[ 113.313473][ T4856] loop1: detected capacity change from 0 to 32768 [ 113.326450][ T4854] ocfs2: Mounting device (7,3) on (node local, slot 0) with writeback data mode. [ 113.372722][ T26] audit: type=1800 audit(1757715655.782:8): pid=4854 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.175" name="file1" dev="loop3" ino=17058 res=0 errno=0 [ 113.422328][ T4854] [ 113.432680][ T4854] WARNING: possible circular locking dependency detected [ 113.441195][ T4854] syzkaller #0 Not tainted [ 113.447033][ T4854] ------------------------------------------------------ [ 113.455548][ T4854] syz.3.175/4854 is trying to acquire lock: [ 113.462841][ T4854] ffff88807a885488 (&osb->system_file_mutex){+.+.}-{3:3}, at: ocfs2_get_system_file_inode+0x1b5/0x760 fs/ocfs2/sysfile.c:101 [ 113.475255][ T4854] [ 113.484110][ T4854] ffff8880625a6a20 (&ocfs2_file_ip_alloc_sem_key){++++}-{3:3}, at: ocfs2_dio_wr_get_block+0x8db/0x17a0 fs/ocfs2/aops.c:2225 [ 113.507185][ T4854] [ 113.517592][ T4854] [ 113.527757][ T4854] down_read+0x44/0x2e0 kernel/locking/rwsem.c:1498 [ 113.533864][ T4854] ocfs2_read_virt_blocks+0x23f/0x8a0 fs/ocfs2/extent_map.c:976 [ 113.541160][ T4854] ocfs2_read_dir_block fs/ocfs2/dir.c:508 [inline] [ 113.541160][ T4854] ocfs2_find_entry_el fs/ocfs2/dir.c:715 [inline] [ 113.541160][ T4854] ocfs2_find_entry+0x3d1/0x1f90 fs/ocfs2/dir.c:1091 [ 113.548042][ T4854] ocfs2_find_files_on_disk+0xdb/0x2f0 fs/ocfs2/dir.c:1995 [ 113.555425][ T4854] ocfs2_lookup_ino_from_name+0x4f/0xf0 fs/ocfs2/dir.c:2017 [ 113.562925][ T4854] _ocfs2_get_system_file_inode fs/ocfs2/sysfile.c:136 [inline] [ 113.562925][ T4854] ocfs2_get_system_file_inode+0x319/0x760 fs/ocfs2/sysfile.c:112 [ 113.570697][ T4854] ocfs2_init_global_system_inodes+0x316/0x650 fs/ocfs2/super.c:458 [ 113.578763][ T4854] ocfs2_initialize_super fs/ocfs2/super.c:2279 [inline] [ 113.578763][ T4854] ocfs2_fill_super+0x3dbf/0x4d80 fs/ocfs2/super.c:995 [ 113.585713][ T4854] mount_bdev+0x287/0x3c0 fs/super.c:1400 [ 113.591946][ T4854] legacy_get_tree+0xe6/0x180 fs/fs_context.c:611 [ 113.598527][ T4854] vfs_get_tree+0x88/0x270 fs/super.c:1530 [ 113.604848][ T4854] do_new_mount+0x24a/0xa40 fs/namespace.c:3025 ./f[ 113.611251][ T4854] do_mount fs/namespace.c:3368 [inline] ./f[ 113.611251][ T4854] __do_sys_mount fs/namespace.c:3576 [inline] ./f[ 113.611251][ T4854] __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:3553 ile0[ 113.617822][ T4854] do_syscall_x64 arch/x86/entry/common.c:50 [inline] ile0[ 113.617822][ T4854] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 [ 113.624134][ T4854] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 113.631925][ T4854] fus[ 113.641624][ T4854] check_prev_add kernel/locking/lockdep.c:3053 [inline] fus[ 113.641624][ T4854] check_prevs_add kernel/locking/lockdep.c:3172 [inline] fus[ 113.641624][ T4854] validate_chain kernel/locking/lockdep.c:3788 [inline] fus[ 113.641624][ T4854] __lock_acquire+0x2c33/0x7c60 kernel/locking/lockdep.c:5012 e[ 113.648378][ T4854] lock_acquire+0x197/0x3f0 kernel/locking/lockdep.c:5623 [ 113.654778][ T4854] __mutex_lock_common+0x1eb/0x2390 kernel/locking/mutex.c:596 [ 113.661981][ T4854] __mutex_lock kernel/locking/mutex.c:729 [inline] [ 113.661981][ T4854] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 8[ 113.668650][ T4854] ocfs2_get_system_file_inode+0x1b5/0x760 fs/ocfs2/sysfile.c:101 [ 113.676368][ T4854] ocfs2_reserve_suballoc_bits+0x139/0x4350 fs/ocfs2/suballoc.c:776 [ 113.684168][ T4854] ocfs2_reserve_cluster_bitmap_bits fs/ocfs2/suballoc.c:1128 [inline] [ 113.684168][ T4854] ocfs2_reserve_clusters_with_limit+0x2f8/0xba0 fs/ocfs2/suballoc.c:1173 "[ 113.692397][ T4854] ocfs2_reserve_clusters fs/ocfs2/suballoc.c:1223 [inline] "[ 113.692397][ T4854] ocfs2_lock_allocators+0x2f7/0x5b0 fs/ocfs2/suballoc.c:2669 ûÿÿ3[ 113.699582][ T4854] ocfs2_write_begin_nolock+0x2216/0x4180 fs/ocfs2/aops.c:1741 [ 113.707216][ T4854] ocfs2_dio_wr_get_block+0xb6d/0x17a0 fs/ocfs2/aops.c:2239 [ 113.714573][ T4854] get_more_blocks fs/direct-io.c:673 [inline] [ 113.714573][ T4854] do_direct_IO fs/direct-io.c:959 [inline] [ 113.714573][ T4854] do_blockdev_direct_IO fs/direct-io.c:1276 [inline] [ 113.714573][ T4854] __blockdev_direct_IO+0x146d/0x3c90 fs/direct-io.c:1368 [ 113.722042][ T4854] ocfs2_direct_IO+0x23e/0x2b0 fs/ocfs2/aops.c:2468 [ 113.728884][ T4854] generic_file_direct_write+0x22c/0x490 mm/filemap.c:3687 [ 113.736427][ T4854] __generic_file_write_iter+0x2b1/0x4e0 mm/filemap.c:3869 [ 113.744110][ T4854] ocfs2_file_write_iter+0x1578/0x1cf0 fs/ocfs2/file.c:2472 [ 113.751489][ T4854] do_iter_readv_writev+0x497/0x600 fs/read_write.c:-1 [ 113.758587][ T4854] do_iter_write+0x205/0x7b0 fs/read_write.c:855 [ 113.765075][ T4854] iter_file_splice_write+0x65f/0xc40 fs/splice.c:689 [ 113.772351][ T4854] do_splice_from fs/splice.c:767 [inline] [ 113.772351][ T4854] direct_splice_actor+0xe1/0x130 fs/splice.c:936 [ 113.779275][ T4854] splice_direct_to_actor+0x4dc/0xb50 fs/splice.c:891 [ 113.786543][ T4854] do_splice_direct+0x1b9/0x2c0 fs/splice.c:979 [ 113.793290][ T4854] do_sendfile+0x5d5/0xec0 fs/read_write.c:1249 [ 113.799610][ T4854] __do_sys_sendfile64 fs/read_write.c:1317 [inline] [ 113.799610][ T4854] __se_sys_sendfile64+0x13b/0x190 fs/read_write.c:1303 [ 113.806620][ T4854] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [ 113.806620][ T4854] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 [ 113.813032][ T4854] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 113.820863][ T4854] [ 113.832469][ T4854] Possible unsafe locking scenario: [ 113.841300][ T4854] CPU0 CPU1 [ 113.848060][ T4854] ---- ---- [ 113.854807][ T4854] lock(&ocfs2_file_ip_alloc_sem_key); [ 113.861728][ T4854] lock(&osb->system_file_mutex); [ 113.870742][ T4854] lock(&ocfs2_file_ip_alloc_sem_key); [ 113.880182][ T4854] lock(&osb->system_file_mutex); [ 113.886681][ T4854] [ 113.896207][ T4854] 3 locks held by syz.3.175/4854: [ 113.902608][ T4854] #0: ffff8880257fc460 (sb_writers#18){.+.+}-{0:0}, at: do_sendfile+0x5b2/0xec0 fs/read_write.c:1248 [ 113.913089][ T4854] #1: ffff8880625a6d88 (&sb->s_type->i_mutex_key#25){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:787 [inline] [ 113.913089][ T4854] #1: ffff8880625a6d88 (&sb->s_type->i_mutex_key#25){+.+.}-{3:3}, at: ocfs2_file_write_iter+0x401/0x1cf0 fs/ocfs2/file.c:2402 [ 113.925738][ T4854] #2: ffff8880625a6a20 (&ocfs2_file_ip_alloc_sem_key){++++}-{3:3}, at: ocfs2_dio_wr_get_block+0x8db/0x17a0 fs/ocfs2/aops.c:2225 [ 113.938651][ T4854] [ 113.946023][ T4854] CPU: 1 PID: 4854 Comm: syz.3.175 Not tainted syzkaller #0 [ 113.954664][ T4854] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 113.966205][ T4854] Call Trace: [ 113.970867][ T4854] [ 113.975179][ T4854] dump_stack_lvl+0x168/0x230 lib/dump_stack.c:106 [ 113.981228][ T4854] ? load_image+0x3b0/0x3b0 [ 113.987105][ T4854] ? show_regs_print_info+0x20/0x20 [ 113.993681][ T4854] ? print_circular_bug+0x12b/0x1a0 kernel/locking/lockdep.c:2010 [ 114.000258][ T4854] check_noncircular+0x274/0x310 kernel/locking/lockdep.c:2133 [ 114.006568][ T4854] ? add_chain_block+0x940/0x940 [ 114.012892][ T4854] ? instrument_atomic_read_write include/linux/instrumented.h:101 [inline] [ 114.012892][ T4854] ? atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:512 [inline] [ 114.012892][ T4854] ? queued_spin_lock include/asm-generic/qspinlock.h:82 [inline] [ 114.012892][ T4854] ? lockdep_lock+0xdc/0x1e0 kernel/locking/lockdep.c:113 [ 114.018871][ T4854] ? instrument_atomic_read include/linux/instrumented.h:71 [inline] [ 114.018871][ T4854] ? test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline] [ 114.018871][ T4854] ? hlock_class kernel/locking/lockdep.c:197 [inline] [ 114.018871][ T4854] ? mark_lock+0x94/0x320 kernel/locking/lockdep.c:4569 [ 114.024575][ T4854] ? instrument_atomic_read include/linux/instrumented.h:71 [inline] [ 114.024575][ T4854] ? test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline] [ 114.024575][ T4854] ? hlock_class kernel/locking/lockdep.c:197 [inline] [ 114.024575][ T4854] ? mark_lock+0x94/0x320 kernel/locking/lockdep.c:4569 [ 114.030277][ T4854] check_prev_add kernel/locking/lockdep.c:3053 [inline] [ 114.030277][ T4854] check_prevs_add kernel/locking/lockdep.c:3172 [inline] [ 114.030277][ T4854] validate_chain kernel/locking/lockdep.c:3788 [inline] [ 114.030277][ T4854] __lock_acquire+0x2c33/0x7c60 kernel/locking/lockdep.c:5012 [ 114.036509][ T4854] ? instrument_atomic_read include/linux/instrumented.h:71 [inline] [ 114.036509][ T4854] ? test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline] [ 114.036509][ T4854] ? hlock_class kernel/locking/lockdep.c:197 [inline] [ 114.036509][ T4854] ? __lock_acquire+0x12d9/0x7c60 kernel/locking/lockdep.c:5009 [ 114.042895][ T4854] ? verify_lock_unused+0x140/0x140 [ 114.049471][ T4854] ? instrument_atomic_read include/linux/instrumented.h:71 [inline] [ 114.049471][ T4854] ? test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline] [ 114.049471][ T4854] ? hlock_class kernel/locking/lockdep.c:197 [inline] [ 114.049471][ T4854] ? mark_lock+0x94/0x320 kernel/locking/lockdep.c:4569 [ 114.055194][ T4854] lock_acquire+0x197/0x3f0 kernel/locking/lockdep.c:5623 [ 114.061060][ T4854] ? ocfs2_get_system_file_inode+0x1b5/0x760 fs/ocfs2/sysfile.c:101 [ 114.068419][ T4854] ? __might_sleep+0xf0/0xf0 [ 114.074384][ T4854] ? read_lock_is_recursive+0x10/0x10 kernel/locking/lockdep.c:5578 [ 114.081130][ T4854] ? instrument_atomic_read include/linux/instrumented.h:71 [inline] [ 114.081130][ T4854] ? test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline] [ 114.081130][ T4854] ? hlock_class kernel/locking/lockdep.c:197 [inline] [ 114.081130][ T4854] ? __lock_acquire+0x12d9/0x7c60 kernel/locking/lockdep.c:5009 [ 114.087533][ T4854] ? instrument_atomic_read include/linux/instrumented.h:71 [inline] [ 114.087533][ T4854] ? test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline] [ 114.087533][ T4854] ? hlock_class kernel/locking/lockdep.c:197 [inline] [ 114.087533][ T4854] ? mark_lock+0x94/0x320 kernel/locking/lockdep.c:4569 [ 114.093258][ T4854] ? instrument_atomic_read include/linux/instrumented.h:71 [inline] [ 114.093258][ T4854] ? test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline] [ 114.093258][ T4854] ? hlock_class kernel/locking/lockdep.c:197 [inline] [ 114.093258][ T4854] ? mark_lock+0x94/0x320 kernel/locking/lockdep.c:4569 [ 114.098959][ T4854] ? ocfs2_get_system_file_inode+0x1b5/0x760 fs/ocfs2/sysfile.c:101 [ 114.106320][ T4854] __mutex_lock_common+0x1eb/0x2390 kernel/locking/mutex.c:596 [ 114.112899][ T4854] ? ocfs2_get_system_file_inode+0x1b5/0x760 fs/ocfs2/sysfile.c:101 [ 114.120258][ T4854] ? instrument_atomic_read include/linux/instrumented.h:71 [inline] [ 114.120258][ T4854] ? test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline] [ 114.120258][ T4854] ? hlock_class kernel/locking/lockdep.c:197 [inline] [ 114.120258][ T4854] ? __lock_acquire+0x12d9/0x7c60 kernel/locking/lockdep.c:5009 [ 114.126658][ T4854] ? read_lock_is_recursive+0x10/0x10 kernel/locking/lockdep.c:5578 [ 114.133401][ T4854] ? mutex_lock_io_nested+0x60/0x60 [ 114.139981][ T4854] ? 0xffffffffa002e000 [ 114.145526][ T4854] __mutex_lock kernel/locking/mutex.c:729 [inline] [ 114.145526][ T4854] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 [ 114.151676][ T4854] ocfs2_get_system_file_inode+0x1b5/0x760 fs/ocfs2/sysfile.c:101 [ 114.158864][ T4854] ? ocfs2_fast_symlink_readpage+0x3e0/0x3e0 [ 114.166236][ T4854] ? instrument_atomic_read include/linux/instrumented.h:71 [inline] [ 114.166236][ T4854] ? test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline] [ 114.166236][ T4854] ? hlock_class kernel/locking/lockdep.c:197 [inline] [ 114.166236][ T4854] ? hlock_conflict+0x59/0x1f0 kernel/locking/lockdep.c:1970 [ 114.172377][ T4854] ? __bfs+0x2a3/0x5c0 kernel/locking/lockdep.c:1748 [ 114.177819][ T4854] ? check_path+0x40/0x40 [ 114.183533][ T4854] ocfs2_reserve_suballoc_bits+0x139/0x4350 fs/ocfs2/suballoc.c:776 [ 114.190798][ T4854] ? __lock_acquire+0x7c60/0x7c60 [ 114.197197][ T4854] ? deref_stack_reg+0xd0/0x120 arch/x86/kernel/unwind_orc.c:360 [ 114.203420][ T4854] ? instrument_atomic_read include/linux/instrumented.h:71 [inline] [ 114.203420][ T4854] ? test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline] [ 114.203420][ T4854] ? hlock_class kernel/locking/lockdep.c:197 [inline] [ 114.203420][ T4854] ? mark_lock+0x94/0x320 kernel/locking/lockdep.c:4569 [ 114.209129][ T4854] ? instrument_atomic_read include/linux/instrumented.h:71 [inline] [ 114.209129][ T4854] ? test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline] [ 114.209129][ T4854] ? hlock_class kernel/locking/lockdep.c:197 [inline] [ 114.209129][ T4854] ? lookup_chain_cache_add kernel/locking/lockdep.c:3700 [inline] [ 114.209129][ T4854] ? validate_chain kernel/locking/lockdep.c:3756 [inline] [ 114.209129][ T4854] ? __lock_acquire+0x13ad/0x7c60 kernel/locking/lockdep.c:5012 [ 114.215528][ T4854] ? kernel_text_address kernel/extable.c:151 [inline] [ 114.215528][ T4854] ? __kernel_text_address+0x9a/0x100 kernel/extable.c:105 [ 114.222363][ T4854] ? ocfs2_block_group_search+0x470/0x470 [ 114.229458][ T4854] ? stack_trace_save+0x98/0xe0 kernel/stacktrace.c:122 [ 114.235674][ T4854] ? verify_lock_unused+0x140/0x140 [ 114.242254][ T4854] ? kasan_save_stack mm/kasan/common.c:40 [inline] [ 114.242254][ T4854] ? kasan_set_track mm/kasan/common.c:46 [inline] [ 114.242254][ T4854] ? set_alloc_info mm/kasan/common.c:434 [inline] [ 114.242254][ T4854] ? ____kasan_kmalloc mm/kasan/common.c:513 [inline] [ 114.242254][ T4854] ? __kasan_kmalloc+0xcc/0xf0 mm/kasan/common.c:522