REISERFS (device loop0): using 3.5.x disk format REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. ====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Not tainted ------------------------------------------------------ syz-executor.0/4386 is trying to acquire lock: ffff0000d60a4460 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write_file+0x64/0x1e8 fs/namespace.c:421 but task is already holding lock: ffff0000da213090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock+0x7c/0xe8 fs/reiserfs/lock.c:27 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&sbi->lock){+.+.}-{3:3}: __mutex_lock_common+0x194/0x1edc kernel/locking/mutex.c:596 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0xac/0x11c kernel/locking/mutex.c:743 reiserfs_write_lock+0x7c/0xe8 fs/reiserfs/lock.c:27 reiserfs_lookup+0x11c/0x378 fs/reiserfs/namei.c:364 __lookup_slow+0x24c/0x380 fs/namei.c:1663 lookup_one_len+0x178/0x28c fs/namei.c:2718 reiserfs_lookup_privroot+0x8c/0x204 fs/reiserfs/xattr.c:980 reiserfs_fill_super+0x17b0/0x1bb4 fs/reiserfs/super.c:2178 mount_bdev+0x264/0x358 fs/super.c:1400 get_super_block+0x44/0x58 fs/reiserfs/super.c:2608 legacy_get_tree+0xd4/0x16c fs/fs_context.c:611 vfs_get_tree+0x90/0x274 fs/super.c:1530 do_new_mount+0x228/0x810 fs/namespace.c:3025 path_mount+0x5b4/0x1000 fs/namespace.c:3355 do_mount fs/namespace.c:3368 [inline] __do_sys_mount fs/namespace.c:3576 [inline] __se_sys_mount fs/namespace.c:3553 [inline] __arm64_sys_mount+0x514/0x5e4 fs/namespace.c:3553 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 -> #1 (&type->i_mutex_dir_key#8){+.+.}-{3:3}: down_write+0xbc/0x12c kernel/locking/rwsem.c:1551 inode_lock include/linux/fs.h:787 [inline] open_last_lookups fs/namei.c:3529 [inline] path_openat+0x5f4/0x26e4 fs/namei.c:3739 do_filp_open+0x164/0x330 fs/namei.c:3769 do_sys_openat2+0x128/0x3d8 fs/open.c:1253 do_sys_open fs/open.c:1269 [inline] __do_sys_openat fs/open.c:1285 [inline] __se_sys_openat fs/open.c:1280 [inline] __arm64_sys_openat+0x120/0x154 fs/open.c:1280 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 -> #0 (sb_writers#12){.+.+}-{0:0}: check_prev_add kernel/locking/lockdep.c:3053 [inline] check_prevs_add kernel/locking/lockdep.c:3172 [inline] validate_chain kernel/locking/lockdep.c:3788 [inline] __lock_acquire+0x2928/0x651c kernel/locking/lockdep.c:5012 lock_acquire+0x1f4/0x620 kernel/locking/lockdep.c:5623 percpu_down_read include/linux/percpu-rwsem.h:51 [inline] __sb_start_write include/linux/fs.h:1811 [inline] sb_start_write+0xec/0x358 include/linux/fs.h:1881 mnt_want_write_file+0x64/0x1e8 fs/namespace.c:421 reiserfs_ioctl+0x118/0x4b4 fs/reiserfs/ioctl.c:103 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 other info that might help us debug this: Chain exists of: sb_writers#12 --> &type->i_mutex_dir_key#8 --> &sbi->lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&sbi->lock); lock(&type->i_mutex_dir_key#8); lock(&sbi->lock); lock(sb_writers#12); *** DEADLOCK *** 1 lock held by syz-executor.0/4386: #0: ffff0000da213090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock+0x7c/0xe8 fs/reiserfs/lock.c:27 stack backtrace: CPU: 0 PID: 4386 Comm: syz-executor.0 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 Call trace: dump_backtrace+0x0/0x43c arch/arm64/kernel/stacktrace.c:152 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106 dump_stack+0x1c/0x5c lib/dump_stack.c:113 print_circular_bug+0x148/0x1b0 kernel/locking/lockdep.c:2011 check_noncircular+0x240/0x2d4 kernel/locking/lockdep.c:2133 check_prev_add kernel/locking/lockdep.c:3053 [inline] check_prevs_add kernel/locking/lockdep.c:3172 [inline] validate_chain kernel/locking/lockdep.c:3788 [inline] __lock_acquire+0x2928/0x651c kernel/locking/lockdep.c:5012 lock_acquire+0x1f4/0x620 kernel/locking/lockdep.c:5623 percpu_down_read include/linux/percpu-rwsem.h:51 [inline] __sb_start_write include/linux/fs.h:1811 [inline] sb_start_write+0xec/0x358 include/linux/fs.h:1881 mnt_want_write_file+0x64/0x1e8 fs/namespace.c:421 reiserfs_ioctl+0x118/0x4b4 fs/reiserfs/ioctl.c:103 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 Internal error: Oops - BTI: 0000000036000001 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 4386 Comm: syz-executor.0 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 pstate: 42400405 (nZcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=jc) pc : reiserfs_ioctl+0x320/0x4b4 fs/reiserfs/ioctl.c:106 lr : reiserfs_ioctl+0x2f8/0x4b4 fs/reiserfs/ioctl.c:106 sp : ffff80001f197cd0 x29: ffff80001f197cd0 x28: ffff0000d092b680 x27: 0000000000400140 x26: 1fffe0001c52e1df x25: dfff800000000000 x24: 0000000000000000 x23: 00000000fffffff2 x22: ffff0000d69b8c80 x21: 0000000000000000 x20: ffff0000e2970ed0 x19: ffff0000e2970ef8 x18: 0000000000000001 x17: 0000000000000000 x16: ffff800008c2e61c x15: 00000000ffffffff x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000000000 x11: 1fffe0001c52e267 x10: 0000ffffffffffff x9 : 0000000000000000 x8 : ffff0000e2971338 x7 : 0000000000000001 x6 : ffff800008751314 x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000001 x2 : 0000000000000000 x1 : 0000000000000001 x0 : 0000000000000000 Call trace: reiserfs_ioctl+0x320/0x4b4 fs/reiserfs/ioctl.c:106 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 Code: ea2a013f 9a9f02ac d503229f b8400998 (38f96969) ---[ end trace 03c72e90b162f840 ]--- ---------------- Code disassembly (best guess): 0: ea2a013f bics xzr, x9, x10 4: 9a9f02ac csel x12, x21, xzr, eq // eq = none 8: d503229f csdb c: b8400998 ldtr w24, [x12] * 10: 38f96969 ldrsb w9, [x11, x25] <-- trapping instruction