====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Not tainted ------------------------------------------------------ syz.2.465/8704 is trying to acquire lock: ffff0000df290660 (&ocfs2_file_ip_alloc_sem_key){++++}-{4:4}, at: ocfs2_try_remove_refcount_tree+0xb4/0x2d8 fs/ocfs2/refcounttree.c:932 but task is already holding lock: ffff0000df2906f8 (&oi->ip_xattr_sem){++++}-{4:4}, at: ocfs2_try_remove_refcount_tree+0xa8/0x2d8 fs/ocfs2/refcounttree.c:931 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #4 (&oi->ip_xattr_sem){++++}-{4:4}: down_read+0x58/0x2f8 kernel/locking/rwsem.c:1537 ocfs2_init_acl+0x258/0x5f0 fs/ocfs2/acl.c:366 ocfs2_mknod+0x1028/0x1cf0 fs/ocfs2/namei.c:413 ocfs2_create+0x190/0x474 fs/ocfs2/namei.c:676 lookup_open fs/namei.c:3796 [inline] open_last_lookups fs/namei.c:3895 [inline] path_openat+0x12d8/0x2c40 fs/namei.c:4131 do_filp_open+0x18c/0x36c fs/namei.c:4161 do_sys_openat2+0x11c/0x1b4 fs/open.c:1437 do_sys_open fs/open.c:1452 [inline] __do_sys_openat fs/open.c:1468 [inline] __se_sys_openat fs/open.c:1463 [inline] __arm64_sys_openat+0x120/0x158 fs/open.c:1463 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x5c/0x254 arch/arm64/kernel/entry-common.c:746 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:765 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 -> #3 (jbd2_handle){++++}-{0:0}: start_this_handle+0xe74/0x10dc fs/jbd2/transaction.c:444 jbd2__journal_start+0x288/0x51c fs/jbd2/transaction.c:501 jbd2_journal_start+0x3c/0x4c fs/jbd2/transaction.c:540 ocfs2_start_trans+0x368/0x6b0 fs/ocfs2/journal.c:374 ocfs2_modify_bh+0xe4/0x43c fs/ocfs2/quota_local.c:101 ocfs2_local_read_info+0x104c/0x1364 fs/ocfs2/quota_local.c:767 dquot_load_quota_sb+0x6bc/0xa90 fs/quota/dquot.c:2462 dquot_load_quota_inode+0x274/0x4e4 fs/quota/dquot.c:2499 ocfs2_enable_quotas+0x17c/0x3b4 fs/ocfs2/super.c:930 ocfs2_fill_super+0x4004/0x532c fs/ocfs2/super.c:1140 get_tree_bdev_flags+0x360/0x414 fs/super.c:1691 get_tree_bdev+0x2c/0x3c fs/super.c:1714 ocfs2_get_tree+0x28/0x38 fs/ocfs2/super.c:1184 vfs_get_tree+0x90/0x28c fs/super.c:1751 fc_mount fs/namespace.c:1208 [inline] do_new_mount_fc fs/namespace.c:3651 [inline] do_new_mount+0x284/0x944 fs/namespace.c:3727 path_mount+0x5b4/0xdfc fs/namespace.c:4037 do_mount fs/namespace.c:4050 [inline] __do_sys_mount fs/namespace.c:4238 [inline] __se_sys_mount fs/namespace.c:4215 [inline] __arm64_sys_mount+0x3e8/0x468 fs/namespace.c:4215 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x5c/0x254 arch/arm64/kernel/entry-common.c:746 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:765 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 -> #2 (&journal->j_trans_barrier){.+.+}-{4:4}: down_read+0x58/0x2f8 kernel/locking/rwsem.c:1537 ocfs2_start_trans+0x35c/0x6b0 fs/ocfs2/journal.c:372 ocfs2_modify_bh+0xe4/0x43c fs/ocfs2/quota_local.c:101 ocfs2_local_read_info+0x104c/0x1364 fs/ocfs2/quota_local.c:767 dquot_load_quota_sb+0x6bc/0xa90 fs/quota/dquot.c:2462 dquot_load_quota_inode+0x274/0x4e4 fs/quota/dquot.c:2499 ocfs2_enable_quotas+0x17c/0x3b4 fs/ocfs2/super.c:930 ocfs2_fill_super+0x4004/0x532c fs/ocfs2/super.c:1140 get_tree_bdev_flags+0x360/0x414 fs/super.c:1691 get_tree_bdev+0x2c/0x3c fs/super.c:1714 ocfs2_get_tree+0x28/0x38 fs/ocfs2/super.c:1184 vfs_get_tree+0x90/0x28c fs/super.c:1751 fc_mount fs/namespace.c:1208 [inline] do_new_mount_fc fs/namespace.c:3651 [inline] do_new_mount+0x284/0x944 fs/namespace.c:3727 path_mount+0x5b4/0xdfc fs/namespace.c:4037 do_mount fs/namespace.c:4050 [inline] __do_sys_mount fs/namespace.c:4238 [inline] __se_sys_mount fs/namespace.c:4215 [inline] __arm64_sys_mount+0x3e8/0x468 fs/namespace.c:4215 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x5c/0x254 arch/arm64/kernel/entry-common.c:746 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:765 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 -> #1 (sb_internal#3){.+.+}-{0:0}: percpu_down_read_internal include/linux/percpu-rwsem.h:53 [inline] percpu_down_read_freezable include/linux/percpu-rwsem.h:83 [inline] __sb_start_write include/linux/fs.h:1916 [inline] sb_start_intwrite include/linux/fs.h:2099 [inline] ocfs2_start_trans+0x1f4/0x6b0 fs/ocfs2/journal.c:370 ocfs2_setattr+0xa04/0x17a0 fs/ocfs2/file.c:1263 notify_change+0xa0c/0xcb8 fs/attr.c:546 chmod_common+0x1f8/0x370 fs/open.c:650 do_fchmodat+0x114/0x224 fs/open.c:697 __do_sys_fchmodat fs/open.c:716 [inline] __se_sys_fchmodat fs/open.c:713 [inline] __arm64_sys_fchmodat+0x80/0x98 fs/open.c:713 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x5c/0x254 arch/arm64/kernel/entry-common.c:746 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:765 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 -> #0 (&ocfs2_file_ip_alloc_sem_key){++++}-{4:4}: check_prev_add kernel/locking/lockdep.c:3165 [inline] check_prevs_add kernel/locking/lockdep.c:3284 [inline] validate_chain kernel/locking/lockdep.c:3908 [inline] __lock_acquire+0x1774/0x30a4 kernel/locking/lockdep.c:5237 lock_acquire+0x14c/0x2e0 kernel/locking/lockdep.c:5868 down_write+0x50/0xc0 kernel/locking/rwsem.c:1590 ocfs2_try_remove_refcount_tree+0xb4/0x2d8 fs/ocfs2/refcounttree.c:932 ocfs2_truncate_file+0xc28/0x12f4 fs/ocfs2/file.c:521 ocfs2_setattr+0x1148/0x17a0 fs/ocfs2/file.c:1212 notify_change+0xa0c/0xcb8 fs/attr.c:546 do_truncate+0x198/0x210 fs/open.c:68 coredump_file+0x648/0x918 fs/coredump.c:964 vfs_coredump+0x152c/0x2354 fs/coredump.c:1143 get_signal+0xe38/0x12f8 kernel/signal.c:3019 arch_do_signal_or_restart+0x1c0/0x4414 arch/arm64/kernel/signal.c:1619 exit_to_user_mode_loop+0x7c/0x178 kernel/entry/common.c:40 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] arm64_exit_to_user_mode arch/arm64/kernel/entry-common.c:103 [inline] el0_ia+0x1c4/0x2e8 arch/arm64/kernel/entry-common.c:581 el0t_64_sync_handler+0xfc/0x12c arch/arm64/kernel/entry-common.c:771 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 other info that might help us debug this: Chain exists of: &ocfs2_file_ip_alloc_sem_key --> jbd2_handle --> &oi->ip_xattr_sem Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&oi->ip_xattr_sem); lock(jbd2_handle); lock(&oi->ip_xattr_sem); lock(&ocfs2_file_ip_alloc_sem_key); *** DEADLOCK *** 2 locks held by syz.2.465/8704: #0: ffff0000df2909c0 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}, at: inode_lock_killable include/linux/fs.h:985 [inline] #0: ffff0000df2909c0 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}, at: do_truncate+0x164/0x210 fs/open.c:63 #1: ffff0000df2906f8 (&oi->ip_xattr_sem){++++}-{4:4}, at: ocfs2_try_remove_refcount_tree+0xa8/0x2d8 fs/ocfs2/refcounttree.c:931 stack backtrace: CPU: 1 UID: 0 PID: 8704 Comm: syz.2.465 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 print_circular_bug+0x324/0x32c kernel/locking/lockdep.c:2043 check_noncircular+0x154/0x174 kernel/locking/lockdep.c:2175 check_prev_add kernel/locking/lockdep.c:3165 [inline] check_prevs_add kernel/locking/lockdep.c:3284 [inline] validate_chain kernel/locking/lockdep.c:3908 [inline] __lock_acquire+0x1774/0x30a4 kernel/locking/lockdep.c:5237 lock_acquire+0x14c/0x2e0 kernel/locking/lockdep.c:5868 down_write+0x50/0xc0 kernel/locking/rwsem.c:1590 ocfs2_try_remove_refcount_tree+0xb4/0x2d8 fs/ocfs2/refcounttree.c:932 ocfs2_truncate_file+0xc28/0x12f4 fs/ocfs2/file.c:521 ocfs2_setattr+0x1148/0x17a0 fs/ocfs2/file.c:1212 notify_change+0xa0c/0xcb8 fs/attr.c:546 do_truncate+0x198/0x210 fs/open.c:68 coredump_file+0x648/0x918 fs/coredump.c:964 vfs_coredump+0x152c/0x2354 fs/coredump.c:1143 get_signal+0xe38/0x12f8 kernel/signal.c:3019 arch_do_signal_or_restart+0x1c0/0x4414 arch/arm64/kernel/signal.c:1619 exit_to_user_mode_loop+0x7c/0x178 kernel/entry/common.c:40 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] arm64_exit_to_user_mode arch/arm64/kernel/entry-common.c:103 [inline] el0_ia+0x1c4/0x2e8 arch/arm64/kernel/entry-common.c:581 el0t_64_sync_handler+0xfc/0x12c arch/arm64/kernel/entry-common.c:771 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 (syz.2.465,8704,0):ocfs2_inode_is_valid_to_delete:948 ERROR: Skipping delete of system file 72 ocfs2: Unmounting device (7,2) on (node local)