possible deadlock in ocfs2_truncate_file

Status: upstream: reported C repro on 2024/12/01 05:06
Bug presence: origin:lts-only
[Documentation on labels]
Reported-by: syzbot+3597623c9c1c862c69ec@syzkaller.appspotmail.com
First crash: 601d, last: 46d
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Bug presence (2)
Date Name Commit Repro Result
2025/03/22 linux-6.1.y (ToT) 344a09659766 C [report] possible deadlock in ocfs2_truncate_file
2025/03/22 upstream (ToT) 88d324e69ea9 C Didn't crash
▶ ▼ Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.6 possible deadlock in ocfs2_truncate_file 4 1 269d 269d 0/2 auto-obsoleted due to no activity on 2026/02/06 01:22
linux-5.15 possible deadlock in ocfs2_truncate_file origin:lts-only 4 C error 46 3d23h 661d 0/3 upstream: reported C repro on 2024/10/02 11:36
upstream possible deadlock in ocfs2_truncate_file ocfs2 4 C 702 22d 700d 0/29 upstream: reported C repro on 2024/08/24 04:12
▶ ▼ Fix bisection attempts (2)
Created Duration User Patch Repo Result
2025/08/11 16:55 1h35m fix candidate upstream OK (0) job log
2025/05/05 23:52 15m bisect fix linux-6.1.y error job log

Sample crash report:
ocfs2: Slot 0 on device (7,0) was already allocated to this node!
ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode.
======================================================
WARNING: possible circular locking dependency detected
6.1.129-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor246/4289 is trying to acquire lock:
ffff0000de81e650 (sb_internal#2){.+.+}-{0:0}, at: ocfs2_orphan_for_truncate fs/ocfs2/file.c:392 [inline]
ffff0000de81e650 (sb_internal#2){.+.+}-{0:0}, at: ocfs2_truncate_file+0x640/0x1618 fs/ocfs2/file.c:496

but task is already holding lock:
ffff0000e16d0660 (&oi->ip_alloc_sem){++++}-{3:3}, at: ocfs2_truncate_file+0x38c/0x1618 fs/ocfs2/file.c:467

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #3 (&oi->ip_alloc_sem){++++}-{3:3}:
       down_read+0x64/0x308 kernel/locking/rwsem.c:1520
       ocfs2_read_virt_blocks+0x2bc/0x9f8 fs/ocfs2/extent_map.c:976
       ocfs2_read_dir_block fs/ocfs2/dir.c:508 [inline]
       ocfs2_find_entry_el fs/ocfs2/dir.c:715 [inline]
       ocfs2_find_entry+0x3d0/0x23c4 fs/ocfs2/dir.c:1091
       ocfs2_rename+0x1cb4/0x3588 fs/ocfs2/namei.c:1568
       vfs_rename+0xac8/0xe04 fs/namei.c:4874
       do_renameat2+0x9ec/0xe64 fs/namei.c:5027
       __do_sys_renameat2 fs/namei.c:5060 [inline]
       __se_sys_renameat2 fs/namei.c:5057 [inline]
       __arm64_sys_renameat2+0xe0/0xfc fs/namei.c:5057
       __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
       invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
       el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
       do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
       el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
       el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
       el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

-> #2 (jbd2_handle){.+.+}-{0:0}:
       start_this_handle+0x1140/0x13ac fs/jbd2/transaction.c:463
       jbd2__journal_start+0x298/0x544 fs/jbd2/transaction.c:520
       jbd2_journal_start+0x3c/0x4c fs/jbd2/transaction.c:559
       ocfs2_start_trans+0x3e8/0x73c fs/ocfs2/journal.c:354
       ocfs2_local_alloc_slide_window fs/ocfs2/localalloc.c:1258 [inline]
       ocfs2_reserve_local_alloc_bits+0x9b4/0x2610 fs/ocfs2/localalloc.c:668
       ocfs2_reserve_clusters_with_limit+0x194/0xabc fs/ocfs2/suballoc.c:1162
       ocfs2_reserve_clusters+0x3c/0x50 fs/ocfs2/suballoc.c:1223
       ocfs2_mknod+0xe04/0x2560 fs/ocfs2/namei.c:354
       ocfs2_mkdir+0x1a8/0x560 fs/ocfs2/namei.c:657
       vfs_mkdir+0x334/0x4e4 fs/namei.c:4106
       do_mkdirat+0x220/0x510 fs/namei.c:4131
       __do_sys_mkdirat fs/namei.c:4146 [inline]
       __se_sys_mkdirat fs/namei.c:4144 [inline]
       __arm64_sys_mkdirat+0x90/0xa8 fs/namei.c:4144
       __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
       invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
       el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
       do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
       el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
       el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
       el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

-> #1 (&journal->j_trans_barrier){.+.+}-{3:3}:
       down_read+0x64/0x308 kernel/locking/rwsem.c:1520
       ocfs2_start_trans+0x3dc/0x73c fs/ocfs2/journal.c:352
       ocfs2_local_alloc_slide_window fs/ocfs2/localalloc.c:1258 [inline]
       ocfs2_reserve_local_alloc_bits+0x9b4/0x2610 fs/ocfs2/localalloc.c:668
       ocfs2_reserve_clusters_with_limit+0x194/0xabc fs/ocfs2/suballoc.c:1162
       ocfs2_reserve_clusters+0x3c/0x50 fs/ocfs2/suballoc.c:1223
       ocfs2_mknod+0xe04/0x2560 fs/ocfs2/namei.c:354
       ocfs2_mkdir+0x1a8/0x560 fs/ocfs2/namei.c:657
       vfs_mkdir+0x334/0x4e4 fs/namei.c:4106
       do_mkdirat+0x220/0x510 fs/namei.c:4131
       __do_sys_mkdirat fs/namei.c:4146 [inline]
       __se_sys_mkdirat fs/namei.c:4144 [inline]
       __arm64_sys_mkdirat+0x90/0xa8 fs/namei.c:4144
       __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
       invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
       el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
       do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
       el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
       el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
       el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

-> #0 (sb_internal#2){.+.+}-{0:0}:
       check_prev_add kernel/locking/lockdep.c:3090 [inline]
       check_prevs_add kernel/locking/lockdep.c:3209 [inline]
       validate_chain kernel/locking/lockdep.c:3825 [inline]
       __lock_acquire+0x3338/0x7680 kernel/locking/lockdep.c:5049
       lock_acquire+0x26c/0x7cc kernel/locking/lockdep.c:5662
       percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
       __sb_start_write include/linux/fs.h:1891 [inline]
       sb_start_intwrite include/linux/fs.h:2013 [inline]
       ocfs2_start_trans+0x260/0x73c fs/ocfs2/journal.c:350
       ocfs2_orphan_for_truncate fs/ocfs2/file.c:392 [inline]
       ocfs2_truncate_file+0x640/0x1618 fs/ocfs2/file.c:496
       ocfs2_setattr+0x142c/0x1b5c fs/ocfs2/file.c:1212
       notify_change+0xb58/0xe1c fs/attr.c:499
       do_truncate+0x1c0/0x28c fs/open.c:65
       handle_truncate fs/namei.c:3285 [inline]
       do_open fs/namei.c:3630 [inline]
       path_openat+0x1fa0/0x2548 fs/namei.c:3783
       do_filp_open+0x1bc/0x3cc fs/namei.c:3810
       do_sys_openat2+0x128/0x3e0 fs/open.c:1318
       do_sys_open fs/open.c:1334 [inline]
       __do_sys_openat fs/open.c:1350 [inline]
       __se_sys_openat fs/open.c:1345 [inline]
       __arm64_sys_openat+0x1f0/0x240 fs/open.c:1345
       __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
       invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
       el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
       do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
       el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
       el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
       el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

other info that might help us debug this:

Chain exists of:
  sb_internal#2 --> jbd2_handle --> &oi->ip_alloc_sem

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&oi->ip_alloc_sem);
                               lock(jbd2_handle);
                               lock(&oi->ip_alloc_sem);
  lock(sb_internal#2);

 *** DEADLOCK ***

3 locks held by syz-executor246/4289:
 #0: ffff0000de81e460 (sb_writers#8){.+.+}-{0:0}, at: mnt_want_write+0x44/0x9c fs/namespace.c:393
 #1: ffff0000e16d09c8 (&sb->s_type->i_mutex_key#20){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline]
 #1: ffff0000e16d09c8 (&sb->s_type->i_mutex_key#20){+.+.}-{3:3}, at: do_truncate+0x1ac/0x28c fs/open.c:63
 #2: ffff0000e16d0660 (&oi->ip_alloc_sem){++++}-{3:3}, at: ocfs2_truncate_file+0x38c/0x1618 fs/ocfs2/file.c:467

stack backtrace:
CPU: 1 PID: 4289 Comm: syz-executor246 Not tainted 6.1.129-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call trace:
 dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
 dump_stack+0x1c/0x58 lib/dump_stack.c:113
 print_circular_bug+0x150/0x1b8 kernel/locking/lockdep.c:2048
 check_noncircular+0x2cc/0x378 kernel/locking/lockdep.c:2170
 check_prev_add kernel/locking/lockdep.c:3090 [inline]
 check_prevs_add kernel/locking/lockdep.c:3209 [inline]
 validate_chain kernel/locking/lockdep.c:3825 [inline]
 __lock_acquire+0x3338/0x7680 kernel/locking/lockdep.c:5049
 lock_acquire+0x26c/0x7cc kernel/locking/lockdep.c:5662
 percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
 __sb_start_write include/linux/fs.h:1891 [inline]
 sb_start_intwrite include/linux/fs.h:2013 [inline]
 ocfs2_start_trans+0x260/0x73c fs/ocfs2/journal.c:350
 ocfs2_orphan_for_truncate fs/ocfs2/file.c:392 [inline]
 ocfs2_truncate_file+0x640/0x1618 fs/ocfs2/file.c:496
 ocfs2_setattr+0x142c/0x1b5c fs/ocfs2/file.c:1212
 notify_change+0xb58/0xe1c fs/attr.c:499
 do_truncate+0x1c0/0x28c fs/open.c:65
 handle_truncate fs/namei.c:3285 [inline]
 do_open fs/namei.c:3630 [inline]
 path_openat+0x1fa0/0x2548 fs/namei.c:3783
 do_filp_open+0x1bc/0x3cc fs/namei.c:3810
 do_sys_openat2+0x128/0x3e0 fs/open.c:1318
 do_sys_open fs/open.c:1334 [inline]
 __do_sys_openat fs/open.c:1350 [inline]
 __se_sys_openat fs/open.c:1345 [inline]
 __arm64_sys_openat+0x1f0/0x240 fs/open.c:1345
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Crashes (32):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/03/01 09:01 linux-6.1.y 3a8358583626 67cf5345 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci2-linux-6-1-kasan-arm64 possible deadlock in ocfs2_truncate_file
2026/05/15 09:53 linux-6.1.y ad16b162f21d 9cd3beaa .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in ocfs2_truncate_file
2026/05/15 09:52 linux-6.1.y ad16b162f21d 9cd3beaa .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in ocfs2_truncate_file
2026/05/11 08:17 linux-6.1.y ad16b162f21d 845acb1c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in ocfs2_truncate_file
2026/04/22 07:35 linux-6.1.y 7c87defbd336 0b6ab7ec .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in ocfs2_truncate_file
2025/10/26 19:20 linux-6.1.y 8e6e2188d949 c0460fcd .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in ocfs2_truncate_file
2025/10/22 03:56 linux-6.1.y 8e6e2188d949 252fbbad .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in ocfs2_truncate_file
2025/09/10 02:01 linux-6.1.y f97f1002271b fdeaa69b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in ocfs2_truncate_file
2025/09/08 18:44 linux-6.1.y 28c695c365e1 d291dd2d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in ocfs2_truncate_file
2025/07/29 23:03 linux-6.1.y 3594f306da12 f8f2b4da .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in ocfs2_truncate_file
2025/06/21 03:26 linux-6.1.y 58485ff1a74f d6cdfb8a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in ocfs2_truncate_file
2025/05/28 17:37 linux-6.1.y da3c5173c55f 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in ocfs2_truncate_file
2025/04/04 11:01 linux-6.1.y 8e60a714ba3b 1c4febdb .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in ocfs2_truncate_file
2025/04/04 11:01 linux-6.1.y 8e60a714ba3b 1c4febdb .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in ocfs2_truncate_file
2025/04/04 10:59 linux-6.1.y 8e60a714ba3b 1c4febdb .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in ocfs2_truncate_file
2025/03/12 04:05 linux-6.1.y 6ae7ac5c4251 ee70e6db .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in ocfs2_truncate_file
2025/03/07 14:53 linux-6.1.y 3a8358583626 7e3bd60d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan possible deadlock in ocfs2_truncate_file
2026/06/08 20:35 linux-6.1.y 228da13e907e 656e94c6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in ocfs2_truncate_file
2026/06/08 20:33 linux-6.1.y 228da13e907e 656e94c6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in ocfs2_truncate_file
2026/01/11 12:43 linux-6.1.y 50cbba13faa2 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in ocfs2_truncate_file
2025/12/07 06:06 linux-6.1.y 50cbba13faa2 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in ocfs2_truncate_file
2025/10/21 21:08 linux-6.1.y 8e6e2188d949 9832ed61 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in ocfs2_truncate_file
2025/10/10 23:50 linux-6.1.y 882efbdd9d34 ff1712fe .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in ocfs2_truncate_file
2025/10/10 23:50 linux-6.1.y 882efbdd9d34 ff1712fe .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in ocfs2_truncate_file
2025/09/01 06:02 linux-6.1.y f89b6e15694c 807a3b61 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in ocfs2_truncate_file
2025/03/13 09:50 linux-6.1.y 6ae7ac5c4251 44be8b44 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in ocfs2_truncate_file
2025/03/12 01:11 linux-6.1.y 6ae7ac5c4251 ee70e6db .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in ocfs2_truncate_file
2025/03/06 00:05 linux-6.1.y 3a8358583626 831e3629 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in ocfs2_truncate_file
2025/03/01 08:11 linux-6.1.y 3a8358583626 67cf5345 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in ocfs2_truncate_file
2025/01/26 10:21 linux-6.1.y 75cefdf153f5 9fbd772e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in ocfs2_truncate_file
2025/01/21 05:23 linux-6.1.y f4f677285b38 6e87cfa2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in ocfs2_truncate_file
2024/12/01 05:06 linux-6.1.y e4d90d63d385 68914665 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 possible deadlock in ocfs2_truncate_file
* Struck through repros no longer work on HEAD.