./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2969639733 <...> Warning: Permanently added '10.128.0.249' (ED25519) to the list of known hosts. execve("./syz-executor2969639733", ["./syz-executor2969639733"], 0x7ffe625f0b60 /* 10 vars */) = 0 brk(NULL) = 0x555555c2d000 brk(0x555555c2dd00) = 0x555555c2dd00 arch_prctl(ARCH_SET_FS, 0x555555c2d380) = 0 set_tid_address(0x555555c2d650) = 5012 set_robust_list(0x555555c2d660, 24) = 0 rseq(0x555555c2dca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2969639733", 4096) = 28 getrandom("\x47\xb8\x4a\x85\x98\x51\x50\xce", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555555c2dd00 brk(0x555555c4ed00) = 0x555555c4ed00 brk(0x555555c4f000) = 0x555555c4f000 mprotect(0x7f892f42a000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8926f75000 [ 53.460768][ T5012] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=5012 'syz-executor296' write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 20699119) = 20699119 munmap(0x7f8926f75000, 20699119) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 mkdir("./file0", 0777) = 0 [ 53.638842][ T5012] loop0: detected capacity change from 0 to 40427 [ 53.656355][ T5012] F2FS-fs (loop0): Found nat_bits in checkpoint mount("/dev/loop0", "./file0", "f2fs", 0, "nolazytime,lazytime,") = 0 openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 chdir("./file0") = 0 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 open(".", O_RDONLY) = 4 symlinkat("\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", 4, "./file0") = 0 mkdirat(4, "\x13\x13\x77\xc5\xfc\x35\xd4\x14\x54\xd5\xd4\x1d\x29\xad\x1a\x60\x29\x59\x81\x46\xe6\xbe\x16\x6e\x41\xad\x0d\xbd\x40\x54\x03\x3c\x9f\x33\xbb\xda\x82\x24\xa2\xf3\xd7\x72\xe7\x63\x6e\x48\xb3\x3c\xbf\x70\x83\x72\xe8\xf1\xb9\x93\x3e\xc5\x12\x77\x43\xbe\x22\x06\x20\x9e\xf0\x2d\xf9\xcb\xf2\xf6\xe8\x80\xd3\x38\x2f", 000) = 0 open(".", O_RDONLY) = 5 [ 53.683744][ T5012] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 53.708086][ T5012] [ 53.710482][ T5012] ====================================================== [ 53.717511][ T5012] WARNING: possible circular locking dependency detected [ 53.724627][ T5012] 6.5.0-rc2-syzkaller-00345-gc2782531397f #0 Not tainted [ 53.732289][ T5012] ------------------------------------------------------ [ 53.739305][ T5012] syz-executor296/5012 is trying to acquire lock: [ 53.745708][ T5012] ffff888079781fb0 (&fi->i_sem){+.+.}-{3:3}, at: f2fs_add_inline_entry+0x3a8/0x760 [ 53.755016][ T5012] [ 53.755016][ T5012] but task is already holding lock: [ 53.762896][ T5012] ffff888079782b28 (&fi->i_xattr_sem){.+.+}-{3:3}, at: f2fs_add_dentry+0x9f/0x1e0 [ 53.772104][ T5012] [ 53.772104][ T5012] which lock already depends on the new lock. [ 53.772104][ T5012] [ 53.782598][ T5012] [ 53.782598][ T5012] the existing dependency chain (in reverse order) is: [ 53.791639][ T5012] [ 53.791639][ T5012] -> #1 (&fi->i_xattr_sem){.+.+}-{3:3}: [ 53.799457][ T5012] down_read+0x47/0x2f0 [ 53.804144][ T5012] f2fs_getxattr+0xb8/0x1460 [ 53.809250][ T5012] __f2fs_get_acl+0x52/0x8e0 [ 53.814349][ T5012] f2fs_init_acl+0xd7/0x9a0 [ 53.819390][ T5012] f2fs_init_inode_metadata+0x824/0x1190 [ 53.825569][ T5012] f2fs_add_regular_entry+0x904/0xe30 [ 53.831910][ T5012] f2fs_add_dentry+0xf7/0x1e0 [ 53.837153][ T5012] f2fs_do_add_link+0x21e/0x340 [ 53.842709][ T5012] f2fs_mkdir+0x2f5/0x530 [ 53.847670][ T5012] vfs_mkdir+0x29d/0x450 [ 53.852521][ T5012] do_mkdirat+0x264/0x520 [ 53.857362][ T5012] __x64_sys_mkdirat+0x89/0xa0 [ 53.862634][ T5012] do_syscall_64+0x41/0xc0 [ 53.867662][ T5012] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 53.874976][ T5012] [ 53.874976][ T5012] -> #0 (&fi->i_sem){+.+.}-{3:3}: [ 53.883328][ T5012] __lock_acquire+0x39ff/0x7f70 [ 53.888977][ T5012] lock_acquire+0x1e3/0x520 [ 53.893994][ T5012] down_write+0x3a/0x50 [ 53.898744][ T5012] f2fs_add_inline_entry+0x3a8/0x760 [ 53.904632][ T5012] f2fs_add_dentry+0xba/0x1e0 [ 53.909905][ T5012] f2fs_do_add_link+0x21e/0x340 [ 53.915282][ T5012] f2fs_rename2+0x17ab/0x29b0 [ 53.920500][ T5012] vfs_rename+0xaba/0xde0 [ 53.925359][ T5012] do_renameat2+0xd78/0x1660 [ 53.930483][ T5012] __x64_sys_renameat2+0xd2/0xe0 [ 53.935949][ T5012] do_syscall_64+0x41/0xc0 [ 53.940895][ T5012] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 53.947317][ T5012] [ 53.947317][ T5012] other info that might help us debug this: [ 53.947317][ T5012] [ 53.957986][ T5012] Possible unsafe locking scenario: [ 53.957986][ T5012] [ 53.965435][ T5012] CPU0 CPU1 [ 53.970874][ T5012] ---- ---- [ 53.976223][ T5012] rlock(&fi->i_xattr_sem); [ 53.981068][ T5012] lock(&fi->i_sem); [ 53.987903][ T5012] lock(&fi->i_xattr_sem); [ 53.995086][ T5012] lock(&fi->i_sem); [ 53.999064][ T5012] [ 53.999064][ T5012] *** DEADLOCK *** [ 53.999064][ T5012] [ 54.007909][ T5012] 7 locks held by syz-executor296/5012: [ 54.014504][ T5012] #0: ffff888029364410 (sb_writers#9){.+.+}-{0:0}, at: mnt_want_write+0x3f/0x90 [ 54.023826][ T5012] #1: ffff8880293646f8 (&type->s_vfs_rename_key){+.+.}-{3:3}, at: do_renameat2+0x5c8/0x1660 [ 54.034257][ T5012] #2: ffff888079781300 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: lock_two_directories+0x66/0x150 [ 54.045299][ T5012] #3: ffff8880797824b0 (&type->i_mutex_dir_key#7/2){+.+.}-{3:3}, at: lock_two_directories+0x107/0x150 [ 54.056342][ T5012] #4: ffff888079781bd8 (&sb->s_type->i_mutex_key#14){+.+.}-{3:3}, at: lock_two_inodes+0x100/0x180 [ 54.067393][ T5012] #5: ffff888079c103b0 (&sbi->cp_rwsem){.+.+}-{3:3}, at: f2fs_rename2+0x1799/0x29b0 [ 54.076979][ T5012] #6: ffff888079782b28 (&fi->i_xattr_sem){.+.+}-{3:3}, at: f2fs_add_dentry+0x9f/0x1e0 [ 54.086797][ T5012] [ 54.086797][ T5012] stack backtrace: [ 54.092670][ T5012] CPU: 0 PID: 5012 Comm: syz-executor296 Not tainted 6.5.0-rc2-syzkaller-00345-gc2782531397f #0 [ 54.103066][ T5012] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023 [ 54.113108][ T5012] Call Trace: [ 54.116374][ T5012] [ 54.119296][ T5012] dump_stack_lvl+0x1e7/0x2d0 [ 54.123964][ T5012] ? nf_tcp_handle_invalid+0x650/0x650 [ 54.129416][ T5012] ? print_circular_bug+0x12b/0x1a0 [ 54.134603][ T5012] check_noncircular+0x375/0x4a0 [ 54.139532][ T5012] ? __kernel_text_address+0xd/0x40 [ 54.144724][ T5012] ? print_deadlock_bug+0x600/0x600 [ 54.150526][ T5012] ? lockdep_lock+0x123/0x2b0 [ 54.155198][ T5012] ? mark_lock+0x9a/0x340 [ 54.159574][ T5012] ? _find_first_zero_bit+0xd4/0x100 [ 54.164852][ T5012] __lock_acquire+0x39ff/0x7f70 [ 54.169701][ T5012] ? verify_lock_unused+0x140/0x140 [ 54.175352][ T5012] ? rcu_lock_release+0x5/0x30 [ 54.180146][ T5012] ? f2fs_inode_chksum_verify+0xd9/0x360 [ 54.185880][ T5012] lock_acquire+0x1e3/0x520 [ 54.190402][ T5012] ? f2fs_add_inline_entry+0x3a8/0x760 [ 54.195858][ T5012] ? read_lock_is_recursive+0x20/0x20 [ 54.201226][ T5012] ? __might_sleep+0xc0/0xc0 [ 54.205879][ T5012] ? pagecache_get_page+0xeb/0x220 [ 54.211185][ T5012] ? f2fs_grab_cache_page+0x38/0x360 [ 54.216469][ T5012] ? _find_next_zero_bit+0x8c/0x140 [ 54.221752][ T5012] ? _find_next_bit+0xed/0x130 [ 54.226527][ T5012] down_write+0x3a/0x50 [ 54.230762][ T5012] ? f2fs_add_inline_entry+0x3a8/0x760 [ 54.236220][ T5012] f2fs_add_inline_entry+0x3a8/0x760 [ 54.241617][ T5012] ? f2fs_setup_filename+0x145/0x360 [ 54.247150][ T5012] ? do_convert_inline_dir+0x1cb0/0x1cb0 [ 54.252776][ T5012] ? down_read+0x1b5/0x2f0 [ 54.257191][ T5012] f2fs_add_dentry+0xba/0x1e0 [ 54.261863][ T5012] f2fs_do_add_link+0x21e/0x340 [ 54.266709][ T5012] ? __might_sleep+0xc0/0xc0 [ 54.271289][ T5012] ? f2fs_add_dentry+0x1e0/0x1e0 [ 54.276222][ T5012] ? f2fs_find_entry+0x1fd/0x210 [ 54.281417][ T5012] ? down_read+0x1b5/0x2f0 [ 54.285817][ T5012] ? f2fs_add_link+0x57/0x130 [ 54.290489][ T5012] f2fs_rename2+0x17ab/0x29b0 [ 54.295162][ T5012] ? f2fs_mknod+0x520/0x520 [ 54.299656][ T5012] ? __down_write_common+0x161/0x200 [ 54.304934][ T5012] ? __lock_acquire+0x7f70/0x7f70 [ 54.309943][ T5012] ? clear_nonspinnable+0x60/0x60 [ 54.314958][ T5012] ? lock_two_inodes+0x13c/0x180 [ 54.319881][ T5012] ? f2fs_mknod+0x520/0x520 [ 54.324371][ T5012] vfs_rename+0xaba/0xde0 [ 54.328781][ T5012] ? __ia32_sys_link+0x90/0x90 [ 54.333569][ T5012] ? security_path_rename+0x183/0x210 [ 54.339035][ T5012] do_renameat2+0xd78/0x1660 [ 54.343636][ T5012] ? fsnotify_move+0x4f0/0x4f0 [ 54.348404][ T5012] ? __virt_addr_valid+0x22f/0x2e0 [ 54.353593][ T5012] ? __check_object_size+0x4e1/0xa40 [ 54.358866][ T5012] ? getname_flags+0x1f0/0x4e0 [ 54.363628][ T5012] __x64_sys_renameat2+0xd2/0xe0 [ 54.368729][ T5012] do_syscall_64+0x41/0xc0 [ 54.373136][ T5012] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 54.379282][ T5012] RIP: 0033:0x7f892f3b2779 [ 54.383685][ T5012] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 54.403293][ T5012] RSP: 002b:00007ffef6124898 EFLAGS: 00000246 ORIG_RAX: 000000000000013c [ 54.411725][ T5012] RAX: ffffffffffffffda RBX: 00007ffef6124a68 RCX: 00007f892f3b2779 [ 54.419692][ T5012] RDX: 0000000000000005 RSI: 00000000200001c0 RDI: 0000000000000005 [ 54.427651][ T5012] RBP: 00007f892f42a610 R08: 0000000000000000 R09: 00007ffef6124a68 renameat2(5, "./file0", 5, "./file0/file0", 0) = 0 exit_group(0) = ? +++ exited with 0 +++ [ 54.435612][ T