./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3401464993 <...> Warning: Permanently added '10.128.0.124' (ED25519) to the list of known hosts. execve("./syz-executor3401464993", ["./syz-executor3401464993"], 0x7ffdb23b7f10 /* 10 vars */) = 0 brk(NULL) = 0x5555560f7000 brk(0x5555560f7d00) = 0x5555560f7d00 arch_prctl(ARCH_SET_FS, 0x5555560f7380) = 0 set_tid_address(0x5555560f7650) = 5057 set_robust_list(0x5555560f7660, 24) = 0 rseq(0x5555560f7ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3401464993", 4096) = 28 getrandom("\x84\xb3\x21\x6d\x80\xa3\x1d\xae", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555560f7d00 brk(0x555556118d00) = 0x555556118d00 brk(0x555556119000) = 0x555556119000 mprotect(0x7ff0e9af0000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff0e163f000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 4194304) = 4194304 munmap(0x7ff0e163f000, 138412032) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 mkdir("./file0", 0777) = 0 [ 55.740527][ T5057] loop0: detected capacity change from 0 to 8192 [ 55.761883][ T5057] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 55.774930][ T5057] REISERFS (device loop0): found reiserfs format "3.5" with non-standard journal [ 55.784339][ T5057] REISERFS (device loop0): using ordered data mode [ 55.790842][ T5057] reiserfs: using flush barriers [ 55.797145][ T5057] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 55.814000][ T5057] REISERFS (device loop0): checking transaction log (loop0) [ 55.823300][ T5057] REISERFS (device loop0): Using r5 hash to sort names [ 55.830295][ T5057] REISERFS (device loop0): using 3.5.x disk format mount("/dev/loop0", "./file0", "reiserfs", 0, "") = 0 openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 chdir("./file0") = 0 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 openat(AT_FDCWD, "memory.events.local", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [ 55.837600][ T5057] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. [ 55.877218][ T5057] [ 55.879552][ T5057] ====================================================== [ 55.886568][ T5057] WARNING: possible circular locking dependency detected [ 55.893583][ T5057] 6.7.0-rc8-syzkaller-00024-gac865f00af29 #0 Not tainted [ 55.900594][ T5057] ------------------------------------------------------ [ 55.907587][ T5057] syz-executor340/5057 is trying to acquire lock: [ 55.913975][ T5057] ffff88801cdda418 (sb_writers#9){.+.+}-{0:0}, at: mnt_want_write_file+0x61/0x200 [ 55.923192][ T5057] [ 55.923192][ T5057] but task is already holding lock: [ 55.930527][ T5057] ffff888078bbc090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock+0x7a/0xd0 [ 55.939457][ T5057] [ 55.939457][ T5057] which lock already depends on the new lock. [ 55.939457][ T5057] [ 55.949836][ T5057] [ 55.949836][ T5057] the existing dependency chain (in reverse order) is: [ 55.958826][ T5057] [ 55.958826][ T5057] -> #2 (&sbi->lock){+.+.}-{3:3}: [ 55.966010][ T5057] lock_acquire+0x1e3/0x530 [ 55.971014][ T5057] __mutex_lock+0x136/0xd60 [ 55.976026][ T5057] reiserfs_write_lock+0x7a/0xd0 [ 55.981465][ T5057] reiserfs_lookup+0x162/0x580 [ 55.986729][ T5057] __lookup_slow+0x282/0x3e0 [ 55.991816][ T5057] lookup_one_len+0x188/0x2c0 [ 55.996988][ T5057] reiserfs_lookup_privroot+0x89/0x180 [ 56.002946][ T5057] reiserfs_fill_super+0x21c1/0x2620 [ 56.008748][ T5057] mount_bdev+0x237/0x300 [ 56.013576][ T5057] legacy_get_tree+0xef/0x190 [ 56.018753][ T5057] vfs_get_tree+0x8c/0x2a0 [ 56.023675][ T5057] do_new_mount+0x28f/0xae0 [ 56.028684][ T5057] __se_sys_mount+0x2d9/0x3c0 [ 56.033863][ T5057] do_syscall_64+0x45/0x110 [ 56.038867][ T5057] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 56.045256][ T5057] [ 56.045256][ T5057] -> #1 (&type->i_mutex_dir_key#6){+.+.}-{3:3}: [ 56.053661][ T5057] lock_acquire+0x1e3/0x530 [ 56.058663][ T5057] down_write+0x3a/0x50 [ 56.063316][ T5057] path_openat+0x7bc/0x3290 [ 56.068315][ T5057] do_filp_open+0x234/0x490 [ 56.073315][ T5057] do_sys_openat2+0x13e/0x1d0 [ 56.078495][ T5057] __x64_sys_openat+0x247/0x290 [ 56.083844][ T5057] do_syscall_64+0x45/0x110 [ 56.088846][ T5057] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 56.095237][ T5057] [ 56.095237][ T5057] -> #0 (sb_writers#9){.+.+}-{0:0}: [ 56.102600][ T5057] validate_chain+0x1909/0x5ab0 [ 56.107955][ T5057] __lock_acquire+0x1345/0x1fd0 [ 56.113320][ T5057] lock_acquire+0x1e3/0x530 [ 56.118323][ T5057] sb_start_write+0x4d/0x1c0 [ 56.123417][ T5057] mnt_want_write_file+0x61/0x200 [ 56.128940][ T5057] reiserfs_ioctl+0x178/0x2f0 [ 56.134115][ T5057] __se_sys_ioctl+0xf8/0x170 [ 56.139203][ T5057] do_syscall_64+0x45/0x110 [ 56.144207][ T5057] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 56.150594][ T5057] [ 56.150594][ T5057] other info that might help us debug this: [ 56.150594][ T5057] [ 56.160799][ T5057] Chain exists of: [ 56.160799][ T5057] sb_writers#9 --> &type->i_mutex_dir_key#6 --> &sbi->lock [ 56.160799][ T5057] [ 56.173901][ T5057] Possible unsafe locking scenario: [ 56.173901][ T5057] [ 56.181324][ T5057] CPU0 CPU1 [ 56.186667][ T5057] ---- ---- [ 56.192006][ T5057] lock(&sbi->lock); [ 56.195965][ T5057] lock(&type->i_mutex_dir_key#6); [ 56.203663][ T5057] lock(&sbi->lock); [ 56.210138][ T5057] rlock(sb_writers#9); [ 56.214367][ T5057] [ 56.214367][ T5057] *** DEADLOCK *** [ 56.214367][ T5057] [ 56.222488][ T5057] 1 lock held by syz-executor340/5057: [ 56.227917][ T5057] #0: ffff888078bbc090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock+0x7a/0xd0 [ 56.237288][ T5057] [ 56.237288][ T5057] stack backtrace: [ 56.243155][ T5057] CPU: 1 PID: 5057 Comm: syz-executor340 Not tainted 6.7.0-rc8-syzkaller-00024-gac865f00af29 #0 [ 56.253538][ T5057] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 56.263570][ T5057] Call Trace: [ 56.266829][ T5057] [ 56.269738][ T5057] dump_stack_lvl+0x1e7/0x2d0 [ 56.274399][ T5057] ? nf_tcp_handle_invalid+0x650/0x650 [ 56.279841][ T5057] ? print_circular_bug+0x12b/0x1a0 [ 56.285018][ T5057] check_noncircular+0x366/0x490 [ 56.289936][ T5057] ? print_deadlock_bug+0x610/0x610 [ 56.296943][ T5057] ? lockdep_lock+0x123/0x2b0 [ 56.301603][ T5057] ? _find_first_zero_bit+0xd4/0x100 [ 56.306873][ T5057] validate_chain+0x1909/0x5ab0 [ 56.311709][ T5057] ? reacquire_held_locks+0x690/0x690 [ 56.317061][ T5057] ? mark_lock+0x9a/0x350 [ 56.321368][ T5057] ? mark_lock+0x9a/0x350 [ 56.325675][ T5057] ? __lock_acquire+0x1345/0x1fd0 [ 56.330682][ T5057] ? mark_lock+0x9a/0x350 [ 56.334991][ T5057] __lock_acquire+0x1345/0x1fd0 [ 56.339822][ T5057] lock_acquire+0x1e3/0x530 [ 56.344303][ T5057] ? mnt_want_write_file+0x61/0x200 [ 56.349483][ T5057] ? read_lock_is_recursive+0x20/0x20 [ 56.354837][ T5057] ? __might_sleep+0xe0/0xe0 [ 56.359405][ T5057] ? mutex_lock_nested+0x20/0x20 [ 56.364323][ T5057] sb_start_write+0x4d/0x1c0 [ 56.368892][ T5057] ? mnt_want_write_file+0x61/0x200 [ 56.374084][ T5057] mnt_want_write_file+0x61/0x200 [ 56.379087][ T5057] reiserfs_ioctl+0x178/0x2f0 [ 56.383756][ T5057] ? __se_sys_ioctl+0xed/0x170 [ 56.388497][ T5057] ? reiserfs_unpack+0x610/0x610 [ 56.393427][ T5057] __se_sys_ioctl+0xf8/0x170 [ 56.397997][ T5057] do_syscall_64+0x45/0x110 [ 56.402487][ T5057] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 56.408368][ T5057] RIP: 0033:0x7ff0e9a7c9b9 [ 56.412767][ T5057] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 56.432351][ T5057] RSP: 002b:00007ffcae798318 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 ioctl(4, FS_IOC_SETVERSION, 0) = -1 EFAULT (Bad address) exit_group(0) = ? +++ exited with 0 +++ [ 56.440743][ T5057] RAX: fffffff