Code: c4 28 c3 e8 b1 1d 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f ====================================================== WARNING: possible circular locking dependency detected 6.16.0-rc1-syzkaller-00101-g27605c8c0f69 #0 Not tainted ------------------------------------------------------ syz-executor939/5323 is trying to acquire lock: ffff888045e3cda0 (&oi->ip_alloc_sem){+.+.}-{4:4}, at: ocfs2_try_remove_refcount_tree+0xb6/0x320 fs/ocfs2/refcounttree.c:932 but task is already holding lock: ffff888045e3ce38 (&oi->ip_xattr_sem){++++}-{4:4}, at: ocfs2_try_remove_refcount_tree+0xa4/0x320 fs/ocfs2/refcounttree.c:931 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #4 (&oi->ip_xattr_sem){++++}-{4:4}: lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871 down_read+0x46/0x2e0 kernel/locking/rwsem.c:1524 ocfs2_init_acl+0x2f9/0x720 fs/ocfs2/acl.c:366 ocfs2_mknod+0x1321/0x2050 fs/ocfs2/namei.c:410 ocfs2_create+0x1a5/0x440 fs/ocfs2/namei.c:673 lookup_open fs/namei.c:3708 [inline] open_last_lookups fs/namei.c:3807 [inline] path_openat+0x14f4/0x3830 fs/namei.c:4043 do_filp_open+0x1fa/0x410 fs/namei.c:4073 file_open_name fs/open.c:1381 [inline] filp_open+0x176/0x1d0 fs/open.c:1401 do_coredump+0x1bd3/0x3440 fs/coredump.c:754 get_signal+0x1109/0x1340 kernel/signal.c:3019 arch_do_signal_or_restart+0x9a/0x750 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] irqentry_exit_to_user_mode+0x81/0x120 kernel/entry/common.c:184 exc_page_fault+0x9f/0xf0 arch/x86/mm/fault.c:1535 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 -> #3 (jbd2_handle){++++}-{0:0}: lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871 start_this_handle+0x1fa7/0x21c0 fs/jbd2/transaction.c:444 jbd2__journal_start+0x2c1/0x5b0 fs/jbd2/transaction.c:501 jbd2_journal_start+0x2a/0x40 fs/jbd2/transaction.c:540 ocfs2_start_trans+0x376/0x6d0 fs/ocfs2/journal.c:374 ocfs2_unlink+0xa9b/0x1940 fs/ocfs2/namei.c:970 vfs_rmdir+0x3ba/0x520 fs/namei.c:4461 do_rmdir+0x2ac/0x630 fs/namei.c:4516 __do_sys_rmdir fs/namei.c:4535 [inline] __se_sys_rmdir fs/namei.c:4533 [inline] __x64_sys_rmdir+0x47/0x50 fs/namei.c:4533 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #2 (&journal->j_trans_barrier){.+.+}-{4:4}: lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871 down_read+0x46/0x2e0 kernel/locking/rwsem.c:1524 ocfs2_start_trans+0x36a/0x6d0 fs/ocfs2/journal.c:372 ocfs2_unlink+0xa9b/0x1940 fs/ocfs2/namei.c:970 vfs_rmdir+0x3ba/0x520 fs/namei.c:4461 do_rmdir+0x2ac/0x630 fs/namei.c:4516 __do_sys_rmdir fs/namei.c:4535 [inline] __se_sys_rmdir fs/namei.c:4533 [inline] __x64_sys_rmdir+0x47/0x50 fs/namei.c:4533 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #1 (sb_internal#2){.+.+}-{0:0}: lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871 percpu_down_read_internal include/linux/percpu-rwsem.h:53 [inline] percpu_down_read_freezable include/linux/percpu-rwsem.h:83 [inline] __sb_start_write include/linux/fs.h:1793 [inline] sb_start_intwrite include/linux/fs.h:1976 [inline] ocfs2_start_trans+0x26b/0x6d0 fs/ocfs2/journal.c:370 ocfs2_orphan_for_truncate fs/ocfs2/file.c:396 [inline] ocfs2_truncate_file+0x643/0x1420 fs/ocfs2/file.c:500 ocfs2_setattr+0x1520/0x1b40 fs/ocfs2/file.c:1212 notify_change+0xb36/0xe40 fs/attr.c:552 do_truncate+0x1a4/0x220 fs/open.c:68 do_coredump+0x2ad3/0x3440 fs/coredump.c:790 get_signal+0x1109/0x1340 kernel/signal.c:3019 arch_do_signal_or_restart+0x9a/0x750 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] irqentry_exit_to_user_mode+0x81/0x120 kernel/entry/common.c:184 exc_page_fault+0x9f/0xf0 arch/x86/mm/fault.c:1535 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 -> #0 (&oi->ip_alloc_sem){+.+.}-{4:4}: check_prev_add kernel/locking/lockdep.c:3168 [inline] check_prevs_add kernel/locking/lockdep.c:3287 [inline] validate_chain+0xb9b/0x2140 kernel/locking/lockdep.c:3911 __lock_acquire+0xab9/0xd20 kernel/locking/lockdep.c:5240 lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871 down_write+0x96/0x1f0 kernel/locking/rwsem.c:1577 ocfs2_try_remove_refcount_tree+0xb6/0x320 fs/ocfs2/refcounttree.c:932 ocfs2_truncate_file+0xda0/0x1420 fs/ocfs2/file.c:521 ocfs2_setattr+0x1520/0x1b40 fs/ocfs2/file.c:1212 notify_change+0xb36/0xe40 fs/attr.c:552 do_truncate+0x1a4/0x220 fs/open.c:68 do_coredump+0x2ad3/0x3440 fs/coredump.c:790 get_signal+0x1109/0x1340 kernel/signal.c:3019 arch_do_signal_or_restart+0x9a/0x750 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] irqentry_exit_to_user_mode+0x81/0x120 kernel/entry/common.c:184 exc_page_fault+0x9f/0xf0 arch/x86/mm/fault.c:1535 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 other info that might help us debug this: Chain exists of: &oi->ip_alloc_sem --> jbd2_handle --> &oi->ip_xattr_sem Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&oi->ip_xattr_sem); lock(jbd2_handle); lock(&oi->ip_xattr_sem); lock(&oi->ip_alloc_sem); *** DEADLOCK *** 2 locks held by syz-executor939/5323: #0: ffff888045e3d100 (&sb->s_type->i_mutex_key#19){+.+.}-{4:4}, at: inode_lock_killable include/linux/fs.h:872 [inline] #0: ffff888045e3d100 (&sb->s_type->i_mutex_key#19){+.+.}-{4:4}, at: do_truncate+0x171/0x220 fs/open.c:63 #1: ffff888045e3ce38 (&oi->ip_xattr_sem){++++}-{4:4}, at: ocfs2_try_remove_refcount_tree+0xa4/0x320 fs/ocfs2/refcounttree.c:931 stack backtrace: CPU: 0 UID: 0 PID: 5323 Comm: syz-executor939 Not tainted 6.16.0-rc1-syzkaller-00101-g27605c8c0f69 #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_circular_bug+0x2ee/0x310 kernel/locking/lockdep.c:2046 check_noncircular+0x134/0x160 kernel/locking/lockdep.c:2178 check_prev_add kernel/locking/lockdep.c:3168 [inline] check_prevs_add kernel/locking/lockdep.c:3287 [inline] validate_chain+0xb9b/0x2140 kernel/locking/lockdep.c:3911 __lock_acquire+0xab9/0xd20 kernel/locking/lockdep.c:5240 lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871 down_write+0x96/0x1f0 kernel/locking/rwsem.c:1577 ocfs2_try_remove_refcount_tree+0xb6/0x320 fs/ocfs2/refcounttree.c:932 ocfs2_truncate_file+0xda0/0x1420 fs/ocfs2/file.c:521 ocfs2_setattr+0x1520/0x1b40 fs/ocfs2/file.c:1212 notify_change+0xb36/0xe40 fs/attr.c:552 do_truncate+0x1a4/0x220 fs/open.c:68 do_coredump+0x2ad3/0x3440 fs/coredump.c:790 get_signal+0x1109/0x1340 kernel/signal.c:3019 arch_do_signal_or_restart+0x9a/0x750 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] irqentry_exit_to_user_mode+0x81/0x120 kernel/entry/common.c:184 exc_page_fault+0x9f/0xf0 arch/x86/mm/fault.c:1535 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0033:0x7fb2217b4731 Code: c4 28 c3 e8 b1 1d 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f RSP: 002b:00000000fffffe10 EFLAGS: 00010217 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00007fb2217b4729 RDX: 0000000000000000 RSI: 00000000fffffe10 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 00007fff00000003 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 R13: 0000200000000040 R14: 0000000001000000 R15: 0000200000004440 ocfs2: Unmounting device (7,0) on (node local) ---------------- Code disassembly (best guess), 1 bytes skipped: 0: 28 c3 sub %al,%bl 2: e8 b1 1d 00 00 call 0x1db8 7: 90 nop 8: 48 89 f8 mov %rdi,%rax b: 48 89 f7 mov %rsi,%rdi e: 48 89 d6 mov %rdx,%rsi 11: 48 89 ca mov %rcx,%rdx 14: 4d 89 c2 mov %r8,%r10 17: 4d 89 c8 mov %r9,%r8 1a: 4c 8b 4c 24 08 mov 0x8(%rsp),%r9 1f: 0f 05 syscall 21: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax 27: 73 01 jae 0x2a * 29: c3 ret <-- trapping instruction 2a: 48 c7 c1 b8 ff ff ff mov $0xffffffffffffffb8,%rcx 31: f7 d8 neg %eax 33: 64 89 01 mov %eax,%fs:(%rcx) 36: 48 83 c8 ff or $0xffffffffffffffff,%rax 3a: c3 ret 3b: 66 data16 3c: 2e cs 3d: 0f .byte 0xf 3e: 1f (bad)