Extracting prog: 1m18.995560239s
Minimizing prog: 8m29.246753973s
Simplifying prog options: 0s
Extracting C: 24.30557668s
Simplifying C: 2m34.799787722s


69 programs, 3 VMs, timeouts [15s 1m40s 6m0s]
extracting reproducer from 69 programs
single: executing 4 programs separately with timeout 15s
testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Repro:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$udf-openat$cgroup_ro-write$binfmt_script-mmap-mkdir
detailed listing:
executing program 0:
syz_mount_image$udf(&(0x7f00000005c0), &(0x7f0000000600)='./file0\x00', 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="005bdefa8134"], 0x1, 0x5bd, &(0x7f0000000680)="$eJzs3U9sHFcdB/Dfm3jtdRonmzR1CwR1paoqCiKKHdomNhKYGFeIqLFwHBFOmHgTlvpPZCfIqQD1BgckxIEDBySEhBSBQIgj4kBPcEDcgXt74OIDEhIHhGZ21ruxt8Sqs3Fdfz5SvLNvfvPmzRwifffNvg0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIOLzX5g6P5b2exQAAABAP70+9+Xz4/I/AAAAfKhdM/8PAAAAAAAAAAddiiy+Fym+NLmZjhXvW6pXmiv3NuanZ3ofNpyKI48U9fm/6tj4hU+//MqrF9uv///4x+0jcXXu2lT98urynbXG+npjsT6/0ry5utjYdQ97PX67s8UNqC+/cW/x1q31+vi5Cw/t3qi9M/TUaG3y4sSNWrt2fnpmZq6rZqDyvs++gyc8AAAADrfByOL1SPH2n3+TRiIii71n4Ud8dtBvw1HL83dxEfPTM8WFLDUXVu7mO2fbQbhWXmtpsJ2Rn0AW35OfRZzKxzoo0QMAALB7lSIFp3jtd5vpeEQcaefgTxYLA773gfUnOMge8nGeiYgX4gBkdgAAANhnQ5HFTyPF8olqnMgz834PCAAAAHjsBiKLVyPFvyY3U614HiAizs5Pz9SvXK9/ceXWalftbCpn1A/69wOeJM8mAAAA8AFQjSxGiif+N9PJ/R4MAAAA0BfDkcVfI8XHnv9Wsa5cFOvSn5i8NDg+1r3C3LOP6CevPRcRz+zyO/mVcq3B2TSbUvb4rwsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDDZShl8d9I8Z3r9U5jLUUWkdpvq/mf2fS54/szRAAAAAAAAADgUVIWP44UP6lspiwiNmrvDD01Wpu8OHGjdiSOFA8BpO76q3PXpuqXV5fvrDXW1xuL9fmV5s3VxcZuT1e90ly5tzE/PdOXi3mk4T6Pf7h6efXO/bXm7W/c7bn/aHXq6+t31xZu9t4dw1GPONLdcrYY8Pz0TDHopebCSnHobNrtiAEAACCikrL4T6R4sf4gbeXO1vP/A603nTT6i89E3l6obs+fxecGx4vPDVrbJyYvVcZf6t7uGVnPFoE6D7gzc13NA5Wdpfk5U8piKlK8O/FcMbIUR2NHZo5W3Uik+OFXz5R12WDUItrd1lo93mouNc7ntT+KFKdvtGujqK2WtU93asfy2qG832sP1w6Xtac7teN57Uyk+MdrvWuf6dReyGs3IsWDB/V27dG8dqSsHe3Unru5urTY61YCAAAAAAAAcHhVUha/ihR//EM9tefGB1rzzzvn/7/d+S7AW9s7eo85/73O/9e62t4q5/V/kI/im88Vc/nF/H+t9/z/VKT4y9UzZV1r7n2w3H+y+NuZ/78eKd5efbh2qKw91akd2/WNBQAAgA+QPP+fiRTf/9PvB9rZuMz/ZQLvnf8/OrCtoz7l/5Ndbfk51++/+cbC0lJjzYYNGza2Nvb+fyEAAHzY5fm/ESl+/re/b813l/n/WOtdJ///+7ud/D+xvaM+5f9TXW0T5VqElYGI6t3lO5XRiOr6/Tc/1VxeuN243VgZu/TK+MXx82MvVwbbc/udrT3fKgAAADiw8vw/Fyl+/c9fbq13t5v5/6PbO+pT/n+6qy0/Z2fSb8+XDgAAAIdGnv8vRYqvPP/brXXpH87/ndSe5//2+v+feKH12vnNgP7k/9NdbbXyvDs+ewAAAAAAAAAAAAAAAAAAAIADrpKyeClSvPjuQBop23az/t/i9o769P3/0a62xXgyv/+355sKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcSllk0YwUH392M302b/haxLHuVwAAAODA+18AAAD//0qnGWg=")
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0)
write$binfmt_script(r0, &(0x7f0000000300)={'#! ', '\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/', [], 0xa, "50c5856a6b1dee05000000000000004e07dff1df738ab6934ff996a284906f297c300f936c3ef8dd95094f"}, 0x7c)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r0, 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)

program did not crash
testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Repro:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdir-mkdir-mount$overlay-mkdir-openat$dir-ioctl$FS_IOC_SET_ENCRYPTION_POLICY-chdir-chdir-open
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x10020, 0x0, 0xfe, 0x0, &(0x7f0000000000))
mkdir(&(0x7f0000000400)='./file1\x00', 0x0)
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]})
mkdir(&(0x7f0000000000)='./file0/file0\x00', 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x0, 0x0)
ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000040)=@v1={0x0, @adiantum, 0x0, @desc3})
chdir(&(0x7f0000000140)='./bus\x00')
chdir(&(0x7f0000000040)='./file0\x00')
open(&(0x7f0000000100)='.\x00', 0x591002, 0x0)

program crashed: possible deadlock in ovl_copy_up_one
single: successfully extracted reproducer
found reproducer with 10 syscalls
minimizing guilty program
testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Repro:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdir-mkdir-mount$overlay-mkdir-openat$dir-ioctl$FS_IOC_SET_ENCRYPTION_POLICY-chdir-chdir
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x10020, 0x0, 0xfe, 0x0, &(0x7f0000000000))
mkdir(&(0x7f0000000400)='./file1\x00', 0x0)
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]})
mkdir(&(0x7f0000000000)='./file0/file0\x00', 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x0, 0x0)
ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000040)=@v1={0x0, @adiantum, 0x0, @desc3})
chdir(&(0x7f0000000140)='./bus\x00')
chdir(&(0x7f0000000040)='./file0\x00')

program did not crash
testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Repro:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdir-mkdir-mount$overlay-mkdir-openat$dir-ioctl$FS_IOC_SET_ENCRYPTION_POLICY-chdir-open
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x10020, 0x0, 0xfe, 0x0, &(0x7f0000000000))
mkdir(&(0x7f0000000400)='./file1\x00', 0x0)
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]})
mkdir(&(0x7f0000000000)='./file0/file0\x00', 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x0, 0x0)
ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000040)=@v1={0x0, @adiantum, 0x0, @desc3})
chdir(&(0x7f0000000140)='./bus\x00')
open(&(0x7f0000000100)='.\x00', 0x591002, 0x0)

program did not crash
testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Repro:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdir-mkdir-mount$overlay-mkdir-openat$dir-ioctl$FS_IOC_SET_ENCRYPTION_POLICY-chdir-open
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x10020, 0x0, 0xfe, 0x0, &(0x7f0000000000))
mkdir(&(0x7f0000000400)='./file1\x00', 0x0)
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]})
mkdir(&(0x7f0000000000)='./file0/file0\x00', 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x0, 0x0)
ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000040)=@v1={0x0, @adiantum, 0x0, @desc3})
chdir(&(0x7f0000000040)='./file0\x00')
open(&(0x7f0000000100)='.\x00', 0x591002, 0x0)

program did not crash
testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Repro:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdir-mkdir-mount$overlay-mkdir-openat$dir-chdir-chdir-open
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x10020, 0x0, 0xfe, 0x0, &(0x7f0000000000))
mkdir(&(0x7f0000000400)='./file1\x00', 0x0)
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]})
mkdir(&(0x7f0000000000)='./file0/file0\x00', 0x0)
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x0, 0x0)
chdir(&(0x7f0000000140)='./bus\x00')
chdir(&(0x7f0000000040)='./file0\x00')
open(&(0x7f0000000100)='.\x00', 0x591002, 0x0)

program crashed: possible deadlock in ovl_copy_up_one
testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Repro:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdir-mkdir-mount$overlay-mkdir-chdir-chdir-open
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x10020, 0x0, 0xfe, 0x0, &(0x7f0000000000))
mkdir(&(0x7f0000000400)='./file1\x00', 0x0)
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]})
mkdir(&(0x7f0000000000)='./file0/file0\x00', 0x0)
chdir(&(0x7f0000000140)='./bus\x00')
chdir(&(0x7f0000000040)='./file0\x00')
open(&(0x7f0000000100)='.\x00', 0x591002, 0x0)

program crashed: possible deadlock in ovl_copy_up_one
testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Repro:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdir-mkdir-mount$overlay-chdir-chdir-open
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x10020, 0x0, 0xfe, 0x0, &(0x7f0000000000))
mkdir(&(0x7f0000000400)='./file1\x00', 0x0)
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]})
chdir(&(0x7f0000000140)='./bus\x00')
chdir(&(0x7f0000000040)='./file0\x00')
open(&(0x7f0000000100)='.\x00', 0x591002, 0x0)

program did not crash
testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Repro:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdir-mkdir-mkdir-chdir-chdir-open
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x10020, 0x0, 0xfe, 0x0, &(0x7f0000000000))
mkdir(&(0x7f0000000400)='./file1\x00', 0x0)
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
mkdir(&(0x7f0000000000)='./file0/file0\x00', 0x0)
chdir(&(0x7f0000000140)='./bus\x00')
chdir(&(0x7f0000000040)='./file0\x00')
open(&(0x7f0000000100)='.\x00', 0x591002, 0x0)

program did not crash
testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Repro:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdir-mount$overlay-mkdir-chdir-chdir-open
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x10020, 0x0, 0xfe, 0x0, &(0x7f0000000000))
mkdir(&(0x7f0000000400)='./file1\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]})
mkdir(&(0x7f0000000000)='./file0/file0\x00', 0x0)
chdir(&(0x7f0000000140)='./bus\x00')
chdir(&(0x7f0000000040)='./file0\x00')
open(&(0x7f0000000100)='.\x00', 0x591002, 0x0)

program did not crash
testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Repro:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdir-mount$overlay-mkdir-chdir-chdir-open
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x10020, 0x0, 0xfe, 0x0, &(0x7f0000000000))
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]})
mkdir(&(0x7f0000000000)='./file0/file0\x00', 0x0)
chdir(&(0x7f0000000140)='./bus\x00')
chdir(&(0x7f0000000040)='./file0\x00')
open(&(0x7f0000000100)='.\x00', 0x591002, 0x0)

program did not crash
testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Repro:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mkdir-mount$overlay-mkdir-chdir-chdir-open
detailed listing:
executing program 0:
mkdir(&(0x7f0000000400)='./file1\x00', 0x0)
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]})
mkdir(&(0x7f0000000000)='./file0/file0\x00', 0x0)
chdir(&(0x7f0000000140)='./bus\x00')
chdir(&(0x7f0000000040)='./file0\x00')
open(&(0x7f0000000100)='.\x00', 0x591002, 0x0)

program did not crash
testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Repro:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdir-mkdir-mount$overlay-mkdir-chdir-chdir-open
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x10020, 0x0, 0xfe, 0x0, &(0x7f0000000000))
mkdir(0x0, 0x0)
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]})
mkdir(&(0x7f0000000000)='./file0/file0\x00', 0x0)
chdir(&(0x7f0000000140)='./bus\x00')
chdir(&(0x7f0000000040)='./file0\x00')
open(&(0x7f0000000100)='.\x00', 0x591002, 0x0)

program did not crash
testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Repro:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdir-mkdir-mount$overlay-mkdir-chdir-chdir-open
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x10020, 0x0, 0xfe, 0x0, &(0x7f0000000000))
mkdir(&(0x7f0000000400)='./file1\x00', 0x0)
mkdir(0x0, 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]})
mkdir(&(0x7f0000000000)='./file0/file0\x00', 0x0)
chdir(&(0x7f0000000140)='./bus\x00')
chdir(&(0x7f0000000040)='./file0\x00')
open(&(0x7f0000000100)='.\x00', 0x591002, 0x0)

program did not crash
testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Repro:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdir-mkdir-mount$overlay-mkdir-chdir-chdir-open
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x10020, 0x0, 0xfe, 0x0, &(0x7f0000000000))
mkdir(&(0x7f0000000400)='./file1\x00', 0x0)
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
mount$overlay(0x0, 0x0, &(0x7f0000000340), 0x0, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]})
mkdir(&(0x7f0000000000)='./file0/file0\x00', 0x0)
chdir(&(0x7f0000000140)='./bus\x00')
chdir(&(0x7f0000000040)='./file0\x00')
open(&(0x7f0000000100)='.\x00', 0x591002, 0x0)

program did not crash
testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Repro:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdir-mkdir-mount$overlay-mkdir-chdir-chdir-open
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x10020, 0x0, 0xfe, 0x0, &(0x7f0000000000))
mkdir(&(0x7f0000000400)='./file1\x00', 0x0)
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]})
mkdir(&(0x7f0000000000)='./file0/file0\x00', 0x0)
chdir(&(0x7f0000000140)='./bus\x00')
chdir(&(0x7f0000000040)='./file0\x00')
open(&(0x7f0000000100)='.\x00', 0x591002, 0x0)

program did not crash
testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Repro:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdir-mkdir-mount$overlay-mkdir-chdir-chdir-open
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x10020, 0x0, 0xfe, 0x0, &(0x7f0000000000))
mkdir(&(0x7f0000000400)='./file1\x00', 0x0)
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, 0x0)
mkdir(&(0x7f0000000000)='./file0/file0\x00', 0x0)
chdir(&(0x7f0000000140)='./bus\x00')
chdir(&(0x7f0000000040)='./file0\x00')
open(&(0x7f0000000100)='.\x00', 0x591002, 0x0)

program did not crash
testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Repro:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdir-mkdir-mount$overlay-mkdir-chdir-chdir-open
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x10020, 0x0, 0xfe, 0x0, &(0x7f0000000000))
mkdir(&(0x7f0000000400)='./file1\x00', 0x0)
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]})
mkdir(0x0, 0x0)
chdir(&(0x7f0000000140)='./bus\x00')
chdir(&(0x7f0000000040)='./file0\x00')
open(&(0x7f0000000100)='.\x00', 0x591002, 0x0)

program did not crash
testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Repro:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdir-mkdir-mount$overlay-mkdir-chdir-chdir-open
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x10020, 0x0, 0xfe, 0x0, &(0x7f0000000000))
mkdir(&(0x7f0000000400)='./file1\x00', 0x0)
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]})
mkdir(&(0x7f0000000000)='./file0/file0\x00', 0x0)
chdir(0x0)
chdir(&(0x7f0000000040)='./file0\x00')
open(&(0x7f0000000100)='.\x00', 0x591002, 0x0)

program did not crash
testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Repro:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdir-mkdir-mount$overlay-mkdir-chdir-chdir-open
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x10020, 0x0, 0xfe, 0x0, &(0x7f0000000000))
mkdir(&(0x7f0000000400)='./file1\x00', 0x0)
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]})
mkdir(&(0x7f0000000000)='./file0/file0\x00', 0x0)
chdir(&(0x7f0000000140)='./bus\x00')
chdir(0x0)
open(&(0x7f0000000100)='.\x00', 0x591002, 0x0)

program did not crash
testing program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Repro:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdir-mkdir-mount$overlay-mkdir-chdir-chdir-open
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x10020, 0x0, 0xfe, 0x0, &(0x7f0000000000))
mkdir(&(0x7f0000000400)='./file1\x00', 0x0)
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]})
mkdir(&(0x7f0000000000)='./file0/file0\x00', 0x0)
chdir(&(0x7f0000000140)='./bus\x00')
chdir(&(0x7f0000000040)='./file0\x00')
open(0x0, 0x591002, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=22.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Repro:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdir-mkdir-mount$overlay-mkdir-chdir-chdir-open
program crashed: possible deadlock in ovl_copy_up_one
simplifying C reproducer
testing compiled C program (duration=22.5s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Repro:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdir-mkdir-mount$overlay-mkdir-chdir-chdir-open
program crashed: possible deadlock in ovl_copy_up_one
testing compiled C program (duration=22.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Repro:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdir-mkdir-mount$overlay-mkdir-chdir-chdir-open
program crashed: possible deadlock in ovl_copy_up_one
testing compiled C program (duration=22.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Repro:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdir-mkdir-mount$overlay-mkdir-chdir-chdir-open
program crashed: possible deadlock in ovl_copy_up_one
testing compiled C program (duration=22.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Repro:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdir-mkdir-mount$overlay-mkdir-chdir-chdir-open
program crashed: possible deadlock in ovl_copy_up_one
testing compiled C program (duration=22.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Repro:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdir-mkdir-mount$overlay-mkdir-chdir-chdir-open
program crashed: possible deadlock in ovl_copy_up_one
testing compiled C program (duration=22.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Repro:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdir-mkdir-mount$overlay-mkdir-chdir-chdir-open
program did not crash
testing compiled C program (duration=22.5s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Repro:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mkdir-mkdir-mount$overlay-mkdir-chdir-chdir-open
program crashed: possible deadlock in ovl_copy_up_one
reproducing took 12m47.34769461s
repro crashed as (corrupted=false):
============================================
WARNING: possible recursive locking detected
6.10.0-rc2-syzkaller-00366-g771ed66105de #0 Not tainted
--------------------------------------------
syz-executor222/5195 is trying to acquire lock:
ffff888024f6a420 (sb_writers#5){.+.+}-{0:0}, at: ovl_do_copy_up fs/overlayfs/copy_up.c:967 [inline]
ffff888024f6a420 (sb_writers#5){.+.+}-{0:0}, at: ovl_copy_up_one+0x82a/0x3490 fs/overlayfs/copy_up.c:1168

but task is already holding lock:
ffff888024f6a420 (sb_writers#5){.+.+}-{0:0}, at: ovl_tmpfile+0x15b/0x6f0 fs/overlayfs/dir.c:1363

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(sb_writers#5);
  lock(sb_writers#5);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

3 locks held by syz-executor222/5195:
 #0: ffff88801bbe2420 (sb_writers#10){.+.+}-{0:0}, at: do_tmpfile fs/namei.c:3761 [inline]
 #0: ffff88801bbe2420 (sb_writers#10){.+.+}-{0:0}, at: path_openat+0xc0f/0x29f0 fs/namei.c:3798
 #1: ffff888024f6a420 (sb_writers#5){.+.+}-{0:0}, at: ovl_tmpfile+0x15b/0x6f0 fs/overlayfs/dir.c:1363
 #2: ffff88803037a808 (&ovl_i_lock_key[depth]){+.+.}-{3:3}, at: ovl_inode_lock_interruptible fs/overlayfs/overlayfs.h:657 [inline]
 #2: ffff88803037a808 (&ovl_i_lock_key[depth]){+.+.}-{3:3}, at: ovl_copy_up_start+0x4d/0x2f0 fs/overlayfs/util.c:719

stack backtrace:
CPU: 0 PID: 5195 Comm: syz-executor222 Not tainted 6.10.0-rc2-syzkaller-00366-g771ed66105de #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
 check_deadlock kernel/locking/lockdep.c:3062 [inline]
 validate_chain kernel/locking/lockdep.c:3856 [inline]
 __lock_acquire+0x20e6/0x3b30 kernel/locking/lockdep.c:5137
 lock_acquire kernel/locking/lockdep.c:5754 [inline]
 lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5719
 percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
 __sb_start_write include/linux/fs.h:1655 [inline]
 sb_start_write include/linux/fs.h:1791 [inline]
 ovl_start_write+0x130/0x310 fs/overlayfs/util.c:31
 ovl_do_copy_up fs/overlayfs/copy_up.c:967 [inline]
 ovl_copy_up_one+0x82a/0x3490 fs/overlayfs/copy_up.c:1168
 ovl_copy_up_flags+0x18d/0x200 fs/overlayfs/copy_up.c:1223
 ovl_create_tmpfile fs/overlayfs/dir.c:1317 [inline]
 ovl_tmpfile+0x2b8/0x6f0 fs/overlayfs/dir.c:1373
 vfs_tmpfile+0x2be/0x540 fs/namei.c:3701
 do_tmpfile fs/namei.c:3764 [inline]
 path_openat+0xc8e/0x29f0 fs/namei.c:3798
 do_filp_open+0x1dc/0x430 fs/namei.c:3834
 do_sys_openat2+0x17a/0x1e0 fs/open.c:1405
 do_sys_open fs/open.c:1420 [inline]
 __do_sys_open fs/open.c:1428 [inline]
 __se_sys_open fs/open.c:1424 [inline]
 __x64_sys_open+0x154/0x1e0 fs/open.c:1424
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9268e3ef49
Code: 48 83 c4 28 c3 e8 67 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff6faf26d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00007fff6faf26e0 RCX: 00007f9268e3ef49
RDX: 0000000000000000 RSI: 0000000000591002 RDI: 0000000020000100
RBP: 00007fff6faf26e8 R08: 00007f9268e0bf50 R09: 00007f9268e0bf50
R10: 00007f9268e0bf50 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fff6faf2948 R14: 0000000000000001 R15: 0000000000000001
 </TASK>

final repro crashed as (corrupted=false):
============================================
WARNING: possible recursive locking detected
6.10.0-rc2-syzkaller-00366-g771ed66105de #0 Not tainted
--------------------------------------------
syz-executor222/5195 is trying to acquire lock:
ffff888024f6a420 (sb_writers#5){.+.+}-{0:0}, at: ovl_do_copy_up fs/overlayfs/copy_up.c:967 [inline]
ffff888024f6a420 (sb_writers#5){.+.+}-{0:0}, at: ovl_copy_up_one+0x82a/0x3490 fs/overlayfs/copy_up.c:1168

but task is already holding lock:
ffff888024f6a420 (sb_writers#5){.+.+}-{0:0}, at: ovl_tmpfile+0x15b/0x6f0 fs/overlayfs/dir.c:1363

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(sb_writers#5);
  lock(sb_writers#5);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

3 locks held by syz-executor222/5195:
 #0: ffff88801bbe2420 (sb_writers#10){.+.+}-{0:0}, at: do_tmpfile fs/namei.c:3761 [inline]
 #0: ffff88801bbe2420 (sb_writers#10){.+.+}-{0:0}, at: path_openat+0xc0f/0x29f0 fs/namei.c:3798
 #1: ffff888024f6a420 (sb_writers#5){.+.+}-{0:0}, at: ovl_tmpfile+0x15b/0x6f0 fs/overlayfs/dir.c:1363
 #2: ffff88803037a808 (&ovl_i_lock_key[depth]){+.+.}-{3:3}, at: ovl_inode_lock_interruptible fs/overlayfs/overlayfs.h:657 [inline]
 #2: ffff88803037a808 (&ovl_i_lock_key[depth]){+.+.}-{3:3}, at: ovl_copy_up_start+0x4d/0x2f0 fs/overlayfs/util.c:719

stack backtrace:
CPU: 0 PID: 5195 Comm: syz-executor222 Not tainted 6.10.0-rc2-syzkaller-00366-g771ed66105de #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
 check_deadlock kernel/locking/lockdep.c:3062 [inline]
 validate_chain kernel/locking/lockdep.c:3856 [inline]
 __lock_acquire+0x20e6/0x3b30 kernel/locking/lockdep.c:5137
 lock_acquire kernel/locking/lockdep.c:5754 [inline]
 lock_acquire+0x1b1/0x560 kernel/locking/lockdep.c:5719
 percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
 __sb_start_write include/linux/fs.h:1655 [inline]
 sb_start_write include/linux/fs.h:1791 [inline]
 ovl_start_write+0x130/0x310 fs/overlayfs/util.c:31
 ovl_do_copy_up fs/overlayfs/copy_up.c:967 [inline]
 ovl_copy_up_one+0x82a/0x3490 fs/overlayfs/copy_up.c:1168
 ovl_copy_up_flags+0x18d/0x200 fs/overlayfs/copy_up.c:1223
 ovl_create_tmpfile fs/overlayfs/dir.c:1317 [inline]
 ovl_tmpfile+0x2b8/0x6f0 fs/overlayfs/dir.c:1373
 vfs_tmpfile+0x2be/0x540 fs/namei.c:3701
 do_tmpfile fs/namei.c:3764 [inline]
 path_openat+0xc8e/0x29f0 fs/namei.c:3798
 do_filp_open+0x1dc/0x430 fs/namei.c:3834
 do_sys_openat2+0x17a/0x1e0 fs/open.c:1405
 do_sys_open fs/open.c:1420 [inline]
 __do_sys_open fs/open.c:1428 [inline]
 __se_sys_open fs/open.c:1424 [inline]
 __x64_sys_open+0x154/0x1e0 fs/open.c:1424
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9268e3ef49
Code: 48 83 c4 28 c3 e8 67 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff6faf26d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00007fff6faf26e0 RCX: 00007f9268e3ef49
RDX: 0000000000000000 RSI: 0000000000591002 RDI: 0000000020000100
RBP: 00007fff6faf26e8 R08: 00007f9268e0bf50 R09: 00007f9268e0bf50
R10: 00007f9268e0bf50 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fff6faf2948 R14: 0000000000000001 R15: 0000000000000001
 </TASK>