Extracting prog: 1m10.851010118s Minimizing prog: 17m55.73737714s Simplifying prog options: 4m33.024729264s Extracting C: 1m49.072686767s Simplifying C: 0s extracting reproducer from 30 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-mknod$loop-creat-dup2-ioctl$BLKTRACESETUP-ioctl$BLKTRACESTART-ioctl$BLKTRACESETUP detailed listing: executing program 0: r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) mknod$loop(&(0x7f0000000080)='./file0\x00', 0x1000000000006005, 0x1) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r2 = dup2(r1, r1) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000000)={'\x00', 0x0, 0xa, 0x2}) ioctl$BLKTRACESTART(r2, 0x1274, 0x0) ioctl$BLKTRACESETUP(r2, 0x1276, 0x0) program crashed: possible deadlock in blk_trace_ioctl single: successfully extracted reproducer found reproducer with 8 syscalls minimizing guilty program testing program (duration=52.146677764s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-mknod$loop-creat-dup2-ioctl$BLKTRACESETUP-ioctl$BLKTRACESTART detailed listing: executing program 0: r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) mknod$loop(&(0x7f0000000080)='./file0\x00', 0x1000000000006005, 0x1) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r2 = dup2(r1, r1) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000000)={'\x00', 0x0, 0xa, 0x2}) ioctl$BLKTRACESTART(r2, 0x1274, 0x0) program crashed: possible deadlock in blk_trace_ioctl testing program (duration=52.146677764s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-mknod$loop-creat-dup2-ioctl$BLKTRACESETUP detailed listing: executing program 0: r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) mknod$loop(&(0x7f0000000080)='./file0\x00', 0x1000000000006005, 0x1) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r2 = dup2(r1, r1) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000000)={'\x00', 0x0, 0xa, 0x2}) program crashed: possible deadlock in blk_trace_ioctl testing program (duration=52.146677764s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-mknod$loop-creat-dup2 detailed listing: executing program 0: r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) mknod$loop(&(0x7f0000000080)='./file0\x00', 0x1000000000006005, 0x1) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) dup2(r1, r1) program did not crash testing program (duration=52.146677764s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-mknod$loop-creat-ioctl$BLKTRACESETUP detailed listing: executing program 0: r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) mknod$loop(&(0x7f0000000080)='./file0\x00', 0x1000000000006005, 0x1) creat(&(0x7f00000000c0)='./file0\x00', 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000000)={'\x00', 0x0, 0xa, 0x2}) program did not crash testing program (duration=52.146677764s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-mknod$loop-dup2-ioctl$BLKTRACESETUP detailed listing: executing program 0: r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) mknod$loop(&(0x7f0000000080)='./file0\x00', 0x1000000000006005, 0x1) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000000)={'\x00', 0x0, 0xa, 0x2}) program did not crash testing program (duration=52.146677764s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-creat-dup2-ioctl$BLKTRACESETUP detailed listing: executing program 0: r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r2 = dup2(r1, r1) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000000)={'\x00', 0x0, 0xa, 0x2}) program did not crash testing program (duration=52.146677764s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-mknod$loop-creat-dup2-ioctl$BLKTRACESETUP detailed listing: executing program 0: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) mknod$loop(&(0x7f0000000080)='./file0\x00', 0x1000000000006005, 0x1) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r1 = dup2(r0, r0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000000)={'\x00', 0x0, 0xa, 0x2}) program crashed: possible deadlock in blk_trace_ioctl testing program (duration=52.146677764s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod$loop-creat-dup2-ioctl$BLKTRACESETUP detailed listing: executing program 0: mknod$loop(&(0x7f0000000080)='./file0\x00', 0x1000000000006005, 0x1) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r1 = dup2(r0, r0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000000)={'\x00', 0x0, 0xa, 0x2}) program crashed: possible deadlock in blk_trace_ioctl testing program (duration=52.146677764s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod$loop-creat-dup2-ioctl$BLKTRACESETUP detailed listing: executing program 0: mknod$loop(0x0, 0x1000000000006005, 0x1) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r1 = dup2(r0, r0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000000)={'\x00', 0x0, 0xa, 0x2}) program did not crash testing program (duration=52.146677764s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod$loop-creat-dup2-ioctl$BLKTRACESETUP detailed listing: executing program 0: mknod$loop(&(0x7f0000000080)='./file0\x00', 0x1000000000006005, 0x1) r0 = creat(0x0, 0x0) r1 = dup2(r0, r0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000000)={'\x00', 0x0, 0xa, 0x2}) program did not crash testing program (duration=52.146677764s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod$loop-creat-dup2-ioctl$BLKTRACESETUP detailed listing: executing program 0: mknod$loop(&(0x7f0000000080)='./file0\x00', 0x1000000000006005, 0x1) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r1 = dup2(r0, r0) ioctl$BLKTRACESETUP(r1, 0xc0481273, 0x0) program crashed: possible deadlock in blk_trace_ioctl extracting C reproducer testing compiled C program (duration=52.146677764s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod$loop-creat-dup2-ioctl$BLKTRACESETUP program did not crash simplifying guilty program options testing program (duration=52.146677764s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod$loop-creat-dup2-ioctl$BLKTRACESETUP detailed listing: executing program 0: mknod$loop(&(0x7f0000000080)='./file0\x00', 0x1000000000006005, 0x1) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r1 = dup2(r0, r0) ioctl$BLKTRACESETUP(r1, 0xc0481273, 0x0) program did not crash testing program (duration=52.146677764s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod$loop-creat-dup2-ioctl$BLKTRACESETUP detailed listing: executing program 0: mknod$loop(&(0x7f0000000080)='./file0\x00', 0x1000000000006005, 0x1) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r1 = dup2(r0, r0) ioctl$BLKTRACESETUP(r1, 0xc0481273, 0x0) program crashed: possible deadlock in blk_trace_ioctl extracting C reproducer testing compiled C program (duration=52.146677764s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknod$loop-creat-dup2-ioctl$BLKTRACESETUP program did not crash reproducing took 25m15.636069906s repro crashed as (corrupted=false): ====================================================== WARNING: possible circular locking dependency detected 6.12.0-rc5-next-20241031-syzkaller #0 Not tainted ------------------------------------------------------ syz.0.15/6017 is trying to acquire lock: ffff88807cae29e0 (&mm->mmap_lock){++++}-{4:4}, at: __might_fault+0xaa/0x120 mm/memory.c:6751 but task is already holding lock: ffff88802565afc0 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_ioctl+0xdd/0x9a0 kernel/trace/blktrace.c:735 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #4 (&q->debugfs_mutex){+.+.}-{4:4}: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 __mutex_lock_common kernel/locking/mutex.c:585 [inline] __mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735 blk_mq_init_sched+0x3fa/0x830 block/blk-mq-sched.c:473 elevator_init_mq+0x1d8/0x2d0 block/elevator.c:605 add_disk_fwnode+0x10d/0xf80 block/genhd.c:413 sd_probe+0xba6/0x1100 drivers/scsi/sd.c:4024 really_probe+0x2b8/0xad0 drivers/base/dd.c:658 __driver_probe_device+0x1a2/0x390 drivers/base/dd.c:800 driver_probe_device+0x50/0x430 drivers/base/dd.c:830 __device_attach_driver+0x2d6/0x530 drivers/base/dd.c:958 bus_for_each_drv+0x24e/0x2e0 drivers/base/bus.c:459 __device_attach_async_helper+0x22d/0x300 drivers/base/dd.c:987 async_run_entry_fn+0xa8/0x420 kernel/async.c:129 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 -> #3 (&q->q_usage_counter(io)#66){++++}-{0:0}: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 bio_queue_enter block/blk.h:75 [inline] blk_mq_submit_bio+0x1510/0x2490 block/blk-mq.c:3069 __submit_bio+0x2c2/0x560 block/blk-core.c:629 __submit_bio_noacct_mq block/blk-core.c:710 [inline] submit_bio_noacct_nocheck+0x4d3/0xe30 block/blk-core.c:739 submit_bio_wait+0x106/0x200 block/bio.c:1454 blkdev_issue_write_zeroes block/blk-lib.c:166 [inline] blkdev_issue_zeroout+0x4c4/0x7e0 block/blk-lib.c:319 sb_issue_zeroout include/linux/blkdev.h:1133 [inline] ext4_init_inode_table+0x4f0/0x930 fs/ext4/ialloc.c:1595 ext4_run_li_request fs/ext4/super.c:3713 [inline] ext4_lazyinit_thread+0x756/0x1930 fs/ext4/super.c:3804 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 -> #2 (&meta_group_info[i]->alloc_sem){++++}-{4:4}: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 down_read+0xb1/0xa40 kernel/locking/rwsem.c:1524 __ext4_new_inode+0x2032/0x4380 fs/ext4/ialloc.c:1188 ext4_create+0x279/0x550 fs/ext4/namei.c:2831 lookup_open fs/namei.c:3595 [inline] open_last_lookups fs/namei.c:3694 [inline] path_openat+0x1c03/0x3590 fs/namei.c:3930 do_filp_open+0x235/0x490 fs/namei.c:3960 do_sys_openat2+0x13e/0x1d0 fs/open.c:1419 do_sys_open fs/open.c:1434 [inline] __do_sys_openat fs/open.c:1450 [inline] __se_sys_openat fs/open.c:1445 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1445 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #1 (jbd2_handle){++++}-{0:0}: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 start_this_handle+0x1eb4/0x2110 fs/jbd2/transaction.c:448 jbd2__journal_start+0x2da/0x5d0 fs/jbd2/transaction.c:505 __ext4_journal_start_sb+0x239/0x600 fs/ext4/ext4_jbd2.c:112 __ext4_journal_start fs/ext4/ext4_jbd2.h:326 [inline] ext4_dirty_inode+0x92/0x110 fs/ext4/inode.c:5981 __mark_inode_dirty+0x2ee/0xe90 fs/fs-writeback.c:2491 generic_update_time fs/inode.c:2110 [inline] inode_update_time fs/inode.c:2123 [inline] touch_atime+0x413/0x690 fs/inode.c:2195 file_accessed include/linux/fs.h:2538 [inline] ext4_file_mmap+0x18c/0x540 fs/ext4/file.c:797 call_mmap include/linux/fs.h:2182 [inline] mmap_file mm/internal.h:124 [inline] __mmap_new_file_vma mm/vma.c:2287 [inline] __mmap_new_vma mm/vma.c:2351 [inline] __mmap_region+0x2204/0x2cd0 mm/vma.c:2452 mmap_region+0x226/0x2c0 mm/mmap.c:1373 do_mmap+0x8f0/0x1000 mm/mmap.c:496 vm_mmap_pgoff+0x214/0x430 mm/util.c:580 ksys_mmap_pgoff+0x4eb/0x720 mm/mmap.c:542 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (&mm->mmap_lock){++++}-{4:4}: check_prev_add kernel/locking/lockdep.c:3161 [inline] check_prevs_add kernel/locking/lockdep.c:3280 [inline] validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904 __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 __might_fault+0xc6/0x120 mm/memory.c:6751 _inline_copy_from_user include/linux/uaccess.h:162 [inline] _copy_from_user+0x2a/0xc0 lib/usercopy.c:18 copy_from_user include/linux/uaccess.h:212 [inline] __blk_trace_setup kernel/trace/blktrace.c:626 [inline] blk_trace_ioctl+0x1ad/0x9a0 kernel/trace/blktrace.c:740 blkdev_ioctl+0x40c/0x6a0 block/ioctl.c:682 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Chain exists of: &mm->mmap_lock --> &q->q_usage_counter(io)#66 --> &q->debugfs_mutex Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&q->debugfs_mutex); lock(&q->q_usage_counter(io)#66); lock(&q->debugfs_mutex); rlock(&mm->mmap_lock); *** DEADLOCK *** 1 lock held by syz.0.15/6017: #0: ffff88802565afc0 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_ioctl+0xdd/0x9a0 kernel/trace/blktrace.c:735 stack backtrace: CPU: 0 UID: 0 PID: 6017 Comm: syz.0.15 Not tainted 6.12.0-rc5-next-20241031-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2074 check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2206 check_prev_add kernel/locking/lockdep.c:3161 [inline] check_prevs_add kernel/locking/lockdep.c:3280 [inline] validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904 __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 __might_fault+0xc6/0x120 mm/memory.c:6751 _inline_copy_from_user include/linux/uaccess.h:162 [inline] _copy_from_user+0x2a/0xc0 lib/usercopy.c:18 copy_from_user include/linux/uaccess.h:212 [inline] __blk_trace_setup kernel/trace/blktrace.c:626 [inline] blk_trace_ioctl+0x1ad/0x9a0 kernel/trace/blktrace.c:740 blkdev_ioctl+0x40c/0x6a0 block/ioctl.c:682 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8f91d7e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f8f92b28038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f8f91f35f80 RCX: 00007f8f91d7e719 RDX: 0000000000000000 RSI: 00000000c0481273 RDI: 0000000000000003 RBP: 00007f8f91df132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f8f91f35f80 R15: 00007fffe472e598 final repro crashed as (corrupted=false): ====================================================== WARNING: possible circular locking dependency detected 6.12.0-rc5-next-20241031-syzkaller #0 Not tainted ------------------------------------------------------ syz.0.15/6017 is trying to acquire lock: ffff88807cae29e0 (&mm->mmap_lock){++++}-{4:4}, at: __might_fault+0xaa/0x120 mm/memory.c:6751 but task is already holding lock: ffff88802565afc0 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_ioctl+0xdd/0x9a0 kernel/trace/blktrace.c:735 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #4 (&q->debugfs_mutex){+.+.}-{4:4}: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 __mutex_lock_common kernel/locking/mutex.c:585 [inline] __mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735 blk_mq_init_sched+0x3fa/0x830 block/blk-mq-sched.c:473 elevator_init_mq+0x1d8/0x2d0 block/elevator.c:605 add_disk_fwnode+0x10d/0xf80 block/genhd.c:413 sd_probe+0xba6/0x1100 drivers/scsi/sd.c:4024 really_probe+0x2b8/0xad0 drivers/base/dd.c:658 __driver_probe_device+0x1a2/0x390 drivers/base/dd.c:800 driver_probe_device+0x50/0x430 drivers/base/dd.c:830 __device_attach_driver+0x2d6/0x530 drivers/base/dd.c:958 bus_for_each_drv+0x24e/0x2e0 drivers/base/bus.c:459 __device_attach_async_helper+0x22d/0x300 drivers/base/dd.c:987 async_run_entry_fn+0xa8/0x420 kernel/async.c:129 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 -> #3 (&q->q_usage_counter(io)#66){++++}-{0:0}: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 bio_queue_enter block/blk.h:75 [inline] blk_mq_submit_bio+0x1510/0x2490 block/blk-mq.c:3069 __submit_bio+0x2c2/0x560 block/blk-core.c:629 __submit_bio_noacct_mq block/blk-core.c:710 [inline] submit_bio_noacct_nocheck+0x4d3/0xe30 block/blk-core.c:739 submit_bio_wait+0x106/0x200 block/bio.c:1454 blkdev_issue_write_zeroes block/blk-lib.c:166 [inline] blkdev_issue_zeroout+0x4c4/0x7e0 block/blk-lib.c:319 sb_issue_zeroout include/linux/blkdev.h:1133 [inline] ext4_init_inode_table+0x4f0/0x930 fs/ext4/ialloc.c:1595 ext4_run_li_request fs/ext4/super.c:3713 [inline] ext4_lazyinit_thread+0x756/0x1930 fs/ext4/super.c:3804 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 -> #2 (&meta_group_info[i]->alloc_sem){++++}-{4:4}: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 down_read+0xb1/0xa40 kernel/locking/rwsem.c:1524 __ext4_new_inode+0x2032/0x4380 fs/ext4/ialloc.c:1188 ext4_create+0x279/0x550 fs/ext4/namei.c:2831 lookup_open fs/namei.c:3595 [inline] open_last_lookups fs/namei.c:3694 [inline] path_openat+0x1c03/0x3590 fs/namei.c:3930 do_filp_open+0x235/0x490 fs/namei.c:3960 do_sys_openat2+0x13e/0x1d0 fs/open.c:1419 do_sys_open fs/open.c:1434 [inline] __do_sys_openat fs/open.c:1450 [inline] __se_sys_openat fs/open.c:1445 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1445 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #1 (jbd2_handle){++++}-{0:0}: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 start_this_handle+0x1eb4/0x2110 fs/jbd2/transaction.c:448 jbd2__journal_start+0x2da/0x5d0 fs/jbd2/transaction.c:505 __ext4_journal_start_sb+0x239/0x600 fs/ext4/ext4_jbd2.c:112 __ext4_journal_start fs/ext4/ext4_jbd2.h:326 [inline] ext4_dirty_inode+0x92/0x110 fs/ext4/inode.c:5981 __mark_inode_dirty+0x2ee/0xe90 fs/fs-writeback.c:2491 generic_update_time fs/inode.c:2110 [inline] inode_update_time fs/inode.c:2123 [inline] touch_atime+0x413/0x690 fs/inode.c:2195 file_accessed include/linux/fs.h:2538 [inline] ext4_file_mmap+0x18c/0x540 fs/ext4/file.c:797 call_mmap include/linux/fs.h:2182 [inline] mmap_file mm/internal.h:124 [inline] __mmap_new_file_vma mm/vma.c:2287 [inline] __mmap_new_vma mm/vma.c:2351 [inline] __mmap_region+0x2204/0x2cd0 mm/vma.c:2452 mmap_region+0x226/0x2c0 mm/mmap.c:1373 do_mmap+0x8f0/0x1000 mm/mmap.c:496 vm_mmap_pgoff+0x214/0x430 mm/util.c:580 ksys_mmap_pgoff+0x4eb/0x720 mm/mmap.c:542 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (&mm->mmap_lock){++++}-{4:4}: check_prev_add kernel/locking/lockdep.c:3161 [inline] check_prevs_add kernel/locking/lockdep.c:3280 [inline] validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904 __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 __might_fault+0xc6/0x120 mm/memory.c:6751 _inline_copy_from_user include/linux/uaccess.h:162 [inline] _copy_from_user+0x2a/0xc0 lib/usercopy.c:18 copy_from_user include/linux/uaccess.h:212 [inline] __blk_trace_setup kernel/trace/blktrace.c:626 [inline] blk_trace_ioctl+0x1ad/0x9a0 kernel/trace/blktrace.c:740 blkdev_ioctl+0x40c/0x6a0 block/ioctl.c:682 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Chain exists of: &mm->mmap_lock --> &q->q_usage_counter(io)#66 --> &q->debugfs_mutex Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&q->debugfs_mutex); lock(&q->q_usage_counter(io)#66); lock(&q->debugfs_mutex); rlock(&mm->mmap_lock); *** DEADLOCK *** 1 lock held by syz.0.15/6017: #0: ffff88802565afc0 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_ioctl+0xdd/0x9a0 kernel/trace/blktrace.c:735 stack backtrace: CPU: 0 UID: 0 PID: 6017 Comm: syz.0.15 Not tainted 6.12.0-rc5-next-20241031-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2074 check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2206 check_prev_add kernel/locking/lockdep.c:3161 [inline] check_prevs_add kernel/locking/lockdep.c:3280 [inline] validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904 __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 __might_fault+0xc6/0x120 mm/memory.c:6751 _inline_copy_from_user include/linux/uaccess.h:162 [inline] _copy_from_user+0x2a/0xc0 lib/usercopy.c:18 copy_from_user include/linux/uaccess.h:212 [inline] __blk_trace_setup kernel/trace/blktrace.c:626 [inline] blk_trace_ioctl+0x1ad/0x9a0 kernel/trace/blktrace.c:740 blkdev_ioctl+0x40c/0x6a0 block/ioctl.c:682 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8f91d7e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f8f92b28038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f8f91f35f80 RCX: 00007f8f91d7e719 RDX: 0000000000000000 RSI: 00000000c0481273 RDI: 0000000000000003 RBP: 00007f8f91df132e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f8f91f35f80 R15: 00007fffe472e598