====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Tainted: G Y ------------------------------------------------------ udevd/5615 is trying to acquire lock: ffff8880793d2780 (DCACHE_PAR_LOOKUP){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] ffff8880793d2780 (DCACHE_PAR_LOOKUP){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] ffff8880793d2780 (DCACHE_PAR_LOOKUP){+.+.}-{0:0}, at: __d_alloc_parallel+0x39e/0x1700 fs/dcache.c:2881 but task is already holding lock: ffff888079858140 (&type->i_mutex_dir_key#4){++++}-{4:4}, at: inode_lock_shared include/linux/fs.h:1039 [inline] ffff888079858140 (&type->i_mutex_dir_key#4){++++}-{4:4}, at: lookup_slow+0x46/0x80 fs/namei.c:1935 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&type->i_mutex_dir_key#4){++++}-{4:4}: down_read+0x45/0x320 kernel/locking/rwsem.c:1574 inode_lock_shared include/linux/fs.h:1039 [inline] lookup_slow+0x46/0x80 fs/namei.c:1935 ovl_lookup_positive_unlocked fs/overlayfs/namei.c:216 [inline] ovl_lookup_single+0x323/0xe90 fs/overlayfs/namei.c:260 ovl_lookup_layer+0x377/0x440 fs/overlayfs/namei.c:365 ovl_lookup_layers fs/overlayfs/namei.c:1168 [inline] ovl_lookup+0x9ae/0x1c80 fs/overlayfs/namei.c:1403 __lookup_slow+0x1fb/0x2f0 fs/namei.c:1919 lookup_slow+0x59/0x80 fs/namei.c:1936 ovl_lookup_positive_unlocked fs/overlayfs/namei.c:216 [inline] ovl_lookup_single+0x323/0xe90 fs/overlayfs/namei.c:260 ovl_lookup_layer+0x377/0x440 fs/overlayfs/namei.c:365 ovl_lookup_layers fs/overlayfs/namei.c:1168 [inline] ovl_lookup+0x9ae/0x1c80 fs/overlayfs/namei.c:1403 __lookup_slow+0x1fb/0x2f0 fs/namei.c:1919 ovl_cache_update+0x2fc/0xb70 fs/overlayfs/readdir.c:577 ovl_iterate_merged fs/overlayfs/readdir.c:858 [inline] ovl_iterate+0x66e/0x2160 fs/overlayfs/readdir.c:906 wrap_directory_iterator+0x96/0xe0 fs/readdir.c:67 iterate_dir+0x2e2/0x4d0 fs/readdir.c:110 __do_sys_getdents64 fs/readdir.c:399 [inline] __se_sys_getdents64+0xf1/0x280 fs/readdir.c:384 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (DCACHE_PAR_LOOKUP){+.+.}-{0:0}: check_prev_add kernel/locking/lockdep.c:3209 [inline] check_prevs_add kernel/locking/lockdep.c:3328 [inline] validate_chain kernel/locking/lockdep.c:3952 [inline] __lock_acquire+0x164c/0x2de0 kernel/locking/lockdep.c:5288 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942 d_wait_lookup fs/dcache.c:2838 [inline] __d_alloc_parallel+0xc32/0x1700 fs/dcache.c:2942 __lookup_slow+0x82/0x2f0 fs/namei.c:1904 lookup_slow+0x59/0x80 fs/namei.c:1936 walk_component fs/namei.c:2282 [inline] lookup_last fs/namei.c:2789 [inline] path_lookupat+0x3f5/0x8c0 fs/namei.c:2813 filename_lookup+0x265/0x5d0 fs/namei.c:2842 vfs_statx+0xfc/0x200 fs/stat.c:353 vfs_fstatat+0x11b/0x170 fs/stat.c:373 __do_sys_newfstatat fs/stat.c:538 [inline] __se_sys_newfstatat+0x118/0x3a0 fs/stat.c:532 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- rlock(&type->i_mutex_dir_key#4); lock(DCACHE_PAR_LOOKUP); lock(&type->i_mutex_dir_key#4); lock(DCACHE_PAR_LOOKUP); *** DEADLOCK *** locks held by udevd/5615: 1, last CPU#0: #0: ffff888079858140 (&type->i_mutex_dir_key#4){++++}-{4:4}, at: inode_lock_shared include/linux/fs.h:1039 [inline] #0: ffff888079858140 (&type->i_mutex_dir_key#4){++++}-{4:4}, at: lookup_slow+0x46/0x80 fs/namei.c:1935 stack backtrace: CPU: 0 UID: 0 PID: 5615 Comm: udevd Tainted: G Y syzkaller #0 PREEMPT(full) Tainted: [Y]=FORCED_BIND Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_circular_bug+0x2e2/0x300 kernel/locking/lockdep.c:2087 check_noncircular+0x12f/0x150 kernel/locking/lockdep.c:2219 check_prev_add kernel/locking/lockdep.c:3209 [inline] check_prevs_add kernel/locking/lockdep.c:3328 [inline] validate_chain kernel/locking/lockdep.c:3952 [inline] __lock_acquire+0x164c/0x2de0 kernel/locking/lockdep.c:5288 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942 d_wait_lookup fs/dcache.c:2838 [inline] __d_alloc_parallel+0xc32/0x1700 fs/dcache.c:2942 __lookup_slow+0x82/0x2f0 fs/namei.c:1904 lookup_slow+0x59/0x80 fs/namei.c:1936 walk_component fs/namei.c:2282 [inline] lookup_last fs/namei.c:2789 [inline] path_lookupat+0x3f5/0x8c0 fs/namei.c:2813 filename_lookup+0x265/0x5d0 fs/namei.c:2842 vfs_statx+0xfc/0x200 fs/stat.c:353 vfs_fstatat+0x11b/0x170 fs/stat.c:373 __do_sys_newfstatat fs/stat.c:538 [inline] __se_sys_newfstatat+0x118/0x3a0 fs/stat.c:532 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1a63d11b0a Code: 48 8b 15 f1 f2 0d 00 f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 41 89 ca b8 06 01 00 00 0f 05 <3d> 00 f0 ff ff 77 07 31 c0 c3 0f 1f 40 00 48 8b 15 b9 f2 0d 00 f7 RSP: 002b:00007ffc6b042908 EFLAGS: 00000246 ORIG_RAX: 0000000000000106 RAX: ffffffffffffffda RBX: 00007ffc6b042da0 RCX: 00007f1a63d11b0a RDX: 00007ffc6b042910 RSI: 00007ffc6b042da0 RDI: 00000000ffffff9c RBP: 000055bc3cd6e910 R08: 0000000000000000 R09: 0000000000000020 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc6b0429a0 R13: 00007ffc6b0431d5 R14: 000055bc23efbca4 R15: 000055bc23efbbcc