ocfs2: Slot 0 on device (7,4) was already allocated to this node! JBD2: Ignoring recovery information on journal ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. ====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Not tainted ------------------------------------------------------ syz.4.100/4792 is trying to acquire lock: ffff88805fabb120 (&oi->ip_alloc_sem){++++}-{3:3}, at: ocfs2_read_virt_blocks+0x23f/0x8a0 fs/ocfs2/extent_map.c:984 but task is already holding lock: ffff88801f7ac990 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x1312/0x15a0 fs/jbd2/transaction.c:462 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (jbd2_handle){++++}-{0:0}: jbd2_log_wait_commit+0x16a/0x4a0 fs/jbd2/journal.c:697 ocfs2_try_to_free_truncate_log+0x310/0x360 fs/ocfs2/alloc.c:6141 ocfs2_write_begin_nolock+0x2ff7/0x4180 fs/ocfs2/aops.c:1871 __ocfs2_page_mkwrite fs/ocfs2/mmap.c:93 [inline] ocfs2_page_mkwrite+0x5be/0xad0 fs/ocfs2/mmap.c:144 do_page_mkwrite+0x168/0x3c0 mm/memory.c:2922 wp_page_shared+0x16b/0x6d0 mm/memory.c:3259 handle_pte_fault mm/memory.c:4668 [inline] __handle_mm_fault mm/memory.c:4785 [inline] handle_mm_fault+0x1ec7/0x43b0 mm/memory.c:4883 do_user_addr_fault+0x489/0xc80 arch/x86/mm/fault.c:1357 handle_page_fault arch/x86/mm/fault.c:1445 [inline] exc_page_fault+0x60/0x100 arch/x86/mm/fault.c:1501 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:606 copy_user_generic_unrolled+0x89/0xc0 arch/x86/lib/copy_user_64.S:91 copy_user_generic arch/x86/include/asm/uaccess_64.h:37 [inline] raw_copy_to_user arch/x86/include/asm/uaccess_64.h:58 [inline] _copy_to_user+0xf0/0x130 lib/usercopy.c:40 copy_to_user include/linux/uaccess.h:200 [inline] f_getown_ex fs/fcntl.c:232 [inline] do_fcntl+0xde9/0x12d0 fs/fcntl.c:390 __do_sys_fcntl fs/fcntl.c:466 [inline] __se_sys_fcntl+0xcc/0x190 fs/fcntl.c:451 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 -> #0 (&oi->ip_alloc_sem){++++}-{3:3}: check_prev_add kernel/locking/lockdep.c:3053 [inline] check_prevs_add kernel/locking/lockdep.c:3172 [inline] validate_chain kernel/locking/lockdep.c:3788 [inline] __lock_acquire+0x2c33/0x7c60 kernel/locking/lockdep.c:5012 lock_acquire+0x197/0x3f0 kernel/locking/lockdep.c:5623 down_read+0x44/0x2e0 kernel/locking/rwsem.c:1498 ocfs2_read_virt_blocks+0x23f/0x8a0 fs/ocfs2/extent_map.c:984 ocfs2_read_dir_block+0xd3/0x4d0 fs/ocfs2/dir.c:508 ocfs2_dir_foreach_blk_el fs/ocfs2/dir.c:1842 [inline] ocfs2_dir_foreach_blk+0x26e/0x1900 fs/ocfs2/dir.c:1928 ocfs2_dir_foreach fs/ocfs2/dir.c:1938 [inline] ocfs2_empty_dir+0x1a1/0x6c0 fs/ocfs2/dir.c:2156 ocfs2_rename+0x204e/0x3690 fs/ocfs2/namei.c:1499 vfs_rename+0xbbf/0x10d0 fs/namei.c:4840 do_renameat2+0xa83/0xf70 fs/namei.c:4993 __do_sys_rename fs/namei.c:5039 [inline] __se_sys_rename fs/namei.c:5037 [inline] __x64_sys_rename+0x82/0x90 fs/namei.c:5037 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(jbd2_handle); lock(&oi->ip_alloc_sem); lock(jbd2_handle); lock(&oi->ip_alloc_sem); *** DEADLOCK *** 10 locks held by syz.4.100/4792: #0: ffff888147286460 (sb_writers#21){.+.+}-{0:0}, at: mnt_want_write+0x3d/0x90 fs/namespace.c:386 #1: ffff888147286748 (&type->s_vfs_rename_key#2){+.+.}-{3:3}, at: lock_rename fs/namei.c:3024 [inline] #1: ffff888147286748 (&type->s_vfs_rename_key#2){+.+.}-{3:3}, at: do_renameat2+0x362/0xf70 fs/namei.c:4932 #2: ffff888062ac89c8 (&type->i_mutex_dir_key#12/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:822 [inline] #2: ffff888062ac89c8 (&type->i_mutex_dir_key#12/1){+.+.}-{3:3}, at: lock_two_directories fs/namei.c:-1 [inline] #2: ffff888062ac89c8 (&type->i_mutex_dir_key#12/1){+.+.}-{3:3}, at: lock_rename fs/namei.c:3025 [inline] #2: ffff888062ac89c8 (&type->i_mutex_dir_key#12/1){+.+.}-{3:3}, at: do_renameat2+0x3f4/0xf70 fs/namei.c:4932 #3: ffff88805fabc2c8 (&sb->s_type->i_mutex_key#33/5){+.+.}-{3:3}, at: lock_rename include/linux/fs.h:-1 [inline] #3: ffff88805fabc2c8 (&sb->s_type->i_mutex_key#33/5){+.+.}-{3:3}, at: do_renameat2+0x42a/0xf70 fs/namei.c:4932 #4: ffff88805fabd108 (&sb->s_type->i_mutex_key#33/2){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:822 [inline] #4: ffff88805fabd108 (&sb->s_type->i_mutex_key#33/2){+.+.}-{3:3}, at: vfs_rename+0x78c/0x10d0 fs/namei.c:4803 #5: ffff88805fabb488 (&sb->s_type->i_mutex_key#33){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:787 [inline] #5: ffff88805fabb488 (&sb->s_type->i_mutex_key#33){+.+.}-{3:3}, at: vfs_rename+0x81f/0x10d0 fs/namei.c:4805 #6: ffff88805fb7d108 (&ocfs2_sysfile_lock_key[args->fi_sysfile_type]){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:787 [inline] #6: ffff88805fb7d108 (&ocfs2_sysfile_lock_key[args->fi_sysfile_type]){+.+.}-{3:3}, at: ocfs2_lookup_lock_orphan_dir+0xeb/0x2c0 fs/ocfs2/namei.c:2116 #7: ffff888147286650 (sb_internal#3){.+.+}-{0:0}, at: ocfs2_rename+0x1919/0x3690 fs/ocfs2/namei.c:1488 #8: ffff888079a488e8 (&journal->j_trans_barrier){.+.+}-{3:3}, at: ocfs2_start_trans+0x368/0x6c0 fs/ocfs2/journal.c:374 #9: ffff88801f7ac990 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x1312/0x15a0 fs/jbd2/transaction.c:462 stack backtrace: CPU: 1 PID: 4792 Comm: syz.4.100 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: dump_stack_lvl+0x168/0x230 lib/dump_stack.c:106 check_noncircular+0x274/0x310 kernel/locking/lockdep.c:2133 check_prev_add kernel/locking/lockdep.c:3053 [inline] check_prevs_add kernel/locking/lockdep.c:3172 [inline] validate_chain kernel/locking/lockdep.c:3788 [inline] __lock_acquire+0x2c33/0x7c60 kernel/locking/lockdep.c:5012 lock_acquire+0x197/0x3f0 kernel/locking/lockdep.c:5623 down_read+0x44/0x2e0 kernel/locking/rwsem.c:1498 ocfs2_read_virt_blocks+0x23f/0x8a0 fs/ocfs2/extent_map.c:984 ocfs2_read_dir_block+0xd3/0x4d0 fs/ocfs2/dir.c:508 ocfs2_dir_foreach_blk_el fs/ocfs2/dir.c:1842 [inline] ocfs2_dir_foreach_blk+0x26e/0x1900 fs/ocfs2/dir.c:1928 ocfs2_dir_foreach fs/ocfs2/dir.c:1938 [inline] ocfs2_empty_dir+0x1a1/0x6c0 fs/ocfs2/dir.c:2156 ocfs2_rename+0x204e/0x3690 fs/ocfs2/namei.c:1499 vfs_rename+0xbbf/0x10d0 fs/namei.c:4840 do_renameat2+0xa83/0xf70 fs/namei.c:4993 __do_sys_rename fs/namei.c:5039 [inline] __se_sys_rename fs/namei.c:5037 [inline] __x64_sys_rename+0x82/0x90 fs/namei.c:5037 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fd9b8720749 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd9b6966038 EFLAGS: 00000246 ORIG_RAX: 0000000000000052 RAX: ffffffffffffffda RBX: 00007fd9b8977090 RCX: 00007fd9b8720749 RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000200000000000 RBP: 00007fd9b87a4f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fd9b8977128 R14: 00007fd9b8977090 R15: 00007fffd901d4e8