5069] ? __pfx_do_renameat2+0x10/0x10 [ 59.872454][ T5069] ? __virt_addr_valid+0x183/0x520 [ 59.877548][ T5069] ? __virt_addr_valid+0x183/0x520 [ 59.882687][ T5069] ? __check_object_size+0x4bc/0xa00 [ 59.887959][ T5069] ? getname_flags+0x1fe/0x4f0 [ 59.892720][ T5069] __x64_sys_rename+0x86/0xa0 [ 59.897397][ T5069] do_syscall_64+0xf5/0x240 [ 59.901884][ T5069] ? clear_bhb_loop+0x35/0x90 [ 59.906543][ T5069] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 59.912719][ T5069] RIP: 0033:0x7fa93f86e739 [ 59.917186][ T5069] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 59.936863][ T5069] RSP: 002b:00007ffd701afa98 EFLAGS: 00000246 ORIG_RAX: 0000000000000052 [ 59.945257][ T5069] RAX: ffffffffffffffda RBX: 0031656c69662f2e RCX: 00007fa93f86e739 [ 59.953217][ T5069] RDX: 0000000000000073 RSI: 0000000020000300 RDI: 0000000020000b00 [ 59.961194][ T5069] RBP: 00007fa93f8e1610 R08: 00007ffd701afc68 R09: 00007ffd701afc68 rename("./bus", "./file2") = 0 exit_group(0) = ? +++ exited with 0 +++ [ 59.969144][ T5069] R10: 00007ffd701afc68 R11: 0000000000000246 R