loop3: p4 size 3321888773 extends beyond EOD, truncated
======================================================
WARNING: possible circular locking dependency detected
4.14.307-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.2/9547 is trying to acquire lock:
 ("%s-%s""btrfs", name){+.+.}, at: [<ffffffff8135cb4b>] flush_workqueue+0xcb/0x1310 kernel/workqueue.c:2622

but task is already holding lock:
 (&fs_info->scrub_lock){+.+.}, at: [<ffffffff82b1bdb6>] btrfs_scrub_dev+0x506/0xcd0 fs/btrfs/scrub.c:4217

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #3 (&fs_info->scrub_lock){+.+.}:
       __mutex_lock_common kernel/locking/mutex.c:756 [inline]
       __mutex_lock+0xc4/0x1310 kernel/locking/mutex.c:893
       btrfs_scrub_dev+0x1f3/0xcd0 fs/btrfs/scrub.c:4150
       btrfs_ioctl_scrub fs/btrfs/ioctl.c:4451 [inline]
       btrfs_ioctl+0xba8/0x5b20 fs/btrfs/ioctl.c:5681
       vfs_ioctl fs/ioctl.c:46 [inline]
       file_ioctl fs/ioctl.c:500 [inline]
       do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684
       SYSC_ioctl fs/ioctl.c:701 [inline]
       SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
       do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
       entry_SYSCALL_64_after_hwframe+0x5e/0xd3

-> #2 (&fs_devs->device_list_mutex){+.+.}:
       __mutex_lock_common kernel/locking/mutex.c:756 [inline]
       __mutex_lock+0xc4/0x1310 kernel/locking/mutex.c:893
       __reada_start_machine fs/btrfs/reada.c:765 [inline]
       reada_start_machine_worker+0x1d2/0xa90 fs/btrfs/reada.c:746
       normal_work_helper+0x304/0x1330 fs/btrfs/async-thread.c:376
       process_one_work+0x793/0x14a0 kernel/workqueue.c:2117
       worker_thread+0x5cc/0xff0 kernel/workqueue.c:2251
       kthread+0x30d/0x420 kernel/kthread.c:232
       ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:406

-> #1 ((&work->normal_work)){+.+.}:
       process_one_work+0x736/0x14a0 kernel/workqueue.c:2093
       worker_thread+0x5cc/0xff0 kernel/workqueue.c:2251
       kthread+0x30d/0x420 kernel/kthread.c:232
       ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:406

-> #0 ("%s-%s""btrfs", name){+.+.}:
       lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
       flush_workqueue+0xfa/0x1310 kernel/workqueue.c:2625
       drain_workqueue+0x177/0x3e0 kernel/workqueue.c:2790
       destroy_workqueue+0x71/0x710 kernel/workqueue.c:4116
       __btrfs_destroy_workqueue fs/btrfs/async-thread.c:436 [inline]
       btrfs_destroy_workqueue+0xf8/0x630 fs/btrfs/async-thread.c:447
       scrub_workers_put+0x90/0x1a0 fs/btrfs/scrub.c:4075
       btrfs_scrub_dev+0x536/0xcd0 fs/btrfs/scrub.c:4219
       btrfs_ioctl_scrub fs/btrfs/ioctl.c:4451 [inline]
       btrfs_ioctl+0xba8/0x5b20 fs/btrfs/ioctl.c:5681
       vfs_ioctl fs/ioctl.c:46 [inline]
       file_ioctl fs/ioctl.c:500 [inline]
       do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684
       SYSC_ioctl fs/ioctl.c:701 [inline]
       SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
       do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
       entry_SYSCALL_64_after_hwframe+0x5e/0xd3

other info that might help us debug this:

Chain exists of:
  "%s-%s""btrfs", name --> &fs_devs->device_list_mutex --> &fs_info->scrub_lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&fs_info->scrub_lock);
                               lock(&fs_devs->device_list_mutex);
                               lock(&fs_info->scrub_lock);
  lock("%s-%s""btrfs", name);

 *** DEADLOCK ***

1 lock held by syz-executor.2/9547:
 #0:  (&fs_info->scrub_lock){+.+.}, at: [<ffffffff82b1bdb6>] btrfs_scrub_dev+0x506/0xcd0 fs/btrfs/scrub.c:4217

stack backtrace:
CPU: 0 PID: 9547 Comm: syz-executor.2 Not tainted 4.14.307-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/16/2023
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x281 lib/dump_stack.c:58
 print_circular_bug.constprop.0.cold+0x2d7/0x41e kernel/locking/lockdep.c:1258
 check_prev_add kernel/locking/lockdep.c:1905 [inline]
 check_prevs_add kernel/locking/lockdep.c:2022 [inline]
 validate_chain kernel/locking/lockdep.c:2464 [inline]
 __lock_acquire+0x2e0e/0x3f20 kernel/locking/lockdep.c:3491
 lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
 flush_workqueue+0xfa/0x1310 kernel/workqueue.c:2625
 drain_workqueue+0x177/0x3e0 kernel/workqueue.c:2790
 destroy_workqueue+0x71/0x710 kernel/workqueue.c:4116
 __btrfs_destroy_workqueue fs/btrfs/async-thread.c:436 [inline]
 btrfs_destroy_workqueue+0xf8/0x630 fs/btrfs/async-thread.c:447
 scrub_workers_put+0x90/0x1a0 fs/btrfs/scrub.c:4075
 btrfs_scrub_dev+0x536/0xcd0 fs/btrfs/scrub.c:4219
 btrfs_ioctl_scrub fs/btrfs/ioctl.c:4451 [inline]
 btrfs_ioctl+0xba8/0x5b20 fs/btrfs/ioctl.c:5681
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x5e/0xd3
RIP: 0033:0x7f85102990f9
RSP: 002b:00007f850e80b168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f85103b8f80 RCX: 00007f85102990f9
RDX: 0000000020000100 RSI: 00000000c400941b RDI: 0000000000000004
RBP: 00007f85102f4ae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd37f251ff R14: 00007f850e80b300 R15: 0000000000022000
XFS (loop0): Mounting V4 Filesystem
XFS (loop0): totally zeroed log
XFS (loop0): Ending clean mount
XFS (loop0): Quotacheck needed: Please wait.
FAT-fs (loop4): Directory bread(block 64) failed
FAT-fs (loop4): Directory bread(block 65) failed
FAT-fs (loop4): Directory bread(block 66) failed
FAT-fs (loop4): Directory bread(block 67) failed
XFS (loop0): Quotacheck: Done.
FAT-fs (loop4): Directory bread(block 68) failed
FAT-fs (loop4): Directory bread(block 69) failed
FAT-fs (loop4): Directory bread(block 70) failed
FAT-fs (loop4): Directory bread(block 71) failed
FAT-fs (loop4): Directory bread(block 72) failed
XFS (loop0): Unmounting Filesystem
attempt to access beyond end of device
FAT-fs (loop4): Directory bread(block 73) failed
loop0: rw=399361, want=65600, limit=65536
XFS (loop0): metadata I/O error: block 0x10000 ("xlog_iodone") error 5 numblks 64
XFS (loop0): xfs_do_force_shutdown(0x2) called from line 1244 of file fs/xfs/xfs_log.c.  Return address = 0xffffffff825f6d1b
XFS (loop0): Log I/O Error Detected.  Shutting down filesystem
XFS (loop0): Please umount the filesystem and rectify the problem(s)
BTRFS info (device loop2): enabling inode map caching
BTRFS info (device loop2): trying to use backup root at mount time
BTRFS info (device loop2): use zlib compression
BTRFS info (device loop2): enabling ssd optimizations
BTRFS info (device loop2): using spread ssd allocation scheme
BTRFS info (device loop2): using free space tree
BTRFS info (device loop2): has skinny extents
loop_reread_partitions: partition scan of loop3 () failed (rc=-16)
print_req_error: I/O error, dev loop3, sector 0
print_req_error: I/O error, dev loop3, sector 1025
print_req_error: I/O error, dev loop3, sector 8064
print_req_error: I/O error, dev loop3, sector 0
print_req_error: I/O error, dev loop3, sector 0
print_req_error: I/O error, dev loop3, sector 0
Buffer I/O error on dev loop3p1, logical block 0, async page read
print_req_error: I/O error, dev loop3, sector 2
Buffer I/O error on dev loop3p1, logical block 1, async page read
print_req_error: I/O error, dev loop3, sector 1025
print_req_error: I/O error, dev loop3, sector 0
Buffer I/O error on dev loop3p3, logical block 0, async page read
print_req_error: I/O error, dev loop3, sector 4
Buffer I/O error on dev loop3p3, logical block 0, async page read
Buffer I/O error on dev loop3p1, logical block 2, async page read
Buffer I/O error on dev loop3p5, logical block 0, async page read
Buffer I/O error on dev loop3p3, logical block 0, async page read
Buffer I/O error on dev loop3p3, logical block 0, async page read
Buffer I/O error on dev loop3p5, logical block 1, async page read
Buffer I/O error on dev loop3p5, logical block 2, async page read
FAT-fs (loop4): Directory bread(block 64) failed
FAT-fs (loop4): Directory bread(block 65) failed
FAT-fs (loop4): Directory bread(block 66) failed
FAT-fs (loop4): Directory bread(block 67) failed
FAT-fs (loop4): Directory bread(block 68) failed
XFS (loop0): Mounting V4 Filesystem
FAT-fs (loop4): Directory bread(block 69) failed
XFS (loop0): totally zeroed log
XFS (loop0): Ending clean mount
XFS (loop0): Quotacheck needed: Please wait.
FAT-fs (loop4): Directory bread(block 70) failed
XFS (loop0): Quotacheck: Done.
FAT-fs (loop4): Directory bread(block 71) failed
FAT-fs (loop4): Directory bread(block 72) failed
FAT-fs (loop4): Directory bread(block 73) failed
XFS (loop0): Unmounting Filesystem
attempt to access beyond end of device
loop0: rw=399361, want=65600, limit=65536
XFS (loop0): metadata I/O error: block 0x10000 ("xlog_iodone") error 5 numblks 64
XFS (loop0): xfs_do_force_shutdown(0x2) called from line 1244 of file fs/xfs/xfs_log.c.  Return address = 0xffffffff825f6d1b
XFS (loop0): Log I/O Error Detected.  Shutting down filesystem
XFS (loop0): Please umount the filesystem and rectify the problem(s)
JFS: discard option not supported on device
JFS: discard option not supported on device
BTRFS info (device loop2): enabling inode map caching
BTRFS info (device loop2): trying to use backup root at mount time
BTRFS info (device loop2): use zlib compression
BTRFS info (device loop2): enabling ssd optimizations
BTRFS info (device loop2): using spread ssd allocation scheme
BTRFS info (device loop2): using free space tree
BTRFS info (device loop2): has skinny extents
 loop3: p1 p2 < p5 p6 p7 p8 p9 p10 p11 p12 p13 p14 p15 p16 p17 p18 p19 p20 p21 p22 p23 p24 p25 p26 p27 p28 p29 p30 p31 p32 p33 p34 p35 p36 p37 p38 p39 p40 p41 p42 p43 p44 p45 p46 p47 p48 p49 p50 p51 p52 p53 p54 p55 p56 p57 p58 p59 p60 p61 p62 p63 p64 p65 p66 p67 p68 p69 p70 p71 p72 p73 p74 p75 p76 p77 p78 p79 p80 p81 p82 p83 p84 p85 p86 p87 p88 p89 p90 p91 p92 p93 p94 p95 p96 p97 p98 p99 p100 p101 p102 p103 p104 p105 p106 p107 p108 p109 p110 p111 p112 p113 p114 p115 p116 p117 p118 p119 p120 p121 p122 p123 p124 p125 p126 p127 p128 p129 p130 p131 p132 p133 p134 p135 p136 p137 p138 p139 p140 p141 p142 p143 p144 p145 p146 p147 p148 p149 p150 p151 p152 p153 p154 p155 p156 p157 p158 p159 p160 p161 p162 p163 p164 p165 p166 p167 p168 p169 p170 p171 p172 p173 p174 p175 p176 p177 p178 p179 p180 p181 p182 p183 p184 p185 p186 p187 p188 p189 p190 p191 p192 p193 p194 p195 p196 p197 p198 p199 p200 p201 p202 p203 p204 p205 p206 p207 p208 p209 p210 p211 p212 p213 p214 p215 p216 p217 p218 p21
loop3: p4 size 3321888773 extends beyond EOD, truncated
BTRFS: device fsid a8ca877d-2527-4094-ad4d-b0beeb72d11c devid 1 transid 8 /dev/loop1
BTRFS info (device loop1): using free space tree
BTRFS info (device loop1): has skinny extents
BTRFS info (device loop1): flagging fs with big metadata feature
JFS: discard option not supported on device
JFS: discard option not supported on device
BTRFS info (device loop2): enabling inode map caching
 loop3: p1 p2 < p5 p6 p7 p8 p9 p10 p11 p12 p13 p14 p15 p16 p17 p18 p19 p20 p21 p22 p23 p24 p25 p26 p27 p28 p29 p30 p31 p32 p33 p34 p35 p36 p37 p38 p39 p40 p41 p42 p43 p44 p45 p46 p47 p48 p49 p50 p51 p52 p53 p54 p55 p56 p57 p58 p59 p60 p61 p62 p63 p64 p65 p66 p67 p68 p69 p70 p71 p72 p73 p74 p75 p76 p77 p78 p79 p80 p81 p82 p83 p84 p85 p86 p87 p88 p89 p90 p91 p92 p93 p94 p95 p96 p97 p98 p99 p100 p101 p102 p103 p104 p105 p106 p107 p108 p109 p110 p111 p112 p113 p114 p115 p116 p117 p118 p119 p120 p121 p122 p123 p124 p125 p126 p127 p128 p129 p130 p131 p132 p133 p134 p135 p136 p137 p138 p139 p140 p141 p142 p143 p144 p145 p146 p147 p148 p149 p150 p151 p152 p153 p154 p155 p156 p157 p158 p159 p160 p161 p162 p163 p164 p165 p166 p167 p168 p169 p170 p171 p172 p173 p174 p175 p176 p177 p178 p179 p180 p181 p182 p183 p184 p185 p186 p187 p188 p189 p190 p191 p192 p193 p194 p195 p196 p197 p198 p199 p200 p201 p202 p203 p204 p205 p206 p207 p208 p209 p210 p211 p212 p213 p214 p215 p216 p217 p218 p21
BTRFS info (device loop2): trying to use backup root at mount time
BTRFS info (device loop2): use zlib compression
BTRFS info (device loop2): enabling ssd optimizations
XFS (loop0): Mounting V4 Filesystem
BTRFS info (device loop2): using spread ssd allocation scheme
BTRFS info (device loop2): using free space tree
XFS (loop0): Ending clean mount
BTRFS info (device loop2): has skinny extents
XFS (loop0): Quotacheck needed: Please wait.
XFS (loop0): Quotacheck: Done.
loop3: p4 size 3321888773 extends beyond EOD, truncated
XFS (loop0): Unmounting Filesystem
JFS: discard option not supported on device
JFS: discard option not supported on device
XFS (loop0): Mounting V4 Filesystem
XFS (loop0): Ending clean mount
XFS (loop0): Quotacheck needed: Please wait.
XFS (loop0): Quotacheck: Done.
JFS: discard option not supported on device
JFS: discard option not supported on device
 loop3: p1 p2 < p5 p6 p7 p8 p9 p10 p11 p12 p13 p14 p15 p16 p17 p18 p19 p20 p21 p22 p23 p24 p25 p26 p27 p28 p29 p30 p31 p32 p33 p34 p35 p36 p37 p38 p39 p40 p41 p42 p43 p44 p45 p46 p47 p48 p49 p50 p51 p52 p53 p54 p55 p56 p57 p58 p59 p60 p61 p62 p63 p64 p65 p66 p67 p68 p69 p70 p71 p72 p73 p74 p75 p76 p77 p78 p79 p80 p81 p82 p83 p84 p85 p86 p87 p88 p89 p90 p91 p92 p93 p94 p95 p96 p97 p98 p99 p100 p101 p102 p103 p104 p105 p106 p107 p108 p109 p110 p111 p112 p113 p114 p115 p116 p117 p118 p119 p120 p121 p122 p123 p124 p125 p126 p127 p128 p129 p130 p131 p132 p133 p134 p135 p136 p137 p138 p139 p140 p141 p142 p143 p144 p145 p146 p147 p148 p149 p150 p151 p152 p153 p154 p155 p156 p157 p158 p159 p160 p161 p162 p163 p164 p165 p166 p167 p168 p169 p170 p171 p172 p173 p174 p175 p176 p177 p178 p179 p180 p181 p182 p183 p184 p185 p186 p187 p188 p189 p190 p191 p192 p193 p194 p195 p196 p197 p198 p199 p200 p201 p202 p203 p204 p205 p206 p207 p208 p209 p210 p211 p212 p213 p214 p215 p216 p217 p218 p21
XFS (loop0): Unmounting Filesystem
loop3: p4 size 3321888773 extends beyond EOD, truncated
XFS (loop2): Mounting V4 Filesystem
XFS (loop2): Ending clean mount
XFS (loop2): Quotacheck needed: Please wait.
BTRFS info (device loop1): using free space tree
XFS (loop2): Quotacheck: Done.
BTRFS info (device loop1): has skinny extents
BTRFS info (device loop1): flagging fs with big metadata feature
XFS (loop2): Unmounting Filesystem
IPVS: ftp: loaded support on port[0] = 21
XFS (loop2): Mounting V4 Filesystem
audit: type=1800 audit(1677362526.764:2): pid=11848 uid=0 auid=4294967295 ses=4294967295 op="collect_data" cause="failed(directio)" comm="syz-executor.3" name="file0" dev="sda1" ino=13967 res=0
XFS (loop2): Ending clean mount
XFS (loop0): Mounting V4 Filesystem
xt_CONNSECMARK: target only valid in the 'mangle' or 'security' tables, not 'filter'.
XFS (loop0): Ending clean mount
XFS (loop0): Quotacheck needed: Please wait.
audit: type=1804 audit(1677362526.794:3): pid=11848 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor.3" name="/root/syzkaller-testdir1698979187/syzkaller.RduOuF/12/file0" dev="sda1" ino=13967 res=1
XFS (loop2): Quotacheck needed: Please wait.
XFS (loop0): Quotacheck: Done.
XFS (loop2): Quotacheck: Done.
audit: type=1804 audit(1677362526.824:4): pid=11848 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor.3" name="/root/syzkaller-testdir1698979187/syzkaller.RduOuF/12/file0" dev="sda1" ino=13967 res=1
XFS (loop2): Unmounting Filesystem
XFS (loop0): Unmounting Filesystem
BTRFS info (device loop1): using free space tree
BTRFS info (device loop1): has skinny extents
BTRFS info (device loop1): flagging fs with big metadata feature