Warning: Permanently added '10.128.1.4' (ECDSA) to the list of known hosts. executing program [ 50.427625][ T3538] [ 50.429962][ T3538] ====================================================== [ 50.436956][ T3538] WARNING: possible circular locking dependency detected [ 50.443953][ T3538] 6.1.35-syzkaller #0 Not tainted [ 50.449040][ T3538] ------------------------------------------------------ [ 50.456033][ T3538] syz-executor338/3538 is trying to acquire lock: [ 50.462423][ T3538] ffff88807ee34170 (&journal->j_barrier){+.+.}-{3:3}, at: jbd2_journal_lock_updates+0x2a8/0x370 [ 50.472850][ T3538] [ 50.472850][ T3538] but task is already holding lock: [ 50.480188][ T3538] ffff88807ee32b98 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_change_inode_journal_flag+0x1a0/0x6e0 [ 50.491468][ T3538] [ 50.491468][ T3538] which lock already depends on the new lock. [ 50.491468][ T3538] [ 50.501846][ T3538] [ 50.501846][ T3538] the existing dependency chain (in reverse order) is: [ 50.510832][ T3538] [ 50.510832][ T3538] -> #4 (&sbi->s_writepages_rwsem){++++}-{0:0}: [ 50.519228][ T3538] lock_acquire+0x1f8/0x5a0 [ 50.524236][ T3538] percpu_down_write+0x50/0x2e0 [ 50.529600][ T3538] ext4_change_inode_journal_flag+0x1a0/0x6e0 [ 50.536173][ T3538] ext4_fileattr_set+0xe04/0x1770 [ 50.541702][ T3538] vfs_fileattr_set+0x8f3/0xd30 [ 50.547056][ T3538] do_vfs_ioctl+0x1cd1/0x2a90 [ 50.552237][ T3538] __se_sys_ioctl+0x81/0x160 [ 50.557336][ T3538] do_syscall_64+0x3d/0xb0 [ 50.562261][ T3538] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 50.568658][ T3538] [ 50.568658][ T3538] -> #3 (mapping.invalidate_lock){++++}-{3:3}: [ 50.577065][ T3538] lock_acquire+0x1f8/0x5a0 [ 50.582069][ T3538] down_write+0x36/0x60 [ 50.586726][ T3538] ext4_setattr+0xec7/0x1a00 [ 50.591816][ T3538] notify_change+0xdcd/0x1080 [ 50.596990][ T3538] do_truncate+0x21c/0x300 [ 50.601910][ T3538] do_sys_ftruncate+0x2e2/0x380 [ 50.607263][ T3538] do_syscall_64+0x3d/0xb0 [ 50.612184][ T3538] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 50.618578][ T3538] [ 50.618578][ T3538] -> #2 (&sb->s_type->i_mutex_key#8){++++}-{3:3}: [ 50.627160][ T3538] lock_acquire+0x1f8/0x5a0 [ 50.632163][ T3538] down_read+0x43/0x2e0 [ 50.636820][ T3538] ext4_bmap+0x4b/0x410 [ 50.641476][ T3538] bmap+0xa1/0xd0 [ 50.645612][ T3538] jbd2_journal_flush+0x5b5/0xc40 [ 50.651150][ T3538] ext4_ioctl+0x39e0/0x5f70 [ 50.656163][ T3538] __se_sys_ioctl+0xf1/0x160 [ 50.661259][ T3538] do_syscall_64+0x3d/0xb0 [ 50.666182][ T3538] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 50.672581][ T3538] [ 50.672581][ T3538] -> #1 (&journal->j_checkpoint_mutex){+.+.}-{3:3}: [ 50.681423][ T3538] lock_acquire+0x1f8/0x5a0 [ 50.686427][ T3538] __mutex_lock_common+0x1d4/0x2520 [ 50.692128][ T3538] mutex_lock_io_nested+0x43/0x60 [ 50.697656][ T3538] jbd2_journal_flush+0x29b/0xc40 [ 50.703185][ T3538] ext4_ioctl+0x39e0/0x5f70 [ 50.708189][ T3538] __se_sys_ioctl+0xf1/0x160 [ 50.713278][ T3538] do_syscall_64+0x3d/0xb0 [ 50.718208][ T3538] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 50.724603][ T3538] [ 50.724603][ T3538] -> #0 (&journal->j_barrier){+.+.}-{3:3}: [ 50.732575][ T3538] validate_chain+0x1667/0x58e0 [ 50.737929][ T3538] __lock_acquire+0x125b/0x1f80 [ 50.743278][ T3538] lock_acquire+0x1f8/0x5a0 [ 50.748281][ T3538] __mutex_lock_common+0x1d4/0x2520 [ 50.753984][ T3538] mutex_lock_nested+0x17/0x20 [ 50.759249][ T3538] jbd2_journal_lock_updates+0x2a8/0x370 [ 50.765388][ T3538] ext4_change_inode_journal_flag+0x1a8/0x6e0 [ 50.771984][ T3538] ext4_fileattr_set+0xe04/0x1770 [ 50.777507][ T3538] vfs_fileattr_set+0x8f3/0xd30 [ 50.782857][ T3538] do_vfs_ioctl+0x1cd1/0x2a90 [ 50.788031][ T3538] __se_sys_ioctl+0x81/0x160 [ 50.793123][ T3538] do_syscall_64+0x3d/0xb0 [ 50.798042][ T3538] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 50.804435][ T3538] [ 50.804435][ T3538] other info that might help us debug this: [ 50.804435][ T3538] [ 50.814640][ T3538] Chain exists of: [ 50.814640][ T3538] &journal->j_barrier --> mapping.invalidate_lock --> &sbi->s_writepages_rwsem [ 50.814640][ T3538] [ 50.829474][ T3538] Possible unsafe locking scenario: [ 50.829474][ T3538] [ 50.836916][ T3538] CPU0 CPU1 [ 50.842273][ T3538] ---- ---- [ 50.847628][ T3538] lock(&sbi->s_writepages_rwsem); [ 50.852816][ T3538] lock(mapping.invalidate_lock); [ 50.860436][ T3538] lock(&sbi->s_writepages_rwsem); [ 50.868146][ T3538] lock(&journal->j_barrier); [ 50.872904][ T3538] [ 50.872904][ T3538] *** DEADLOCK *** [ 50.872904][ T3538] [ 50.881035][ T3538] 4 locks held by syz-executor338/3538: [ 50.886646][ T3538] #0: ffff88807ee30460 (sb_writers#4){.+.+}-{0:0}, at: mnt_want_write_file+0x5a/0x1f0 [ 50.896300][ T3538] #1: ffff888070820400 (&sb->s_type->i_mutex_key#8){++++}-{3:3}, at: vfs_fileattr_set+0x135/0xd30 [ 50.906994][ T3538] #2: ffff8880708205a0 (mapping.invalidate_lock){++++}-{3:3}, at: ext4_change_inode_journal_flag+0x115/0x6e0 [ 50.918646][ T3538] #3: ffff88807ee32b98 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_change_inode_journal_flag+0x1a0/0x6e0 [ 50.930375][ T3538] [ 50.930375][ T3538] stack backtrace: [ 50.936255][ T3538] CPU: 1 PID: 3538 Comm: syz-executor338 Not tainted 6.1.35-syzkaller #0 [ 50.944651][ T3538] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 [ 50.954694][ T3538] Call Trace: [ 50.957958][ T3538] [ 50.960871][ T3538] dump_stack_lvl+0x1e3/0x2cb [ 50.965538][ T3538] ? nf_tcp_handle_invalid+0x642/0x642 [ 50.970993][ T3538] ? print_circular_bug+0x12b/0x1a0 [ 50.976198][ T3538] check_noncircular+0x2fa/0x3b0 [ 50.981128][ T3538] ? add_chain_block+0x850/0x850 [ 50.986058][ T3538] ? lockdep_lock+0x11f/0x2a0 [ 50.990738][ T3538] ? validate_chain+0x115/0x58e0 [ 50.995669][ T3538] ? _find_first_zero_bit+0xd0/0x100 [ 51.000943][ T3538] validate_chain+0x1667/0x58e0 [ 51.005792][ T3538] ? lockdep_unlock+0x165/0x300 [ 51.010630][ T3538] ? reacquire_held_locks+0x660/0x660 [ 51.015986][ T3538] ? validate_chain+0x13d1/0x58e0 [ 51.021005][ T3538] ? mark_lock+0x9a/0x340 [ 51.025326][ T3538] ? mark_lock+0x9a/0x340 [ 51.029641][ T3538] __lock_acquire+0x125b/0x1f80 [ 51.034491][ T3538] lock_acquire+0x1f8/0x5a0 [ 51.038988][ T3538] ? jbd2_journal_lock_updates+0x2a8/0x370 [ 51.044782][ T3538] ? read_lock_is_recursive+0x10/0x10 [ 51.050132][ T3538] ? __might_sleep+0xb0/0xb0 [ 51.054706][ T3538] ? lockdep_hardirqs_on_prepare+0x438/0x7a0 [ 51.060676][ T3538] ? print_irqtrace_events+0x210/0x210 [ 51.066137][ T3538] ? do_raw_spin_unlock+0x137/0x8a0 [ 51.071418][ T3538] __mutex_lock_common+0x1d4/0x2520 [ 51.076608][ T3538] ? jbd2_journal_lock_updates+0x2a8/0x370 [ 51.082413][ T3538] ? jbd2_journal_lock_updates+0x2a8/0x370 [ 51.088204][ T3538] ? jbd2_journal_lock_updates+0x297/0x370 [ 51.093995][ T3538] ? mutex_lock_io_nested+0x60/0x60 [ 51.099190][ T3538] ? do_raw_read_unlock+0x70/0x70 [ 51.104198][ T3538] ? rcu_sync_func+0xaa/0x210 [ 51.108852][ T3538] mutex_lock_nested+0x17/0x20 [ 51.113604][ T3538] jbd2_journal_lock_updates+0x2a8/0x370 [ 51.119231][ T3538] ? jbd2_journal_wait_updates+0x2d0/0x2d0 [ 51.125019][ T3538] ? rcu_is_watching+0x11/0xb0 [ 51.129773][ T3538] ? _find_next_bit+0x11b/0x120 [ 51.134620][ T3538] ? rcu_is_watching+0x11/0xb0 [ 51.139371][ T3538] ext4_change_inode_journal_flag+0x1a8/0x6e0 [ 51.145431][ T3538] ext4_fileattr_set+0xe04/0x1770 [ 51.150441][ T3538] ? ext4_fileattr_get+0x200/0x200 [ 51.155536][ T3538] ? rwsem_write_trylock+0x166/0x210 [ 51.160813][ T3538] ? bpf_lsm_capable+0x5/0x10 [ 51.165471][ T3538] ? security_capable+0x86/0xb0 [ 51.170300][ T3538] ? fscrypt_prepare_setflags+0x5d/0x220 [ 51.175915][ T3538] vfs_fileattr_set+0x8f3/0xd30 [ 51.180748][ T3538] ? copy_fsxattr_to_user+0x3a0/0x3a0 [ 51.186114][ T3538] do_vfs_ioctl+0x1cd1/0x2a90 [ 51.190795][ T3538] ? __x64_compat_sys_ioctl+0x80/0x80 [ 51.196155][ T3538] ? __lock_acquire+0x1f80/0x1f80 [ 51.201161][ T3538] ? lockdep_hardirqs_on+0x94/0x130 [ 51.206340][ T3538] ? __kmem_cache_free+0x25c/0x3c0 [ 51.211439][ T3538] ? tomoyo_path_number_perm+0x5f4/0x7b0 [ 51.217056][ T3538] ? tomoyo_path_number_perm+0x657/0x7b0 [ 51.222685][ T3538] ? print_irqtrace_events+0x210/0x210 [ 51.228134][ T3538] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 51.233583][ T3538] ? lockdep_hardirqs_on+0x94/0x130 [ 51.238780][ T3538] ? kmem_cache_free+0x292/0x510 [ 51.243720][ T3538] ? lockdep_hardirqs_on_prepare+0x438/0x7a0 [ 51.249686][ T3538] ? print_irqtrace_events+0x210/0x210 [ 51.255148][ T3538] ? print_irqtrace_events+0x210/0x210 [ 51.260604][ T3538] ? bpf_lsm_file_ioctl+0x5/0x10 [ 51.265551][ T3538] ? security_file_ioctl+0x7d/0xa0 [ 51.270672][ T3538] __se_sys_ioctl+0x81/0x160 [ 51.275255][ T3538] do_syscall_64+0x3d/0xb0 [ 51.279680][ T3538] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 51.285654][ T3538] RIP: 0033:0x7f8bf4c7e0a9 [ 51.290057][ T3538] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 51.309651][ T3538] RSP: 002b:00007ffe1244b0a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 51.318134][ T3538] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f8bf4c7e0a9 [ 51.326090][ T3538] RDX: 0000000020000140 RSI: 0000000040086