ci2 starts bisection 2025-01-19 14:41:49.25059763 +0000 UTC m=+134109.889276627 bisecting fixing commit since 0a51d2d4527b43c5e467ffa6897deefeaf499358 building syzkaller on 9ac0fdc66500475f1914254ef369b32d51adbff9 ensuring issue is reproducible on original commit 0a51d2d4527b43c5e467ffa6897deefeaf499358 testing commit 0a51d2d4527b43c5e467ffa6897deefeaf499358 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: c45b347e9124b66b4336d3d382cee7364650080111969b464392decd2e71e024 all runs: crashed: possible deadlock in btrfs_dirty_inode representative crash: possible deadlock in btrfs_dirty_inode, types: [LOCKDEP] check whether we can drop unnecessary instrumentation disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN BUG KASAN], they are not needed testing commit 0a51d2d4527b43c5e467ffa6897deefeaf499358 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: f32662db96127d2d5ba3eedc2a7fc6e77ab950b389f7437f26e1d51ca8cb3713 all runs: crashed: possible deadlock in btrfs_dirty_inode representative crash: possible deadlock in btrfs_dirty_inode, types: [LOCKDEP] the bug reproduces without the instrumentation disabling configs for [KASAN ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed kconfig minimization: base=3706 full=7305 leaves diff=2038 split chunks (needed=false): <2038> split chunk #0 of len 2038 into 5 parts testing without sub-chunk 1/5 disabling configs for [BUG KASAN ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed testing commit 0a51d2d4527b43c5e467ffa6897deefeaf499358 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 0cb8dd630f5e56edff24a7f37a0719ad9572ba6220a785c68b1829c8747d4456 all runs: OK false negative chance: 0.000 testing without sub-chunk 2/5 disabling configs for [BUG KASAN ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed testing commit 0a51d2d4527b43c5e467ffa6897deefeaf499358 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: e2c59a34941eabaac5ee81ecb4b4e39c9ae8201fddc6c2a6a0531d87cf032fd9 all runs: crashed: possible deadlock in btrfs_dirty_inode representative crash: possible deadlock in btrfs_dirty_inode, types: [LOCKDEP] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [KASAN ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing commit 0a51d2d4527b43c5e467ffa6897deefeaf499358 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 48ed7482c9d9cfcd1612bd39be6c91329e37facf3f25632da000a722fc603438 all runs: crashed: possible deadlock in btrfs_dirty_inode representative crash: possible deadlock in btrfs_dirty_inode, types: [LOCKDEP] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [KASAN ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing commit 0a51d2d4527b43c5e467ffa6897deefeaf499358 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 4421ad8b7fa35692fa854942cffd683e1b21b8664b2aed934d201c125cc536f1 all runs: crashed: possible deadlock in btrfs_dirty_inode representative crash: possible deadlock in btrfs_dirty_inode, types: [LOCKDEP] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [HANG LEAK UBSAN BUG KASAN ATOMIC_SLEEP], they are not needed testing commit 0a51d2d4527b43c5e467ffa6897deefeaf499358 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: ef9acc01555591e534ddab13ea19b1b704e40944c2a60577007b5640a6b4292b all runs: crashed: possible deadlock in btrfs_dirty_inode representative crash: possible deadlock in btrfs_dirty_inode, types: [LOCKDEP] the chunk can be dropped minimized to 408 configs; suspects: [6LOWPAN 6LOWPAN_GHC_EXT_HDR_DEST 6LOWPAN_GHC_EXT_HDR_FRAG 6LOWPAN_GHC_EXT_HDR_HOP 6LOWPAN_GHC_EXT_HDR_ROUTE 6LOWPAN_GHC_ICMPV6 6LOWPAN_GHC_UDP 6LOWPAN_NHC 6LOWPAN_NHC_DEST 6LOWPAN_NHC_FRAGMENT 6LOWPAN_NHC_HOP 6LOWPAN_NHC_IPV6 6LOWPAN_NHC_MOBILITY 6LOWPAN_NHC_ROUTING 6LOWPAN_NHC_UDP 6PACK 842_COMPRESS 842_DECOMPRESS 9P_FSCACHE 9P_FS_POSIX_ACL 9P_FS_SECURITY ACORN_PARTITION ACORN_PARTITION_ADFS ACORN_PARTITION_CUMANA ACORN_PARTITION_EESOX ACORN_PARTITION_ICS ACORN_PARTITION_POWERTEC ACORN_PARTITION_RISCIX ACPI_NFIT ACPI_PLATFORM_PROFILE ADFS_FS AFFS_FS AFS_FS AFS_FSCACHE AF_KCM AF_RXRPC AF_RXRPC_IPV6 AIX_PARTITION AMD_SFH_HID AMIGA_PARTITION ANDROID ANDROID_BINDERFS ANDROID_BINDER_IPC APPLE_MFI_FASTCHARGE AR5523 ARCH_ENABLE_MEMORY_HOTREMOVE ARCH_ENABLE_THP_MIGRATION ASHMEM ASM_MODVERSIONS ASN1_ENCODER ASYNC_CORE ASYNC_MEMCPY ASYNC_PQ ASYNC_RAID6_RECOV ASYNC_TX_DMA ASYNC_XOR ATARI_PARTITION ATA_GENERIC ATA_OVER_ETH ATH10K ATH10K_CE ATH10K_PCI ATH10K_USB ATH11K ATH6KL ATH6KL_USB ATH9K ATH9K_AHB ATH9K_BTCOEX_SUPPORT ATH9K_CHANNEL_CONTEXT ATH9K_COMMON ATH9K_COMMON_DEBUG ATH9K_COMMON_SPECTRAL ATH9K_DEBUGFS ATH9K_DYNACK ATH9K_HTC ATH9K_HTC_DEBUGFS ATH9K_HW ATH9K_PCI ATH9K_PCOEM ATH9K_RFKILL ATH_COMMON ATM ATM_BR2684 ATM_CLIP ATM_DRIVERS ATM_LANE ATM_MPOA ATM_TCP AX25 AX25_DAMA_SLAVE AX88796B_PHY BAREUDP BATMAN_ADV BATMAN_ADV_BATMAN_V BATMAN_ADV_BLA BATMAN_ADV_DAT BATMAN_ADV_MCAST BATMAN_ADV_NC BCACHE BCMA BCMA_HOST_PCI_POSSIBLE BEFS_FS BFQ_CGROUP_DEBUG BFQ_GROUP_IOSCHED BFS_FS BIG_KEYS BLK_CGROUP BLK_CGROUP_IOCOST BLK_CGROUP_IOLATENCY BLK_CGROUP_RWSTAT BLK_DEBUG_FS_ZONED BLK_DEV_BSGLIB BLK_DEV_CRYPTOLOOP BLK_DEV_INTEGRITY BLK_DEV_INTEGRITY_T10 BLK_DEV_NBD BLK_DEV_NULL_BLK BLK_DEV_NULL_BLK_FAULT_INJECTION BLK_DEV_NVME BLK_DEV_PMEM BLK_DEV_RAM BLK_DEV_RNBD BLK_DEV_RNBD_CLIENT BLK_DEV_THROTTLING BLK_DEV_ZONED BLK_INLINE_ENCRYPTION BLK_INLINE_ENCRYPTION_FALLBACK BLK_MQ_RDMA BLK_RQ_ALLOC_TIME BLK_WBT BLK_WBT_MQ BONDING BPF_EVENTS BPF_JIT BPF_JIT_ALWAYS_ON BPF_JIT_DEFAULT_ON BPF_LSM BPF_PRELOAD BPF_PRELOAD_UMD BPF_STREAM_PARSER BPF_SYSCALL BPQETHER BRIDGE BRIDGE_CFM BRIDGE_EBT_802_3 BRIDGE_EBT_AMONG BRIDGE_EBT_ARP BRIDGE_EBT_ARPREPLY BRIDGE_EBT_BROUTE BRIDGE_EBT_DNAT BRIDGE_EBT_IP BRIDGE_EBT_IP6 BRIDGE_EBT_LIMIT BRIDGE_EBT_LOG BRIDGE_EBT_MARK BRIDGE_EBT_MARK_T BRIDGE_EBT_NFLOG BRIDGE_EBT_PKTTYPE BRIDGE_EBT_REDIRECT BRIDGE_EBT_SNAT BRIDGE_EBT_STP BRIDGE_EBT_T_FILTER BRIDGE_EBT_T_NAT BRIDGE_EBT_VLAN BRIDGE_IGMP_SNOOPING BRIDGE_MRP BRIDGE_NF_EBTABLES BRIDGE_VLAN_FILTERING BSD_DISKLABEL BSD_PROCESS_ACCT_V3 BT BTRFS_ASSERT BTRFS_FS BTRFS_FS_POSIX_ACL BTRFS_FS_REF_VERIFY BTT BT_6LOWPAN BT_ATH3K BT_BCM BT_BNEP BT_BNEP_MC_FILTER BT_BNEP_PROTO_FILTER BT_BREDR BT_CMTP BT_HCIBCM203X BT_HCIBFUSB BT_HCIBPA10X BT_HCIBTUSB BT_HCIBTUSB_AUTOSUSPEND BT_HCIBTUSB_BCM BT_HCIBTUSB_MTK BT_HCIBTUSB_RTL BT_HCIUART BT_HCIUART_3WIRE BT_HCIUART_AG6XX BT_HCIUART_BCSP BT_HCIUART_H4 BT_HCIUART_LL BT_HCIUART_MRVL BT_HCIUART_QCA BT_HCIUART_SERDEV BT_HCIVHCI BT_HIDP BT_HS BT_INTEL BT_LE BT_LEDS BT_MSFTEXT BT_QCA BT_RFCOMM BT_RFCOMM_TTY BT_RTL CACHEFILES CAIF CAIF_DEBUG CAIF_DRIVERS CAIF_NETDEV CAIF_TTY CAIF_USB CAIF_VIRTIO CAN CAN_8DEV_USB CAN_BCM CAN_CALC_BITTIMING CAN_DEV CAN_EMS_USB CAN_ESD_USB2 CAN_ETAS_ES58X CAN_GS_USB CAN_GW CAN_IFI_CANFD CAN_ISOTP CAN_J1939 CAN_KVASER_USB CAN_MCBA_USB CAN_PEAK_USB CAN_RAW CAN_SLCAN CAN_UCAN CAN_VCAN CAN_VXCAN CAPI_TRACE CARL9170 CARL9170_HWRNG CARL9170_LEDS CARL9170_WPC CEC_CORE CEPH_FS CEPH_FSCACHE CEPH_FS_POSIX_ACL CEPH_LIB CEPH_LIB_USE_DNS_RESOLVER CFG80211 CFG80211_CRDA_SUPPORT CFG80211_DEBUGFS CFG80211_DEFAULT_PS CFG80211_REQUIRE_SIGNED_REGDB CFG80211_USE_KERNEL_REGDB_KEYS CFG80211_WEXT CFS_BANDWIDTH CGROUP_BPF CGROUP_DEVICE CGROUP_HUGETLB CGROUP_NET_CLASSID CGROUP_NET_PRIO CGROUP_PERF CGROUP_RDMA CGROUP_WRITEBACK CHARGER_ISP1704 CHR_DEV_ST CIFS CIFS_ALLOW_INSECURE_LEGACY CIFS_DEBUG CIFS_DFS_UPCALL CIFS_FSCACHE CIFS_POSIX CIFS_SMB_DIRECT CIFS_SWN_UPCALL CIFS_UPCALL CIFS_XATTR CLS_U32_MARK CLS_U32_PERF CMA CMA_SIZE_SEL_MBYTES CMDLINE_PARTITION COMEDI COMEDI_DT9812 COMEDI_NI_USB6501 COMEDI_USBDUX COMEDI_USBDUXFAST COMEDI_USBDUXSIGMA COMEDI_USB_DRIVERS COMEDI_VMK80XX COMPAT_NETLINK_MESSAGES COUNTER CRAMFS CRAMFS_BLOCKDEV CRAMFS_MTD CRC4 CRC64 CRC7 CRC8 CRC_ITU_T CRC_T10DIF CRYPTO_ADIANTUM CRYPTO_AEGIS128 CRYPTO_AEGIS128_AESNI_SSE2 CRYPTO_AES_NI_INTEL CRYPTO_AES_TI CRYPTO_ANSI_CPRNG CRYPTO_ANUBIS CRYPTO_ARC4 CRYPTO_ARCH_HAVE_LIB_BLAKE2S CRYPTO_ARCH_HAVE_LIB_CHACHA CRYPTO_ARCH_HAVE_LIB_CURVE25519 CRYPTO_ARCH_HAVE_LIB_POLY1305 CRYPTO_BLAKE2B CRYPTO_BLAKE2S_X86 CRYPTO_BLOWFISH CRYPTO_BLOWFISH_COMMON CRYPTO_BLOWFISH_X86_64 CRYPTO_CAMELLIA CRYPTO_CAMELLIA_AESNI_AVX2_X86_64 CRYPTO_CAMELLIA_AESNI_AVX_X86_64 CRYPTO_CAMELLIA_X86_64 CRYPTO_CAST5 CRYPTO_CAST5_AVX_X86_64 CRYPTO_CAST6 CRYPTO_CAST6_AVX_X86_64 CRYPTO_CAST_COMMON CRYPTO_CHACHA20 CRYPTO_CHACHA20POLY1305 CRYPTO_CHACHA20_X86_64 CRYPTO_CRC32 CRYPTO_CRC32C_INTEL CRYPTO_CRC32_PCLMUL CRYPTO_CRCT10DIF CRYPTO_CRCT10DIF_PCLMUL CRYPTO_CRYPTD CRYPTO_CTS CRYPTO_CURVE25519 CRYPTO_CURVE25519_X86 CRYPTO_DEFLATE CRYPTO_DES CRYPTO_DES3_EDE_X86_64 CRYPTO_DEV_CCP CRYPTO_DEV_CCP_DD CRYPTO_DEV_PADLOCK CRYPTO_DEV_PADLOCK_AES CRYPTO_DEV_PADLOCK_SHA CRYPTO_DEV_QAT CRYPTO_DEV_QAT_C3XXX CRYPTO_DEV_QAT_C3XXXVF CRYPTO_DEV_QAT_C62X CRYPTO_DEV_QAT_C62XVF CRYPTO_DEV_QAT_DH895xCC CRYPTO_DEV_QAT_DH895xCCVF CRYPTO_DEV_VIRTIO CRYPTO_DH CRYPTO_DRBG_CTR CRYPTO_DRBG_HASH CRYPTO_ECB CRYPTO_ECC CRYPTO_ECDH CRYPTO_ECRDSA CRYPTO_ENGINE CRYPTO_ESSIV CRYPTO_FCRYPT CRYPTO_GHASH_CLMUL_NI_INTEL CRYPTO_KEYWRAP CRYPTO_KHAZAD CRYPTO_KPP CRYPTO_LIB_ARC4 CRYPTO_LIB_CHACHA CRYPTO_LIB_CHACHA20POLY1305 CRYPTO_LIB_CHACHA_GENERIC CRYPTO_LIB_CURVE25519 CRYPTO_LIB_CURVE25519_GENERIC CRYPTO_LIB_DES CRYPTO_LIB_POLY1305 CRYPTO_LIB_POLY1305_GENERIC CRYPTO_LIB_SM4 CRYPTO_LRW CRYPTO_MICHAEL_MIC CRYPTO_NHPOLY1305 CRYPTO_NHPOLY1305_AVX2 CRYPTO_NHPOLY1305_SSE2 CRYPTO_PCBC CRYPTO_PCRYPT CRYPTO_POLY1305 CRYPTO_POLY1305_X86_64 CRYPTO_RMD160 CRYPTO_SEED CRYPTO_SERPENT CRYPTO_SERPENT_AVX2_X86_64 CRYPTO_SERPENT_AVX_X86_64 CRYPTO_SERPENT_SSE2_X86_64 CRYPTO_SHA1_SSSE3 CRYPTO_SHA256_SSSE3 CRYPTO_SHA3 CRYPTO_SHA512_SSSE3 CRYPTO_SIMD CRYPTO_SM2 CRYPTO_SM3 CRYPTO_SM4 CRYPTO_STREEBOG CRYPTO_TEA CRYPTO_TWOFISH CRYPTO_TWOFISH_AVX_X86_64 CRYPTO_TWOFISH_COMMON CRYPTO_TWOFISH_X86_64 CRYPTO_TWOFISH_X86_64_3WAY CRYPTO_USER CRYPTO_USER_API CRYPTO_USER_API_AEAD CRYPTO_USER_API_ENABLE_OBSOLETE CRYPTO_USER_API_HASH CRYPTO_USER_API_RNG CRYPTO_USER_API_SKCIPHER CRYPTO_VMAC CRYPTO_WP512 CRYPTO_XCBC CRYPTO_XTS CRYPTO_XXHASH CUSE CYPRESS_FIRMWARE DAMON DAMON_DBGFS DAMON_VADDR DAX DCA DCB DEBUG_PREEMPT DEFAULT_PFIFO_FAST DEVICE_PRIVATE DEV_COREDUMP DEV_DAX DEV_PAGEMAP_OPS DIMLIB DLN2_ADC DMABUF_HEAPS DMABUF_HEAPS_CMA DMABUF_HEAPS_SYSTEM DMABUF_MOVE_NOTIFY DMA_CMA DMA_ENGINE_RAID DM_BIO_PRISON DM_BUFIO DM_CACHE DM_CACHE_SMQ DM_CLONE DM_CRYPT DM_FLAKEY DM_INTEGRITY DM_MULTIPATH DM_MULTIPATH_QL DM_MULTIPATH_ST DM_PERSISTENT_DATA DM_RAID DM_SNAPSHOT DM_THIN_PROVISIONING DM_UEVENT DM_VERITY DM_VERITY_FEC DM_WRITECACHE DM_ZONED DRAGONRISE_FF DRM DRM_BOCHS DRM_BRIDGE DRM_CIRRUS_QEMU DRM_DEBUG_MM DRM_DP_AUX_CHARDEV DRM_GEM_SHMEM_HELPER DRM_GM12U320 DRM_GUD DRM_I915 DRM_I915_CAPTURE_ERROR DRM_I915_COMPRESS_ERROR DRM_I915_USERPTR DRM_KMS_HELPER DRM_MIPI_DSI DRM_PANEL DRM_PANEL_BRIDGE DRM_PANEL_ORIENTATION_QUIRKS DRM_SIMPLEDRM DRM_TTM DRM_TTM_HELPER DRM_UDL ENCRYPTED_KEYS FSCACHE FUSE_FS HAMRADIO HID_DRAGONRISE IIO INFINIBAND INFINIBAND_ADDR_TRANS INFINIBAND_RTRS_CLIENT IOSCHED_BFQ ISDN ISDN_CAPI LIBNVDIMM MAC80211 MAC80211_LEDS MEDIA_SUPPORT MEMORY_HOTPLUG MEMORY_HOTREMOVE MFD_DLN2 MTD NET_CLS_U32 NET_SCH_DEFAULT PARTITION_ADVANCED PREEMPTION RFKILL SERIAL_DEV_BUS STAGING TCG_TPM TLS TLS_DEVICE TRANSPARENT_HUGEPAGE TRUSTED_KEYS USB_GADGET USB_PHY VLAN_8021Q WANT_COMPAT_NETLINK_MESSAGES WEXT_CORE WIRELESS WIRELESS_EXT WLAN WLAN_VENDOR_ATH X86_X32 ZONE_DEVICE] disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN BUG KASAN], they are not needed testing current HEAD 4735586da88ed2254ada53bbe19ce4fe968a1e7b testing commit 4735586da88ed2254ada53bbe19ce4fe968a1e7b gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: faef97d604b681980eed929a18dbccbcfaa5858c80ee55d7894dbe3a46c11ac6 all runs: crashed: possible deadlock in btrfs_dirty_inode representative crash: possible deadlock in btrfs_dirty_inode, types: [LOCKDEP] crash still not fixed/happens on the oldest tested release revisions tested: 8, total time: 2h5m8.537854969s (build: 1h13m18.185354649s, test: 48m55.380400157s) crash still not fixed or there were kernel test errors commit msg: Linux 5.15.176 crash: possible deadlock in btrfs_dirty_inode BTRFS info (device loop2): setting incompat feature flag for COMPRESS_ZSTD (0x10) BTRFS info (device loop2): use zstd compression, level 3 BTRFS info (device loop2): force zstd compression, level 3 BTRFS info (device loop2): has skinny extents BTRFS info (device loop2): clearing free space tree BTRFS info (device loop2): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) BTRFS info (device loop2): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) ====================================================== WARNING: possible circular locking dependency detected 5.15.176-syzkaller #0 Not tainted ------------------------------------------------------ syz.2.15/2733 is trying to acquire lock: ffff888178174628 (sb_internal#2){.+.+}-{0:0}, at: btrfs_dirty_inode+0x43/0xe0 fs/btrfs/inode.c:6436 but task is already holding lock: ffff8881771b8610 (&type->i_mutex_dir_key#8){++++}-{3:3}, at: inode_lock include/linux/fs.h:789 [inline] ffff8881771b8610 (&type->i_mutex_dir_key#8){++++}-{3:3}, at: chown_common+0x145/0x280 fs/open.c:674 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (&type->i_mutex_dir_key#8){++++}-{3:3}: down_read+0x23/0xd0 kernel/locking/rwsem.c:1498 inode_lock_shared include/linux/fs.h:799 [inline] lookup_slow fs/namei.c:1679 [inline] walk_component+0x13d/0x1c0 fs/namei.c:1976 lookup_last fs/namei.c:2431 [inline] path_lookupat+0x69/0x1b0 fs/namei.c:2455 filename_lookup+0xc6/0x1d0 fs/namei.c:2484 kern_path+0x29/0x40 fs/namei.c:2582 lookup_bdev+0x32/0xb0 block/bdev.c:979 device_matched fs/btrfs/volumes.c:568 [inline] btrfs_free_stale_devices+0x1a9/0x460 fs/btrfs/volumes.c:608 btrfs_forget_devices+0x2b/0x50 fs/btrfs/volumes.c:1431 btrfs_control_ioctl+0x69/0x170 fs/btrfs/super.c:2451 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __x64_sys_ioctl+0x7b/0xb0 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x33/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 -> #2 (&fs_devs->device_list_mutex){+.+.}-{3:3}: __mutex_lock_common kernel/locking/mutex.c:596 [inline] __mutex_lock+0x60/0x660 kernel/locking/mutex.c:729 btrfs_run_dev_stats+0x41/0x4a0 fs/btrfs/volumes.c:7985 commit_cowonly_roots+0x9f/0x2a0 fs/btrfs/transaction.c:1290 btrfs_commit_transaction+0x46f/0xb00 fs/btrfs/transaction.c:2392 btrfs_start_pre_rw_mount.cold+0x7e/0xfd fs/btrfs/disk-io.c:3079 open_ctree+0x1634/0x186f fs/btrfs/disk-io.c:3634 btrfs_fill_super fs/btrfs/super.c:1387 [inline] btrfs_mount_root.cold+0x12/0xde fs/btrfs/super.c:1752 legacy_get_tree+0x28/0x50 fs/fs_context.c:611 vfs_get_tree+0x18/0x70 fs/super.c:1530 fc_mount fs/namespace.c:1000 [inline] vfs_kern_mount.part.0+0x6c/0xb0 fs/namespace.c:1030 btrfs_mount+0x118/0x390 fs/btrfs/super.c:1812 legacy_get_tree+0x28/0x50 fs/fs_context.c:611 vfs_get_tree+0x18/0x70 fs/super.c:1530 do_new_mount fs/namespace.c:3012 [inline] path_mount+0x2b9/0xb50 fs/namespace.c:3342 do_mount fs/namespace.c:3355 [inline] __do_sys_mount fs/namespace.c:3563 [inline] __se_sys_mount fs/namespace.c:3540 [inline] __x64_sys_mount+0xfe/0x140 fs/namespace.c:3540 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x33/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 -> #1 (&fs_info->tree_log_mutex){+.+.}-{3:3}: __lock_release kernel/locking/lockdep.c:5339 [inline] lock_release+0x101/0x220 kernel/locking/lockdep.c:5643 __mutex_unlock_slowpath+0x37/0x1e0 kernel/locking/mutex.c:851 btrfs_commit_transaction+0x6bd/0xb00 fs/btrfs/transaction.c:2439 btrfs_start_pre_rw_mount.cold+0x7e/0xfd fs/btrfs/disk-io.c:3079 open_ctree+0x1634/0x186f fs/btrfs/disk-io.c:3634 btrfs_fill_super fs/btrfs/super.c:1387 [inline] btrfs_mount_root.cold+0x12/0xde fs/btrfs/super.c:1752 legacy_get_tree+0x28/0x50 fs/fs_context.c:611 vfs_get_tree+0x18/0x70 fs/super.c:1530 fc_mount fs/namespace.c:1000 [inline] vfs_kern_mount.part.0+0x6c/0xb0 fs/namespace.c:1030 btrfs_mount+0x118/0x390 fs/btrfs/super.c:1812 legacy_get_tree+0x28/0x50 fs/fs_context.c:611 vfs_get_tree+0x18/0x70 fs/super.c:1530 do_new_mount fs/namespace.c:3012 [inline] path_mount+0x2b9/0xb50 fs/namespace.c:3342 do_mount fs/namespace.c:3355 [inline] __do_sys_mount fs/namespace.c:3563 [inline] __se_sys_mount fs/namespace.c:3540 [inline] __x64_sys_mount+0xfe/0x140 fs/namespace.c:3540 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x33/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 -> #0 (sb_internal#2){.+.+}-{0:0}: check_prev_add kernel/locking/lockdep.c:3053 [inline] check_prevs_add kernel/locking/lockdep.c:3172 [inline] validate_chain kernel/locking/lockdep.c:3788 [inline] __lock_acquire+0x10b6/0x1a40 kernel/locking/lockdep.c:5012 lock_acquire kernel/locking/lockdep.c:5623 [inline] lock_acquire+0xbb/0x290 kernel/locking/lockdep.c:5588 percpu_down_read include/linux/percpu-rwsem.h:51 [inline] __sb_start_write include/linux/fs.h:1813 [inline] sb_start_intwrite include/linux/fs.h:1930 [inline] start_transaction+0x3e5/0x6a0 fs/btrfs/transaction.c:678 btrfs_dirty_inode+0x43/0xe0 fs/btrfs/inode.c:6436 btrfs_setattr+0x2e8/0x6e0 fs/btrfs/inode.c:5495 notify_change+0x1f8/0x500 fs/attr.c:505 chown_common+0x23d/0x280 fs/open.c:680 do_fchownat+0x88/0xe0 fs/open.c:711 __do_sys_lchown fs/open.c:736 [inline] __se_sys_lchown fs/open.c:734 [inline] __x64_sys_lchown+0x1c/0x20 fs/open.c:734 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x33/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 other info that might help us debug this: Chain exists of: sb_internal#2 --> &fs_devs->device_list_mutex --> &type->i_mutex_dir_key#8 Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&type->i_mutex_dir_key#8); lock(&fs_devs->device_list_mutex); lock(&type->i_mutex_dir_key#8); lock(sb_internal#2); *** DEADLOCK *** 2 locks held by syz.2.15/2733: #0: ffff888178174438 (sb_writers#13){.+.+}-{0:0}, at: do_fchownat+0x73/0xe0 fs/open.c:708 #1: ffff8881771b8610 (&type->i_mutex_dir_key#8){++++}-{3:3}, at: inode_lock include/linux/fs.h:789 [inline] #1: ffff8881771b8610 (&type->i_mutex_dir_key#8){++++}-{3:3}, at: chown_common+0x145/0x280 fs/open.c:674 stack backtrace: CPU: 0 PID: 2733 Comm: syz.2.15 Not tainted 5.15.176-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x57/0x7d lib/dump_stack.c:106 check_noncircular+0xcc/0xe0 kernel/locking/lockdep.c:2133 check_prev_add kernel/locking/lockdep.c:3053 [inline] check_prevs_add kernel/locking/lockdep.c:3172 [inline] validate_chain kernel/locking/lockdep.c:3788 [inline] __lock_acquire+0x10b6/0x1a40 kernel/locking/lockdep.c:5012 lock_acquire kernel/locking/lockdep.c:5623 [inline] lock_acquire+0xbb/0x290 kernel/locking/lockdep.c:5588 percpu_down_read include/linux/percpu-rwsem.h:51 [inline] __sb_start_write include/linux/fs.h:1813 [inline] sb_start_intwrite include/linux/fs.h:1930 [inline] start_transaction+0x3e5/0x6a0 fs/btrfs/transaction.c:678 btrfs_dirty_inode+0x43/0xe0 fs/btrfs/inode.c:6436 btrfs_setattr+0x2e8/0x6e0 fs/btrfs/inode.c:5495 notify_change+0x1f8/0x500 fs/attr.c:505 chown_common+0x23d/0x280 fs/open.c:680 do_fchownat+0x88/0xe0 fs/open.c:711 __do_sys_lchown fs/open.c:736 [inline] __se_sys_lchown fs/open.c:734 [inline] __x64_sys_lchown+0x1c/0x20 fs/open.c:734 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x33/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fa453baced9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fa452e2b058 EFLAGS: 00000246 ORIG_RAX: 000000000000005e RAX: ffffffffffffffda RBX: 00007fa453d72fa0 RCX: 00007fa453baced9 RDX: 0000000000000000 RSI: 000000000000ee00 RDI: 0000000020000000 RBP: 00007fa453c20cc8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fa453d72fa0 R15: 00007fff84ef3348