./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4216434357 <...> Warning: Permanently added '10.128.1.7' (ECDSA) to the list of known hosts. execve("./syz-executor4216434357", ["./syz-executor4216434357"], 0x7ffcab32c6e0 /* 10 vars */) = 0 brk(NULL) = 0x55555637a000 brk(0x55555637ac40) = 0x55555637ac40 arch_prctl(ARCH_SET_FS, 0x55555637a300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor4216434357", 4096) = 28 brk(0x55555639bc40) = 0x55555639bc40 brk(0x55555639c000) = 0x55555639c000 mprotect(0x7fc0d1d3d000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5078 attached , child_tidptr=0x55555637a5d0) = 5078 [pid 5078] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 5078] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5078] setsid() = 1 [pid 5078] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5078] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5078] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5078] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5078] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5078] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5078] unshare(CLONE_NEWNS) = 0 [pid 5078] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5078] unshare(CLONE_NEWIPC) = 0 [pid 5078] unshare(CLONE_NEWCGROUP) = 0 [pid 5078] unshare(CLONE_NEWUTS) = 0 [pid 5078] unshare(CLONE_SYSVSEM) = 0 [pid 5078] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5078] write(3, "16777216", 8) = 8 [pid 5078] close(3) = 0 [pid 5078] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5078] write(3, "536870912", 9) = 9 [pid 5078] close(3) = 0 [pid 5078] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5078] write(3, "1024", 4) = 4 [pid 5078] close(3) = 0 [pid 5078] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5078] write(3, "8192", 4) = 4 [pid 5078] close(3) = 0 [pid 5078] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5078] write(3, "1024", 4) = 4 [pid 5078] close(3) = 0 [pid 5078] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5078] write(3, "1024", 4) = 4 [pid 5078] close(3) = 0 [pid 5078] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5078] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5078] close(3) = 0 [pid 5078] getpid() = 1 [pid 5078] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<i_mutex_dir_key#6/2){+.+.}-{3:3}, at: delete_one_xattr+0x106/0x2f0 [ 52.932500][ T5078] [ 52.932500][ T5078] but task is already holding lock: [ 52.939850][ T5078] ffff888072c7a400 (&type->i_mutex_dir_key#6/3){+.+.}-{3:3}, at: reiserfs_for_each_xattr+0x9a2/0xb50 [ 52.950727][ T5078] [ 52.950727][ T5078] which lock already depends on the new lock. [ 52.950727][ T5078] [ 52.961129][ T5078] [ 52.961129][ T5078] the existing dependency chain (in reverse order) is: [ 52.970134][ T5078] [ 52.970134][ T5078] -> #2 (&type->i_mutex_dir_key#6/3){+.+.}-{3:3}: [ 52.978732][ T5078] lock_acquire+0x20b/0x600 [ 52.983764][ T5078] down_write_nested+0x3d/0x60 [ 52.989043][ T5078] open_xa_dir+0x122/0x650 [ 52.993973][ T5078] xattr_lookup+0x24/0x280 [ 52.998900][ T5078] reiserfs_xattr_set_handle+0xfd/0xdc0 [ 53.004973][ T5078] reiserfs_xattr_set+0x428/0x550 [ 53.010520][ T5078] __vfs_setxattr+0x460/0x4a0 [ 53.015718][ T5078] __vfs_setxattr_noperm+0x12e/0x5e0 [ 53.021531][ T5078] vfs_setxattr+0x221/0x420 [ 53.026552][ T5078] ovl_get_workdir+0xcf6/0x16c0 [ 53.031931][ T5078] ovl_fill_super+0x1b8a/0x29c0 [ 53.037301][ T5078] mount_nodev+0x56/0xe0 [ 53.042065][ T5078] legacy_get_tree+0xef/0x190 [ 53.047256][ T5078] vfs_get_tree+0x8c/0x270 [ 53.052191][ T5078] do_new_mount+0x28f/0xae0 [ 53.057210][ T5078] __se_sys_mount+0x2c9/0x3b0 [ 53.062404][ T5078] do_syscall_64+0x41/0xc0 [ 53.067351][ T5078] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 53.073758][ T5078] [ 53.073758][ T5078] -> #1 (&type->i_mutex_dir_key#6){++++}-{3:3}: [ 53.082177][ T5078] lock_acquire+0x20b/0x600 [ 53.087191][ T5078] down_write+0x3a/0x60 [ 53.091855][ T5078] vfs_rename+0x797/0x1190 [ 53.096791][ T5078] do_renameat2+0xa70/0x1250 [ 53.101885][ T5078] __x64_sys_rename+0x86/0x90 [ 53.107066][ T5078] do_syscall_64+0x41/0xc0 [ 53.111993][ T5078] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 53.118417][ T5078] [ 53.118417][ T5078] -> #0 (&type->i_mutex_dir_key#6/2){+.+.}-{3:3}: [ 53.127009][ T5078] validate_chain+0x166b/0x5860 [ 53.132453][ T5078] __lock_acquire+0x125b/0x1f80 [ 53.137820][ T5078] lock_acquire+0x20b/0x600 [ 53.142828][ T5078] down_write_nested+0x3d/0x60 [ 53.148103][ T5078] delete_one_xattr+0x106/0x2f0 [ 53.153469][ T5078] reiserfs_for_each_xattr+0x9b0/0xb50 [ 53.159441][ T5078] reiserfs_delete_xattrs+0x1f/0x90 [ 53.165151][ T5078] reiserfs_evict_inode+0x207/0x470 [ 53.170857][ T5078] evict+0x2a4/0x620 [ 53.175260][ T5078] __dentry_kill+0x436/0x650 [ 53.180359][ T5078] dentry_kill+0xbb/0x290 [ 53.185194][ T5078] dput+0x1d8/0x3f0 [ 53.189508][ T5078] cleanup_mnt+0x469/0x520 [ 53.194429][ T5078] task_work_run+0x24a/0x300 [ 53.199544][ T5078] do_exit+0x605/0x2210 [ 53.204209][ T5078] do_group_exit+0x206/0x2c0 [ 53.209306][ T5078] __x64_sys_exit_group+0x3f/0x40 [ 53.214841][ T5078] do_syscall_64+0x41/0xc0 [ 53.219768][ T5078] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 53.226173][ T5078] [ 53.226173][ T5078] other info that might help us debug this: [ 53.226173][ T5078] [ 53.236381][ T5078] Chain exists of: [ 53.236381][ T5078] &type->i_mutex_dir_key#6/2 --> &type->i_mutex_dir_key#6 --> &type->i_mutex_dir_key#6/3 [ 53.236381][ T5078] [ 53.252115][ T5078] Possible unsafe locking scenario: [ 53.252115][ T5078] [ 53.259544][ T5078] CPU0 CPU1 [ 53.264888][ T5078] ---- ---- [ 53.270236][ T5078] lock(&type->i_mutex_dir_key#6/3); [ 53.275603][ T5078] lock(&type->i_mutex_dir_key#6); [ 53.283314][ T5078] lock(&type->i_mutex_dir_key#6/3); [ 53.291195][ T5078] lock(&type->i_mutex_dir_key#6/2); [ 53.296560][ T5078] [ 53.296560][ T5078] *** DEADLOCK *** [ 53.296560][ T5078] [ 53.304687][ T5078] 1 lock held by syz-executor421/5078: [ 53.310127][ T5078] #0: ffff888072c7a400 (&type->i_mutex_dir_key#6/3){+.+.}-{3:3}, at: reiserfs_for_each_xattr+0x9a2/0xb50 [ 53.321435][ T5078] [ 53.321435][ T5078] stack backtrace: [ 53.327304][ T5078] CPU: 0 PID: 5078 Comm: syz-executor421 Not tainted 6.2.0-rc7-syzkaller-00013-g513c1a3d3f19 #0 [ 53.337696][ T5078] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 [ 53.347735][ T5078] Call Trace: [ 53.351002][ T5078] [ 53.353924][ T5078] dump_stack_lvl+0x1b5/0x2a0 [ 53.358596][ T5078] ? nf_tcp_handle_invalid+0x640/0x640 [ 53.364048][ T5078] ? print_circular_bug+0x12b/0x1a0 [ 53.369236][ T5078] check_noncircular+0x2d1/0x390 [ 53.374159][ T5078] ? add_chain_block+0x850/0x850 [ 53.379088][ T5078] ? lockdep_lock+0x108/0x290 [ 53.383756][ T5078] ? _find_first_zero_bit+0xd4/0x100 [ 53.389028][ T5078] validate_chain+0x166b/0x5860 [ 53.393864][ T5078] ? validate_chain+0x119/0x5860 [ 53.398791][ T5078] ? reacquire_held_locks+0x640/0x640 [ 53.404150][ T5078] ? reacquire_held_locks+0x640/0x640 [ 53.409505][ T5078] ? do_journal_begin_r+0xdb9/0x1010 [ 53.414778][ T5078] ? __lock_acquire+0x1f80/0x1f80 [ 53.419785][ T5078] ? __mutex_lock_common+0x454/0x2630 [ 53.425146][ T5078] ? register_lock_class+0xc7/0x950 [ 53.430352][ T5078] ? register_lock_class+0xc7/0x950 [ 53.435539][ T5078] ? is_dynamic_key+0x1e0/0x1e0 [ 53.440381][ T5078] ? reiserfs_for_each_xattr+0x921/0xb50 [ 53.446003][ T5078] ? mark_lock+0x9a/0x340 [ 53.450317][ T5078] __lock_acquire+0x125b/0x1f80 [ 53.455156][ T5078] lock_acquire+0x20b/0x600 [ 53.459641][ T5078] ? delete_one_xattr+0x106/0x2f0 [ 53.464656][ T5078] ? read_lock_is_recursive+0x20/0x20 [ 53.470012][ T5078] ? __might_sleep+0xc0/0xc0 [ 53.474585][ T5078] ? __mutex_unlock_slowpath+0x21c/0x750 [ 53.480208][ T5078] ? journal_join_abort+0xe0/0xe0 [ 53.485223][ T5078] ? rwsem_write_trylock+0x16a/0x220 [ 53.490513][ T5078] ? mutex_unlock+0x10/0x10 [ 53.495009][ T5078] ? clear_nonspinnable+0x60/0x60 [ 53.500023][ T5078] down_write_nested+0x3d/0x60 [ 53.504775][ T5078] ? delete_one_xattr+0x106/0x2f0 [ 53.509787][ T5078] delete_one_xattr+0x106/0x2f0 [ 53.514642][ T5078] reiserfs_for_each_xattr+0x9b0/0xb50 [ 53.520095][ T5078] ? reiserfs_for_each_xattr+0xb50/0xb50 [ 53.525719][ T5078] ? reiserfs_delete_xattrs+0x90/0x90 [ 53.531082][ T5078] ? memset+0x23/0x40 [ 53.535058][ T5078] ? reiserfs_xattr_init+0x730/0x730 [ 53.540348][ T5078] ? do_raw_spin_unlock+0x13b/0x8b0 [ 53.545535][ T5078] reiserfs_delete_xattrs+0x1f/0x90 [ 53.550725][ T5078] reiserfs_evict_inode+0x207/0x470 [ 53.555914][ T5078] ? entry_points_to_object+0x340/0x340 [ 53.561451][ T5078] ? bit_waitqueue+0x30/0x30 [ 53.566050][ T5078] ? do_raw_spin_unlock+0x13b/0x8b0 [ 53.571238][ T5078] ? entry_points_to_object+0x340/0x340 [ 53.576794][ T5078] evict+0x2a4/0x620 [ 53.580678][ T5078] __dentry_kill+0x436/0x650 [ 53.585282][ T5078] dentry_kill+0xbb/0x290 [ 53.589601][ T5078] dput+0x1d8/0x3f0 [ 53.593397][ T5078] cleanup_mnt+0x469/0x520 [ 53.597802][ T5078] ? lockdep_hardirqs_on+0x90/0x130 [ 53.602987][ T5078] task_work_run+0x24a/0x300 [ 53.607653][ T5078] ? kasan_quarantine_put+0xc4/0x210 [ 53.612924][ T5078] ? task_work_cancel+0x2b0/0x2b0 [ 53.617938][ T5078] ? kmem_cache_free+0x2b5/0x580 [ 53.622865][ T5078] ? do_exit+0x600/0x2210 [ 53.627185][ T5078] do_exit+0x605/0x2210 [ 53.631335][ T5078] ? lockdep_hardirqs_on_prepare+0x418/0x780 [ 53.637308][ T5078] ? put_task_struct+0x80/0x80 [ 53.642064][ T5078] ? print_irqtrace_events+0x220/0x220 [ 53.647514][ T5078] ? _raw_spin_unlock_irq+0x23/0x50 [ 53.652703][ T5078] ? lockdep_hardirqs_on+0x90/0x130 [ 53.657887][ T5078] do_group_exit+0x206/0x2c0 [ 53.662476][ T5078] __x64_sys_exit_group+0x3f/0x40 [ 53.667505][ T5078] do_syscall_64+0x41/0xc0 [ 53.671914][ T5078] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 53.677798][ T5078] RIP: 0033:0x7fc0d1cccbb9 [ 53.682199][ T5078] Code: Unable to access opcode bytes at 0x7fc0d1cccb8f. [ 53.689197][ T5078] RSP: 002b:00007ffc7f488aa8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 53.697596][ T5078] RAX: ffffffffffffffda RBX: 00007fc0d1d43330 RCX: 00007fc0d1cccbb9 [ 53.705553][ T5078] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 53.713510][ T5078] RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 00007fc0d1d3de40 [ 53.721466][ T5078] R10: 00007fc0d1d3de40 R11: 0000000000000246 R12: 00007fc0d1d43330 [ 53.729423][ T5078] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 [pid 5078] +++ exited with 1 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5078, si_uid=0, si_status=1, si_utime=0, si_stime=20 /* 0.20 s */} --- exit_group(0) = ? +++ exited with 0 +++ [ 53.737383][ T5078]