./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3502874331 <...> Warning: Permanently added '10.128.0.212' (ED25519) to the list of known hosts. execve("./syz-executor3502874331", ["./syz-executor3502874331"], 0x7ffe84345f00 /* 10 vars */) = 0 brk(NULL) = 0x55558250b000 brk(0x55558250bd00) = 0x55558250bd00 arch_prctl(ARCH_SET_FS, 0x55558250b380) = 0 set_tid_address(0x55558250b650) = 5827 set_robust_list(0x55558250b660, 24) = 0 rseq(0x55558250bca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3502874331", 4096) = 28 getrandom("\xce\xaf\xbc\x0f\x4c\x78\x7a\x33", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55558250bd00 brk(0x55558252cd00) = 0x55558252cd00 brk(0x55558252d000) = 0x55558252d000 mprotect(0x7fe57606d000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 write(1, "executing program\n", 18executing program ) = 18 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe56da00000 write(3, "\x02\x02\x02\x02\x02\x02\x02\x02\x74\x68\x69\x73\x20\x69\x73\x20\x61\x6e\x20\x6f\x63\x66\x73\x32\x20\x76\x6f\x6c\x75\x6d\x65\x00\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02"..., 16777216) = 16777216 munmap(0x7fe56da00000, 138412032) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 close(4) = 0 mkdir("./file1", 0777) = 0 [ 60.837626][ T5827] loop0: detected capacity change from 0 to 32768 [ 60.881264][ T5827] ======================================================= [ 60.881264][ T5827] WARNING: The mand mount option has been deprecated and [ 60.881264][ T5827] and is ignored by this kernel. Remove the mand [ 60.881264][ T5827] option from the mount to silence this warning. [ 60.881264][ T5827] ======================================================= mount("/dev/loop0", "./file1", "ocfs2", MS_MANDLOCK|MS_DIRSYNC|MS_NODIRATIME, "coherency=buffered,heartbeat=none,coherency=full,errors=continue,journal_async_commit,localflocks,in"...) = 0 openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 chdir("./file1") = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [ 60.950192][ T5827] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_DIRECT|O_NOFOLLOW|O_NOATIME, 000) = 4 [ 61.020919][ T29] audit: type=1800 audit(1731463349.441:2): pid=5827 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor350" name="bus" dev="loop0" ino=17058 res=0 errno=0 [ 61.034564][ T5827] [ 61.043256][ T5827] ====================================================== [ 61.050263][ T5827] WARNING: possible circular locking dependency detected [ 61.057280][ T5827] 6.12.0-rc7-syzkaller-00012-g3022e9d00ebe #0 Not tainted [ 61.064392][ T5827] ------------------------------------------------------ [ 61.071407][ T5827] syz-executor350/5827 is trying to acquire lock: [ 61.077812][ T5827] ffff8880567fb120 (&oi->ip_alloc_sem){+.+.}-{3:3}, at: ocfs2_try_remove_refcount_tree+0xb6/0x330 [ 61.088460][ T5827] [ 61.088460][ T5827] but task is already holding lock: [ 61.095808][ T5827] ffff8880567fb1b8 (&oi->ip_xattr_sem){++++}-{3:3}, at: ocfs2_try_remove_refcount_tree+0xa5/0x330 [ 61.106414][ T5827] [ 61.106414][ T5827] which lock already depends on the new lock. [ 61.106414][ T5827] [ 61.116800][ T5827] [ 61.116800][ T5827] the existing dependency chain (in reverse order) is: [ 61.125815][ T5827] [ 61.125815][ T5827] -> #4 (&oi->ip_xattr_sem){++++}-{3:3}: [ 61.133623][ T5827] lock_acquire+0x1ed/0x550 [ 61.138643][ T5827] down_read+0xb1/0xa40 [ 61.143325][ T5827] ocfs2_init_acl+0x397/0x930 [ 61.148516][ T5827] ocfs2_mknod+0x1c05/0x2b40 [ 61.153619][ T5827] ocfs2_create+0x1ab/0x480 [ 61.158638][ T5827] path_openat+0x1c03/0x3590 [ 61.163738][ T5827] do_filp_open+0x235/0x490 [ 61.168749][ T5827] do_sys_openat2+0x13e/0x1d0 [ 61.173937][ T5827] __x64_sys_open+0x225/0x270 [ 61.179121][ T5827] do_syscall_64+0xf3/0x230 [ 61.184158][ T5827] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 61.190563][ T5827] [ 61.190563][ T5827] -> #3 (jbd2_handle){.+.+}-{0:0}: [ 61.197855][ T5827] lock_acquire+0x1ed/0x550 [ 61.202876][ T5827] start_this_handle+0x1eb4/0x2110 [ 61.208498][ T5827] jbd2__journal_start+0x2da/0x5d0 [ 61.214141][ T5827] jbd2_journal_start+0x29/0x40 [ 61.219520][ T5827] ocfs2_start_trans+0x3c9/0x700 [ 61.224976][ T5827] ocfs2_reserve_suballoc_bits+0x9f6/0x4eb0 [ 61.231394][ T5827] ocfs2_reserve_new_metadata_blocks+0x41c/0x9c0 [ 61.238235][ T5827] ocfs2_mknod+0x143a/0x2b40 [ 61.243347][ T5827] ocfs2_create+0x1ab/0x480 [ 61.248362][ T5827] path_openat+0x1c03/0x3590 [ 61.253463][ T5827] do_filp_open+0x235/0x490 [ 61.258480][ T5827] do_sys_openat2+0x13e/0x1d0 [ 61.263664][ T5827] __x64_sys_open+0x225/0x270 [ 61.268871][ T5827] do_syscall_64+0xf3/0x230 [ 61.273889][ T5827] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 61.280300][ T5827] [ 61.280300][ T5827] -> #2 (&journal->j_trans_barrier){.+.+}-{3:3}: [ 61.288815][ T5827] lock_acquire+0x1ed/0x550 [ 61.293835][ T5827] down_read+0xb1/0xa40 [ 61.298505][ T5827] ocfs2_start_trans+0x3be/0x700 [ 61.303959][ T5827] ocfs2_reserve_suballoc_bits+0x9f6/0x4eb0 [ 61.310365][ T5827] ocfs2_reserve_new_metadata_blocks+0x41c/0x9c0 [ 61.317204][ T5827] ocfs2_mknod+0x143a/0x2b40 [ 61.322312][ T5827] ocfs2_create+0x1ab/0x480 [ 61.327325][ T5827] path_openat+0x1c03/0x3590 [ 61.332424][ T5827] do_filp_open+0x235/0x490 [ 61.337442][ T5827] do_sys_openat2+0x13e/0x1d0 [ 61.342625][ T5827] __x64_sys_open+0x225/0x270 [ 61.347835][ T5827] do_syscall_64+0xf3/0x230 [ 61.352852][ T5827] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 61.359257][ T5827] [ 61.359257][ T5827] -> #1 (sb_internal#2){.+.+}-{0:0}: [ 61.366734][ T5827] lock_acquire+0x1ed/0x550 [ 61.371754][ T5827] ocfs2_start_trans+0x2b9/0x700 [ 61.377206][ T5827] ocfs2_truncate_file+0x68c/0x1560 [ 61.382916][ T5827] ocfs2_setattr+0x1890/0x1f00 [ 61.388190][ T5827] notify_change+0xbca/0xe90 [ 61.393295][ T5827] do_truncate+0x220/0x310 [ 61.398247][ T5827] path_openat+0x2e1e/0x3590 [ 61.403374][ T5827] do_filp_open+0x235/0x490 [ 61.408431][ T5827] do_sys_openat2+0x13e/0x1d0 [ 61.413625][ T5827] __x64_sys_open+0x225/0x270 [ 61.418809][ T5827] do_syscall_64+0xf3/0x230 [ 61.423825][ T5827] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 61.430228][ T5827] [ 61.430228][ T5827] -> #0 (&oi->ip_alloc_sem){+.+.}-{3:3}: [ 61.438046][ T5827] validate_chain+0x18ef/0x5920 [ 61.443429][ T5827] __lock_acquire+0x1384/0x2050 [ 61.448796][ T5827] lock_acquire+0x1ed/0x550 [ 61.453812][ T5827] down_write+0x99/0x220 [ 61.458565][ T5827] ocfs2_try_remove_refcount_tree+0xb6/0x330 [ 61.465066][ T5827] ocfs2_truncate_file+0xe08/0x1560 [ 61.470779][ T5827] ocfs2_setattr+0x1890/0x1f00 [ 61.476054][ T5827] notify_change+0xbca/0xe90 [ 61.481154][ T5827] do_truncate+0x220/0x310 [ 61.486126][ T5827] path_openat+0x2e1e/0x3590 [ 61.491228][ T5827] do_filp_open+0x235/0x490 [ 61.496264][ T5827] do_sys_openat2+0x13e/0x1d0 [ 61.501480][ T5827] __x64_sys_open+0x225/0x270 [ 61.506679][ T5827] do_syscall_64+0xf3/0x230 [ 61.511701][ T5827] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 61.518108][ T5827] [ 61.518108][ T5827] other info that might help us debug this: [ 61.518108][ T5827] [ 61.528341][ T5827] Chain exists of: [ 61.528341][ T5827] &oi->ip_alloc_sem --> jbd2_handle --> &oi->ip_xattr_sem [ 61.528341][ T5827] [ 61.541386][ T5827] Possible unsafe locking scenario: [ 61.541386][ T5827] [ 61.548824][ T5827] CPU0 CPU1 [ 61.554175][ T5827] ---- ---- [ 61.559528][ T5827] lock(&oi->ip_xattr_sem); [ 61.564111][ T5827] lock(jbd2_handle); [ 61.570691][ T5827] lock(&oi->ip_xattr_sem); [ 61.577790][ T5827] lock(&oi->ip_alloc_sem); [ 61.582372][ T5827] [ 61.582372][ T5827] *** DEADLOCK *** [ 61.582372][ T5827] [ 61.590503][ T5827] 3 locks held by syz-executor350/5827: [ 61.596034][ T5827] #0: ffff88805ae3c420 (sb_writers#9){.+.+}-{0:0}, at: mnt_want_write+0x3f/0x90 [ 61.605172][ T5827] #1: ffff8880567fb480 (&sb->s_type->i_mutex_key#14){+.+.}-{3:3}, at: do_truncate+0x20c/0x310 [ 61.615549][ T5827] #2: ffff8880567fb1b8 (&oi->ip_xattr_sem){++++}-{3:3}, at: ocfs2_try_remove_refcount_tree+0xa5/0x330 [ 61.626632][ T5827] [ 61.626632][ T5827] stack backtrace: [ 61.632536][ T5827] CPU: 0 UID: 0 PID: 5827 Comm: syz-executor350 Not tainted 6.12.0-rc7-syzkaller-00012-g3022e9d00ebe #0 [ 61.643633][ T5827] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 [ 61.653689][ T5827] Call Trace: [ 61.656960][ T5827] [ 61.659881][ T5827] dump_stack_lvl+0x241/0x360 [ 61.664556][ T5827] ? __pfx_dump_stack_lvl+0x10/0x10 [ 61.669748][ T5827] ? __pfx__printk+0x10/0x10 [ 61.674332][ T5827] print_circular_bug+0x13a/0x1b0 [ 61.679350][ T5827] check_noncircular+0x36a/0x4a0 [ 61.684283][ T5827] ? __pfx_check_noncircular+0x10/0x10 [ 61.689732][ T5827] ? lockdep_lock+0x123/0x2b0 [ 61.694413][ T5827] validate_chain+0x18ef/0x5920 [ 61.699267][ T5827] ? __pfx_validate_chain+0x10/0x10 [ 61.704454][ T5827] ? do_sys_openat2+0x13e/0x1d0 [ 61.709293][ T5827] ? do_syscall_64+0xf3/0x230 [ 61.713960][ T5827] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 61.720021][ T5827] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 61.726000][ T5827] ? mark_lock+0x9a/0x360 [ 61.730320][ T5827] __lock_acquire+0x1384/0x2050 [ 61.735173][ T5827] lock_acquire+0x1ed/0x550 [ 61.739672][ T5827] ? ocfs2_try_remove_refcount_tree+0xb6/0x330 [ 61.745822][ T5827] ? __pfx_lock_acquire+0x10/0x10 [ 61.750946][ T5827] ? __pfx___might_resched+0x10/0x10 [ 61.756259][ T5827] ? ocfs2_truncate_file+0xd32/0x1560 [ 61.761636][ T5827] ? __pfx_lock_release+0x10/0x10 [ 61.766665][ T5827] down_write+0x99/0x220 [ 61.770912][ T5827] ? ocfs2_try_remove_refcount_tree+0xb6/0x330 [ 61.777062][ T5827] ? __pfx_down_write+0x10/0x10 [ 61.781908][ T5827] ocfs2_try_remove_refcount_tree+0xb6/0x330 [ 61.787902][ T5827] ? __pfx_ocfs2_try_remove_refcount_tree+0x10/0x10 [ 61.794485][ T5827] ocfs2_truncate_file+0xe08/0x1560 [ 61.799708][ T5827] ? ocfs2_inode_lock_tracker+0x45a/0x760 [ 61.805462][ T5827] ? __pfx_ocfs2_truncate_file+0x10/0x10 [ 61.811131][ T5827] ? do_raw_spin_unlock+0x13c/0x8b0 [ 61.816426][ T5827] ? __asan_memset+0x23/0x50 [ 61.821044][ T5827] ? _raw_spin_unlock+0x28/0x50 [ 61.825906][ T5827] ? ocfs2_inode_lock_tracker+0x45a/0x760 [ 61.831662][ T5827] ? __pfx_ocfs2_inode_lock_tracker+0x10/0x10 [ 61.837765][ T5827] ? ocfs2_rw_lock+0x13e/0x260 [ 61.842548][ T5827] ? __pfx_ocfs2_rw_lock+0x10/0x10 [ 61.847659][ T5827] ? setattr_prepare+0x1f5/0xb20 [ 61.852590][ T5827] ? jbd2_journal_begin_ordered_truncate+0xc0/0x160 [ 61.859439][ T5827] ocfs2_setattr+0x1890/0x1f00 [ 61.864199][ T5827] ? __pfx_ocfs2_setattr+0x10/0x10 [ 61.869308][ T5827] ? __pfx_smack_inode_setattr+0x10/0x10 [ 61.874935][ T5827] ? current_time+0x1be/0x2b0 [ 61.879600][ T5827] ? evm_inode_setattr+0x1b2/0x7d0 [ 61.884707][ T5827] ? security_inode_setattr+0xdb/0x350 [ 61.890164][ T5827] ? __pfx_ocfs2_setattr+0x10/0x10 [ 61.895267][ T5827] notify_change+0xbca/0xe90 [ 61.899855][ T5827] do_truncate+0x220/0x310 [ 61.904266][ T5827] ? __pfx_do_truncate+0x10/0x10 [ 61.909242][ T5827] path_openat+0x2e1e/0x3590 [ 61.913851][ T5827] ? __pfx_path_openat+0x10/0x10 [ 61.918813][ T5827] do_filp_open+0x235/0x490 [ 61.923329][ T5827] ? __pfx_do_filp_open+0x10/0x10 [ 61.928368][ T5827] ? _raw_spin_unlock+0x28/0x50 [ 61.933214][ T5827] ? alloc_fd+0x5a1/0x640 [ 61.937543][ T5827] do_sys_openat2+0x13e/0x1d0 [ 61.942212][ T5827] ? __pfx_do_sys_openat2+0x10/0x10 [ 61.947400][ T5827] ? lockdep_hardirqs_on+0x99/0x150 [ 61.952593][ T5827] ? _raw_spin_unlock_irq+0x2e/0x50 [ 61.957784][ T5827] ? ptrace_notify+0x279/0x380 [ 61.962577][ T5827] __x64_sys_open+0x225/0x270 [ 61.967246][ T5827] ? __pfx___x64_sys_open+0x10/0x10 [ 61.972437][ T5827] ? do_syscall_64+0x100/0x230 [ 61.977198][ T5827] do_syscall_64+0xf3/0x230 [ 61.981703][ T5827] ? clear_bhb_loop+0x35/0x90 [ 61.986389][ T5827] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 61.992286][ T5827] RIP: 0033:0x7fe575ff69f9 [ 61.996701][ T5827] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 62.016317][ T5827] RSP: 002b:00007fff66476698 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_SYNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5 exit_group(0) = ? +++ exited with 0 +++ [ 62.0247