program: fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000a00)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000980), &(0x7f00000009c0)}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000e40)={0x18, 0xf, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x6}, [@func, @ldst={0x1, 0x0, 0x0, 0x9, 0xa, 0x8, 0xfffffffffffffffc}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x5}}, @jmp={0x5, 0x0, 0x6, 0x0, 0x8, 0x100}, @btf_id={0x18, 0x1, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}]}, &(0x7f00000007c0)='syzkaller\x00', 0x8, 0xf2, &(0x7f0000000800)=""/242, 0x41000, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000900)={0x2, 0x2}, 0x8, 0x10, &(0x7f0000000940)={0x2, 0x4, 0x9, 0x8}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000000a40)=[r0], &(0x7f0000000a80)=[{0x2, 0x1, 0xf, 0x1}], 0x10, 0xf6a}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./export\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./proc\x00', &(0x7f00000002c0)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0) write(r1, &(0x7f0000000440)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./proc/net/rpc/nfsd.export/channel\x00', 0x1, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010000000900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a32000000007c000000060a010400000000000000000100000a08000b400000000054000480340001800b000100657874686472000024000280080001400000000c0800034000000000080004400000002205000200070000001c0001800a00010072656469720000000c00028008000140000000120900010073797a3000000000140000001100010000000000000000000000000a58fd93c62e7fb3355c0af830468a155c3310b09bef03e2529dfb3cd170fc5e19bc54a43c6776daa6001690fe5b98e072c2d04b0c71fc2fb4deefe7150c87e19522fa9a6b32c03126184b66678b2867e34292c37c4f3a142d3faa02b576356c2eec03579839040ac7453ee3766fe1ffff89320708b5698b2c"], 0xf0}}, 0x0) setfsgid(0xee00) r4 = syz_clone(0x2008400, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r5) mount(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000080)='proc\x00', 0x189, 0x0) syz_open_procfs(r4, &(0x7f0000000200)='attr/fscreate\x00') write(r2, &(0x7f0000000540)='localhost ./export 2147483647\n', 0x1e) r6 = fsmount(0xffffffffffffffff, 0x0, 0x2) setns(r1, 0x20000) fchdir(r6) syz_read_part_table(0x604, &(0x7f0000000000)="$eJzs1D+LXFUYB+DfnZ2ZOxNcZtGAIkIWAlbLWkiKBQddgkqaZAlRLOwEq1gYCJhqliSlSLAV1iaChMB+AW0kTALBxipYhmBvEEFWPDJzJzsJKSx2YUx4nuKc97z3/Lucc294prVSj0qp+hk9ynS6s+ClpuqmlFL2B1z75NL5WdjOBzeO30y2Ns+eS45sf5xk9bUXksH+XPOFbj25bhnslfTzsDdPVc2cyXaSz+5fn4bt+SwrT22+PtCr8xzYHX7xU6b3ZthPL518k2x81zwbffjyWx+1qmp+C6t39sPOYa0/Pja9uKlzb3/O1WR5vf12kjuzzNqk029NPG6+ter041e41VRLzWfwpP5TmUPaPQe1OxwPrly90P26PW0++Pbo/V8vT36YF99Ye7Fza3Stag7vWJJed/KTq6aHvbTgfQMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAM+f3eF40J3F9z6vH7z5aXvWWin/lFKS1EkmXXpNvkp/cKRM6mwfzvpX7n7ZTz2sHuVKOfP7zvJ653YnZ3Zm665VGT02bGevqbsH3wGLND3/qxfe/+rS8M+baa7A5b9Ov95rwnpa9pM/ur3R0YtJWvOx/cVsGQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4n3v3vVOrW5tnzyWp2r0krZXr48mDE680HUry6o8nvj9/Z3Pj5KS9Pin+7p6q671y9+TDGys/H//l9lK26qb7D62kzsZy2u0msTstOwt5Of7TvwEAAP//Gzxl+g==") r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r7, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r7, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000b80), 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000640)={'ipvlan1\x00', 0x0}) r9 = openat(0xffffffffffffff9c, &(0x7f00000013c0)='./file0/file0\x00', 0x42, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000001c0), 0x10000, &(0x7f0000000300)=ANY=[@ANYBLOB="7b4e1bea00"/15, @ANYRESHEX=r9, @ANYBLOB=',wfdno=', @ANYRESHEX=r9, @ANYBLOB=',\x00']) bpf$MAP_CREATE(0x0, &(0x7f0000000680)=@base={0x1b, 0x8, 0x5af, 0x1ff, 0x46504, r7, 0x7, '\x00', r8, r9, 0x4, 0x0, 0x3}, 0x50) [ 87.160006][ T5316] [ 87.161011][ T5316] ============================================ [ 87.163322][ T5316] WARNING: possible recursive locking detected [ 87.165599][ T5316] syzkaller #0 Not tainted [ 87.167392][ T5316] -------------------------------------------- [ 87.170007][ T5316] syz.0.0/5316 is trying to acquire lock: [ 87.171958][ T5316] ffff8880122b78e0 (&sb->s_type->i_mutex_key#12){++++}-{4:4}, at: lookup_slow+0x46/0x70 [ 87.175123][ T5316] [ 87.175123][ T5316] but task is already holding lock: [ 87.177597][ T5316] ffff888013029ab0 (&sb->s_type->i_mutex_key#12){++++}-{4:4}, at: cache_write+0x78/0x210 [ 87.180927][ T5316] [ 87.180927][ T5316] other info that might help us debug this: [ 87.184177][ T5316] Possible unsafe locking scenario: [ 87.184177][ T5316] [ 87.187350][ T5316] CPU0 [ 87.188747][ T5316] ---- [ 87.190159][ T5316] lock(&sb->s_type->i_mutex_key#12); [ 87.192251][ T5316] lock(&sb->s_type->i_mutex_key#12); [ 87.194529][ T5316] [ 87.194529][ T5316] *** DEADLOCK *** [ 87.194529][ T5316] [ 87.197905][ T5316] May be due to missing lock nesting notation [ 87.197905][ T5316] [ 87.201172][ T5316] 3 locks held by syz.0.0/5316: [ 87.203010][ T5316] #0: ffff88803ff0aef0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x246/0x320 [ 87.206817][ T5316] #1: ffff88801244a450 (sb_writers#3){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 87.210558][ T5316] #2: ffff888013029ab0 (&sb->s_type->i_mutex_key#12){++++}-{4:4}, at: cache_write+0x78/0x210 [ 87.214742][ T5316] [ 87.214742][ T5316] stack backtrace: [ 87.217150][ T5316] CPU: 0 UID: 0 PID: 5316 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 87.217161][ T5316] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 87.217166][ T5316] Call Trace: [ 87.217172][ T5316] [ 87.217176][ T5316] dump_stack_lvl+0xe8/0x150 [ 87.217189][ T5316] print_deadlock_bug+0x279/0x290 [ 87.217207][ T5316] __lock_acquire+0x24df/0x2cf0 [ 87.217220][ T5316] ? lookup_slow+0x46/0x70 [ 87.217233][ T5316] lock_acquire+0x106/0x350 [ 87.217247][ T5316] ? lookup_slow+0x46/0x70 [ 87.217262][ T5316] down_read+0x4a/0x330 [ 87.217277][ T5316] ? lookup_slow+0x46/0x70 [ 87.217290][ T5316] lookup_slow+0x46/0x70 [ 87.217301][ T5316] path_lookupat+0x3f5/0x8c0 [ 87.217315][ T5316] filename_lookup+0x265/0x5d0 [ 87.217329][ T5316] ? __pfx_filename_lookup+0x10/0x10 [ 87.217345][ T5316] ? kmem_cache_alloc_noprof+0x150/0x5f0 [ 87.217361][ T5316] ? do_getname_kernel+0x54/0x230 [ 87.217371][ T5316] ? do_getname_kernel+0x54/0x230 [ 87.217382][ T5316] ? do_getname_kernel+0x97/0x230 [ 87.217392][ T5316] ? __asan_memcpy+0x40/0x70 [ 87.217403][ T5316] ? do_getname_kernel+0x183/0x230 [ 87.217414][ T5316] kern_path+0x3d/0x150 [ 87.217426][ T5316] svc_export_parse+0x237/0xa90 [ 87.217442][ T5316] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.217454][ T5316] ? __pfx_svc_export_parse+0x10/0x10 [ 87.217470][ T5316] ? __lock_acquire+0x683/0x2cf0 [ 87.217493][ T5316] cache_write+0x191/0x210 [ 87.217507][ T5316] ? cache_write_procfs+0x26/0x80 [ 87.217521][ T5316] ? __pfx_cache_write_procfs+0x10/0x10 [ 87.217534][ T5316] proc_reg_write+0x1e9/0x2e0 [ 87.217548][ T5316] ? __pfx_proc_reg_write+0x10/0x10 [ 87.217557][ T5316] vfs_write+0x296/0xba0 [ 87.217567][ T5316] ? __pfx_vfs_write+0x10/0x10 [ 87.217576][ T5316] ? __fget_files+0x2a/0x420 [ 87.217584][ T5316] ? __fget_files+0x3a2/0x420 [ 87.217591][ T5316] ? __fget_files+0x2a/0x420 [ 87.217599][ T5316] ksys_write+0x150/0x270 [ 87.217608][ T5316] ? __pfx_ksys_write+0x10/0x10 [ 87.217617][ T5316] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.217624][ T5316] do_syscall_64+0x174/0x580 [ 87.217633][ T5316] ? trace_irq_disable+0x3b/0x140 [ 87.217642][ T5316] ? clear_bhb_loop+0x70/0xc0 [ 87.217649][ T5316] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.217657][ T5316] RIP: 0033:0x7fc2b719e0d9 [ 87.217665][ T5316] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 87.217671][ T5316] RSP: 002b:00007fc2b80c9fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 87.217679][ T5316] RAX: ffffffffffffffda RBX: 00007fc2b7425fa0 RCX: 00007fc2b719e0d9 [ 87.217684][ T5316] RDX: 000000000000001e RSI: 0000200000000540 RDI: 0000000000000004 [ 87.217688][ T5316] RBP: 00007fc2b7235024 R08: 0000000000000000 R09: 0000000000000000 [ 87.217693][ T5316] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 87.217697][ T5316] R13: 00007fc2b7426038 R14: 00007fc2b7425fa0 R15: 00007fff07c4da18 [ 87.217708][ T5316] [ 87.343209][ T5279] Bluetooth: hci0: command tx timeout [ 87.394348][ T5317] loop0: detected capacity change from 0 to 2048 [ 87.418673][ T5317] loop0: p2 < > p4 [ 87.422407][ T5317] loop0: p4 size 262144 extends beyond EOD, truncated