REISERFS (device loop2): journal params: device loop2, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 REISERFS (device loop2): checking transaction log (loop2) REISERFS (device loop2): Using r5 hash to sort names REISERFS (device loop2): Created .reiserfs_priv - reserved for xattr storage. ====================================================== WARNING: possible circular locking dependency detected 4.14.305-syzkaller #0 Not tainted ------------------------------------------------------ syz-executor.2/11577 is trying to acquire lock: (&type->i_mutex_dir_key#12/2){+.+.}, at: [] inode_lock_nested include/linux/fs.h:754 [inline] (&type->i_mutex_dir_key#12/2){+.+.}, at: [] xattr_rmdir fs/reiserfs/xattr.c:106 [inline] (&type->i_mutex_dir_key#12/2){+.+.}, at: [] delete_one_xattr+0x11a/0x2a0 fs/reiserfs/xattr.c:338 but task is already holding lock: (&type->i_mutex_dir_key#12/3){+.+.}, at: [] inode_lock_nested include/linux/fs.h:754 [inline] (&type->i_mutex_dir_key#12/3){+.+.}, at: [] reiserfs_for_each_xattr+0x5f2/0x830 fs/reiserfs/xattr.c:309 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&type->i_mutex_dir_key#12/3){+.+.}: down_write_nested+0x36/0x90 kernel/locking/rwsem.c:172 inode_lock_nested include/linux/fs.h:754 [inline] open_xa_root fs/reiserfs/xattr.c:127 [inline] open_xa_dir+0x115/0x600 fs/reiserfs/xattr.c:152 reiserfs_for_each_xattr+0x159/0x830 fs/reiserfs/xattr.c:252 reiserfs_delete_xattrs+0x1c/0x90 fs/reiserfs/xattr.c:364 reiserfs_evict_inode+0x2b4/0x4a0 fs/reiserfs/inode.c:53 evict+0x2c8/0x700 fs/inode.c:554 iput_final fs/inode.c:1523 [inline] iput+0x458/0x7e0 fs/inode.c:1550 dentry_unlink_inode+0x25c/0x310 fs/dcache.c:387 __dentry_kill+0x320/0x550 fs/dcache.c:591 dentry_kill fs/dcache.c:632 [inline] dput.part.0+0x4b5/0x710 fs/dcache.c:847 dput+0x1b/0x30 fs/dcache.c:811 SYSC_renameat2 fs/namei.c:4650 [inline] SyS_renameat2+0x96a/0xad0 fs/namei.c:4535 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x5e/0xd3 -> #0 (&type->i_mutex_dir_key#12/2){+.+.}: lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 down_write_nested+0x36/0x90 kernel/locking/rwsem.c:172 inode_lock_nested include/linux/fs.h:754 [inline] xattr_rmdir fs/reiserfs/xattr.c:106 [inline] delete_one_xattr+0x11a/0x2a0 fs/reiserfs/xattr.c:338 reiserfs_for_each_xattr+0x603/0x830 fs/reiserfs/xattr.c:311 reiserfs_delete_xattrs+0x1c/0x90 fs/reiserfs/xattr.c:364 reiserfs_evict_inode+0x2b4/0x4a0 fs/reiserfs/inode.c:53 evict+0x2c8/0x700 fs/inode.c:554 iput_final fs/inode.c:1523 [inline] iput+0x458/0x7e0 fs/inode.c:1550 dentry_unlink_inode+0x25c/0x310 fs/dcache.c:387 d_delete+0x1c5/0x280 fs/dcache.c:2417 vfs_rmdir.part.0+0x260/0x390 fs/namei.c:3922 vfs_rmdir fs/namei.c:3895 [inline] do_rmdir+0x334/0x3c0 fs/namei.c:3970 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x5e/0xd3 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&type->i_mutex_dir_key#12/3); lock(&type->i_mutex_dir_key#12/2); lock(&type->i_mutex_dir_key#12/3); lock(&type->i_mutex_dir_key#12/2); *** DEADLOCK *** 3 locks held by syz-executor.2/11577: #0: (sb_writers#19){.+.+}, at: [] sb_start_write include/linux/fs.h:1551 [inline] #0: (sb_writers#19){.+.+}, at: [] mnt_want_write+0x3a/0xb0 fs/namespace.c:386 #1: (&type->i_mutex_dir_key#12/1){+.+.}, at: [] inode_lock_nested include/linux/fs.h:754 [inline] #1: (&type->i_mutex_dir_key#12/1){+.+.}, at: [] do_rmdir+0x1de/0x3c0 fs/namei.c:3958 #2: (&type->i_mutex_dir_key#12/3){+.+.}, at: [] inode_lock_nested include/linux/fs.h:754 [inline] #2: (&type->i_mutex_dir_key#12/3){+.+.}, at: [] reiserfs_for_each_xattr+0x5f2/0x830 fs/reiserfs/xattr.c:309 stack backtrace: CPU: 1 PID: 11577 Comm: syz-executor.2 Not tainted 4.14.305-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 print_circular_bug.constprop.0.cold+0x2d7/0x41e kernel/locking/lockdep.c:1258 check_prev_add kernel/locking/lockdep.c:1905 [inline] check_prevs_add kernel/locking/lockdep.c:2022 [inline] validate_chain kernel/locking/lockdep.c:2464 [inline] __lock_acquire+0x2e0e/0x3f20 kernel/locking/lockdep.c:3491 lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 down_write_nested+0x36/0x90 kernel/locking/rwsem.c:172 inode_lock_nested include/linux/fs.h:754 [inline] xattr_rmdir fs/reiserfs/xattr.c:106 [inline] delete_one_xattr+0x11a/0x2a0 fs/reiserfs/xattr.c:338 reiserfs_for_each_xattr+0x603/0x830 fs/reiserfs/xattr.c:311 reiserfs_delete_xattrs+0x1c/0x90 fs/reiserfs/xattr.c:364 reiserfs_evict_inode+0x2b4/0x4a0 fs/reiserfs/inode.c:53 evict+0x2c8/0x700 fs/inode.c:554 iput_final fs/inode.c:1523 [inline] iput+0x458/0x7e0 fs/inode.c:1550 dentry_unlink_inode+0x25c/0x310 fs/dcache.c:387 d_delete+0x1c5/0x280 fs/dcache.c:2417 vfs_rmdir.part.0+0x260/0x390 fs/namei.c:3922 vfs_rmdir fs/namei.c:3895 [inline] do_rmdir+0x334/0x3c0 fs/namei.c:3970 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x5e/0xd3 RIP: 0033:0x7f3b8a3510f9 RSP: 002b:00007f3b888c3168 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 RAX: ffffffffffffffda RBX: 00007f3b8a470f80 RCX: 00007f3b8a3510f9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000100 RBP: 00007f3b8a3acae9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffcca5e779f R14: 00007f3b888c3300 R15: 0000000000022000 REISERFS (device loop2): found reiserfs format "3.6" with non-standard journal REISERFS (device loop2): using ordered data mode reiserfs: using flush barriers REISERFS (device loop2): journal params: device loop2, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 REISERFS (device loop3): found reiserfs format "3.6" with non-standard journal REISERFS (device loop2): checking transaction log (loop2) REISERFS (device loop3): using ordered data mode reiserfs: using flush barriers REISERFS (device loop3): journal params: device loop3, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 REISERFS (device loop2): Using r5 hash to sort names REISERFS (device loop2): Created .reiserfs_priv - reserved for xattr storage. REISERFS (device loop3): checking transaction log (loop3) REISERFS (device loop3): Using r5 hash to sort names REISERFS (device loop3): Created .reiserfs_priv - reserved for xattr storage. REISERFS (device loop2): found reiserfs format "3.6" with non-standard journal REISERFS (device loop2): using ordered data mode reiserfs: using flush barriers REISERFS (device loop2): journal params: device loop2, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 REISERFS (device loop2): checking transaction log (loop2) REISERFS (device loop2): Using r5 hash to sort names REISERFS (device loop2): Created .reiserfs_priv - reserved for xattr storage. REISERFS (device loop3): found reiserfs format "3.6" with non-standard journal REISERFS (device loop3): using ordered data mode reiserfs: using flush barriers REISERFS (device loop3): journal params: device loop3, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 REISERFS (device loop2): found reiserfs format "3.6" with non-standard journal REISERFS (device loop2): using ordered data mode reiserfs: using flush barriers REISERFS (device loop2): journal params: device loop2, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 REISERFS (device loop3): checking transaction log (loop3) REISERFS (device loop2): checking transaction log (loop2) REISERFS (device loop3): Using r5 hash to sort names REISERFS (device loop3): Created .reiserfs_priv - reserved for xattr storage. REISERFS (device loop2): Using r5 hash to sort names REISERFS (device loop2): Created .reiserfs_priv - reserved for xattr storage. REISERFS (device loop3): found reiserfs format "3.6" with non-standard journal REISERFS (device loop3): using ordered data mode reiserfs: using flush barriers REISERFS (device loop3): journal params: device loop3, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 REISERFS (device loop3): checking transaction log (loop3) REISERFS (device loop3): Using r5 hash to sort names REISERFS (device loop3): Created .reiserfs_priv - reserved for xattr storage. ntfs: volume version 3.1. ntfs: volume version 3.1. ntfs: volume version 3.1. ntfs: volume version 3.1. netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'. netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'. netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'. netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. BTRFS info (device loop1): enabling inode map caching BTRFS warning (device loop1): excessive commit interval 622039222 BTRFS info (device loop1): force zlib compression BTRFS info (device loop1): using free space tree BTRFS info (device loop1): has skinny extents BTRFS info (device loop1): enabling inode map caching BTRFS warning (device loop1): excessive commit interval 622039222 BTRFS info (device loop1): force zlib compression BTRFS info (device loop1): using free space tree BTRFS info (device loop1): has skinny extents