[v5.15] possible deadlock in mnt_want_write_file

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: abddfcf701a5 Linux 5.15.99
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=17220088c80000
kernel config: https://syzkaller.appspot.com/x/.config?x=e8038112e99511e7
dashboard link: https://syzkaller.appspot.com/bug?extid=05d77323dd63604b4769
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/5d41fec63ff8/disk-abddfcf7.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/69db433dc01f/vmlinux-abddfcf7.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a00e1270bd95/bzImage-abddfcf7.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+05d773...@syzkaller.appspotmail.com

REISERFS (device loop1): checking transaction log (loop1)
REISERFS (device loop1): Using r5 hash to sort names
REISERFS (device loop1): using 3.5.x disk format
REISERFS (device loop1): Created .reiserfs_priv - reserved for xattr storage.
======================================================
WARNING: possible circular locking dependency detected
5.15.99-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.1/8903 is trying to acquire lock:
ffff88807e204460 (sb_writers#29){.+.+}-{0:0}, at: mnt_want_write_file+0x5a/0x1f0 fs/namespace.c:421

but task is already holding lock:
ffff888046a62090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock+0x76/0xd0 fs/reiserfs/lock.c:27

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (&sbi->lock){+.+.}-{3:3}:
lock_acquire+0x1ff/0x570 kernel/locking/lockdep.c:5622
__mutex_lock_common+0x1da/0x25a0 kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
reiserfs_write_lock+0x76/0xd0 fs/reiserfs/lock.c:27
reiserfs_lookup+0x15c/0x4b0 fs/reiserfs/namei.c:364
__lookup_slow+0x275/0x3d0 fs/namei.c:1659
lookup_one_len+0x187/0x2d0 fs/namei.c:2688
reiserfs_lookup_privroot+0x85/0x1e0 fs/reiserfs/xattr.c:980
reiserfs_fill_super+0x191e/0x2690 fs/reiserfs/super.c:2196
mount_bdev+0x26d/0x3a0 fs/super.c:1369
legacy_get_tree+0xeb/0x180 fs/fs_context.c:610
vfs_get_tree+0x88/0x270 fs/super.c:1499
do_new_mount+0x28b/0xad0 fs/namespace.c:2994
do_mount fs/namespace.c:3337 [inline]
__do_sys_mount fs/namespace.c:3545 [inline]
__se_sys_mount+0x2d5/0x3c0 fs/namespace.c:3522
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb

-> #1 (&type->i_mutex_dir_key#9){+.+.}-{3:3}:
lock_acquire+0x1ff/0x570 kernel/locking/lockdep.c:5622
down_write+0x97/0x170 kernel/locking/rwsem.c:1541
inode_lock include/linux/fs.h:787 [inline]
open_last_lookups fs/namei.c:3401 [inline]
path_openat+0x818/0x2ee0 fs/namei.c:3612
do_filp_open+0x21c/0x460 fs/namei.c:3642
do_sys_openat2+0x13b/0x500 fs/open.c:1211
do_sys_open fs/open.c:1227 [inline]
__do_sys_open fs/open.c:1235 [inline]
__se_sys_open fs/open.c:1231 [inline]
__x64_sys_open+0x221/0x270 fs/open.c:1231
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb

-> #0 (sb_writers#29){.+.+}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain+0x1646/0x58b0 kernel/locking/lockdep.c:3787
__lock_acquire+0x1295/0x1ff0 kernel/locking/lockdep.c:5011
lock_acquire+0x1ff/0x570 kernel/locking/lockdep.c:5622
percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
__sb_start_write include/linux/fs.h:1742 [inline]
sb_start_write+0x4f/0x1c0 include/linux/fs.h:1812
mnt_want_write_file+0x5a/0x1f0 fs/namespace.c:421
reiserfs_ioctl+0x170/0x340 fs/reiserfs/ioctl.c:103
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb

other info that might help us debug this:

Chain exists of:
sb_writers#29 --> &type->i_mutex_dir_key#9 --> &sbi->lock

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&sbi->lock);
lock(&type->i_mutex_dir_key#9);
lock(&sbi->lock);
lock(sb_writers#29);

*** DEADLOCK ***

1 lock held by syz-executor.1/8903:
#0: ffff888046a62090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock+0x76/0xd0 fs/reiserfs/lock.c:27

stack backtrace:
CPU: 1 PID: 8903 Comm: syz-executor.1 Not tainted 5.15.99-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
check_noncircular+0x2f8/0x3b0 kernel/locking/lockdep.c:2133
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain+0x1646/0x58b0 kernel/locking/lockdep.c:3787
__lock_acquire+0x1295/0x1ff0 kernel/locking/lockdep.c:5011
lock_acquire+0x1ff/0x570 kernel/locking/lockdep.c:5622
percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
__sb_start_write include/linux/fs.h:1742 [inline]
sb_start_write+0x4f/0x1c0 include/linux/fs.h:1812
mnt_want_write_file+0x5a/0x1f0 fs/namespace.c:421
reiserfs_ioctl+0x170/0x340 fs/reiserfs/ioctl.c:103
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f6ddc6c10f9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6ddac33168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f6ddc7e0f80 RCX: 00007f6ddc6c10f9
RDX: 0000000000000000 RSI: 0000000040087602 RDI: 0000000000000004
RBP: 00007f6ddc71cae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffee34d545f R14: 00007f6ddac33300 R15: 0000000000022000
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 6449a0ba6843 Linux 6.1.19
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15a38aecc80000
kernel config: https://syzkaller.appspot.com/x/.config?x=9ed8b3ec03e8c126
dashboard link: https://syzkaller.appspot.com/bug?extid=8e2806d6bcf61ef2ef23

compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:

disk image: https://storage.googleapis.com/syzbot-assets/0ad616da3180/disk-6449a0ba.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/42677a30acb3/vmlinux-6449a0ba.xz
kernel image: https://storage.googleapis.com/syzbot-assets/2e21fe35d03d/bzImage-6449a0ba.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+8e2806...@syzkaller.appspotmail.com

REISERFS (device loop3): journal params: device loop3, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
REISERFS (device loop3): checking transaction log (loop3)
REISERFS (device loop3): Using r5 hash to sort names

======================================================
WARNING: possible circular locking dependency detected

6.1.19-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.3/20546 is trying to acquire lock:
ffff888077306460 (sb_writers#24){.+.+}-{0:0}, at: mnt_want_write_file+0x5a/0x1f0 fs/namespace.c:437

but task is already holding lock:

ffff888018876090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock+0x76/0xd0 fs/reiserfs/lock.c:27

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (&sbi->lock){+.+.}-{3:3}:

lock_acquire+0x23a/0x630 kernel/locking/lockdep.c:5669
__mutex_lock_common+0x1d4/0x2520 kernel/locking/mutex.c:603
__mutex_lock kernel/locking/mutex.c:747 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:799

reiserfs_write_lock+0x76/0xd0 fs/reiserfs/lock.c:27
reiserfs_lookup+0x15c/0x4b0 fs/reiserfs/namei.c:364

__lookup_slow+0x27e/0x3d0 fs/namei.c:1685
lookup_one_len+0x187/0x2d0 fs/namei.c:2711
reiserfs_lookup_privroot+0x85/0x1e0 fs/reiserfs/xattr.c:973
reiserfs_fill_super+0x21bd/0x2620 fs/reiserfs/super.c:2174
mount_bdev+0x26d/0x3a0 fs/super.c:1414
legacy_get_tree+0xeb/0x180 fs/fs_context.c:610
vfs_get_tree+0x88/0x270 fs/super.c:1544
do_new_mount+0x28b/0xad0 fs/namespace.c:3040
do_mount fs/namespace.c:3383 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount+0x2d5/0x3c0 fs/namespace.c:3568

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80

entry_SYSCALL_64_after_hwframe+0x63/0xcd

-> #1 (&type->i_mutex_dir_key#16){+.+.}-{3:3}:
lock_acquire+0x23a/0x630 kernel/locking/lockdep.c:5669
down_write+0x36/0x60 kernel/locking/rwsem.c:1573
inode_lock include/linux/fs.h:756 [inline]
open_last_lookups fs/namei.c:3478 [inline]
path_openat+0x7b6/0x2e60 fs/namei.c:3711
do_filp_open+0x230/0x480 fs/namei.c:3741
do_sys_openat2+0x13b/0x500 fs/open.c:1310
do_sys_open fs/open.c:1326 [inline]
__do_sys_creat fs/open.c:1402 [inline]
__se_sys_creat fs/open.c:1396 [inline]
__x64_sys_creat+0x11f/0x160 fs/open.c:1396

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80

entry_SYSCALL_64_after_hwframe+0x63/0xcd

-> #0 (sb_writers#24){.+.+}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3098 [inline]
check_prevs_add kernel/locking/lockdep.c:3217 [inline]
validate_chain+0x1667/0x58e0 kernel/locking/lockdep.c:3832
__lock_acquire+0x125b/0x1f80 kernel/locking/lockdep.c:5056
lock_acquire+0x23a/0x630 kernel/locking/lockdep.c:5669
percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
__sb_start_write include/linux/fs.h:1832 [inline]
sb_start_write+0x4d/0x1c0 include/linux/fs.h:1907
mnt_want_write_file+0x5a/0x1f0 fs/namespace.c:437

reiserfs_ioctl+0x170/0x340 fs/reiserfs/ioctl.c:103
vfs_ioctl fs/ioctl.c:51 [inline]

__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl+0xf1/0x160 fs/ioctl.c:856

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80

entry_SYSCALL_64_after_hwframe+0x63/0xcd

other info that might help us debug this:

Chain exists of:

sb_writers#24 --> &type->i_mutex_dir_key#16 --> &sbi->lock

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&sbi->lock);

lock(&type->i_mutex_dir_key#16);
lock(&sbi->lock);
lock(sb_writers#24);

*** DEADLOCK ***

1 lock held by syz-executor.3/20546:
#0: ffff888018876090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock+0x76/0xd0 fs/reiserfs/lock.c:27

stack backtrace:
CPU: 0 PID: 20546 Comm: syz-executor.3 Not tainted 6.1.19-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106

check_noncircular+0x2fa/0x3b0 kernel/locking/lockdep.c:2178
check_prev_add kernel/locking/lockdep.c:3098 [inline]
check_prevs_add kernel/locking/lockdep.c:3217 [inline]
validate_chain+0x1667/0x58e0 kernel/locking/lockdep.c:3832
__lock_acquire+0x125b/0x1f80 kernel/locking/lockdep.c:5056
lock_acquire+0x23a/0x630 kernel/locking/lockdep.c:5669
percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
__sb_start_write include/linux/fs.h:1832 [inline]
sb_start_write+0x4d/0x1c0 include/linux/fs.h:1907
mnt_want_write_file+0x5a/0x1f0 fs/namespace.c:437

reiserfs_ioctl+0x170/0x340 fs/reiserfs/ioctl.c:103
vfs_ioctl fs/ioctl.c:51 [inline]

__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl+0xf1/0x160 fs/ioctl.c:856

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80

entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f26bda8c0f9

Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007f26be7c7168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f26bdbabf80 RCX: 00007f26bda8c0f9

RDX: 0000000000000000 RSI: 0000000040087602 RDI: 0000000000000004

RBP: 00007f26bdae7b39 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007fff213ab1ef R14: 00007f26be7c7300 R15: 0000000000022000

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 8a7f2a5c5aa1 Linux 5.15.110
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1444e15c280000
kernel config: https://syzkaller.appspot.com/x/.config?x=7e93d602da27af41

dashboard link: https://syzkaller.appspot.com/bug?extid=05d77323dd63604b4769
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2

userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13105938280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12741f04280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/16bea75b636d/disk-8a7f2a5c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3b169e33dcf2/vmlinux-8a7f2a5c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/190d08a00950/Image-8a7f2a5c.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/3add93d61bde/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+05d773...@syzkaller.appspotmail.com

REISERFS (device loop0): using 3.5.x disk format
REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage.

======================================================
WARNING: possible circular locking dependency detected

5.15.110-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor865/3961 is trying to acquire lock:
ffff0000c887e460 (sb_writers#8){.+.+}-{0:0}, at: mnt_want_write_file+0x64/0x1e8 fs/namespace.c:421

but task is already holding lock:

ffff0000c1ec6090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock+0x7c/0xe8 fs/reiserfs/lock.c:27

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (&sbi->lock){+.+.}-{3:3}:

__mutex_lock_common+0x194/0x2154 kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0xa4/0xf8 kernel/locking/mutex.c:743
reiserfs_write_lock+0x7c/0xe8 fs/reiserfs/lock.c:27
reiserfs_lookup+0x130/0x3c4 fs/reiserfs/namei.c:364
__lookup_slow+0x250/0x388 fs/namei.c:1659
lookup_one_len+0x178/0x28c fs/namei.c:2688
reiserfs_lookup_privroot+0x8c/0x204 fs/reiserfs/xattr.c:980
reiserfs_fill_super+0x1aec/0x1e8c fs/reiserfs/super.c:2178
mount_bdev+0x26c/0x368 fs/super.c:1378
get_super_block+0x44/0x58 fs/reiserfs/super.c:2608
legacy_get_tree+0xd4/0x16c fs/fs_context.c:610
vfs_get_tree+0x90/0x274 fs/super.c:1508
do_new_mount+0x25c/0x8c8 fs/namespace.c:2994
path_mount+0x590/0x104c fs/namespace.c:3324

do_mount fs/namespace.c:3337 [inline]
__do_sys_mount fs/namespace.c:3545 [inline]

__se_sys_mount fs/namespace.c:3522 [inline]
__arm64_sys_mount+0x510/0x5e0 fs/namespace.c:3522
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

-> #1 (&type->i_mutex_dir_key#6){+.+.}-{3:3}:
down_write+0x110/0x260 kernel/locking/rwsem.c:1541
inode_lock include/linux/fs.h:787 [inline]
open_last_lookups fs/namei.c:3459 [inline]
path_openat+0x63c/0x26f0 fs/namei.c:3669
do_filp_open+0x1a8/0x3b4 fs/namei.c:3699
do_sys_openat2+0x128/0x3d8 fs/open.c:1211
do_sys_open fs/open.c:1227 [inline]
__do_sys_openat fs/open.c:1243 [inline]
__se_sys_openat fs/open.c:1238 [inline]
__arm64_sys_openat+0x1f0/0x240 fs/open.c:1238
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

-> #0 (sb_writers#8){.+.+}-{0:0}:

check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]

validate_chain kernel/locking/lockdep.c:3787 [inline]
__lock_acquire+0x32cc/0x7620 kernel/locking/lockdep.c:5011
lock_acquire+0x240/0x77c kernel/locking/lockdep.c:5622

percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
__sb_start_write include/linux/fs.h:1742 [inline]

sb_start_write+0xf0/0x3ac include/linux/fs.h:1812
mnt_want_write_file+0x64/0x1e8 fs/namespace.c:421
reiserfs_ioctl+0x188/0x4b8 fs/reiserfs/ioctl.c:103

vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]

__se_sys_ioctl fs/ioctl.c:860 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

other info that might help us debug this:

Chain exists of:

sb_writers#8 --> &type->i_mutex_dir_key#6 --> &sbi->lock

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&sbi->lock);

lock(&type->i_mutex_dir_key#6);
lock(&sbi->lock);
lock(sb_writers#8);

*** DEADLOCK ***

1 lock held by syz-executor865/3961:
#0: ffff0000c1ec6090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock+0x7c/0xe8 fs/reiserfs/lock.c:27

stack backtrace:
CPU: 1 PID: 3961 Comm: syz-executor865 Not tainted 5.15.110-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
print_circular_bug+0x150/0x1b8 kernel/locking/lockdep.c:2011
check_noncircular+0x2cc/0x378 kernel/locking/lockdep.c:2133

check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]

validate_chain kernel/locking/lockdep.c:3787 [inline]
__lock_acquire+0x32cc/0x7620 kernel/locking/lockdep.c:5011
lock_acquire+0x240/0x77c kernel/locking/lockdep.c:5622

percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
__sb_start_write include/linux/fs.h:1742 [inline]

sb_start_write+0xf0/0x3ac include/linux/fs.h:1812
mnt_want_write_file+0x64/0x1e8 fs/namespace.c:421
reiserfs_ioctl+0x188/0x4b8 fs/reiserfs/ioctl.c:103

vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]

__se_sys_ioctl fs/ioctl.c:860 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: ca48fc16c493 Linux 6.1.27
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1238ee22280000
kernel config: https://syzkaller.appspot.com/x/.config?x=aea4bb7802570997

dashboard link: https://syzkaller.appspot.com/bug?extid=8e2806d6bcf61ef2ef23
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2

userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e31bd2280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=123479f4280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ec11c1903c52/disk-ca48fc16.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8ce41c1ad391/vmlinux-ca48fc16.xz
kernel image: https://storage.googleapis.com/syzbot-assets/affba5631cad/Image-ca48fc16.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/4bd2a5255896/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8e2806...@syzkaller.appspotmail.com

REISERFS (device loop0): using 3.5.x disk format
REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage.

======================================================
WARNING: possible circular locking dependency detected

6.1.27-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor684/4217 is trying to acquire lock:
ffff0000d5f3a460 (sb_writers#8){.+.+}-{0:0}, at: mnt_want_write_file+0x64/0x1e8 fs/namespace.c:437

but task is already holding lock:

ffff0000d1bc9090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock+0x7c/0xe8 fs/reiserfs/lock.c:27

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (&sbi->lock){+.+.}-{3:3}:

__mutex_lock_common+0x190/0x21a0 kernel/locking/mutex.c:603
__mutex_lock kernel/locking/mutex.c:747 [inline]
mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799

reiserfs_write_lock+0x7c/0xe8 fs/reiserfs/lock.c:27
reiserfs_lookup+0x130/0x3c4 fs/reiserfs/namei.c:364

__lookup_slow+0x250/0x374 fs/namei.c:1685
lookup_one_len+0x178/0x28c fs/namei.c:2711
reiserfs_lookup_privroot+0x8c/0x204 fs/reiserfs/xattr.c:973
reiserfs_fill_super+0x1bc0/0x2028 fs/reiserfs/super.c:2174
mount_bdev+0x26c/0x368 fs/super.c:1423
get_super_block+0x44/0x58 fs/reiserfs/super.c:2601
legacy_get_tree+0xd4/0x16c fs/fs_context.c:610
vfs_get_tree+0x90/0x274 fs/super.c:1553
do_new_mount+0x25c/0x8c8 fs/namespace.c:3040
path_mount+0x590/0xe58 fs/namespace.c:3370

do_mount fs/namespace.c:3383 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]

__se_sys_mount fs/namespace.c:3568 [inline]
__arm64_sys_mount+0x45c/0x594 fs/namespace.c:3568
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581

-> #1 (&type->i_mutex_dir_key#6){+.+.}-{3:3}:

down_write+0x5c/0x88 kernel/locking/rwsem.c:1573

inode_lock include/linux/fs.h:756 [inline]
open_last_lookups fs/namei.c:3478 [inline]

path_openat+0x5ec/0x2548 fs/namei.c:3711
do_filp_open+0x1bc/0x3cc fs/namei.c:3741
do_sys_openat2+0x128/0x3d8 fs/open.c:1310
do_sys_open fs/open.c:1326 [inline]
__do_sys_openat fs/open.c:1342 [inline]
__se_sys_openat fs/open.c:1337 [inline]
__arm64_sys_openat+0x1f0/0x240 fs/open.c:1337
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581

-> #0 (sb_writers#8){.+.+}-{0:0}:

check_prev_add kernel/locking/lockdep.c:3098 [inline]
check_prevs_add kernel/locking/lockdep.c:3217 [inline]

validate_chain kernel/locking/lockdep.c:3832 [inline]
__lock_acquire+0x3338/0x764c kernel/locking/lockdep.c:5056
lock_acquire+0x26c/0x7cc kernel/locking/lockdep.c:5669

percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
__sb_start_write include/linux/fs.h:1832 [inline]

sb_start_write+0x7c/0x308 include/linux/fs.h:1907
mnt_want_write_file+0x64/0x1e8 fs/namespace.c:437
reiserfs_ioctl+0x184/0x454 fs/reiserfs/ioctl.c:103

vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]

__se_sys_ioctl fs/ioctl.c:856 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581

other info that might help us debug this:

Chain exists of:

sb_writers#8 --> &type->i_mutex_dir_key#6 --> &sbi->lock

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&sbi->lock);

lock(&type->i_mutex_dir_key#6);
lock(&sbi->lock);
lock(sb_writers#8);

*** DEADLOCK ***

1 lock held by syz-executor684/4217:
#0: ffff0000d1bc9090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock+0x7c/0xe8 fs/reiserfs/lock.c:27

stack backtrace:
CPU: 1 PID: 4217 Comm: syz-executor684 Not tainted 6.1.27-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
Call trace:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165

__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106

dump_stack+0x1c/0x5c lib/dump_stack.c:113
print_circular_bug+0x150/0x1b8 kernel/locking/lockdep.c:2056
check_noncircular+0x2cc/0x378 kernel/locking/lockdep.c:2178

check_prev_add kernel/locking/lockdep.c:3098 [inline]
check_prevs_add kernel/locking/lockdep.c:3217 [inline]

validate_chain kernel/locking/lockdep.c:3832 [inline]
__lock_acquire+0x3338/0x764c kernel/locking/lockdep.c:5056
lock_acquire+0x26c/0x7cc kernel/locking/lockdep.c:5669

percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
__sb_start_write include/linux/fs.h:1832 [inline]

sb_start_write+0x7c/0x308 include/linux/fs.h:1907
mnt_want_write_file+0x64/0x1e8 fs/namespace.c:437
reiserfs_ioctl+0x184/0x454 fs/reiserfs/ioctl.c:103

vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]

__se_sys_ioctl fs/ioctl.c:856 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581