====================================================== WARNING: possible circular locking dependency detected 6.1.141-syzkaller #0 Not tainted ------------------------------------------------------ syz.0.24/4527 is trying to acquire lock: ffff8880705fb120 (&oi->ip_alloc_sem){++++}-{3:3}, at: ocfs2_try_remove_refcount_tree+0xb3/0x320 fs/ocfs2/refcounttree.c:932 but task is already holding lock: ffff8880705fb1b8 (&oi->ip_xattr_sem){++++}-{3:3}, at: ocfs2_try_remove_refcount_tree+0xa1/0x320 fs/ocfs2/refcounttree.c:931 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (&oi->ip_xattr_sem){++++}-{3:3}: down_read+0x42/0x2d0 kernel/locking/rwsem.c:1520 ocfs2_init_acl+0x2fb/0x720 fs/ocfs2/acl.c:365 ocfs2_mknod+0x1463/0x2350 fs/ocfs2/namei.c:410 ocfs2_create+0x1b6/0x4a0 fs/ocfs2/namei.c:674 lookup_open fs/namei.c:3482 [inline] open_last_lookups fs/namei.c:3550 [inline] path_openat+0x1187/0x2e70 fs/namei.c:3780 do_filp_open+0x1c1/0x3c0 fs/namei.c:3810 do_sys_openat2+0x142/0x490 fs/open.c:1318 do_sys_open fs/open.c:1334 [inline] __do_sys_openat fs/open.c:1350 [inline] __se_sys_openat fs/open.c:1345 [inline] __x64_sys_openat+0x135/0x160 fs/open.c:1345 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 -> #2 (jbd2_handle){++++}-{0:0}: jbd2_journal_lock_updates+0xa7/0x380 fs/jbd2/transaction.c:880 __ocfs2_flush_truncate_log+0x2cd/0x11d0 fs/ocfs2/alloc.c:6030 ocfs2_flush_truncate_log+0x4b/0x60 fs/ocfs2/alloc.c:6077 ocfs2_sync_fs+0x113/0x310 fs/ocfs2/super.c:402 iterate_supers+0x11e/0x1d0 fs/super.c:757 ksys_sync+0xaf/0x150 fs/sync.c:104 __ia32_sys_sync+0xa/0x10 fs/sync.c:113 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 -> #1 (&ocfs2_sysfile_lock_key[args->fi_sysfile_type]#7){+.+.}-{3:3}: down_write+0x36/0x60 kernel/locking/rwsem.c:1573 inode_lock include/linux/fs.h:758 [inline] ocfs2_remove_btree_range+0x641/0x1480 fs/ocfs2/alloc.c:5743 ocfs2_commit_truncate+0xaf5/0x1bf0 fs/ocfs2/alloc.c:7354 ocfs2_truncate_file+0xcd6/0x14d0 fs/ocfs2/file.c:505 ocfs2_setattr+0x16a9/0x1cf0 fs/ocfs2/file.c:1212 notify_change+0xc74/0xf40 fs/attr.c:499 do_truncate+0x197/0x220 fs/open.c:65 handle_truncate fs/namei.c:3285 [inline] do_open fs/namei.c:3630 [inline] path_openat+0x27f2/0x2e70 fs/namei.c:3783 do_filp_open+0x1c1/0x3c0 fs/namei.c:3810 do_sys_openat2+0x142/0x490 fs/open.c:1318 do_sys_open fs/open.c:1334 [inline] __do_sys_creat fs/open.c:1412 [inline] __se_sys_creat fs/open.c:1406 [inline] __x64_sys_creat+0x8c/0xb0 fs/open.c:1406 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 -> #0 (&oi->ip_alloc_sem){++++}-{3:3}: check_prev_add kernel/locking/lockdep.c:3090 [inline] check_prevs_add kernel/locking/lockdep.c:3209 [inline] validate_chain kernel/locking/lockdep.c:3825 [inline] __lock_acquire+0x2cf8/0x7c50 kernel/locking/lockdep.c:5049 lock_acquire+0x1b4/0x490 kernel/locking/lockdep.c:5662 down_write+0x36/0x60 kernel/locking/rwsem.c:1573 ocfs2_try_remove_refcount_tree+0xb3/0x320 fs/ocfs2/refcounttree.c:932 ocfs2_truncate_file+0xdd4/0x14d0 fs/ocfs2/file.c:517 ocfs2_setattr+0x16a9/0x1cf0 fs/ocfs2/file.c:1212 notify_change+0xc74/0xf40 fs/attr.c:499 do_truncate+0x197/0x220 fs/open.c:65 handle_truncate fs/namei.c:3285 [inline] do_open fs/namei.c:3630 [inline] path_openat+0x27f2/0x2e70 fs/namei.c:3783 do_filp_open+0x1c1/0x3c0 fs/namei.c:3810 do_sys_openat2+0x142/0x490 fs/open.c:1318 do_sys_open fs/open.c:1334 [inline] __do_sys_creat fs/open.c:1412 [inline] __se_sys_creat fs/open.c:1406 [inline] __x64_sys_creat+0x8c/0xb0 fs/open.c:1406 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 other info that might help us debug this: Chain exists of: &oi->ip_alloc_sem --> jbd2_handle --> &oi->ip_xattr_sem Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&oi->ip_xattr_sem); lock(jbd2_handle); lock(&oi->ip_xattr_sem); lock(&oi->ip_alloc_sem); *** DEADLOCK *** 3 locks held by syz.0.24/4527: #0: ffff888072a12460 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x3d/0x90 fs/namespace.c:393 #1: ffff8880705fb488 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline] #1: ffff8880705fb488 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: do_truncate+0x183/0x220 fs/open.c:63 #2: ffff8880705fb1b8 (&oi->ip_xattr_sem){++++}-{3:3}, at: ocfs2_try_remove_refcount_tree+0xa1/0x320 fs/ocfs2/refcounttree.c:931 stack backtrace: CPU: 0 PID: 4527 Comm: syz.0.24 Not tainted 6.1.141-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: dump_stack_lvl+0x168/0x22e lib/dump_stack.c:106 check_noncircular+0x274/0x310 kernel/locking/lockdep.c:2170 check_prev_add kernel/locking/lockdep.c:3090 [inline] check_prevs_add kernel/locking/lockdep.c:3209 [inline] validate_chain kernel/locking/lockdep.c:3825 [inline] __lock_acquire+0x2cf8/0x7c50 kernel/locking/lockdep.c:5049 lock_acquire+0x1b4/0x490 kernel/locking/lockdep.c:5662 down_write+0x36/0x60 kernel/locking/rwsem.c:1573 ocfs2_try_remove_refcount_tree+0xb3/0x320 fs/ocfs2/refcounttree.c:932 ocfs2_truncate_file+0xdd4/0x14d0 fs/ocfs2/file.c:517 ocfs2_setattr+0x16a9/0x1cf0 fs/ocfs2/file.c:1212 notify_change+0xc74/0xf40 fs/attr.c:499 do_truncate+0x197/0x220 fs/open.c:65 handle_truncate fs/namei.c:3285 [inline] do_open fs/namei.c:3630 [inline] path_openat+0x27f2/0x2e70 fs/namei.c:3783 do_filp_open+0x1c1/0x3c0 fs/namei.c:3810 do_sys_openat2+0x142/0x490 fs/open.c:1318 do_sys_open fs/open.c:1334 [inline] __do_sys_creat fs/open.c:1412 [inline] __se_sys_creat fs/open.c:1406 [inline] __x64_sys_creat+0x8c/0xb0 fs/open.c:1406 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fa55e58e929 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fa55f375038 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 RAX: ffffffffffffffda RBX: 00007fa55e7b6400 RCX: 00007fa55e58e929 RDX: 0000000000000000 RSI: 0000000000000011 RDI: 00002000000002c0 RBP: 00007fa55e610b39 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000001 R14: 00007fa55e7b6400 R15: 00007ffeda05e498