./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3829094442 <...> Warning: Permanently added '10.128.10.25' (ED25519) to the list of known hosts. execve("./syz-executor3829094442", ["./syz-executor3829094442"], 0x7fff5de7d570 /* 10 vars */) = 0 brk(NULL) = 0x555565c5b000 brk(0x555565c5bd00) = 0x555565c5bd00 arch_prctl(ARCH_SET_FS, 0x555565c5b380) = 0 set_tid_address(0x555565c5b650) = 5834 set_robust_list(0x555565c5b660, 24) = 0 rseq(0x555565c5bca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3829094442", 4096) = 28 getrandom("\x18\x52\xb8\x9a\x37\xb3\xdb\x97", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555565c5bd00 brk(0x555565c7cd00) = 0x555565c7cd00 brk(0x555565c7d000) = 0x555565c7d000 mprotect(0x7efd7cb33000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 executing program write(1, "executing program\n", 18) = 18 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7efd74600000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 munmap(0x7efd74600000, 138412032) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 close(4) = 0 mkdir("./bus", 0777) = 0 [ 73.263364][ T5834] loop0: detected capacity change from 0 to 32768 [ 73.279516][ T5834] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop0 (7:0) scanned by syz-executor382 (5834) [ 73.301626][ T5834] BTRFS info (device loop0): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 73.312370][ T5834] BTRFS info (device loop0): using sha256 (sha256-x86_64) checksum algorithm [ 73.321661][ T5834] BTRFS info (device loop0): using free-space-tree [ 73.353149][ T5834] [ 73.355500][ T5834] ====================================================== [ 73.362507][ T5834] WARNING: possible circular locking dependency detected [ 73.369532][ T5834] 6.16.0-rc2-next-20250620-syzkaller #0 Not tainted [ 73.376109][ T5834] ------------------------------------------------------ [ 73.383125][ T5834] syz-executor382/5834 is trying to acquire lock: [ 73.389531][ T5834] ffffffff8e6e9fe8 (uuid_mutex){+.+.}-{4:4}, at: btrfs_read_chunk_tree+0xef/0x2170 [ 73.398893][ T5834] [ 73.398893][ T5834] but task is already holding lock: [ 73.406257][ T5834] ffff88802ab880e0 (&type->s_umount_key#41/1){+.+.}-{4:4}, at: alloc_super+0x204/0x970 [ 73.415939][ T5834] [ 73.415939][ T5834] which lock already depends on the new lock. [ 73.415939][ T5834] [ 73.426336][ T5834] [ 73.426336][ T5834] the existing dependency chain (in reverse order) is: [ 73.435359][ T5834] [ 73.435359][ T5834] -> #1 (&type->s_umount_key#41/1){+.+.}-{4:4}: [ 73.443803][ T5834] lock_acquire+0x120/0x360 [ 73.448842][ T5834] down_write_nested+0x9d/0x200 [ 73.454214][ T5834] alloc_super+0x204/0x970 [ 73.459150][ T5834] sget_fc+0x329/0xa40 [ 73.463742][ T5834] btrfs_get_tree+0x4c6/0x12d0 [ 73.469025][ T5834] vfs_get_tree+0x8f/0x2b0 [ 73.473961][ T5834] do_new_mount+0x24a/0xa40 [ 73.478977][ T5834] __se_sys_mount+0x317/0x410 [ 73.484169][ T5834] do_syscall_64+0xfa/0x3b0 [ 73.489199][ T5834] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 73.495607][ T5834] [ 73.495607][ T5834] -> #0 (uuid_mutex){+.+.}-{4:4}: [ 73.502820][ T5834] validate_chain+0xb9b/0x2140 [ 73.508112][ T5834] __lock_acquire+0xab9/0xd20 [ 73.513334][ T5834] lock_acquire+0x120/0x360 [ 73.518363][ T5834] __mutex_lock+0x182/0xe80 [ 73.523384][ T5834] btrfs_read_chunk_tree+0xef/0x2170 [ 73.529188][ T5834] open_ctree+0x17f2/0x3a10 [ 73.534298][ T5834] btrfs_get_tree+0xc6f/0x12d0 [ 73.539583][ T5834] vfs_get_tree+0x8f/0x2b0 [ 73.544527][ T5834] do_new_mount+0x24a/0xa40 [ 73.549552][ T5834] __se_sys_mount+0x317/0x410 [ 73.554748][ T5834] do_syscall_64+0xfa/0x3b0 [ 73.559782][ T5834] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 73.566196][ T5834] [ 73.566196][ T5834] other info that might help us debug this: [ 73.566196][ T5834] [ 73.576417][ T5834] Possible unsafe locking scenario: [ 73.576417][ T5834] [ 73.583858][ T5834] CPU0 CPU1 [ 73.589203][ T5834] ---- ---- [ 73.594538][ T5834] lock(&type->s_umount_key#41/1); [ 73.599717][ T5834] lock(uuid_mutex); [ 73.606188][ T5834] lock(&type->s_umount_key#41/1); [ 73.613882][ T5834] lock(uuid_mutex); [ 73.617836][ T5834] [ 73.617836][ T5834] *** DEADLOCK *** [ 73.617836][ T5834] [ 73.625949][ T5834] 1 lock held by syz-executor382/5834: [ 73.631375][ T5834] #0: ffff88802ab880e0 (&type->s_umount_key#41/1){+.+.}-{4:4}, at: alloc_super+0x204/0x970 [ 73.641438][ T5834] [ 73.641438][ T5834] stack backtrace: [ 73.647310][ T5834] CPU: 0 UID: 0 PID: 5834 Comm: syz-executor382 Not tainted 6.16.0-rc2-next-20250620-syzkaller #0 PREEMPT(full) [ 73.647323][ T5834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 73.647333][ T5834] Call Trace: [ 73.647340][ T5834] [ 73.647345][ T5834] dump_stack_lvl+0x189/0x250 [ 73.647361][ T5834] ? __pfx_dump_stack_lvl+0x10/0x10 [ 73.647373][ T5834] ? __pfx__printk+0x10/0x10 [ 73.647383][ T5834] ? print_lock_name+0xde/0x100 [ 73.647393][ T5834] print_circular_bug+0x2ee/0x310 [ 73.647403][ T5834] check_noncircular+0x134/0x160 [ 73.647417][ T5834] validate_chain+0xb9b/0x2140 [ 73.647434][ T5834] __lock_acquire+0xab9/0xd20 [ 73.647446][ T5834] ? btrfs_read_chunk_tree+0xef/0x2170 [ 73.647456][ T5834] lock_acquire+0x120/0x360 [ 73.647466][ T5834] ? btrfs_read_chunk_tree+0xef/0x2170 [ 73.647478][ T5834] __mutex_lock+0x182/0xe80 [ 73.647488][ T5834] ? btrfs_read_chunk_tree+0xef/0x2170 [ 73.647499][ T5834] ? btrfs_read_chunk_tree+0xef/0x2170 [ 73.647509][ T5834] ? __pfx___mutex_lock+0x10/0x10 [ 73.647519][ T5834] ? rcu_is_watching+0x15/0xb0 [ 73.647531][ T5834] ? trace_kmem_cache_alloc+0x1f/0xc0 [ 73.647544][ T5834] ? btrfs_read_chunk_tree+0xcd/0x2170 [ 73.647553][ T5834] btrfs_read_chunk_tree+0xef/0x2170 [ 73.647564][ T5834] ? btrfs_root_node+0xae/0x4a0 [ 73.647575][ T5834] ? btrfs_root_node+0x459/0x4a0 [ 73.647585][ T5834] ? btrfs_root_node+0xae/0x4a0 [ 73.647595][ T5834] ? __pfx_btrfs_root_node+0x10/0x10 [ 73.647606][ T5834] ? __pfx_btrfs_read_chunk_tree+0x10/0x10 [ 73.647615][ T5834] ? load_super_root+0x2b2/0x3f0 [ 73.647625][ T5834] ? __pfx_load_super_root+0x10/0x10 [ 73.647635][ T5834] ? read_extent_buffer+0x120/0x5e0 [ 73.647645][ T5834] ? open_ctree+0x17ea/0x3a10 [ 73.647655][ T5834] open_ctree+0x17f2/0x3a10 [ 73.647663][ T5834] ? bdi_register_va+0x58d/0x740 [ 73.647673][ T5834] ? open_ctree+0xa1a/0x3a10 [ 73.647684][ T5834] ? __pfx_open_ctree+0x10/0x10 [ 73.647694][ T5834] btrfs_get_tree+0xc6f/0x12d0 [ 73.647707][ T5834] vfs_get_tree+0x8f/0x2b0 [ 73.647719][ T5834] do_new_mount+0x24a/0xa40 [ 73.647729][ T5834] __se_sys_mount+0x317/0x410 [ 73.647739][ T5834] ? __pfx___se_sys_mount+0x10/0x10 [ 73.647747][ T5834] ? rcu_is_watching+0x15/0xb0 [ 73.647763][ T5834] ? __x64_sys_mount+0x20/0xc0 [ 73.647771][ T5834] do_syscall_64+0xfa/0x3b0 [ 73.647781][ T5834] ? lockdep_hardirqs_on+0x9c/0x150 [ 73.647789][ T5834] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 73.647797][ T5834] ? clear_bhb_loop+0x60/0xb0 [ 73.647807][ T5834] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 73.647816][ T5834] RIP: 0033:0x7efd7cabbcfa [ 73.647828][ T5834] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 73.647838][ T5834] RSP: 002b:00007ffeada7d1e8 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5 [ 73.647848][ T5834] RAX: ffffffffffffffda RBX: 00007ffeada7d200 RCX: 00007efd7cabbcfa [ 73.647854][ T5834] RDX: 00002000000055c0 RSI: 0000200000000340 RDI: 00007ffeada7d200 [ 73.647860][ T5834] RBP: 0000200000000340 R08: 00007ffeada7d240 R09: 000000000000559d [ 73.647866][ T5834] R10: 0000000000000008 R11: 0000000000000282 R12: 00002000000055c0 [ 73.647872][ T5834] R13: 00007ffeada7d240 R14: 0000000000000003 R15: 0000000000000008 mount("/dev/loop0", "./bus", "btrfs", MS_NOEXEC, "user_subvol_rm_allowed,autodefrag,ref_verify,acl,clear_cache,discard,thread_pool=0x0000000000000009,"...) = 0 openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 chdir("./bus") = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_CLR_FD) = 0 close(4) = 0 exit_group(0) = ? +++ exited with 0 +++ [ 73.64