program: syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='mnt\x00', 0x4, &(0x7f0000000000), 0x0, 0x236, &(0x7f0000000300)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=") mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='mnt/encrypted_dir\x00', 0x0) chdir(&(0x7f00000002c0)='mnt/encrypted_dir\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='.\x00', 0x0, 0x0) open_by_handle_at(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="08000000020003000b"], 0x80) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) open(&(0x7f0000000780)='./bus\x00', 0x14507e, 0x0) fallocate(r1, 0x0, 0x0, 0x1000f4) io_setup(0x5ff, &(0x7f0000000040)=0x0) io_submit(r2, 0x1, &(0x7f0000000900)=[&(0x7f0000000740)={0x0, 0x0, 0x0, 0x7, 0x200, r1, &(0x7f0000000680)="ab9e80d7fba59cd67cc71749eab4cd9f3539358cf30dcde007f7774a4e7d71fd4c78293877b59709acd1ca86f1d39d3d2e51135b1413cdea9a5d00651b652f3ee67083f86a092e25e0c56360f122fae998831e0e5f2fcfb92af501d10465e0d30bd5b73dcee52f44044c1df4df8fc12e35c252d0e1431113f53cb1ac113854392adf5452e8d9e3105b280446ff5e374e12275bf3461a8fb5b438a24bba1bbd9b058df85387d6fdfdfe2366aa6e01849150c3a741c332dc006bb5df92efc3387b", 0xc0, 0x2, 0x0, 0x3, r0}]) io_destroy(r2) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r3) socket(0x2b, 0x1, 0x1) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty, 0xfffffffc}, 0x1c) listen(r3, 0xffffffff) r4 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) ioctl$sock_inet_SIOCGIFADDR(r4, 0x8915, &(0x7f0000000540)={'veth0_virt_wifi\x00', {0x2, 0x0, @remote}}) [ 94.614236][ T4643] Bluetooth: hci0: command tx timeout [ 94.875468][ T5315] loop0: detected capacity change from 0 to 128 [ 95.304807][ T5315] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 95.380845][ T5315] ext4 filesystem being mounted at /0/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 95.442182][ T24] audit: type=1800 audit(1786628998.653:2): pid=5315 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.0" name="bus" dev="loop0" ino=13 res=0 errno=0 [ 95.649610][ T5314] [ 95.651129][ T5314] ====================================================== [ 95.654649][ T5314] WARNING: possible circular locking dependency detected [ 95.698315][ T5314] syzkaller #0 Not tainted [ 95.709694][ T5314] ------------------------------------------------------ [ 95.713500][ T5314] syz.0.0/5314 is trying to acquire lock: [ 95.737534][ T5314] ffff888042118a68 ((work_completion)(&new_smc->smc_listen_work)){+.+.}-{0:0}, at: __flush_work+0x101/0xca0 [ 95.744027][ T5314] [ 95.744027][ T5314] but task is already holding lock: [ 95.747825][ T5314] ffff888042118ee0 (sk_lock-AF_SMC/1){+.+.}-{0:0}, at: smc_release+0x24d/0x550 [ 95.751418][ T5314] [ 95.751418][ T5314] which lock already depends on the new lock. [ 95.751418][ T5314] [ 95.755510][ T5314] [ 95.755510][ T5314] the existing dependency chain (in reverse order) is: [ 95.760620][ T5314] [ 95.760620][ T5314] -> #1 (sk_lock-AF_SMC/1){+.+.}-{0:0}: [ 95.766767][ T5314] lock_sock_nested+0x41/0x100 [ 95.785524][ T5314] smc_listen_out+0xd4/0x3d0 [ 95.789029][ T5314] smc_listen_work+0x81d/0x1410 [ 95.792098][ T5314] process_scheduled_works+0xa8e/0x14e0 [ 95.794705][ T5314] worker_thread+0xa47/0xfb0 [ 95.796804][ T5314] kthread+0x388/0x470 [ 95.798715][ T5314] ret_from_fork+0x514/0xb70 [ 95.800854][ T5314] ret_from_fork_asm+0x1a/0x30 [ 95.802975][ T5314] [ 95.802975][ T5314] -> #0 ((work_completion)(&new_smc->smc_listen_work)){+.+.}-{0:0}: [ 95.824090][ T5314] __lock_acquire+0x1520/0x2cf0 [ 95.826817][ T5314] lock_acquire+0x106/0x350 [ 95.828892][ T5314] __flush_work+0x74c/0xca0 [ 95.830950][ T5314] __cancel_work_sync+0xbe/0x110 [ 95.833558][ T5314] smc_clcsock_release+0x60/0xf0 [ 95.862908][ T5314] __smc_release+0x64e/0x7c0 [ 95.865060][ T5314] smc_close_non_accepted+0xd5/0x1f0 [ 95.867496][ T5314] smc_close_active+0xb42/0xf30 [ 95.869702][ T5314] __smc_release+0x9c/0x7c0 [ 95.871741][ T5314] smc_release+0x2c5/0x550 [ 95.873771][ T5314] sock_close+0xad/0x220 [ 95.885899][ T5314] __fput+0x418/0xa50 [ 95.887863][ T5314] task_work_run+0x1d9/0x270 [ 95.890172][ T5314] exit_to_user_mode_loop+0x1fa/0x730 [ 95.896660][ T5314] do_syscall_64+0x353/0x580 [ 95.906665][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.909635][ T5314] [ 95.909635][ T5314] other info that might help us debug this: [ 95.909635][ T5314] [ 95.914045][ T5314] Possible unsafe locking scenario: [ 95.914045][ T5314] [ 95.931855][ T5314] CPU0 CPU1 [ 95.934205][ T5314] ---- ---- [ 95.936335][ T5314] lock(sk_lock-AF_SMC/1); [ 95.938259][ T5314] lock((work_completion)(&new_smc->smc_listen_work)); [ 95.945830][ T5314] lock(sk_lock-AF_SMC/1); [ 95.948883][ T5314] lock((work_completion)(&new_smc->smc_listen_work)); [ 95.958664][ T5314] [ 95.958664][ T5314] *** DEADLOCK *** [ 95.958664][ T5314] [ 95.965818][ T5314] 3 locks held by syz.0.0/5314: [ 95.967788][ T5314] #0: ffff888013050800 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: sock_close+0x82/0x220 [ 95.971842][ T5314] #1: ffff888042118ee0 (sk_lock-AF_SMC/1){+.+.}-{0:0}, at: smc_release+0x24d/0x550 [ 95.985725][ T5314] #2: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: __flush_work+0x101/0xca0 [ 95.997843][ T5314] [ 95.997843][ T5314] stack backtrace: [ 96.001371][ T5314] CPU: 0 UID: 0 PID: 5314 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 96.001431][ T5314] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 96.001440][ T5314] Call Trace: [ 96.001448][ T5314] [ 96.001492][ T5314] dump_stack_lvl+0xe8/0x150 [ 96.001556][ T5314] print_circular_bug+0x2e1/0x300 [ 96.001579][ T5314] check_noncircular+0x12e/0x150 [ 96.001640][ T5314] __lock_acquire+0x1520/0x2cf0 [ 96.001702][ T5314] ? do_raw_spin_unlock+0x4d/0x210 [ 96.001756][ T5314] ? __flush_work+0x101/0xca0 [ 96.001772][ T5314] lock_acquire+0x106/0x350 [ 96.001828][ T5314] ? __flush_work+0x101/0xca0 [ 96.001886][ T5314] ? __flush_work+0x101/0xca0 [ 96.001939][ T5314] __flush_work+0x74c/0xca0 [ 96.001954][ T5314] ? __flush_work+0x101/0xca0 [ 96.002009][ T5314] ? __flush_work+0x101/0xca0 [ 96.002024][ T5314] ? __pfx___flush_work+0x10/0x10 [ 96.002079][ T5314] ? __pfx_wq_barrier_func+0x10/0x10 [ 96.002137][ T5314] ? __cancel_work_sync+0x5c/0x110 [ 96.002196][ T5314] __cancel_work_sync+0xbe/0x110 [ 96.002213][ T5314] smc_clcsock_release+0x60/0xf0 [ 96.002272][ T5314] __smc_release+0x64e/0x7c0 [ 96.002286][ T5314] smc_close_non_accepted+0xd5/0x1f0 [ 96.002343][ T5314] smc_close_active+0xb42/0xf30 [ 96.002400][ T5314] ? __pfx_sock_def_readable+0x10/0x10 [ 96.002415][ T5314] __smc_release+0x9c/0x7c0 [ 96.002468][ T5314] ? __local_bh_enable_ip+0xd0/0x130 [ 96.002482][ T5314] smc_release+0x2c5/0x550 [ 96.002536][ T5314] sock_close+0xad/0x220 [ 96.002588][ T5314] ? __pfx_sock_close+0x10/0x10 [ 96.002602][ T5314] __fput+0x418/0xa50 [ 96.002656][ T5314] task_work_run+0x1d9/0x270 [ 96.002674][ T5314] ? __pfx_task_work_run+0x10/0x10 [ 96.002735][ T5314] exit_to_user_mode_loop+0x1fa/0x730 [ 96.002792][ T5314] ? rcu_is_watching+0x15/0xb0 [ 96.002850][ T5314] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.002863][ T5314] do_syscall_64+0x353/0x580 [ 96.002919][ T5314] ? clear_bhb_loop+0x70/0xc0 [ 96.002973][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.002987][ T5314] RIP: 0033:0x7f40f919e0d9 [ 96.003041][ T5314] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 96.003052][ T5314] RSP: 002b:00007ffcdb8f4918 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 96.003107][ T5314] RAX: 0000000000000000 RBX: 00007f40f9427da0 RCX: 00007f40f919e0d9 [ 96.003116][ T5314] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 96.003123][ T5314] RBP: 00007f40f9427da0 R08: 00007f40f9426038 R09: 0000000000000000 [ 96.003177][ T5314] R10: 0000000000de0480 R11: 0000000000000246 R12: 0000000000017554 [ 96.003185][ T5314] R13: 00007f40f942609c R14: 00000000000174f1 R15: 00007f40f9426090 [ 96.003198][ T5314]