syz-executor.3 (1770): drop_caches: 1 ====================================================== WARNING: possible circular locking dependency detected 4.19.211-syzkaller #0 Not tainted ------------------------------------------------------ syz-executor.5/8117 is trying to acquire lock: 00000000e9b74897 (&rl->lock){++++}, at: ntfs_read_block fs/ntfs/aops.c:265 [inline] 00000000e9b74897 (&rl->lock){++++}, at: ntfs_readpage+0x1909/0x21b0 fs/ntfs/aops.c:452 but task is already holding lock: 000000004d3fcdb8 (&ni->mrec_lock){+.+.}, at: map_mft_record+0x3c/0xc70 fs/ntfs/mft.c:168 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&ni->mrec_lock){+.+.}: bridge0: port 3(team0) entered blocking state map_mft_record+0x3c/0xc70 fs/ntfs/mft.c:168 ntfs_truncate+0x202/0x2820 fs/ntfs/inode.c:2395 ntfs_truncate_vfs fs/ntfs/inode.c:2875 [inline] ntfs_setattr+0x1b6/0x620 fs/ntfs/inode.c:2925 notify_change+0x70b/0xfc0 fs/attr.c:334 do_truncate+0x134/0x1f0 fs/open.c:63 vfs_truncate+0x54b/0x6d0 fs/open.c:109 do_sys_truncate fs/open.c:132 [inline] do_sys_truncate+0x145/0x170 fs/open.c:120 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe -> #0 (&rl->lock){++++}: down_read+0x36/0x80 kernel/locking/rwsem.c:24 ntfs_read_block fs/ntfs/aops.c:265 [inline] ntfs_readpage+0x1909/0x21b0 fs/ntfs/aops.c:452 bridge0: port 3(team0) entered disabled state do_read_cache_page+0x533/0x1170 mm/filemap.c:2828 read_mapping_page include/linux/pagemap.h:402 [inline] ntfs_map_page fs/ntfs/aops.h:89 [inline] ntfs_sync_mft_mirror+0x24f/0x1d00 fs/ntfs/mft.c:494 write_mft_record_nolock+0x13f1/0x16c0 fs/ntfs/mft.c:819 write_mft_record fs/ntfs/mft.h:109 [inline] __ntfs_write_inode+0x609/0xe10 fs/ntfs/inode.c:3064 ntfs_commit_inode fs/ntfs/inode.h:315 [inline] ntfs_put_super+0x1325/0x16f0 fs/ntfs/super.c:2320 generic_shutdown_super+0x144/0x370 fs/super.c:456 kill_block_super+0x97/0xf0 fs/super.c:1185 deactivate_locked_super+0x94/0x160 fs/super.c:329 deactivate_super+0x174/0x1a0 fs/super.c:360 cleanup_mnt+0x1a8/0x290 fs/namespace.c:1098 task_work_run+0x148/0x1c0 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:193 [inline] exit_to_usermode_loop+0x251/0x2a0 arch/x86/entry/common.c:167 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- device team0 entered promiscuous mode lock(&ni->mrec_lock); lock(&rl->lock); lock(&ni->mrec_lock); lock(&rl->lock); *** DEADLOCK *** 2 locks held by syz-executor.5/8117: #0: 000000003504232a (&type->s_umount_key#83){++++}, at: deactivate_super+0x16c/0x1a0 fs/super.c:359 #1: 000000004d3fcdb8 (&ni->mrec_lock){+.+.}, at: map_mft_record+0x3c/0xc70 fs/ntfs/mft.c:168 stack backtrace: CPU: 1 PID: 8117 Comm: syz-executor.5 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022 device team_slave_0 entered promiscuous mode Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 print_circular_bug.constprop.0.cold+0x2d7/0x41e kernel/locking/lockdep.c:1222 check_prev_add kernel/locking/lockdep.c:1866 [inline] check_prevs_add kernel/locking/lockdep.c:1979 [inline] validate_chain kernel/locking/lockdep.c:2420 [inline] __lock_acquire+0x30c9/0x3ff0 kernel/locking/lockdep.c:3416 device team_slave_1 entered promiscuous mode lock_acquire+0x170/0x3c0 kernel/locking/lockdep.c:3908 down_read+0x36/0x80 kernel/locking/rwsem.c:24 ntfs_read_block fs/ntfs/aops.c:265 [inline] ntfs_readpage+0x1909/0x21b0 fs/ntfs/aops.c:452 do_read_cache_page+0x533/0x1170 mm/filemap.c:2828 read_mapping_page include/linux/pagemap.h:402 [inline] ntfs_map_page fs/ntfs/aops.h:89 [inline] ntfs_sync_mft_mirror+0x24f/0x1d00 fs/ntfs/mft.c:494 write_mft_record_nolock+0x13f1/0x16c0 fs/ntfs/mft.c:819 write_mft_record fs/ntfs/mft.h:109 [inline] __ntfs_write_inode+0x609/0xe10 fs/ntfs/inode.c:3064 ntfs_commit_inode fs/ntfs/inode.h:315 [inline] ntfs_put_super+0x1325/0x16f0 fs/ntfs/super.c:2320 generic_shutdown_super+0x144/0x370 fs/super.c:456 kill_block_super+0x97/0xf0 fs/super.c:1185 deactivate_locked_super+0x94/0x160 fs/super.c:329 deactivate_super+0x174/0x1a0 fs/super.c:360 cleanup_mnt+0x1a8/0x290 fs/namespace.c:1098 task_work_run+0x148/0x1c0 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:193 [inline] exit_to_usermode_loop+0x251/0x2a0 arch/x86/entry/common.c:167 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7fdd46ac3a17 Code: ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd9158eee8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fdd46ac3a17 RDX: 00007ffd9158efbc RSI: 000000000000000a RDI: 00007ffd9158efb0 RBP: 00007ffd9158efb0 R08: 00000000ffffffff R09: 00007ffd9158ed80 R10: 0000555556a55903 R11: 0000000000000246 R12: 00007fdd46b1c826 R13: 00007ffd91590070 R14: 0000555556a55810 R15: 00007ffd915900b0 syz-executor.3 (1770): drop_caches: 1 netlink: 'syz-executor.4': attribute type 10 has an invalid length. device team0 left promiscuous mode device team_slave_0 left promiscuous mode device team_slave_1 left promiscuous mode bridge0: port 3(team0) entered disabled state 8021q: adding VLAN 0 to HW filter on device team0 audit: type=1800 audit(1667488200.688:345): pid=1825 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="file0" dev="sda1" ino=13995 res=0 bond0: Enslaving team0 as an active interface with an up link netlink: 'syz-executor.4': attribute type 10 has an invalid length. bond0: Releasing backup interface team0 syz-executor.3 (1825): drop_caches: 1 syz-executor.3 (1825): drop_caches: 1 bridge0: port 3(team0) entered blocking state bridge0: port 3(team0) entered disabled state device team0 entered promiscuous mode device team_slave_0 entered promiscuous mode device team_slave_1 entered promiscuous mode IPVS: sync thread started: state = MASTER, mcast_ifn = veth0_macvtap, syncid = 1, id = 0 IPVS: sync thread started: state = MASTER, mcast_ifn = veth0_macvtap, syncid = 1, id = 0 IPVS: sync thread started: state = MASTER, mcast_ifn = veth0_macvtap, syncid = 1, id = 0 IPVS: set_ctl: invalid protocol: 0 172.20.20.187:0 IPVS: set_ctl: invalid protocol: 0 172.20.20.187:0 IPVS: set_ctl: invalid protocol: 0 172.20.20.187:0