./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2779994891 <...> Warning: Permanently added '10.128.0.187' (ED25519) to the list of known hosts. execve("./syz-executor2779994891", ["./syz-executor2779994891"], 0x7ffdc07fd6d0 /* 10 vars */) = 0 brk(NULL) = 0x555555585000 brk(0x555555585d00) = 0x555555585d00 arch_prctl(ARCH_SET_FS, 0x555555585380) = 0 set_tid_address(0x555555585650) = 5012 set_robust_list(0x555555585660, 24) = 0 rseq(0x555555585ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2779994891", 4096) = 28 getrandom("\x42\x78\x2d\x6a\x42\x6d\x37\x95", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555555585d00 brk(0x5555555a6d00) = 0x5555555a6d00 brk(0x5555555a7000) = 0x5555555a7000 mprotect(0x7f0bec9c6000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0be4511000 [ 53.289628][ T5012] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=5012 'syz-executor277' write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 munmap(0x7f0be4511000, 16777216) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 mkdir("./file0", 0777) = 0 [ 53.438513][ T5012] loop0: detected capacity change from 0 to 32768 [ 53.450577][ T5012] BTRFS: device fsid d552757d-9c39-40e3-95f0-16d819589928 devid 1 transid 8 /dev/loop0 scanned by syz-executor277 (5012) [ 53.474336][ T5012] BTRFS info (device loop0): using sha256 (sha256-avx2) checksum algorithm mount("/dev/loop0", "./file0", "btrfs", 0, "noacl,subvolid=0x0000000000000000,ssd_spread,space_cache=v2,discard,enospc_debug,space_cache=v2,nofl"...) = 0 openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 chdir("./file0") = 0 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [ 53.483222][ T5012] BTRFS info (device loop0): enabling ssd optimizations [ 53.490221][ T5012] BTRFS info (device loop0): using spread ssd allocation scheme [ 53.498010][ T5012] BTRFS info (device loop0): turning on sync discard [ 53.504680][ T5012] BTRFS info (device loop0): using free space tree [ 53.546180][ T5012] [ 53.548559][ T5012] ====================================================== [ 53.555585][ T5012] WARNING: possible circular locking dependency detected [ 53.562615][ T5012] 6.5.0-rc7-syzkaller-00004-gf7757129e3de #0 Not tainted [ 53.569640][ T5012] ------------------------------------------------------ [ 53.576663][ T5012] syz-executor277/5012 is trying to acquire lock: [ 53.583090][ T5012] ffff88802df41710 (btrfs-tree-01){++++}-{3:3}, at: __btrfs_tree_read_lock+0x2f/0x220 [ 53.592715][ T5012] [ 53.592715][ T5012] but task is already holding lock: [ 53.600085][ T5012] ffff88802df418e8 (btrfs-tree-00){++++}-{3:3}, at: __btrfs_tree_read_lock+0x2f/0x220 [ 53.609792][ T5012] [ 53.609792][ T5012] which lock already depends on the new lock. [ 53.609792][ T5012] [ 53.620215][ T5012] [ 53.620215][ T5012] the existing dependency chain (in reverse order) is: [ 53.629327][ T5012] [ 53.629327][ T5012] -> #1 (btrfs-tree-00){++++}-{3:3}: [ 53.636825][ T5012] down_read_nested+0x49/0x2f0 [ 53.642146][ T5012] __btrfs_tree_read_lock+0x2f/0x220 [ 53.648066][ T5012] btrfs_search_slot+0x13a4/0x2f80 [ 53.653729][ T5012] btrfs_init_root_free_objectid+0x148/0x320 [ 53.660407][ T5012] btrfs_get_root_ref+0x5ae/0xae0 [ 53.665960][ T5012] open_ctree+0x29c8/0x3030 [ 53.671160][ T5012] btrfs_fill_super+0x1c7/0x2f0 [ 53.676540][ T5012] btrfs_mount_root+0x7e0/0x910 [ 53.681899][ T5012] legacy_get_tree+0xef/0x190 [ 53.687094][ T5012] vfs_get_tree+0x8c/0x270 [ 53.692022][ T5012] vfs_kern_mount+0xbc/0x150 [ 53.697128][ T5012] btrfs_mount+0x39f/0xb50 [ 53.702061][ T5012] legacy_get_tree+0xef/0x190 [ 53.707254][ T5012] vfs_get_tree+0x8c/0x270 [ 53.712279][ T5012] do_new_mount+0x28f/0xae0 [ 53.717511][ T5012] __se_sys_mount+0x2d9/0x3c0 [ 53.722699][ T5012] do_syscall_64+0x41/0xc0 [ 53.727621][ T5012] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 53.734257][ T5012] [ 53.734257][ T5012] -> #0 (btrfs-tree-01){++++}-{3:3}: [ 53.741910][ T5012] __lock_acquire+0x39ff/0x7f70 [ 53.747291][ T5012] lock_acquire+0x1e3/0x520 [ 53.752606][ T5012] down_read_nested+0x49/0x2f0 [ 53.757908][ T5012] __btrfs_tree_read_lock+0x2f/0x220 [ 53.763733][ T5012] btrfs_read_lock_root_node+0x292/0x3c0 [ 53.769927][ T5012] btrfs_search_slot+0x4ff/0x2f80 [ 53.775555][ T5012] btrfs_lookup_inode+0xdc/0x480 [ 53.781016][ T5012] btrfs_iget_path+0x2d9/0x1520 [ 53.786491][ T5012] btrfs_ioctl_ino_lookup_user+0x77a/0xf50 [ 53.792980][ T5012] btrfs_ioctl+0xb0b/0xd40 [ 53.798091][ T5012] __se_sys_ioctl+0xf8/0x170 [ 53.803732][ T5012] do_syscall_64+0x41/0xc0 [ 53.808673][ T5012] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 53.815258][ T5012] [ 53.815258][ T5012] other info that might help us debug this: [ 53.815258][ T5012] [ 53.825560][ T5012] Possible unsafe locking scenario: [ 53.825560][ T5012] [ 53.833010][ T5012] CPU0 CPU1 [ 53.838463][ T5012] ---- ---- [ 53.843842][ T5012] rlock(btrfs-tree-00); [ 53.848162][ T5012] lock(btrfs-tree-01); [ 53.855001][ T5012] lock(btrfs-tree-00); [ 53.861923][ T5012] rlock(btrfs-tree-01); [ 53.866250][ T5012] [ 53.866250][ T5012] *** DEADLOCK *** [ 53.866250][ T5012] [ 53.874395][ T5012] 1 lock held by syz-executor277/5012: [ 53.880273][ T5012] #0: ffff88802df418e8 (btrfs-tree-00){++++}-{3:3}, at: __btrfs_tree_read_lock+0x2f/0x220 [ 53.890274][ T5012] [ 53.890274][ T5012] stack backtrace: [ 53.896149][ T5012] CPU: 1 PID: 5012 Comm: syz-executor277 Not tainted 6.5.0-rc7-syzkaller-00004-gf7757129e3de #0 [ 53.906630][ T5012] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 [ 53.916676][ T5012] Call Trace: [ 53.919952][ T5012] [ 53.922874][ T5012] dump_stack_lvl+0x1e7/0x2d0 [ 53.927807][ T5012] ? nf_tcp_handle_invalid+0x650/0x650 [ 53.933356][ T5012] ? print_circular_bug+0x12b/0x1a0 [ 53.938582][ T5012] check_noncircular+0x375/0x4a0 [ 53.943512][ T5012] ? print_deadlock_bug+0x600/0x600 [ 53.948710][ T5012] ? lockdep_lock+0x123/0x2b0 [ 53.953381][ T5012] ? mark_lock+0x9a/0x340 [ 53.957700][ T5012] ? _find_first_zero_bit+0xd4/0x100 [ 53.962977][ T5012] __lock_acquire+0x39ff/0x7f70 [ 53.967922][ T5012] ? stack_trace_save+0x117/0x1c0 [ 53.972939][ T5012] ? verify_lock_unused+0x140/0x140 [ 53.978146][ T5012] ? read_lock_is_recursive+0x20/0x20 [ 53.983511][ T5012] ? rcu_lock_release+0x5/0x30 [ 53.988263][ T5012] ? __lock_acquire+0x7f70/0x7f70 [ 53.993283][ T5012] ? unwind_next_frame+0x1a0d/0x2390 [ 53.998818][ T5012] lock_acquire+0x1e3/0x520 [ 54.003311][ T5012] ? __btrfs_tree_read_lock+0x2f/0x220 [ 54.008764][ T5012] ? read_lock_is_recursive+0x20/0x20 [ 54.014144][ T5012] ? __might_sleep+0xc0/0xc0 [ 54.018736][ T5012] ? __lock_acquire+0x7f70/0x7f70 [ 54.023757][ T5012] down_read_nested+0x49/0x2f0 [ 54.028538][ T5012] ? __btrfs_tree_read_lock+0x2f/0x220 [ 54.034034][ T5012] ? __btrfs_tree_read_lock+0x1e/0x220 [ 54.039496][ T5012] __btrfs_tree_read_lock+0x2f/0x220 [ 54.044780][ T5012] btrfs_read_lock_root_node+0x292/0x3c0 [ 54.050408][ T5012] btrfs_search_slot+0x4ff/0x2f80 [ 54.055515][ T5012] ? btrfs_ioctl+0xb0b/0xd40 [ 54.060181][ T5012] ? __se_sys_ioctl+0xf8/0x170 [ 54.064939][ T5012] ? do_syscall_64+0x41/0xc0 [ 54.069527][ T5012] ? btrfs_find_item+0x5c0/0x5c0 [ 54.074549][ T5012] btrfs_lookup_inode+0xdc/0x480 [ 54.079565][ T5012] ? __kasan_slab_alloc+0x66/0x70 [ 54.084685][ T5012] ? slab_post_alloc_hook+0x87/0x3b0 [ 54.089969][ T5012] ? btrfs_insert_empty_inode+0x2e0/0x2e0 [ 54.095764][ T5012] ? rcu_is_watching+0x15/0xb0 [ 54.100523][ T5012] ? kmem_cache_alloc+0x152/0x300 [ 54.105537][ T5012] ? btrfs_iget_path+0x2c4/0x1520 [ 54.110554][ T5012] btrfs_iget_path+0x2d9/0x1520 [ 54.115480][ T5012] ? read_extent_buffer+0x1f0/0x2a0 [ 54.120762][ T5012] ? evict_refill_and_join+0x210/0x210 [ 54.126296][ T5012] ? btrfs_search_backwards+0x650/0x650 [ 54.131831][ T5012] ? read_extent_buffer+0x122/0x2a0 [ 54.137018][ T5012] ? __asan_memcpy+0x40/0x70 [ 54.141605][ T5012] ? read_extent_buffer+0x1f0/0x2a0 [ 54.146894][ T5012] btrfs_ioctl_ino_lookup_user+0x77a/0xf50 [ 54.152787][ T5012] ? btrfs_ioctl_get_subvol_rootref+0x960/0x960 [ 54.159017][ T5012] ? smack_file_alloc_security+0x70/0xe0 [ 54.164725][ T5012] ? do_notify_parent+0xf50/0xf50 [ 54.169737][ T5012] btrfs_ioctl+0xb0b/0xd40 [ 54.174270][ T5012] ? btrfs_ioctl_get_supported_features+0x50/0x50 [ 54.180783][ T5012] __se_sys_ioctl+0xf8/0x170 [ 54.185374][ T5012] do_syscall_64+0x41/0xc0 [ 54.189793][ T5012] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 54.195860][ T5012] RIP: 0033:0x7f0bec94ea39 [ 54.200302][ T5012] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 54.220594][ T5012] RSP: 002b:00007ffcde5751e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 54.229174][ T5012] RAX: ffffffffffffffda RBX: 00007ffcde5753b8 RCX: 00007f0bec94ea39 [ 54.237226][ T5012] RDX: 0000000020000040 RSI: 00000000d000943e RDI: 0000000000000004 ioctl(4, BTRFS_IOC_INO_LOOKUP_USER, 0x20000040) = -1 EACCES (Permission denied) exit_group(0) = ? +++ exited with 0 +++ [ 54.245275][ T5012] RBP: 00007f0bec9c6610 R08: