======================================================
WARNING: possible circular locking dependency detected
5.15.188-syzkaller #0 Not tainted
------------------------------------------------------
syz.0.22/4249 is trying to acquire lock:
ffff0000d46d8650 (sb_internal#2){.+.+}-{0:0}, at: ocfs2_extend_allocation+0x5d4/0x1504 fs/ocfs2/file.c:596
but task is already holding lock:
ffff0000ef345108 (&ocfs2_sysfile_lock_key[args->fi_sysfile_type]#3){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:787 [inline]
ffff0000ef345108 (&ocfs2_sysfile_lock_key[args->fi_sysfile_type]#3){+.+.}-{3:3}, at: ocfs2_reserve_suballoc_bits+0x12c/0x3a68 fs/ocfs2/suballoc.c:782
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #7 (&ocfs2_sysfile_lock_key[args->fi_sysfile_type]#3){+.+.}-{3:3}:
down_write+0xbc/0x12c kernel/locking/rwsem.c:1551
inode_lock include/linux/fs.h:787 [inline]
ocfs2_reserve_suballoc_bits+0x12c/0x3a68 fs/ocfs2/suballoc.c:782
ocfs2_reserve_cluster_bitmap_bits fs/ocfs2/suballoc.c:1128 [inline]
ocfs2_reserve_clusters_with_limit+0x290/0x9e0 fs/ocfs2/suballoc.c:1173
ocfs2_reserve_clusters fs/ocfs2/suballoc.c:1223 [inline]
ocfs2_lock_allocators+0x27c/0x518 fs/ocfs2/suballoc.c:2669
ocfs2_extend_allocation+0x328/0x1504 fs/ocfs2/file.c:588
ocfs2_extend_no_holes+0x1a8/0x424 fs/ocfs2/file.c:1030
ocfs2_acquire_dquot+0x530/0xa2c fs/ocfs2/quota_global.c:841
dqget+0x658/0xcf4 fs/quota/dquot.c:988
ocfs2_setattr+0xa7c/0x16c4 fs/ocfs2/file.c:1236
notify_change+0xa08/0xcd8 fs/attr.c:505
chown_common+0x42c/0x5a0 fs/open.c:680
vfs_fchown fs/open.c:748 [inline]
ksys_fchown+0xe0/0x158 fs/open.c:759
__do_sys_fchown fs/open.c:767 [inline]
__se_sys_fchown fs/open.c:765 [inline]
__arm64_sys_fchown+0x7c/0x94 fs/open.c:765
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
-> #6 (&ocfs2_quota_ip_alloc_sem_key){++++}-{3:3}:
down_write+0xbc/0x12c kernel/locking/rwsem.c:1551
ocfs2_lock_global_qf+0x1a8/0x22c fs/ocfs2/quota_global.c:314
ocfs2_acquire_dquot+0x244/0xa2c fs/ocfs2/quota_global.c:816
dqget+0x658/0xcf4 fs/quota/dquot.c:988
ocfs2_setattr+0xa7c/0x16c4 fs/ocfs2/file.c:1236
notify_change+0xa08/0xcd8 fs/attr.c:505
chown_common+0x42c/0x5a0 fs/open.c:680
vfs_fchown fs/open.c:748 [inline]
ksys_fchown+0xe0/0x158 fs/open.c:759
__do_sys_fchown fs/open.c:767 [inline]
__se_sys_fchown fs/open.c:765 [inline]
__arm64_sys_fchown+0x7c/0x94 fs/open.c:765
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
-> #5 (&ocfs2_sysfile_lock_key[args->fi_sysfile_type]#2){+.+.}-{3:3}:
down_write+0xbc/0x12c kernel/locking/rwsem.c:1551
inode_lock include/linux/fs.h:787 [inline]
ocfs2_lock_global_qf+0x18c/0x22c fs/ocfs2/quota_global.c:313
ocfs2_acquire_dquot+0x244/0xa2c fs/ocfs2/quota_global.c:816
dqget+0x658/0xcf4 fs/quota/dquot.c:988
ocfs2_setattr+0xa7c/0x16c4 fs/ocfs2/file.c:1236
notify_change+0xa08/0xcd8 fs/attr.c:505
chown_common+0x42c/0x5a0 fs/open.c:680
vfs_fchown fs/open.c:748 [inline]
ksys_fchown+0xe0/0x158 fs/open.c:759
__do_sys_fchown fs/open.c:767 [inline]
__se_sys_fchown fs/open.c:765 [inline]
__arm64_sys_fchown+0x7c/0x94 fs/open.c:765
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
-> #4 (&dquot->dq_lock){+.+.}-{3:3}:
__mutex_lock_common+0x194/0x1edc kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0xac/0x11c kernel/locking/mutex.c:743
wait_on_dquot fs/quota/dquot.c:356 [inline]
dqget+0x5e8/0xcf4 fs/quota/dquot.c:983
dquot_transfer+0x19c/0x3cc fs/quota/dquot.c:2146
ext4_setattr+0x588/0x142c fs/ext4/inode.c:5452
notify_change+0xa08/0xcd8 fs/attr.c:505
chown_common+0x42c/0x5a0 fs/open.c:680
vfs_fchown fs/open.c:748 [inline]
ksys_fchown+0xe0/0x158 fs/open.c:759
__do_sys_fchown fs/open.c:767 [inline]
__se_sys_fchown fs/open.c:765 [inline]
__arm64_sys_fchown+0x7c/0x94 fs/open.c:765
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
-> #3 (&ei->xattr_sem){.+.+}-{3:3}:
down_read+0xc0/0x390 kernel/locking/rwsem.c:1498
ext4_setattr+0x57c/0x142c fs/ext4/inode.c:5451
notify_change+0xa08/0xcd8 fs/attr.c:505
chown_common+0x42c/0x5a0 fs/open.c:680
do_fchownat+0x158/0x268 fs/open.c:711
__do_sys_fchownat fs/open.c:726 [inline]
__se_sys_fchownat fs/open.c:723 [inline]
__arm64_sys_fchownat+0xb8/0xd4 fs/open.c:723
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
-> #2 (jbd2_handle){++++}-{0:0}:
start_this_handle+0xef4/0x11a4 fs/jbd2/transaction.c:464
jbd2__journal_start+0x28c/0x744 fs/jbd2/transaction.c:521
jbd2_journal_start+0x3c/0x4c fs/jbd2/transaction.c:560
ocfs2_start_trans+0x43c/0x794 fs/ocfs2/journal.c:376
ocfs2_modify_bh+0xe4/0x450 fs/ocfs2/quota_local.c:101
ocfs2_local_read_info+0x102c/0x131c fs/ocfs2/quota_local.c:764
dquot_load_quota_sb+0x6c4/0xa24 fs/quota/dquot.c:2463
dquot_load_quota_inode+0x274/0x4e4 fs/quota/dquot.c:2500
ocfs2_enable_quotas+0x17c/0x3b4 fs/ocfs2/super.c:927
ocfs2_fill_super+0x2e74/0x4074 fs/ocfs2/super.c:1140
mount_bdev+0x264/0x358 fs/super.c:1400
ocfs2_mount+0x44/0x58 fs/ocfs2/super.c:1187
legacy_get_tree+0xd4/0x16c fs/fs_context.c:611
vfs_get_tree+0x90/0x274 fs/super.c:1530
do_new_mount+0x228/0x810 fs/namespace.c:3014
path_mount+0x5b4/0x1000 fs/namespace.c:3344
do_mount fs/namespace.c:3357 [inline]
__do_sys_mount fs/namespace.c:3565 [inline]
__se_sys_mount fs/namespace.c:3542 [inline]
__arm64_sys_mount+0x514/0x5e4 fs/namespace.c:3542
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
-> #1 (&journal->j_trans_barrier){.+.+}-{3:3}:
down_read+0xc0/0x390 kernel/locking/rwsem.c:1498
ocfs2_start_trans+0x430/0x794 fs/ocfs2/journal.c:374
ocfs2_modify_bh+0xe4/0x450 fs/ocfs2/quota_local.c:101
ocfs2_local_read_info+0x102c/0x131c fs/ocfs2/quota_local.c:764
dquot_load_quota_sb+0x6c4/0xa24 fs/quota/dquot.c:2463
dquot_load_quota_inode+0x274/0x4e4 fs/quota/dquot.c:2500
ocfs2_enable_quotas+0x17c/0x3b4 fs/ocfs2/super.c:927
ocfs2_fill_super+0x2e74/0x4074 fs/ocfs2/super.c:1140
mount_bdev+0x264/0x358 fs/super.c:1400
ocfs2_mount+0x44/0x58 fs/ocfs2/super.c:1187
legacy_get_tree+0xd4/0x16c fs/fs_context.c:611
vfs_get_tree+0x90/0x274 fs/super.c:1530
do_new_mount+0x228/0x810 fs/namespace.c:3014
path_mount+0x5b4/0x1000 fs/namespace.c:3344
do_mount fs/namespace.c:3357 [inline]
__do_sys_mount fs/namespace.c:3565 [inline]
__se_sys_mount fs/namespace.c:3542 [inline]
__arm64_sys_mount+0x514/0x5e4 fs/namespace.c:3542
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
-> #0 (sb_internal#2){.+.+}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain kernel/locking/lockdep.c:3788 [inline]
__lock_acquire+0x2928/0x651c kernel/locking/lockdep.c:5012
lock_acquire+0x1f4/0x620 kernel/locking/lockdep.c:5623
percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
__sb_start_write include/linux/fs.h:1811 [inline]
sb_start_intwrite include/linux/fs.h:1928 [inline]
ocfs2_start_trans+0x2c4/0x794 fs/ocfs2/journal.c:372
ocfs2_extend_allocation+0x5d4/0x1504 fs/ocfs2/file.c:596
ocfs2_extend_no_holes+0x1a8/0x424 fs/ocfs2/file.c:1030
ocfs2_acquire_dquot+0x530/0xa2c fs/ocfs2/quota_global.c:841
dqget+0x658/0xcf4 fs/quota/dquot.c:988
ocfs2_setattr+0xa7c/0x16c4 fs/ocfs2/file.c:1236
notify_change+0xa08/0xcd8 fs/attr.c:505
chown_common+0x42c/0x5a0 fs/open.c:680
vfs_fchown fs/open.c:748 [inline]
ksys_fchown+0xe0/0x158 fs/open.c:759
__do_sys_fchown fs/open.c:767 [inline]
__se_sys_fchown fs/open.c:765 [inline]
__arm64_sys_fchown+0x7c/0x94 fs/open.c:765
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
other info that might help us debug this:
Chain exists of:
sb_internal#2 --> &ocfs2_quota_ip_alloc_sem_key --> &ocfs2_sysfile_lock_key[args->fi_sysfile_type]#3
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&ocfs2_sysfile_lock_key[args->fi_sysfile_type]#3);
lock(&ocfs2_quota_ip_alloc_sem_key);
lock(&ocfs2_sysfile_lock_key[args->fi_sysfile_type]#3);
lock(sb_internal#2);
*** DEADLOCK ***
6 locks held by syz.0.22/4249:
#0: ffff0000d46d8460 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write_file+0x64/0x1e8 fs/namespace.c:421
#1: ffff0000ef3409c8 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:787 [inline]
#1: ffff0000ef3409c8 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: chown_common+0x380/0x5a0 fs/open.c:674
#2: ffff0000dce060a8 (&dquot->dq_lock){+.+.}-{3:3}, at: ocfs2_acquire_dquot+0x238/0xa2c fs/ocfs2/quota_global.c:811
#3: ffff0000ef345f48 (&ocfs2_sysfile_lock_key[args->fi_sysfile_type]#2){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:787 [inline]
#3: ffff0000ef345f48 (&ocfs2_sysfile_lock_key[args->fi_sysfile_type]#2){+.+.}-{3:3}, at: ocfs2_lock_global_qf+0x18c/0x22c fs/ocfs2/quota_global.c:313
#4: ffff0000ef345be0 (&ocfs2_quota_ip_alloc_sem_key){++++}-{3:3}, at: ocfs2_lock_global_qf+0x1a8/0x22c fs/ocfs2/quota_global.c:314
#5: ffff0000ef345108 (&ocfs2_sysfile_lock_key[args->fi_sysfile_type]#3){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:787 [inline]
#5: ffff0000ef345108 (&ocfs2_sysfile_lock_key[args->fi_sysfile_type]#3){+.+.}-{3:3}, at: ocfs2_reserve_suballoc_bits+0x12c/0x3a68 fs/ocfs2/suballoc.c:782
stack backtrace:
CPU: 0 PID: 4249 Comm: syz.0.22 Not tainted 5.15.188-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call trace:
dump_backtrace+0x0/0x43c arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack+0x30/0x40 lib/dump_stack.c:88
dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106
dump_stack+0x1c/0x5c lib/dump_stack.c:113
print_circular_bug+0x148/0x1b0 kernel/locking/lockdep.c:2011
check_noncircular+0x240/0x2d4 kernel/locking/lockdep.c:2133
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain kernel/locking/lockdep.c:3788 [inline]
__lock_acquire+0x2928/0x651c kernel/locking/lockdep.c:5012
lock_acquire+0x1f4/0x620 kernel/locking/lockdep.c:5623
percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
__sb_start_write include/linux/fs.h:1811 [inline]
sb_start_intwrite include/linux/fs.h:1928 [inline]
ocfs2_start_trans+0x2c4/0x794 fs/ocfs2/journal.c:372
ocfs2_extend_allocation+0x5d4/0x1504 fs/ocfs2/file.c:596
ocfs2_extend_no_holes+0x1a8/0x424 fs/ocfs2/file.c:1030
ocfs2_acquire_dquot+0x530/0xa2c fs/ocfs2/quota_global.c:841
dqget+0x658/0xcf4 fs/quota/dquot.c:988
ocfs2_setattr+0xa7c/0x16c4 fs/ocfs2/file.c:1236
notify_change+0xa08/0xcd8 fs/attr.c:505
chown_common+0x42c/0x5a0 fs/open.c:680
vfs_fchown fs/open.c:748 [inline]
ksys_fchown+0xe0/0x158 fs/open.c:759
__do_sys_fchown fs/open.c:767 [inline]
__se_sys_fchown fs/open.c:765 [inline]
__arm64_sys_fchown+0x7c/0x94 fs/open.c:765
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
(syz.0.22,4249,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xdf8356d3, computed 0xb8c23ae4. Applying ECC.
(syz.0.22,4249,1):ocfs2_block_check_validate:416 ERROR: Fixed CRC32 failed: stored: 0xdf8356d3, computed 0x2acb7e3c
(syz.0.22,4249,1):ocfs2_read_quota_phys_block:160 ERROR: status = -5
(syz.0.22,4249,1):ocfs2_quota_read:201 ERROR: status = -5
Quota error (device loop0): qtree_write_dquot: Error -5 occurred while creating quota
(syz.0.22,4249,1):ocfs2_acquire_dquot:878 ERROR: status = -5