====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Not tainted ------------------------------------------------------ syz.7.753/7885 is trying to acquire lock: ffff88804cd85108 (&ei->xattr_sem){++++}-{3:3}, at: ext4_write_lock_xattr fs/ext4/xattr.h:158 [inline] ffff88804cd85108 (&ei->xattr_sem){++++}-{3:3}, at: ext4_destroy_inline_data+0x24/0xe0 fs/ext4/inline.c:1922 but task is already holding lock: ffff888053588c18 (&sbi->s_writepages_rwsem){.+.+}-{0:0}, at: ext4_writepages+0x20f/0x2f40 fs/ext4/inode.c:2717 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&sbi->s_writepages_rwsem){.+.+}-{0:0}: percpu_down_read+0x44/0x1a0 include/linux/percpu-rwsem.h:51 ext4_writepages+0x20f/0x2f40 fs/ext4/inode.c:2717 do_writepages+0x3ba/0x640 mm/page-writeback.c:2491 __writeback_single_inode+0x156/0x1160 fs/fs-writeback.c:1622 writeback_single_inode+0x3cb/0x8e0 fs/fs-writeback.c:1743 write_inode_now+0x17f/0x210 fs/fs-writeback.c:2786 iput_final fs/inode.c:1821 [inline] iput+0x613/0x980 fs/inode.c:1860 ext4_xattr_block_set+0x273b/0x32b0 fs/ext4/xattr.c:2146 ext4_xattr_move_to_block fs/ext4/xattr.c:2611 [inline] ext4_xattr_make_inode_space fs/ext4/xattr.c:2686 [inline] ext4_expand_extra_isize_ea+0x120b/0x1dc0 fs/ext4/xattr.c:2774 __ext4_expand_extra_isize+0x301/0x3e0 fs/ext4/inode.c:6003 ext4_try_to_expand_extra_isize fs/ext4/inode.c:6046 [inline] __ext4_mark_inode_dirty+0x47f/0x770 fs/ext4/inode.c:6124 ext4_evict_inode+0xa7f/0x1110 fs/ext4/inode.c:281 evict+0x4c9/0x8d0 fs/inode.c:705 ext4_orphan_cleanup+0xbeb/0x1420 fs/ext4/orphan.c:472 __ext4_fill_super fs/ext4/super.c:5574 [inline] ext4_fill_super+0x6ee3/0x78c0 fs/ext4/super.c:5693 get_tree_bdev+0x3f1/0x610 fs/super.c:1366 vfs_get_tree+0x88/0x270 fs/super.c:1573 do_new_mount+0x24a/0xa40 fs/namespace.c:3078 do_mount fs/namespace.c:3421 [inline] __do_sys_mount fs/namespace.c:3629 [inline] __se_sys_mount+0x2e3/0x3d0 fs/namespace.c:3606 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 -> #0 (&ei->xattr_sem){++++}-{3:3}: check_prev_add kernel/locking/lockdep.c:3090 [inline] check_prevs_add kernel/locking/lockdep.c:3209 [inline] validate_chain kernel/locking/lockdep.c:3825 [inline] __lock_acquire+0x2d07/0x7d10 kernel/locking/lockdep.c:5049 lock_acquire+0x1bb/0x4a0 kernel/locking/lockdep.c:5662 down_write+0x36/0x60 kernel/locking/rwsem.c:1573 ext4_write_lock_xattr fs/ext4/xattr.h:158 [inline] ext4_destroy_inline_data+0x24/0xe0 fs/ext4/inline.c:1922 ext4_writepages+0x670/0x2f40 fs/ext4/inode.c:2763 do_writepages+0x3ba/0x640 mm/page-writeback.c:2491 filemap_fdatawrite_wbc+0x11e/0x180 mm/filemap.c:388 __filemap_fdatawrite_range mm/filemap.c:421 [inline] __filemap_fdatawrite mm/filemap.c:427 [inline] filemap_flush+0xe0/0x140 mm/filemap.c:454 ext4_convert_inline_data+0x18b/0x5f0 fs/ext4/inline.c:2097 ext4_page_mkwrite+0x1c5/0x10d0 fs/ext4/inode.c:6278 do_page_mkwrite+0x16b/0x5c0 mm/memory.c:3009 wp_page_shared+0x167/0x370 mm/memory.c:3358 handle_pte_fault mm/memory.c:5047 [inline] __handle_mm_fault mm/memory.c:5171 [inline] handle_mm_fault+0x1d19/0x3ee0 mm/memory.c:5292 do_user_addr_fault+0x51f/0xb10 arch/x86/mm/fault.c:1338 handle_page_fault arch/x86/mm/fault.c:1429 [inline] exc_page_fault+0x60/0x100 arch/x86/mm/fault.c:1482 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:608 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&sbi->s_writepages_rwsem); lock(&ei->xattr_sem); lock(&sbi->s_writepages_rwsem); lock(&ei->xattr_sem); *** DEADLOCK *** 4 locks held by syz.7.753/7885: #0: ffff8880752c5b58 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:136 [inline] #0: ffff8880752c5b58 (&mm->mmap_lock){++++}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:5320 [inline] #0: ffff8880752c5b58 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x2e/0x2f0 mm/memory.c:5382 #1: ffff88807c8be558 (sb_pagefaults){.+.+}-{0:0}, at: __sb_start_write include/linux/fs.h:1891 [inline] #1: ffff88807c8be558 (sb_pagefaults){.+.+}-{0:0}, at: sb_start_pagefault include/linux/fs.h:1995 [inline] #1: ffff88807c8be558 (sb_pagefaults){.+.+}-{0:0}, at: ext4_page_mkwrite+0x193/0x10d0 fs/ext4/inode.c:6273 #2: ffff88804cd855e0 (mapping.invalidate_lock#2){++++}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:813 [inline] #2: ffff88804cd855e0 (mapping.invalidate_lock#2){++++}-{3:3}, at: ext4_page_mkwrite+0x1bd/0x10d0 fs/ext4/inode.c:6276 #3: ffff888053588c18 (&sbi->s_writepages_rwsem){.+.+}-{0:0}, at: ext4_writepages+0x20f/0x2f40 fs/ext4/inode.c:2717 stack backtrace: CPU: 0 PID: 7885 Comm: syz.7.753 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Call Trace: dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106 check_noncircular+0x296/0x330 kernel/locking/lockdep.c:2170 check_prev_add kernel/locking/lockdep.c:3090 [inline] check_prevs_add kernel/locking/lockdep.c:3209 [inline] validate_chain kernel/locking/lockdep.c:3825 [inline] __lock_acquire+0x2d07/0x7d10 kernel/locking/lockdep.c:5049 lock_acquire+0x1bb/0x4a0 kernel/locking/lockdep.c:5662 down_write+0x36/0x60 kernel/locking/rwsem.c:1573 ext4_write_lock_xattr fs/ext4/xattr.h:158 [inline] ext4_destroy_inline_data+0x24/0xe0 fs/ext4/inline.c:1922 ext4_writepages+0x670/0x2f40 fs/ext4/inode.c:2763 do_writepages+0x3ba/0x640 mm/page-writeback.c:2491 filemap_fdatawrite_wbc+0x11e/0x180 mm/filemap.c:388 __filemap_fdatawrite_range mm/filemap.c:421 [inline] __filemap_fdatawrite mm/filemap.c:427 [inline] filemap_flush+0xe0/0x140 mm/filemap.c:454 ext4_convert_inline_data+0x18b/0x5f0 fs/ext4/inline.c:2097 ext4_page_mkwrite+0x1c5/0x10d0 fs/ext4/inode.c:6278 do_page_mkwrite+0x16b/0x5c0 mm/memory.c:3009 wp_page_shared+0x167/0x370 mm/memory.c:3358 handle_pte_fault mm/memory.c:5047 [inline] __handle_mm_fault mm/memory.c:5171 [inline] handle_mm_fault+0x1d19/0x3ee0 mm/memory.c:5292 do_user_addr_fault+0x51f/0xb10 arch/x86/mm/fault.c:1338 handle_page_fault arch/x86/mm/fault.c:1429 [inline] exc_page_fault+0x60/0x100 arch/x86/mm/fault.c:1482 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:608 RIP: 0033:0x7f4c87b6be47 Code: ce 48 ff c7 48 01 fe 48 8d 54 11 80 0f 1f 80 00 00 00 00 c5 fe 6f 0e c5 fe 6f 56 20 c5 fe 6f 5e 40 c5 fe 6f 66 60 48 83 ee 80 fd 7f 0f c5 fd 7f 57 20 c5 fd 7f 5f 40 c5 fd 7f 67 60 48 83 ef RSP: 002b:00007fff5a15eca8 EFLAGS: 00010203 RAX: 0000200000000000 RBX: 0000000000000004 RCX: 0000200000000000 RDX: 000020000000057f RSI: 0000001b33920a9b RDI: 0000200000000020 RBP: fffffffffffffffe R08: 0000000000000000 R09: 0000000000000017 R10: 00000000000005ff R11: 0000000000000001 R12: 00007fff5a15edd0 R13: 00007f4c87e1618c R14: 0000000000059fa2 R15: 00007f4c87e16180 EXT4-fs error (device loop7): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 25 vs 281 free clusters EXT4-fs (loop7): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 610 with error 28 EXT4-fs (loop7): This should not happen!! Data will be lost EXT4-fs (loop7): Total free blocks count 0 EXT4-fs (loop7): Free/Dirty block details EXT4-fs (loop7): free_blocks=4096 EXT4-fs (loop7): dirty_blocks=640 EXT4-fs (loop7): Block reservation details EXT4-fs (loop7): i_reserved_data_blocks=40