====================================================== WARNING: possible circular locking dependency detected 6.13.0-rc3-syzkaller-g573067a5a685 #0 Not tainted ------------------------------------------------------ syz.2.334/7961 is trying to acquire lock: ffff0000cdb49030 (&lp->qli_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline] ffff0000cdb49030 (&lp->qli_lock){+.+.}-{3:3}, at: xfs_dquot_detach_buf+0x38/0x168 fs/xfs/xfs_dquot.c:83 but task is already holding lock: ffff0000d5815e30 (&l->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline] ffff0000d5815e30 (&l->lock){+.+.}-{3:3}, at: lock_list_lru_of_memcg+0x200/0x458 mm/list_lru.c:77 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (&l->lock){+.+.}-{3:3}: __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x48/0x60 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] lock_list_lru_of_memcg+0x200/0x458 mm/list_lru.c:77 list_lru_add+0x70/0x248 mm/list_lru.c:164 list_lru_add_obj+0x114/0x288 mm/list_lru.c:190 xfs_buf_rele_cached fs/xfs/xfs_buf.c:1106 [inline] xfs_buf_rele+0x33c/0x1248 fs/xfs/xfs_buf.c:1151 xfs_trans_brelse+0xf0/0x460 xfs_imap_lookup+0x268/0x5ec fs/xfs/libxfs/xfs_ialloc.c:2431 xfs_imap+0x44c/0xd84 fs/xfs/libxfs/xfs_ialloc.c:2514 xfs_iget_cache_miss fs/xfs/xfs_icache.c:644 [inline] xfs_iget+0x930/0x2d0c fs/xfs/xfs_icache.c:806 xfs_mountfs+0xed4/0x1ba8 fs/xfs/xfs_mount.c:919 xfs_fs_fill_super+0xf68/0x11c0 fs/xfs/xfs_super.c:1791 get_tree_bdev_flags+0x38c/0x494 fs/super.c:1636 get_tree_bdev+0x2c/0x3c fs/super.c:1659 xfs_fs_get_tree+0x28/0x38 fs/xfs/xfs_super.c:1838 vfs_get_tree+0x90/0x28c fs/super.c:1814 do_new_mount+0x278/0x900 fs/namespace.c:3507 path_mount+0x590/0xe04 fs/namespace.c:3834 do_mount fs/namespace.c:3847 [inline] __do_sys_mount fs/namespace.c:4057 [inline] __se_sys_mount fs/namespace.c:4034 [inline] __arm64_sys_mount+0x4d4/0x5ac fs/namespace.c:4034 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 -> #2 (&bch->bc_lock){+.+.}-{3:3}: __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x48/0x60 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] _atomic_dec_and_lock+0xd8/0x168 lib/dec_and_lock.c:28 xfs_buf_rele_cached fs/xfs/xfs_buf.c:1085 [inline] xfs_buf_rele+0xf4/0x1248 fs/xfs/xfs_buf.c:1151 xfs_trans_brelse+0xf0/0x460 xfs_imap_lookup+0x268/0x5ec fs/xfs/libxfs/xfs_ialloc.c:2431 xfs_imap+0x44c/0xd84 fs/xfs/libxfs/xfs_ialloc.c:2514 xfs_iget_cache_miss fs/xfs/xfs_icache.c:644 [inline] xfs_iget+0x930/0x2d0c fs/xfs/xfs_icache.c:806 xfs_mountfs+0xed4/0x1ba8 fs/xfs/xfs_mount.c:919 xfs_fs_fill_super+0xf68/0x11c0 fs/xfs/xfs_super.c:1791 get_tree_bdev_flags+0x38c/0x494 fs/super.c:1636 get_tree_bdev+0x2c/0x3c fs/super.c:1659 xfs_fs_get_tree+0x28/0x38 fs/xfs/xfs_super.c:1838 vfs_get_tree+0x90/0x28c fs/super.c:1814 do_new_mount+0x278/0x900 fs/namespace.c:3507 path_mount+0x590/0xe04 fs/namespace.c:3834 do_mount fs/namespace.c:3847 [inline] __do_sys_mount fs/namespace.c:4057 [inline] __se_sys_mount fs/namespace.c:4034 [inline] __arm64_sys_mount+0x4d4/0x5ac fs/namespace.c:4034 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 -> #1 (&bp->b_lock){+.+.}-{3:3}: __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x48/0x60 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] xfs_buf_rele_cached fs/xfs/xfs_buf.c:1084 [inline] xfs_buf_rele+0xe0/0x1248 fs/xfs/xfs_buf.c:1151 xfs_trans_brelse+0xf0/0x460 xfs_dquot_attach_buf+0x2a8/0x44c fs/xfs/xfs_dquot.c:1345 xfs_qm_quotacheck_dqadjust+0x118/0x628 fs/xfs/xfs_qm.c:1341 xfs_qm_dqusage_adjust+0x550/0x764 fs/xfs/xfs_qm.c:1457 xfs_iwalk_ag_recs+0x43c/0x828 fs/xfs/xfs_iwalk.c:209 xfs_iwalk_run_callbacks+0x1c0/0x3f4 fs/xfs/xfs_iwalk.c:370 xfs_iwalk_ag+0x8cc/0x9c0 fs/xfs/xfs_iwalk.c:476 xfs_iwalk_ag_work+0x10c/0x1a8 fs/xfs/xfs_iwalk.c:625 xfs_pwork_work+0x80/0x1a4 fs/xfs/xfs_pwork.c:47 process_one_work+0x7a8/0x15cc kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x97c/0xeec kernel/workqueue.c:3391 kthread+0x288/0x310 kernel/kthread.c:389 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862 -> #0 (&lp->qli_lock){+.+.}-{3:3}: check_prev_add kernel/locking/lockdep.c:3161 [inline] check_prevs_add kernel/locking/lockdep.c:3280 [inline] validate_chain kernel/locking/lockdep.c:3904 [inline] __lock_acquire+0x34f0/0x7904 kernel/locking/lockdep.c:5226 lock_acquire+0x23c/0x724 kernel/locking/lockdep.c:5849 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x48/0x60 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] xfs_dquot_detach_buf+0x38/0x168 fs/xfs/xfs_dquot.c:83 xfs_qm_dquot_isolate+0x458/0x1620 fs/xfs/xfs_qm.c:528 __list_lru_walk_one+0x144/0x450 mm/list_lru.c:301 list_lru_walk_one+0x54/0x6c mm/list_lru.c:338 list_lru_shrink_walk include/linux/list_lru.h:240 [inline] xfs_qm_shrink_scan+0x18c/0x378 fs/xfs/xfs_qm.c:574 do_shrink_slab+0x62c/0x124c mm/shrinker.c:437 shrink_slab+0xe9c/0x124c mm/shrinker.c:664 drop_slab_node mm/vmscan.c:414 [inline] drop_slab+0x124/0x26c mm/vmscan.c:432 drop_caches_sysctl_handler+0x17c/0x398 fs/drop_caches.c:68 proc_sys_call_handler+0x64c/0x918 fs/proc/proc_sysctl.c:601 proc_sys_write+0x2c/0x3c fs/proc/proc_sysctl.c:627 do_iter_readv_writev+0x490/0x6d4 vfs_writev+0x410/0xbc8 fs/read_write.c:1050 do_writev+0x178/0x304 fs/read_write.c:1096 __do_sys_writev fs/read_write.c:1164 [inline] __se_sys_writev fs/read_write.c:1161 [inline] __arm64_sys_writev+0x80/0x94 fs/read_write.c:1161 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 other info that might help us debug this: Chain exists of: &lp->qli_lock --> &bch->bc_lock --> &l->lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&l->lock); lock(&bch->bc_lock); lock(&l->lock); lock(&lp->qli_lock); *** DEADLOCK *** 4 locks held by syz.2.334/7961: #0: ffff0000d3a509b8 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x220/0x2ac fs/file.c:1191 #1: ffff0000d1a76420 (sb_writers#4){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2964 [inline] #1: ffff0000d1a76420 (sb_writers#4){.+.+}-{0:0}, at: vfs_writev+0x3a8/0xbc8 fs/read_write.c:1048 #2: ffff0000d5815e30 (&l->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline] #2: ffff0000d5815e30 (&l->lock){+.+.}-{3:3}, at: lock_list_lru_of_memcg+0x200/0x458 mm/list_lru.c:77 #3: ffff0000cdb49118 (&xfs_dquot_group_class){+.+.}-{4:4}, at: xfs_dqlock_nowait fs/xfs/xfs_dquot.h:126 [inline] #3: ffff0000cdb49118 (&xfs_dquot_group_class){+.+.}-{4:4}, at: xfs_qm_dquot_isolate+0x90/0x1620 fs/xfs/xfs_qm.c:467 stack backtrace: CPU: 0 UID: 0 PID: 7961 Comm: syz.2.334 Not tainted 6.13.0-rc3-syzkaller-g573067a5a685 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C) __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 print_circular_bug+0x154/0x1c0 kernel/locking/lockdep.c:2074 check_noncircular+0x310/0x404 kernel/locking/lockdep.c:2206 check_prev_add kernel/locking/lockdep.c:3161 [inline] check_prevs_add kernel/locking/lockdep.c:3280 [inline] validate_chain kernel/locking/lockdep.c:3904 [inline] __lock_acquire+0x34f0/0x7904 kernel/locking/lockdep.c:5226 lock_acquire+0x23c/0x724 kernel/locking/lockdep.c:5849 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x48/0x60 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] xfs_dquot_detach_buf+0x38/0x168 fs/xfs/xfs_dquot.c:83 xfs_qm_dquot_isolate+0x458/0x1620 fs/xfs/xfs_qm.c:528 __list_lru_walk_one+0x144/0x450 mm/list_lru.c:301 list_lru_walk_one+0x54/0x6c mm/list_lru.c:338 list_lru_shrink_walk include/linux/list_lru.h:240 [inline] xfs_qm_shrink_scan+0x18c/0x378 fs/xfs/xfs_qm.c:574 do_shrink_slab+0x62c/0x124c mm/shrinker.c:437 shrink_slab+0xe9c/0x124c mm/shrinker.c:664 drop_slab_node mm/vmscan.c:414 [inline] drop_slab+0x124/0x26c mm/vmscan.c:432 drop_caches_sysctl_handler+0x17c/0x398 fs/drop_caches.c:68 proc_sys_call_handler+0x64c/0x918 fs/proc/proc_sysctl.c:601 proc_sys_write+0x2c/0x3c fs/proc/proc_sysctl.c:627 do_iter_readv_writev+0x490/0x6d4 vfs_writev+0x410/0xbc8 fs/read_write.c:1050 do_writev+0x178/0x304 fs/read_write.c:1096 __do_sys_writev fs/read_write.c:1164 [inline] __se_sys_writev fs/read_write.c:1161 [inline] __arm64_sys_writev+0x80/0x94 fs/read_write.c:1161 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 syz.2.334 (7961): drop_caches: 2