bcachefs (loop0): check_subvols... done bcachefs (loop0): check_subvol_children... done bcachefs (loop0): delete_dead_snapshots... done bcachefs (loop0): check_inodes... done bcachefs (loop0): check_extents... done bcachefs (loop0): check_indirect_extents... done bcachefs (loop0): check_dirents... directory 4096:4294967295 with wrong i_size: got 0, should be 352, fixing done bcachefs (loop0): check_xattrs... done bcachefs (loop0): check_root... done bcachefs (loop0): check_unreachable_inodes... done bcachefs (loop0): check_subvolume_structure... done bcachefs (loop0): check_directory_structure... done bcachefs (loop0): check_nlinks... inode 536870914 type reg has wrong i_nlink (2780562353, should be 1), fixing done bcachefs (loop0): resume_logged_ops... done bcachefs (loop0): delete_dead_inodes... done bcachefs (loop0): set_fs_needs_rebalance... done bcachefs (loop0): Fixed errors, running fsck a second time to verify fs is clean bcachefs (loop0): check_alloc_info... done bcachefs (loop0): check_lrus... done bcachefs (loop0): check_btree_backpointers... done bcachefs (loop0): check_backpointers_to_extents... done bcachefs (loop0): check_extents_to_backpointers... bcachefs (loop0): scanning for missing backpointers in 1/128 buckets done bcachefs (loop0): check_alloc_to_lru_refs... done bcachefs (loop0): bucket_gens_init... done bcachefs (loop0): check_snapshot_trees... done bcachefs (loop0): check_snapshots... done bcachefs (loop0): check_subvols... done bcachefs (loop0): check_subvol_children... done bcachefs (loop0): delete_dead_snapshots... done bcachefs (loop0): check_inodes... done bcachefs (loop0): check_extents... done bcachefs (loop0): check_indirect_extents... done bcachefs (loop0): check_dirents... done bcachefs (loop0): check_xattrs... done bcachefs (loop0): check_root... done bcachefs (loop0): check_unreachable_inodes... done bcachefs (loop0): check_subvolume_structure... done bcachefs (loop0): check_directory_structure... done bcachefs (loop0): check_nlinks... done bcachefs (loop0): resume_logged_ops... done bcachefs (loop0): delete_dead_inodes... done bcachefs (loop0): set_fs_needs_rebalance... done bcachefs (loop0): done starting filesystem ====================================================== WARNING: possible circular locking dependency detected 6.14.0-rc3-syzkaller-00213-g8a61cb6e150e #0 Not tainted ------------------------------------------------------ syz.0.0/5323 is trying to acquire lock: ffff888053401c68 (&bc->lock){+.+.}-{4:4}, at: bch2_btree_cache_scan+0x184/0xec0 fs/bcachefs/btree_cache.c:482 but task is already holding lock: ffffffff8ec3a200 (fs_reclaim){+.+.}-{0:0}, at: __perform_reclaim mm/page_alloc.c:3926 [inline] ffffffff8ec3a200 (fs_reclaim){+.+.}-{0:0}, at: __alloc_pages_direct_reclaim+0xd4/0x3c0 mm/page_alloc.c:3951 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (fs_reclaim){+.+.}-{0:0}: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851 __fs_reclaim_acquire mm/page_alloc.c:3853 [inline] fs_reclaim_acquire+0x88/0x130 mm/page_alloc.c:3867 might_alloc include/linux/sched/mm.h:318 [inline] slab_pre_alloc_hook mm/slub.c:4066 [inline] slab_alloc_node mm/slub.c:4144 [inline] __do_kmalloc_node mm/slub.c:4293 [inline] __kmalloc_noprof+0xae/0x4c0 mm/slub.c:4306 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1037 [inline] pcpu_mem_zalloc mm/percpu.c:510 [inline] pcpu_alloc_chunk mm/percpu.c:1430 [inline] pcpu_create_chunk+0x57/0xbc0 mm/percpu-vm.c:338 pcpu_balance_populated mm/percpu.c:2063 [inline] pcpu_balance_workfn+0xc4d/0xd40 mm/percpu.c:2200 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xabe/0x18e0 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x7a9/0x920 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 -> #1 (pcpu_alloc_mutex){+.+.}-{4:4}: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851 __mutex_lock_common kernel/locking/mutex.c:585 [inline] __mutex_lock+0x19c/0x1010 kernel/locking/mutex.c:730 pcpu_alloc_noprof+0x293/0x1760 mm/percpu.c:1782 __six_lock_init+0x104/0x150 fs/bcachefs/six.c:876 bch2_btree_lock_init+0x38/0x100 fs/bcachefs/btree_locking.c:12 bch2_btree_node_mem_alloc+0x5b7/0x1780 fs/bcachefs/btree_cache.c:807 __bch2_btree_node_alloc fs/bcachefs/btree_update_interior.c:304 [inline] bch2_btree_reserve_get+0x308/0x19a0 fs/bcachefs/btree_update_interior.c:532 bch2_btree_update_start+0xe92/0x1540 fs/bcachefs/btree_update_interior.c:1232 bch2_btree_split_leaf+0x121/0x880 fs/bcachefs/btree_update_interior.c:1853 bch2_trans_commit_error+0x212/0x1380 fs/bcachefs/btree_trans_commit.c:908 __bch2_trans_commit+0x8105/0x9790 fs/bcachefs/btree_trans_commit.c:1089 bch2_trans_commit fs/bcachefs/btree_update.h:183 [inline] bch2_journal_replay+0x1ab1/0x2b10 fs/bcachefs/recovery.c:373 bch2_run_recovery_pass+0xf0/0x1e0 fs/bcachefs/recovery_passes.c:226 bch2_run_recovery_passes+0x2ad/0xa90 fs/bcachefs/recovery_passes.c:291 bch2_fs_recovery+0x265a/0x3de0 fs/bcachefs/recovery.c:936 bch2_fs_start+0x37c/0x610 fs/bcachefs/super.c:1041 bch2_fs_get_tree+0xdb7/0x17a0 fs/bcachefs/fs.c:2203 vfs_get_tree+0x90/0x2b0 fs/super.c:1814 do_new_mount+0x2be/0xb40 fs/namespace.c:3560 do_mount fs/namespace.c:3900 [inline] __do_sys_mount fs/namespace.c:4111 [inline] __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4088 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (&bc->lock){+.+.}-{4:4}: check_prev_add kernel/locking/lockdep.c:3163 [inline] check_prevs_add kernel/locking/lockdep.c:3282 [inline] validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3906 __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5228 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851 __mutex_lock_common kernel/locking/mutex.c:585 [inline] __mutex_lock+0x19c/0x1010 kernel/locking/mutex.c:730 bch2_btree_cache_scan+0x184/0xec0 fs/bcachefs/btree_cache.c:482 do_shrink_slab+0x72d/0x1160 mm/shrinker.c:437 shrink_slab+0x1093/0x14d0 mm/shrinker.c:664 shrink_one+0x43b/0x850 mm/vmscan.c:4868 shrink_many mm/vmscan.c:4929 [inline] lru_gen_shrink_node mm/vmscan.c:5007 [inline] shrink_node+0x379b/0x3e20 mm/vmscan.c:5978 shrink_zones mm/vmscan.c:6237 [inline] do_try_to_free_pages+0x78c/0x1cf0 mm/vmscan.c:6299 try_to_free_pages+0x47c/0x1050 mm/vmscan.c:6549 __perform_reclaim mm/page_alloc.c:3929 [inline] __alloc_pages_direct_reclaim+0x178/0x3c0 mm/page_alloc.c:3951 __alloc_pages_slowpath+0x811/0x10b0 mm/page_alloc.c:4382 __alloc_frozen_pages_noprof+0x49b/0x710 mm/page_alloc.c:4752 alloc_pages_mpol+0x311/0x660 mm/mempolicy.c:2270 folio_alloc_mpol_noprof+0x36/0x70 mm/mempolicy.c:2289 shmem_alloc_folio mm/shmem.c:1863 [inline] shmem_alloc_and_add_folio+0x4a0/0x1090 mm/shmem.c:1902 shmem_get_folio_gfp+0x621/0x1840 mm/shmem.c:2522 shmem_fault+0x220/0x5b0 mm/shmem.c:2723 __do_fault+0x135/0x390 mm/memory.c:4988 do_read_fault mm/memory.c:5403 [inline] do_fault mm/memory.c:5537 [inline] do_pte_missing mm/memory.c:4058 [inline] handle_pte_fault mm/memory.c:5900 [inline] __handle_mm_fault+0x4c44/0x70f0 mm/memory.c:6043 handle_mm_fault+0x3e5/0x8d0 mm/memory.c:6212 faultin_page mm/gup.c:1196 [inline] __get_user_pages+0x1a92/0x4140 mm/gup.c:1491 populate_vma_page_range+0x264/0x330 mm/gup.c:1929 __mm_populate+0x27a/0x460 mm/gup.c:2032 mm_populate include/linux/mm.h:3386 [inline] vm_mmap_pgoff+0x303/0x430 mm/util.c:580 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Chain exists of: &bc->lock --> pcpu_alloc_mutex --> fs_reclaim Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(fs_reclaim); lock(pcpu_alloc_mutex); lock(fs_reclaim); lock(&bc->lock); *** DEADLOCK *** 2 locks held by syz.0.0/5323: #0: ffff8880124151e0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:190 [inline] #0: ffff8880124151e0 (&mm->mmap_lock){++++}-{4:4}, at: __mm_populate+0x1b0/0x460 mm/gup.c:2011 #1: ffffffff8ec3a200 (fs_reclaim){+.+.}-{0:0}, at: __perform_reclaim mm/page_alloc.c:3926 [inline] #1: ffffffff8ec3a200 (fs_reclaim){+.+.}-{0:0}, at: __alloc_pages_direct_reclaim+0xd4/0x3c0 mm/page_alloc.c:3951 stack backtrace: CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted 6.14.0-rc3-syzkaller-00213-g8a61cb6e150e #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2076 check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2208 check_prev_add kernel/locking/lockdep.c:3163 [inline] check_prevs_add kernel/locking/lockdep.c:3282 [inline] validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3906 __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5228 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851 __mutex_lock_common kernel/locking/mutex.c:585 [inline] __mutex_lock+0x19c/0x1010 kernel/locking/mutex.c:730 bch2_btree_cache_scan+0x184/0xec0 fs/bcachefs/btree_cache.c:482 do_shrink_slab+0x72d/0x1160 mm/shrinker.c:437 shrink_slab+0x1093/0x14d0 mm/shrinker.c:664 shrink_one+0x43b/0x850 mm/vmscan.c:4868 shrink_many mm/vmscan.c:4929 [inline] lru_gen_shrink_node mm/vmscan.c:5007 [inline] shrink_node+0x379b/0x3e20 mm/vmscan.c:5978 shrink_zones mm/vmscan.c:6237 [inline] do_try_to_free_pages+0x78c/0x1cf0 mm/vmscan.c:6299 try_to_free_pages+0x47c/0x1050 mm/vmscan.c:6549 __perform_reclaim mm/page_alloc.c:3929 [inline] __alloc_pages_direct_reclaim+0x178/0x3c0 mm/page_alloc.c:3951 __alloc_pages_slowpath+0x811/0x10b0 mm/page_alloc.c:4382 __alloc_frozen_pages_noprof+0x49b/0x710 mm/page_alloc.c:4752 alloc_pages_mpol+0x311/0x660 mm/mempolicy.c:2270 folio_alloc_mpol_noprof+0x36/0x70 mm/mempolicy.c:2289 shmem_alloc_folio mm/shmem.c:1863 [inline] shmem_alloc_and_add_folio+0x4a0/0x1090 mm/shmem.c:1902 shmem_get_folio_gfp+0x621/0x1840 mm/shmem.c:2522 shmem_fault+0x220/0x5b0 mm/shmem.c:2723 __do_fault+0x135/0x390 mm/memory.c:4988 do_read_fault mm/memory.c:5403 [inline] do_fault mm/memory.c:5537 [inline] do_pte_missing mm/memory.c:4058 [inline] handle_pte_fault mm/memory.c:5900 [inline] __handle_mm_fault+0x4c44/0x70f0 mm/memory.c:6043 handle_mm_fault+0x3e5/0x8d0 mm/memory.c:6212 faultin_page mm/gup.c:1196 [inline] __get_user_pages+0x1a92/0x4140 mm/gup.c:1491 populate_vma_page_range+0x264/0x330 mm/gup.c:1929 __mm_populate+0x27a/0x460 mm/gup.c:2032 mm_populate include/linux/mm.h:3386 [inline] vm_mmap_pgoff+0x303/0x430 mm/util.c:580 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fca3e38d169 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fca3f1d8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 RAX: ffffffffffffffda RBX: 00007fca3e5a5fa0 RCX: 00007fca3e38d169 RDX: b635773f06ebbeee RSI: 0000000000b36000 RDI: 0000400000000000 RBP: 00007fca3e40e2a0 R08: ffffffffffffffff R09: 0000000000000000 R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fca3e5a5fa0 R15: 00007ffcdcf1a118 syz.0.0 (5323) used greatest stack depth: 8464 bytes left