ntfs: volume version 3.1. syz-executor.3 (13325): drop_caches: 1 syz-executor.3 (13325): drop_caches: 1 ====================================================== WARNING: possible circular locking dependency detected 4.19.211-syzkaller #0 Not tainted ------------------------------------------------------ kworker/u4:6/9381 is trying to acquire lock: 00000000f989d026 (&rl->lock){++++}, at: ntfs_read_block fs/ntfs/aops.c:265 [inline] 00000000f989d026 (&rl->lock){++++}, at: ntfs_readpage+0x1909/0x21b0 fs/ntfs/aops.c:452 but task is already holding lock: 00000000128d1bec (&ni->mrec_lock){+.+.}, at: map_mft_record+0x3c/0xc70 fs/ntfs/mft.c:168 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&ni->mrec_lock){+.+.}: map_mft_record+0x3c/0xc70 fs/ntfs/mft.c:168 ntfs_truncate+0x202/0x2820 fs/ntfs/inode.c:2395 ntfs_truncate_vfs fs/ntfs/inode.c:2875 [inline] ntfs_setattr+0x1b6/0x620 fs/ntfs/inode.c:2925 notify_change+0x70b/0xfc0 fs/attr.c:334 do_truncate+0x134/0x1f0 fs/open.c:63 handle_truncate fs/namei.c:3009 [inline] do_last fs/namei.c:3427 [inline] path_openat+0x2308/0x2df0 fs/namei.c:3537 do_filp_open+0x18c/0x3f0 fs/namei.c:3567 do_sys_open+0x3b3/0x520 fs/open.c:1085 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe -> #0 (&rl->lock){++++}: down_read+0x36/0x80 kernel/locking/rwsem.c:24 ntfs_read_block fs/ntfs/aops.c:265 [inline] ntfs_readpage+0x1909/0x21b0 fs/ntfs/aops.c:452 do_read_cache_page+0x533/0x1170 mm/filemap.c:2828 read_mapping_page include/linux/pagemap.h:402 [inline] ntfs_map_page fs/ntfs/aops.h:89 [inline] ntfs_sync_mft_mirror+0x24f/0x1d00 fs/ntfs/mft.c:494 write_mft_record_nolock+0x13d2/0x16c0 fs/ntfs/mft.c:801 write_mft_record fs/ntfs/mft.h:109 [inline] __ntfs_write_inode+0x609/0xe10 fs/ntfs/inode.c:3064 write_inode fs/fs-writeback.c:1244 [inline] __writeback_single_inode+0x733/0x11d0 fs/fs-writeback.c:1442 writeback_sb_inodes+0x537/0xef0 fs/fs-writeback.c:1647 wb_writeback+0x28d/0xcc0 fs/fs-writeback.c:1820 wb_do_writeback fs/fs-writeback.c:1965 [inline] wb_workfn+0x29b/0x1250 fs/fs-writeback.c:2006 process_one_work+0x864/0x1570 kernel/workqueue.c:2153 worker_thread+0x64c/0x1130 kernel/workqueue.c:2296 kthread+0x33f/0x460 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&ni->mrec_lock); lock(&rl->lock); lock(&ni->mrec_lock); lock(&rl->lock); *** DEADLOCK *** 3 locks held by kworker/u4:6/9381: #0: 00000000425c90b0 ((wq_completion)"writeback"){+.+.}, at: process_one_work+0x767/0x1570 kernel/workqueue.c:2124 #1: 00000000500aa3d0 ((work_completion)(&(&wb->dwork)->work)){+.+.}, at: process_one_work+0x79c/0x1570 kernel/workqueue.c:2128 #2: 00000000128d1bec (&ni->mrec_lock){+.+.}, at: map_mft_record+0x3c/0xc70 fs/ntfs/mft.c:168 stack backtrace: CPU: 0 PID: 9381 Comm: kworker/u4:6 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: writeback wb_workfn (flush-7:2) Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 print_circular_bug.constprop.0.cold+0x2d7/0x41e kernel/locking/lockdep.c:1222 check_prev_add kernel/locking/lockdep.c:1866 [inline] check_prevs_add kernel/locking/lockdep.c:1979 [inline] validate_chain kernel/locking/lockdep.c:2420 [inline] __lock_acquire+0x30c9/0x3ff0 kernel/locking/lockdep.c:3416 lock_acquire+0x170/0x3c0 kernel/locking/lockdep.c:3908 down_read+0x36/0x80 kernel/locking/rwsem.c:24 ntfs_read_block fs/ntfs/aops.c:265 [inline] ntfs_readpage+0x1909/0x21b0 fs/ntfs/aops.c:452 do_read_cache_page+0x533/0x1170 mm/filemap.c:2828 read_mapping_page include/linux/pagemap.h:402 [inline] ntfs_map_page fs/ntfs/aops.h:89 [inline] ntfs_sync_mft_mirror+0x24f/0x1d00 fs/ntfs/mft.c:494 write_mft_record_nolock+0x13d2/0x16c0 fs/ntfs/mft.c:801 write_mft_record fs/ntfs/mft.h:109 [inline] __ntfs_write_inode+0x609/0xe10 fs/ntfs/inode.c:3064 write_inode fs/fs-writeback.c:1244 [inline] __writeback_single_inode+0x733/0x11d0 fs/fs-writeback.c:1442 writeback_sb_inodes+0x537/0xef0 fs/fs-writeback.c:1647 wb_writeback+0x28d/0xcc0 fs/fs-writeback.c:1820 wb_do_writeback fs/fs-writeback.c:1965 [inline] wb_workfn+0x29b/0x1250 fs/fs-writeback.c:2006 process_one_work+0x864/0x1570 kernel/workqueue.c:2153 worker_thread+0x64c/0x1130 kernel/workqueue.c:2296 kthread+0x33f/0x460 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 IPVS: ftp: loaded support on port[0] = 21 batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state device veth1_macvtap left promiscuous mode device veth0_macvtap left promiscuous mode device veth1_vlan left promiscuous mode device veth0_vlan left promiscuous mode device hsr_slave_1 left promiscuous mode device hsr_slave_0 left promiscuous mode Bluetooth: hci2: command 0x0409 tx timeout team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed bond0 (unregistering): Releasing backup interface bond_slave_1 bond0 (unregistering): Releasing backup interface bond_slave_0 bond0 (unregistering): Released all slaves chnl_net:caif_netlink_parms(): no params data found IPVS: ftp: loaded support on port[0] = 21 bridge0: port 1(bridge_slave_0) entered blocking state bridge0: port 1(bridge_slave_0) entered disabled state device bridge_slave_0 entered promiscuous mode bridge0: port 2(bridge_slave_1) entered blocking state bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_1 entered promiscuous mode bond0: Enslaving bond_slave_0 as an active interface with an up link bond0: Enslaving bond_slave_1 as an active interface with an up link IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready team0: Port device team_slave_0 added IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready team0: Port device team_slave_1 added batman_adv: batadv0: Adding interface: batadv_slave_0 batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active batman_adv: batadv0: Adding interface: batadv_slave_1 batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready device hsr_slave_0 entered promiscuous mode device hsr_slave_1 entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready bridge0: port 2(bridge_slave_1) entered blocking state bridge0: port 2(bridge_slave_1) entered forwarding state bridge0: port 1(bridge_slave_0) entered blocking state bridge0: port 1(bridge_slave_0) entered forwarding state IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready 8021q: adding VLAN 0 to HW filter on device bond0 IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready bridge0: port 1(bridge_slave_0) entered disabled state bridge0: port 2(bridge_slave_1) entered disabled state IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready 8021q: adding VLAN 0 to HW filter on device team0 IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready bridge0: port 1(bridge_slave_0) entered blocking state bridge0: port 1(bridge_slave_0) entered forwarding state IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready bridge0: port 2(bridge_slave_1) entered blocking state bridge0: port 2(bridge_slave_1) entered forwarding state IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 8021q: adding VLAN 0 to HW filter on device batadv0 IPv6: ADDRCONF(NETDEV_UP): veth0_virt_wifi: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready IPv6: ADDRCONF(NETDEV_UP): veth0_vlan: link is not ready IPv6: ADDRCONF(NETDEV_UP): vlan0: link is not ready IPv6: ADDRCONF(NETDEV_UP): vlan1: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready device veth0_vlan entered promiscuous mode device veth1_vlan entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): veth0_macvtap: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1_macvtap: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready device veth0_macvtap entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): macvtap0: link is not ready device veth1_macvtap entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): macsec0: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth0_to_batadv: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! IPv6: ADDRCONF(NETDEV_UP): batadv_slave_0: link is not ready batman_adv: batadv0: Interface activated: batadv_slave_0 IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready batman_adv: batadv0: Interface activated: batadv_slave_1 IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready ieee80211 phy23: Selected rate control algorithm 'minstrel_ht' IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 ieee80211 phy24: Selected rate control algorithm 'minstrel_ht' wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready audit: type=1326 audit(1671975775.288:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=13769 comm="syz-executor.4" exe="/root/syz-executor.4" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe0617270a9 code=0x7ffc0000 IPVS: ftp: loaded support on port[0] = 21 netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. overlayfs: unrecognized mount option "lowerd¢´†ir=./fiàªÒfWî('le0" or missing value netlink: 39927 bytes leftover after parsing attributes in process `syz-executor.0'. audit: type=1326 audit(1671975775.318:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=13769 comm="syz-executor.4" exe="/root/syz-executor.4" sig=0 arch=c000003e syscall=298 compat=0 ip=0x7fe0617270a9 code=0x7ffc0000 audit: type=1326 audit(1671975775.318:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=13769 comm="syz-executor.4" exe="/root/syz-executor.4" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe0617270a9 code=0x7ffc0000 audit: type=1326 audit(1671975775.318:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=13769 comm="syz-executor.4" exe="/root/syz-executor.4" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fe061728727 code=0x7ffc0000 audit: type=1326 audit(1671975775.318:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=13769 comm="syz-executor.4" exe="/root/syz-executor.4" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7fe0616d90dc code=0x7ffc0000 ntfs: volume version 3.1. audit: type=1326 audit(1671975775.328:30): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=13769 comm="syz-executor.4" exe="/root/syz-executor.4" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7fe0616d9014 code=0x7ffc0000 audit: type=1326 audit(1671975775.328:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=13769 comm="syz-executor.4" exe="/root/syz-executor.4" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7fe0616d9014 code=0x7ffc0000 audit: type=1326 audit(1671975775.328:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=13769 comm="syz-executor.4" exe="/root/syz-executor.4" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fe061728727 code=0x7ffc0000 xt_hashlimit: overflow, try lower: 17592186044416/4294967303 Bluetooth: hci2: command 0x041b tx timeout audit: type=1326 audit(1671975775.328:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=13769 comm="syz-executor.4" exe="/root/syz-executor.4" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe061726e97 code=0x7ffc0000 netlink: 39927 bytes leftover after parsing attributes in process `syz-executor.0'. audit: type=1326 audit(1671975775.328:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=13769 comm="syz-executor.4" exe="/root/syz-executor.4" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7fe061726a77 code=0x7ffc0000 ntfs: volume version 3.1. netlink: 39927 bytes leftover after parsing attributes in process `syz-executor.1'. xt_hashlimit: overflow, try lower: 17592186044416/4294967303 netlink: 39927 bytes leftover after parsing attributes in process `syz-executor.0'. xt_hashlimit: overflow, try lower: 17592186044416/4294967303 xt_hashlimit: overflow, try lower: 17592186044416/4294967303 xt_hashlimit: overflow, try lower: 17592186044416/4294967303 xt_hashlimit: overflow, try lower: 17592186044416/4294967303 FS-Cache: Duplicate cookie detected FS-Cache: O-cookie c=000000008d3261d5 [p=0000000078918943 fl=222 nc=0 na=1] FS-Cache: O-cookie d=00000000dd190fa8 n=00000000a29b7948 FS-Cache: O-key=[10] '34323934393737393439' FS-Cache: N-cookie c=00000000d270d932 [p=0000000078918943 fl=2 nc=0 na=1] FS-Cache: N-cookie d=00000000dd190fa8 n=00000000e08702e8 FS-Cache: N-key=[10] '34323934393737393439' xt_hashlimit: overflow, try lower: 17592186044416/4294967303 xt_hashlimit: overflow, try lower: 17592186044416/4294967303 xt_hashlimit: overflow, try lower: 17592186044416/4294967303 Bluetooth: hci2: command 0x040f tx timeout xt_hashlimit: overflow, try lower: 17592186044416/4294967303 Bluetooth: hci2: command 0x0419 tx timeout kauditd_printk_skb: 507 callbacks suppressed audit: type=1326 audit(1671975780.338:542): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=14273 comm="syz-executor.3" exe="/root/syz-executor.3" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa99fa010a9 code=0x7ffc0000 audit: type=1326 audit(1671975780.448:543): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=14327 comm="syz-executor.3" exe="/root/syz-executor.3" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa99fa010a9 code=0x7ffc0000