EXT4-fs error (device loop1) in ext4_do_update_inode:5397: error 27
EXT4-fs error (device loop1): ext4_xattr_delete_inode:2952: inode #15: comm syz-executor.1: mark inode dirty (error -27)
EXT4-fs warning (device loop1): ext4_evict_inode:318: xattr delete (err -27)
EXT4-fs (loop1): mounted filesystem without journal. Opts: acl,grpquota,,errors=continue
INFO: task syz-executor.2:25200 blocked for more than 140 seconds.
      Not tainted 4.19.211-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.2  D26136 25200  29800 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2828 [inline]
 __schedule+0x887/0x2040 kernel/sched/core.c:3517
 schedule+0x8d/0x1b0 kernel/sched/core.c:3561
 xlog_grant_head_wait+0x13b/0xcd0 fs/xfs/xfs_log.c:263
 xlog_grant_head_check+0x3c8/0x420 fs/xfs/xfs_log.c:325
 xfs_log_reserve+0x347/0xa70 fs/xfs/xfs_log.c:454
 xfs_trans_reserve+0x63a/0x9c0 fs/xfs/xfs_trans.c:197
 xfs_trans_alloc+0x2f7/0x700 fs/xfs/xfs_trans.c:289
 xlog_finish_defer_ops fs/xfs/xfs_log_recover.c:4841 [inline]
 xlog_recover_process_intents+0x274/0x430 fs/xfs/xfs_log_recover.c:4947
 xlog_recover_finish+0x5f/0x230 fs/xfs/xfs_log_recover.c:5839
 xfs_log_mount_finish+0x135/0x450 fs/xfs/xfs_log.c:778
 xfs_mountfs+0x1032/0x1bf0 fs/xfs/xfs_mount.c:974
 xfs_fs_fill_super+0xd0e/0x1540 fs/xfs/xfs_super.c:1720
 mount_bdev+0x2fc/0x3b0 fs/super.c:1158
 mount_fs+0xa3/0x310 fs/super.c:1261
 vfs_kern_mount.part.0+0x68/0x470 fs/namespace.c:961
 vfs_kern_mount fs/namespace.c:951 [inline]
 do_new_mount fs/namespace.c:2492 [inline]
 do_mount+0x115c/0x2f50 fs/namespace.c:2822
 ksys_mount+0xcf/0x130 fs/namespace.c:3038
 __do_sys_mount fs/namespace.c:3052 [inline]
 __se_sys_mount fs/namespace.c:3049 [inline]
 __x64_sys_mount+0xba/0x150 fs/namespace.c:3049
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f2863c6d62a
Code: Bad RIP value.
RSP: 002b:00007f28621ddf88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 000000000000bb10 RCX: 00007f2863c6d62a
RDX: 0000000020000000 RSI: 000000002000bb40 RDI: 00007f28621ddfe0
RBP: 00007f28621de020 R08: 00007f28621de020 R09: 00000000008000c1
R10: 00000000008000c1 R11: 0000000000000202 R12: 0000000020000000
R13: 000000002000bb40 R14: 00007f28621ddfe0 R15: 00000000200005c0

Showing all locks held in the system:
1 lock held by khungtaskd/1572:
 #0: 000000004b21a321 (rcu_read_lock){....}, at: debug_show_all_locks+0x53/0x265 kernel/locking/lockdep.c:4441
1 lock held by systemd-udevd/4697:
1 lock held by in:imklog/7848:
 #0: 000000007c78a70b (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x26f/0x310 fs/file.c:767
2 locks held by agetty/8033:
 #0: 000000001dbb08b0 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:272
 #1: 0000000073b95342 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x217/0x1950 drivers/tty/n_tty.c:2154
9 locks held by syz-fuzzer/9808:
3 locks held by kworker/u4:11/29410:
2 locks held by agetty/23097:
 #0: 00000000881c9638 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:272
 #1: 0000000094f15cec (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x217/0x1950 drivers/tty/n_tty.c:2154
2 locks held by syz-executor.2/25200:
 #0: 00000000862a7bd1 (&type->s_umount_key#49/1){+.+.}, at: alloc_super fs/super.c:226 [inline]
 #0: 00000000862a7bd1 (&type->s_umount_key#49/1){+.+.}, at: sget_userns+0x20b/0xcd0 fs/super.c:519
 #1: 000000007f1430ca (sb_internal#2){.+.+}, at: sb_start_intwrite include/linux/fs.h:1626 [inline]
 #1: 000000007f1430ca (sb_internal#2){.+.+}, at: xfs_trans_alloc+0x4fc/0x700 fs/xfs/xfs_trans.c:271
2 locks held by login/27148:
 #0: 0000000018ceef8b (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:272
 #1: 0000000069da7bfb (&tty->atomic_write_lock){+.+.}, at: tty_write_lock drivers/tty/tty_io.c:889 [inline]
 #1: 0000000069da7bfb (&tty->atomic_write_lock){+.+.}, at: do_tty_write drivers/tty/tty_io.c:909 [inline]
 #1: 0000000069da7bfb (&tty->atomic_write_lock){+.+.}, at: tty_write+0x28f/0x810 drivers/tty/tty_io.c:1044
2 locks held by agetty/29903:
 #0: 00000000ee186460 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:272
 #1: 0000000077129c2e (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x217/0x1950 drivers/tty/n_tty.c:2154
3 locks held by kworker/u4:1/29941:
5 locks held by syz-executor.3/30713:
4 locks held by syz-executor.3/30715:
 #0: 0000000018ceef8b (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:272
 #1: 0000000069da7bfb (&tty->atomic_write_lock){+.+.}, at: tty_write_lock drivers/tty/tty_io.c:886 [inline]
 #1: 0000000069da7bfb (&tty->atomic_write_lock){+.+.}, at: do_tty_write drivers/tty/tty_io.c:909 [inline]
 #1: 0000000069da7bfb (&tty->atomic_write_lock){+.+.}, at: tty_write+0x24e/0x810 drivers/tty/tty_io.c:1044
 #2: 00000000c3c090f1 (&tty->termios_rwsem){++++}, at: n_tty_write+0x1b5/0xff0 drivers/tty/n_tty.c:2314
 #3: 0000000014607a92 (&ldata->output_lock){+.+.}, at: process_output_block drivers/tty/n_tty.c:548 [inline]
 #3: 0000000014607a92 (&ldata->output_lock){+.+.}, at: n_tty_write+0x4e3/0xff0 drivers/tty/n_tty.c:2331
2 locks held by syz-executor.4/30733:

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 1572 Comm: khungtaskd Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 nmi_cpu_backtrace.cold+0x63/0xa2 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x1a6/0x1f0 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:203 [inline]
 watchdog+0x991/0xe60 kernel/hung_task.c:287
 kthread+0x33f/0x460 kernel/kthread.c:259
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 30688 Comm: syz-executor.0 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023
RIP: 0010:get_current arch/x86/include/asm/current.h:15 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x4/0x50 kernel/kcov.c:100
Code: e8 11 dd 35 00 e9 ab fe ff ff 4c 89 ef e8 04 dd 35 00 e9 23 fe ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 8b 34 24 <65> 48 8b 04 25 c0 df 01 00 65 8b 15 cc 59 9f 7e 81 e2 00 01 1f 00
RSP: 0018:ffff8880a022f8f0 EFLAGS: 00000013
RAX: 0000000000000002 RBX: 000000000000000c RCX: ffffffff81819458
RDX: 00fff0000004000c RSI: ffffffff81819467 RDI: 0000000000000007
RBP: 00fff0000004000c R08: 0000000000000001 R09: ffffffffffffffff
R10: 0000000000000007 R11: 0000000000000000 R12: ffffea0000d6d2c0
R13: ffffea0000d6d2c0 R14: 0000000000000000 R15: dffffc0000000000
FS:  00007fa1d320e700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c01328e000 CR3: 0000000098946000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __read_once_size include/linux/compiler.h:263 [inline]
 compound_head include/linux/page-flags.h:142 [inline]
 PageUnevictable include/linux/page-flags.h:349 [inline]
 page_off_lru include/linux/mm_inline.h:94 [inline]
 release_pages+0x597/0x15a0 mm/swap.c:787
 __pagevec_release+0x7b/0x150 mm/swap.c:820
 pagevec_release include/linux/pagevec.h:86 [inline]
 shmem_undo_range+0xb35/0x1e40 mm/shmem.c:873
 shmem_truncate_range mm/shmem.c:995 [inline]
 shmem_evict_inode+0x31c/0x8f0 mm/shmem.c:1095
 evict+0x2ed/0x760 fs/inode.c:559
 iput_final fs/inode.c:1555 [inline]
 iput+0x4f1/0x860 fs/inode.c:1581
 dentry_unlink_inode+0x265/0x320 fs/dcache.c:374
 __dentry_kill+0x3c0/0x640 fs/dcache.c:566
 dentry_kill+0xc4/0x510 fs/dcache.c:685
 dput+0x55f/0x640 fs/dcache.c:846
 __fput+0x415/0x890 fs/file_table.c:291
 task_work_run+0x148/0x1c0 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:193 [inline]
 exit_to_usermode_loop+0x251/0x2a0 arch/x86/entry/common.c:167
 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
 do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fa1d4c9bee7
Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 c4 57 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa1d320df88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: 0000000000000000 RBX: 000000000000bb10 RCX: 00007fa1d4c9bee7
RDX: 0000000000000000 RSI: 0000000000004c01 RDI: 0000000000000004
RBP: 00007fa1d320e6b8 R08: 00007fa1d320e020 R09: 00000000008000c1
R10: 00000000008000c1 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000075 R14: 00007fa1d320dfe0 R15: 00000000200005c0