BUG: MAX_LOCK_DEPTH too low! turning off the locking correctness validator. depth: 48 max: 48! 48 locks held by syz.9.2729/15779: #0: ffff88804db52190 (&sb->s_type->i_mutex_key#35){++++}-{3:3}, at: inode_trylock include/linux/fs.h:824 [inline] #0: ffff88804db52190 (&sb->s_type->i_mutex_key#35){++++}-{3:3}, at: btrfs_inode_lock+0x8d/0xe0 fs/btrfs/inode.c:372 #1: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #2: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #3: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #4: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #5: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #6: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #7: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #8: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #9: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #10: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #11: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #12: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #13: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #14: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #15: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #16: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #17: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #18: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #19: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #20: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #21: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #22: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #23: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #24: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #25: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #26: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #27: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #28: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #29: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #30: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #31: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #32: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #33: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #34: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #35: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #36: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #37: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #38: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #39: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #40: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #41: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #42: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #43: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #44: ffff88805d3e4850 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1e/0x1f0 fs/btrfs/locking.c:152 #45: ffff88805d3e43e8 (&eb->refs_lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] #45: ffff88805d3e43e8 (&eb->refs_lock){+.+.}-{2:2}, at: free_extent_buffer+0x263/0x420 fs/btrfs/extent_io.c:3935 #46: ffff8880b8f2b718 (hrtimer_bases.lock){-.-.}-{2:2}, at: hrtimer_interrupt+0xfc/0x9c0 kernel/time/hrtimer.c:1857 #47: ffffffff8cd49988 (tk_core.seq.seqcount){----}-{0:0}, at: ktime_get_update_offsets_now+0x48/0x3f0 kernel/time/timekeeping.c:2317 INFO: lockdep is turned off. CPU: 1 PID: 15779 Comm: syz.9.2729 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 Call Trace: dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106 __lock_acquire+0x1ba4/0x7c80 kernel/locking/lockdep.c:-1 lock_acquire+0x197/0x410 kernel/locking/lockdep.c:5754 seqcount_lockdep_reader_access+0xca/0x1c0 include/linux/seqlock.h:102 ktime_get_update_offsets_now+0x48/0x3f0 kernel/time/timekeeping.c:2317 hrtimer_update_base kernel/time/hrtimer.c:661 [inline] hrtimer_interrupt+0x134/0x9c0 kernel/time/hrtimer.c:1858 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1077 [inline] __sysvec_apic_timer_interrupt+0xfb/0x3b0 arch/x86/kernel/apic/apic.c:1094 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline] sysvec_apic_timer_interrupt+0x9f/0xc0 arch/x86/kernel/apic/apic.c:1088 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687 RIP: 0010:lock_acquire+0x1f2/0x410 kernel/locking/lockdep.c:5758 Code: 00 9c 8f 84 24 80 00 00 00 f6 84 24 81 00 00 00 02 0f 85 f5 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 3c 00 00 00 00 66 43 c7 44 3c 09 00 00 43 c6 44 3c 0b 00 RSP: 0018:ffffc90004b86ec0 EFLAGS: 00000206 RAX: 0000000000000001 RBX: 0000000000000000 RCX: 20c6d7875e917000 RDX: 0000000000000001 RSI: ffffffff8aaace60 RDI: ffffffff8afc63c0 RBP: ffffc90004b86fd8 R08: dffffc0000000000 R09: 1ffffffff21b4edb R10: dffffc0000000000 R11: fffffbfff21b4edc R12: 1ffff92000970de4 R13: ffff88805d3e43e8 R14: 0000000000000246 R15: dffffc0000000000 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] free_extent_buffer+0x263/0x420 fs/btrfs/extent_io.c:3935 read_block_for_search+0x5b5/0x990 fs/btrfs/ctree.c:1708 btrfs_search_slot+0x109a/0x27e0 fs/btrfs/ctree.c:2355 btrfs_lookup_file_extent+0xd9/0x120 fs/btrfs/file-item.c:270 can_nocow_extent+0x1bb/0x810 fs/btrfs/inode.c:7093 btrfs_check_nocow_lock+0x245/0x3a0 fs/btrfs/file.c:1092 btrfs_buffered_write+0x559/0x1130 fs/btrfs/file.c:1265 btrfs_do_write_iter+0x24b/0x11b0 fs/btrfs/file.c:1689 call_write_iter include/linux/fs.h:2018 [inline] aio_write+0x53c/0x790 fs/aio.c:1593 __io_submit_one fs/aio.c:-1 [inline] io_submit_one+0x70b/0x1240 fs/aio.c:2012 __do_sys_io_submit fs/aio.c:2071 [inline] __se_sys_io_submit+0x194/0x300 fs/aio.c:2041 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fd16e58eec9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd16f3d3038 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 RAX: ffffffffffffffda RBX: 00007fd16e7e6180 RCX: 00007fd16e58eec9 RDX: 0000200000000540 RSI: 0000000000000001 RDI: 00007fd16f3f5000 RBP: 00007fd16e611f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fd16e7e6218 R14: 00007fd16e7e6180 R15: 00007ffc03fe6aa8 ---------------- Code disassembly (best guess): 0: 00 9c 8f 84 24 80 00 add %bl,0x802484(%rdi,%rcx,4) 7: 00 00 add %al,(%rax) 9: f6 84 24 81 00 00 00 testb $0x2,0x81(%rsp) 10: 02 11: 0f 85 f5 00 00 00 jne 0x10c 17: 41 f7 c6 00 02 00 00 test $0x200,%r14d 1e: 74 01 je 0x21 20: fb sti 21: 48 c7 44 24 60 0e 36 movq $0x45e0360e,0x60(%rsp) 28: e0 45 * 2a: 4b c7 04 3c 00 00 00 movq $0x0,(%r12,%r15,1) <-- trapping instruction 31: 00 32: 66 43 c7 44 3c 09 00 movw $0x0,0x9(%r12,%r15,1) 39: 00 3a: 43 c6 44 3c 0b 00 movb $0x0,0xb(%r12,%r15,1)