======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.0.689/6817 is trying to acquire lock:
ffff0000c37da990 (jbd2_handle){++++}-{0:0}, at: wait_transaction_locked+0x158/0x234 fs/jbd2/transaction.c:176

but task is already holding lock:
ffff0000f493c0e8 (&journal->j_trans_barrier){.+.+}-{3:3}, at: ocfs2_start_trans+0x374/0x6cc fs/ocfs2/journal.c:374

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #5 (&journal->j_trans_barrier){.+.+}-{3:3}:
       down_read+0x64/0x300 kernel/locking/rwsem.c:1520
       ocfs2_start_trans+0x374/0x6cc fs/ocfs2/journal.c:374
       ocfs2_shutdown_local_alloc+0x1a0/0x834 fs/ocfs2/localalloc.c:416
       ocfs2_dismount_volume+0x1f4/0x948 fs/ocfs2/super.c:1882
       ocfs2_put_super+0x108/0x388 fs/ocfs2/super.c:1609
       generic_shutdown_super+0x130/0x324 fs/super.c:501
       kill_block_super+0x70/0xdc fs/super.c:1470
       deactivate_locked_super+0xac/0x120 fs/super.c:332
       deactivate_super+0xe4/0x104 fs/super.c:363
       cleanup_mnt+0x390/0x418 fs/namespace.c:1191
       __cleanup_mnt+0x20/0x30 fs/namespace.c:1198
       task_work_run+0x1ec/0x278 kernel/task_work.c:203
       resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
       do_notify_resume+0x1fa0/0x2aa4 arch/arm64/kernel/signal.c:1151
       prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
       exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
       el0_svc+0x98/0x128 arch/arm64/kernel/entry-common.c:638
       el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
       el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

-> #4 (sb_internal#4){.+.+}-{0:0}:
       percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
       __sb_start_write include/linux/fs.h:1891 [inline]
       sb_start_intwrite include/linux/fs.h:2013 [inline]
       ocfs2_start_trans+0x20c/0x6cc fs/ocfs2/journal.c:372
       ocfs2_acquire_dquot+0x5c8/0xac8 fs/ocfs2/quota_global.c:848
       dqget+0x654/0xcc4 fs/quota/dquot.c:988
       dquot_set_dqblk+0x40/0xe28 fs/quota/dquot.c:2833
       quota_setquota+0x41c/0x4cc fs/quota/quota.c:310
       do_quotactl+0x65c/0x738 fs/quota/quota.c:802
       __do_sys_quotactl fs/quota/quota.c:960 [inline]
       __se_sys_quotactl fs/quota/quota.c:916 [inline]
       __arm64_sys_quotactl+0x2cc/0x77c fs/quota/quota.c:916
       __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
       invoke_syscall+0x98/0x2b4 arch/arm64/kernel/syscall.c:52
       el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
       do_el0_svc+0x58/0x130 arch/arm64/kernel/syscall.c:204
       el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
       el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
       el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

-> #3 (&ocfs2_quota_ip_alloc_sem_key){++++}-{3:3}:
       down_write+0x5c/0x88 kernel/locking/rwsem.c:1573
       ocfs2_create_local_dquot+0x144/0x13d4 fs/ocfs2/quota_local.c:1224
       ocfs2_acquire_dquot+0x6f4/0xac8 fs/ocfs2/quota_global.c:871
       dqget+0x654/0xcc4 fs/quota/dquot.c:988
       dquot_set_dqblk+0x40/0xe28 fs/quota/dquot.c:2833
       quota_setquota+0x41c/0x4cc fs/quota/quota.c:310
       do_quotactl+0x65c/0x738 fs/quota/quota.c:802
       __do_sys_quotactl fs/quota/quota.c:960 [inline]
       __se_sys_quotactl fs/quota/quota.c:916 [inline]
       __arm64_sys_quotactl+0x2cc/0x77c fs/quota/quota.c:916
       __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
       invoke_syscall+0x98/0x2b4 arch/arm64/kernel/syscall.c:52
       el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
       do_el0_svc+0x58/0x130 arch/arm64/kernel/syscall.c:204
       el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
       el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
       el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

-> #2 (&dquot->dq_lock){+.+.}-{3:3}:
       __mutex_lock_common+0x190/0x1f60 kernel/locking/mutex.c:603
       __mutex_lock kernel/locking/mutex.c:747 [inline]
       mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799
       dquot_commit+0x50/0x1c4 fs/quota/dquot.c:507
       ext4_write_dquot+0x1b4/0x31c fs/ext4/super.c:6811
       ext4_mark_dquot_dirty+0xe8/0x140 fs/ext4/super.c:6888
       mark_dquot_dirty fs/quota/dquot.c:372 [inline]
       mark_all_dquot_dirty+0x108/0x424 fs/quota/dquot.c:412
       __dquot_free_space+0x73c/0xa78 fs/quota/dquot.c:1942
       dquot_free_space_nodirty include/linux/quotaops.h:379 [inline]
       dquot_free_space include/linux/quotaops.h:384 [inline]
       dquot_free_block include/linux/quotaops.h:395 [inline]
       ext4_mb_clear_bb fs/ext4/mballoc.c:6154 [inline]
       ext4_free_blocks+0x1888/0x2390 fs/ext4/mballoc.c:6284
       ext4_remove_blocks fs/ext4/extents.c:2526 [inline]
       ext4_ext_rm_leaf fs/ext4/extents.c:2692 [inline]
       ext4_ext_remove_space+0x1720/0x3a9c fs/ext4/extents.c:2940
       ext4_ext_truncate+0x164/0x20c fs/ext4/extents.c:4470
       ext4_truncate+0x9f4/0x1084 fs/ext4/inode.c:4295
       ext4_evict_inode+0xc10/0x1278 fs/ext4/inode.c:286
       evict+0x3e0/0x828 fs/inode.c:705
       iput_final fs/inode.c:1834 [inline]
       iput+0x754/0x7e4 fs/inode.c:1860
       ext4_process_orphan+0x240/0x2b4 fs/ext4/orphan.c:358
       ext4_orphan_cleanup+0x920/0x1060 fs/ext4/orphan.c:472
       __ext4_fill_super fs/ext4/super.c:5556 [inline]
       ext4_fill_super+0x6188/0x660c fs/ext4/super.c:5687
       get_tree_bdev+0x358/0x544 fs/super.c:1366
       ext4_get_tree+0x28/0x38 fs/ext4/super.c:5717
       vfs_get_tree+0x90/0x274 fs/super.c:1573
       do_new_mount+0x228/0x810 fs/namespace.c:3078
       path_mount+0x5bc/0xe80 fs/namespace.c:3408
       do_mount fs/namespace.c:3421 [inline]
       __do_sys_mount fs/namespace.c:3629 [inline]
       __se_sys_mount fs/namespace.c:3606 [inline]
       __arm64_sys_mount+0x49c/0x59c fs/namespace.c:3606
       __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
       invoke_syscall+0x98/0x2b4 arch/arm64/kernel/syscall.c:52
       el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
       do_el0_svc+0x58/0x130 arch/arm64/kernel/syscall.c:204
       el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
       el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
       el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

-> #1 (&ei->i_data_sem){++++}-{3:3}:
       down_write+0x5c/0x88 kernel/locking/rwsem.c:1573
       ext4_map_blocks+0x7c4/0x1778 fs/ext4/inode.c:672
       mpage_map_one_extent fs/ext4/inode.c:2434 [inline]
       mpage_map_and_submit_extent fs/ext4/inode.c:2487 [inline]
       ext4_writepages+0xdbc/0x28b4 fs/ext4/inode.c:2855
       do_writepages+0x2b0/0x504 mm/page-writeback.c:2491
       __writeback_single_inode+0x164/0x1554 fs/fs-writeback.c:1622
       writeback_sb_inodes+0x858/0x143c fs/fs-writeback.c:1913
       __writeback_inodes_wb+0x110/0x394 fs/fs-writeback.c:1984
       wb_writeback+0x428/0xfcc fs/fs-writeback.c:2089
       wb_check_background_flush fs/fs-writeback.c:2155 [inline]
       wb_do_writeback fs/fs-writeback.c:2243 [inline]
       wb_workfn+0xb38/0xe18 fs/fs-writeback.c:2270
       process_one_work+0x7f8/0x13a4 kernel/workqueue.c:2292
       worker_thread+0x8c4/0xfec kernel/workqueue.c:2439
       kthread+0x250/0x2d8 kernel/kthread.c:376
       ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850

-> #0 (jbd2_handle){++++}-{0:0}:
       check_prev_add kernel/locking/lockdep.c:3090 [inline]
       check_prevs_add kernel/locking/lockdep.c:3209 [inline]
       validate_chain kernel/locking/lockdep.c:3825 [inline]
       __lock_acquire+0x2880/0x6800 kernel/locking/lockdep.c:5049
       lock_acquire+0x20c/0x63c kernel/locking/lockdep.c:5662
       wait_transaction_locked+0x180/0x234 fs/jbd2/transaction.c:177
       add_transaction_credits+0x104/0xaf0 fs/jbd2/transaction.c:-1
       start_this_handle+0x520/0x1280 fs/jbd2/transaction.c:422
       jbd2__journal_restart+0x1c8/0x674 fs/jbd2/transaction.c:815
       jbd2_journal_restart+0x30/0x40 fs/jbd2/transaction.c:827
       ocfs2_extend_trans+0x2d8/0x860 fs/ocfs2/journal.c:459
       ocfs2_split_tree fs/ocfs2/alloc.c:5316 [inline]
       ocfs2_remove_extent+0xca8/0x1d9c fs/ocfs2/alloc.c:5588
       ocfs2_remove_btree_range+0xcb0/0x1260 fs/ocfs2/alloc.c:5770
       ocfs2_remove_inode_range+0xb98/0x2390 fs/ocfs2/file.c:1907
       __ocfs2_change_file_space+0x71c/0xc5c fs/ocfs2/file.c:2028
       ocfs2_fallocate+0x1f0/0x224 fs/ocfs2/file.c:2138
       vfs_fallocate+0x4a4/0x5f4 fs/open.c:323
       ioctl_preallocate+0x20c/0x2b4 fs/ioctl.c:290
       file_ioctl fs/ioctl.c:-1 [inline]
       do_vfs_ioctl+0x1874/0x2100 fs/ioctl.c:849
       __do_sys_ioctl fs/ioctl.c:868 [inline]
       __se_sys_ioctl fs/ioctl.c:856 [inline]
       __arm64_sys_ioctl+0xe4/0x1c8 fs/ioctl.c:856
       __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
       invoke_syscall+0x98/0x2b4 arch/arm64/kernel/syscall.c:52
       el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
       do_el0_svc+0x58/0x130 arch/arm64/kernel/syscall.c:204
       el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
       el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
       el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

other info that might help us debug this:

Chain exists of:
  jbd2_handle --> sb_internal#4 --> &journal->j_trans_barrier

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&journal->j_trans_barrier);
                               lock(sb_internal#4);
                               lock(&journal->j_trans_barrier);
  lock(jbd2_handle);

 *** DEADLOCK ***

6 locks held by syz.0.689/6817:
 #0: ffff0000c37de460 (sb_writers#22){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:3015 [inline]
 #0: ffff0000c37de460 (sb_writers#22){.+.+}-{0:0}, at: vfs_fallocate+0x434/0x5f4 fs/open.c:322
 #1: ffff0000e215c2c8 (&sb->s_type->i_mutex_key#40){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline]
 #1: ffff0000e215c2c8 (&sb->s_type->i_mutex_key#40){+.+.}-{3:3}, at: __ocfs2_change_file_space+0x184/0xc5c fs/ocfs2/file.c:1949
 #2: ffff0000e215bf60 (&oi->ip_alloc_sem){++++}-{3:3}, at: __ocfs2_change_file_space+0x660/0xc5c fs/ocfs2/file.c:2015
 #3: ffff0000e215b488 (&ocfs2_sysfile_lock_key[args->fi_sysfile_type]#2){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline]
 #3: ffff0000e215b488 (&ocfs2_sysfile_lock_key[args->fi_sysfile_type]#2){+.+.}-{3:3}, at: ocfs2_remove_btree_range+0x514/0x1260 fs/ocfs2/alloc.c:5742
 #4: ffff0000c37de650 (sb_internal#4){.+.+}-{0:0}, at: ocfs2_remove_btree_range+0x65c/0x1260 fs/ocfs2/alloc.c:5752
 #5: ffff0000f493c0e8 (&journal->j_trans_barrier){.+.+}-{3:3}, at: ocfs2_start_trans+0x374/0x6cc fs/ocfs2/journal.c:374

stack backtrace:
CPU: 0 PID: 6817 Comm: syz.0.689 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025
Call trace:
 dump_backtrace+0x1c0/0x1ec arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 dump_stack+0x1c/0x5c lib/dump_stack.c:113
 print_circular_bug+0x148/0x1b0 kernel/locking/lockdep.c:2048
 check_noncircular+0x264/0x2f8 kernel/locking/lockdep.c:2170
 check_prev_add kernel/locking/lockdep.c:3090 [inline]
 check_prevs_add kernel/locking/lockdep.c:3209 [inline]
 validate_chain kernel/locking/lockdep.c:3825 [inline]
 __lock_acquire+0x2880/0x6800 kernel/locking/lockdep.c:5049
 lock_acquire+0x20c/0x63c kernel/locking/lockdep.c:5662
 wait_transaction_locked+0x180/0x234 fs/jbd2/transaction.c:177
 add_transaction_credits+0x104/0xaf0 fs/jbd2/transaction.c:-1
 start_this_handle+0x520/0x1280 fs/jbd2/transaction.c:422
 jbd2__journal_restart+0x1c8/0x674 fs/jbd2/transaction.c:815
 jbd2_journal_restart+0x30/0x40 fs/jbd2/transaction.c:827
 ocfs2_extend_trans+0x2d8/0x860 fs/ocfs2/journal.c:459
 ocfs2_split_tree fs/ocfs2/alloc.c:5316 [inline]
 ocfs2_remove_extent+0xca8/0x1d9c fs/ocfs2/alloc.c:5588
 ocfs2_remove_btree_range+0xcb0/0x1260 fs/ocfs2/alloc.c:5770
 ocfs2_remove_inode_range+0xb98/0x2390 fs/ocfs2/file.c:1907
 __ocfs2_change_file_space+0x71c/0xc5c fs/ocfs2/file.c:2028
 ocfs2_fallocate+0x1f0/0x224 fs/ocfs2/file.c:2138
 vfs_fallocate+0x4a4/0x5f4 fs/open.c:323
 ioctl_preallocate+0x20c/0x2b4 fs/ioctl.c:290
 file_ioctl fs/ioctl.c:-1 [inline]
 do_vfs_ioctl+0x1874/0x2100 fs/ioctl.c:849
 __do_sys_ioctl fs/ioctl.c:868 [inline]
 __se_sys_ioctl fs/ioctl.c:856 [inline]
 __arm64_sys_ioctl+0xe4/0x1c8 fs/ioctl.c:856
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b4 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x130 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585