ci2 starts bisection 2025-10-23 02:52:06.092307262 +0000 UTC m=+32384.909685253 bisecting fixing commit since c330cb607721bae34c404604e2867be53e6c6949 building syzkaller on bf27483f963359281b2d9b6d6efd36289f82e282 ensuring issue is reproducible on original commit c330cb607721bae34c404604e2867be53e6c6949 testing commit c330cb607721bae34c404604e2867be53e6c6949 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: f54d00d38a4e065f21a6f60832362edf6556d0d30a5679922c27603a03cb0408 all runs: crashed: possible deadlock in ocfs2_fiemap representative crash: possible deadlock in ocfs2_fiemap, types: [LOCKDEP] check whether we can drop unnecessary instrumentation disabling configs for [kasan atomic_sleep hang memleak ubsan bug_or_warning], they are not needed testing commit c330cb607721bae34c404604e2867be53e6c6949 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: ee0601f1d3bd6d0e0e38cd53b9e09555ca7d5bedb769a7eb1ff05438d33a4046 all runs: crashed: possible deadlock in ocfs2_fiemap representative crash: possible deadlock in ocfs2_fiemap, types: [LOCKDEP] the bug reproduces without the instrumentation disabling configs for [bug_or_warning kasan atomic_sleep hang memleak ubsan], they are not needed kconfig minimization: base=4109 full=8349 leaves diff=2173 split chunks (needed=false): <2173> split chunk #0 of len 2173 into 5 parts testing without sub-chunk 1/5 disabling configs for [atomic_sleep hang memleak ubsan bug_or_warning kasan], they are not needed testing commit c330cb607721bae34c404604e2867be53e6c6949 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 867216d4989e7689c3e65b41b9ebae1c162207d07c9264c874420adc871f73c9 all runs: crashed: possible deadlock in ocfs2_fiemap representative crash: possible deadlock in ocfs2_fiemap, types: [LOCKDEP] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [ubsan bug_or_warning kasan atomic_sleep hang memleak], they are not needed testing commit c330cb607721bae34c404604e2867be53e6c6949 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 04259d57c8ad2bb7ab88f7eb04a110c2a70835267b8d4807adf6aa7e44e4bc0e all runs: crashed: possible deadlock in ocfs2_fiemap representative crash: possible deadlock in ocfs2_fiemap, types: [LOCKDEP] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [hang memleak ubsan bug_or_warning kasan atomic_sleep], they are not needed testing commit c330cb607721bae34c404604e2867be53e6c6949 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: ae92d14216cd584be3721be3922752f547280f517c04448d4980ff1aac31cd12 all runs: crashed: possible deadlock in ocfs2_fiemap representative crash: possible deadlock in ocfs2_fiemap, types: [LOCKDEP] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [atomic_sleep hang memleak ubsan bug_or_warning kasan], they are not needed testing commit c330cb607721bae34c404604e2867be53e6c6949 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: c72d7a94202632d8a5e04a5aed67d76ca66e488fff38b127815aad707b16f59f all runs: OK false negative chance: 0.000 testing without sub-chunk 5/5 disabling configs for [atomic_sleep hang memleak ubsan bug_or_warning kasan], they are not needed testing commit c330cb607721bae34c404604e2867be53e6c6949 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: c056f04b1850c93dbb146808e5805544097697a0e683270564901b7691f77937 all runs: crashed: possible deadlock in ocfs2_fiemap representative crash: possible deadlock in ocfs2_fiemap, types: [LOCKDEP] the chunk can be dropped minimized to 435 configs; suspects: [AF_RXRPC ARCH_ENABLE_MEMORY_HOTREMOVE ATM AX25 BT BT_BREDR BT_HIDP BXT_WC_PMIC_OPREGION CFG80211 CMA DAX DLM DRM DVB_CORE ENCRYPTED_KEYS EXTCON GENEVE GPIOLIB HAMRADIO HAVE_CLK HID_NINTENDO HID_NVIDIA_SHIELD HID_PLAYSTATION HID_SENSOR_HUB HID_SMARTJOYPLUS HID_STEAM HID_THRUSTMASTER IIO INFINIBAND INFINIBAND_ADDR_TRANS INFINIBAND_IPOIB INFINIBAND_USER_ACCESS INFINIBAND_VIRT_DMA INPUT_TABLET INPUT_TOUCHSCREEN INTEL_SCU_IPC INTEL_SOC_PMIC_BXTWC IP_SCTP L2TP LEDS_CLASS_MULTICOLOR LIBNVDIMM MAC80211 MEDIA_COMMON_OPTIONS MEDIA_DIGITAL_TV_SUPPORT MEDIA_PLATFORM_SUPPORT MEDIA_RADIO_SUPPORT MEDIA_SUPPORT MEDIA_USB_SUPPORT MEMORY_HOTPLUG MEMORY_HOTREMOVE MFD_DLN2 MFD_INTEL_PMC_BXT MFD_MT6360 MFD_MT6370 MFD_RETU MMC MTD MTD_UBI NETFILTER_CONNCOUNT NET_IPGRE NET_IPGRE_DEMUX NFS_V4_1 NF_SOCKET_IPV4 NF_SOCKET_IPV6 NF_TPROXY_IPV4 NF_TPROXY_IPV6 NILFS2_FS NINTENDO_FF NLMON NLS_CODEPAGE_1250 NLS_CODEPAGE_1251 NLS_CODEPAGE_737 NLS_CODEPAGE_775 NLS_CODEPAGE_850 NLS_CODEPAGE_852 NLS_CODEPAGE_855 NLS_CODEPAGE_857 NLS_CODEPAGE_860 NLS_CODEPAGE_861 NLS_CODEPAGE_862 NLS_CODEPAGE_863 NLS_CODEPAGE_864 NLS_CODEPAGE_865 NLS_CODEPAGE_866 NLS_CODEPAGE_869 NLS_CODEPAGE_874 NLS_CODEPAGE_932 NLS_CODEPAGE_936 NLS_CODEPAGE_949 NLS_CODEPAGE_950 NLS_ISO8859_13 NLS_ISO8859_14 NLS_ISO8859_15 NLS_ISO8859_2 NLS_ISO8859_3 NLS_ISO8859_4 NLS_ISO8859_5 NLS_ISO8859_6 NLS_ISO8859_7 NLS_ISO8859_8 NLS_ISO8859_9 NLS_KOI8_R NLS_KOI8_U NLS_MAC_CELTIC NLS_MAC_CENTEURO NLS_MAC_CROATIAN NLS_MAC_CYRILLIC NLS_MAC_GAELIC NLS_MAC_GREEK NLS_MAC_ICELAND NLS_MAC_INUIT NLS_MAC_ROMAN NLS_MAC_ROMANIAN NLS_MAC_TURKISH NLS_UCS2_UTILS NOZOMI NTFS3_FS NTFS3_FS_POSIX_ACL NTFS3_LZX_XPRESS NULL_TTY NUMA_EMU NUMA_KEEP_MEMINFO NVDIMM_DAX NVDIMM_KEYS NVDIMM_PFN NVIDIA_SHIELD_FF NVME_CORE NVME_FABRICS NVME_FC NVME_MULTIPATH NVME_RDMA NVME_TARGET NVME_TARGET_FC NVME_TARGET_FCLOOP NVME_TARGET_LOOP NVME_TARGET_RDMA NVME_TARGET_TCP NVME_TCP N_GSM N_HDLC OCFS2_DEBUG_FS OCFS2_FS OCFS2_FS_O2CB OCFS2_FS_STATS OCFS2_FS_USERSPACE_CLUSTER OF_GPIO OF_PMEM OMFS_FS OPENVSWITCH OPENVSWITCH_GENEVE OPENVSWITCH_GRE OPENVSWITCH_VXLAN ORANGEFS_FS OSF_PARTITION OVERLAY_FS OVERLAY_FS_DEBUG OVERLAY_FS_INDEX OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW OVERLAY_FS_REDIRECT_DIR PACKET_DIAG PAGE_IDLE_FLAG PAGE_REPORTING PAHOLE_HAS_BTF_TAG PAHOLE_HAS_LANG_EXCLUDE PAHOLE_HAS_SPLIT_BTF PARPORT PARPORT_NOT_PC PARTITION_ADVANCED PCCARD PCCARD_NONSTATIC PCIEAER PCI_ENDPOINT PCI_IOV PCMCIA PCMCIA_LOAD_CIS PERCPU_STATS PERSISTENT_KEYRINGS PHYLINK PHY_CPCAP_USB PHY_QCOM_USB_HS PHY_QCOM_USB_HSIC PHY_SAMSUNG_USB2 PHY_TUSB1210 PKCS7_TEST_KEY PKCS8_PRIVATE_KEY_PARSER PLAYSTATION_FF PLFXLC PMIC_OPREGION PM_CLK PNFS_BLOCK PNFS_FILE_LAYOUT PNFS_FLEXFILE_LAYOUT PPP PPPOATM PPPOE PPPOE_HASH_BITS_1 PPPOL2TP PPP_ASYNC PPP_BSDCOMP PPP_DEFLATE PPP_FILTER PPP_MPPE PPP_MULTILINK PPP_SYNC_TTY PPTP PREEMPT PREEMPT_NOTIFIERS PREEMPT_RT PROC_CHILDREN PSAMPLE PSI PSTORE PSTORE_COMPRESS QCOM_QMI_HELPERS QNX4FS_FS QNX6FS_FS QRTR QRTR_TUN RADIO_ADAPTERS RADIO_SHARK RADIO_SHARK2 RADIO_TEA575X RAID6_PQ RAID_ATTRS RC_ATI_REMOTE RC_CORE RC_DEVICES RC_XBOX_DVD RDMA_RXE RDMA_SIW RDS RDS_RDMA RDS_TCP REALTEK_AUTOPM REED_SOLOMON REED_SOLOMON_DEC8 REGMAP REGMAP_I2C REGMAP_IRQ REGMAP_MMIO REGMAP_SPI REGULATOR REGULATOR_FIXED_VOLTAGE REGULATOR_TWL4030 RESET_CONTROLLER RFKILL RFKILL_INPUT RFKILL_LEDS RMI4_2D_SENSOR RMI4_CORE RMI4_F03 RMI4_F03_SERIO RMI4_F11 RMI4_F12 RMI4_F30 RMI4_F3A ROMFS_BACKED_BY_BOTH ROMFS_FS ROMFS_ON_BLOCK ROMFS_ON_MTD ROSE RTC_DRV_HID_SENSOR_TIME RXKAD SCHED_CORE SCREEN_INFO SCSI_FC_ATTRS SCSI_HPSA SCSI_ISCSI_ATTRS SCSI_LOGGING SCSI_NETLINK SCSI_SAS_ATA SCSI_SAS_ATTRS SCSI_SAS_LIBSAS SCSI_SCAN_ASYNC SCSI_SRP_ATTRS SCTP_COOKIE_HMAC_MD5 SCTP_COOKIE_HMAC_SHA1 SCTP_DEFAULT_COOKIE_HMAC_MD5 SECONDARY_TRUSTED_KEYRING SECURITY_INFINIBAND SECURITY_NETWORK_XFRM SECURITY_SMACK_NETFILTER SENSORS_AQUACOMPUTER_D5NEXT SENSORS_CORSAIR_CPRO SENSORS_CORSAIR_PSU SENSORS_GIGABYTE_WATERFORCE SENSORS_NZXT_KRAKEN2 SENSORS_NZXT_SMART2 SENSORS_POWERZ SERIAL_DEV_BUS SERIAL_DEV_CTRL_TTYPORT SERIAL_MCTRL_GPIO SGI_PARTITION SIGNATURE SIGNED_PE_FILE_VERIFICATION SKB_DECRYPTED SLHC SLIP SLIP_COMPRESSED SLIP_MODE_SLIP6 SLIP_SMART SMARTJOYPLUS_FF SMBFS SMB_SERVER SMC SMC_DIAG SMSC_PHY SMS_SDIO_DRV SMS_SIANO_DEBUGFS SMS_SIANO_MDTV SMS_SIANO_RC SMS_USB_DRV SND SND_ALOOP SND_BCD2000 SND_CTL_FAST_LOOKUP SND_CTL_LED SND_DEBUG SND_DMA_SGBUF SND_DRIVERS SND_DUMMY SND_DYNAMIC_MINORS SND_HDA SND_HDA_CODEC_ALC260 SND_HDA_CODEC_ALC262 SND_HDA_CODEC_ALC268 SND_HDA_CODEC_ALC269 SND_HDA_CODEC_ALC662 SND_HDA_CODEC_ALC680 SND_HDA_CODEC_ALC861 SND_HDA_CODEC_ALC861VD SND_HDA_CODEC_ALC880 SND_HDA_CODEC_ALC882 SND_HDA_CODEC_ANALOG SND_HDA_CODEC_CA0110 SND_HDA_CODEC_CA0132 SND_HDA_CODEC_CIRRUS SND_HDA_CODEC_CMEDIA SND_HDA_CODEC_CONEXANT SND_HDA_CODEC_CS420X SND_HDA_CODEC_CS421X SND_HDA_CODEC_HDMI SND_HDA_CODEC_HDMI_ATI SND_HDA_CODEC_HDMI_GENERIC SND_HDA_CODEC_HDMI_INTEL SND_HDA_CODEC_HDMI_NVIDIA SND_HDA_CODEC_HDMI_NVIDIA_MCP SND_HDA_CODEC_HDMI_SIMPLE SND_HDA_CODEC_HDMI_TEGRA SND_HDA_CODEC_REALTEK SND_HDA_CODEC_REALTEK_LIB SND_HDA_CODEC_SI3054 SND_HDA_CODEC_SIGMATEL SND_HDA_CODEC_VIA SND_HDA_CORE SND_HDA_GENERIC SND_HDA_GENERIC_LEDS SND_HDA_HWDEP SND_HDA_INPUT_BEEP SND_HDA_INTEL SND_HDA_PATCH_LOADER SND_HDA_RECONFIG SND_HDA_SCODEC_COMPONENT SND_HRTIMER SND_HWDEP SND_INTEL_DSP_CONFIG SND_INTEL_NHLT SND_INTEL_SOUNDWIRE_ACPI SND_JACK SND_JACK_INPUT_DEV SND_MIXER_OSS SND_OSSEMUL SND_PCI SND_PCM SND_PCMCIA SND_PCM_ELD SND_PCM_OSS SND_PCM_OSS_PLUGINS SND_PCM_TIMER SND_PCM_XRUN_DEBUG SND_PROC_FS SND_RAWMIDI SND_SEQUENCER SND_SEQUENCER_OSS SND_SEQ_DEVICE SND_SEQ_DUMMY SND_SEQ_HRTIMER_DEFAULT SND_SEQ_MIDI SND_SEQ_MIDI_EVENT SND_SEQ_VIRMIDI SND_SOC SND_SOC_I2C_AND_SPI SND_SOC_SDCA_OPTIONAL SND_SUPPORT_OLD_API SND_TIMER SND_UMP SND_UMP_LEGACY_RAWMIDI SND_USB SND_USB_6FIRE SND_USB_AUDIO SND_USB_AUDIO_MIDI_V2 SND_USB_AUDIO_USE_MEDIA_CONTROLLER SND_USB_CAIAQ SND_USB_CAIAQ_INPUT SND_USB_HIFACE SND_USB_LINE6 SND_USB_POD SND_USB_PODHD SND_USB_TONEPORT SND_USB_UA101 SND_USB_US122L SND_USB_USX2Y SND_USB_VARIAX SND_VERBOSE_PROCFS SND_VIRMIDI SND_VIRTIO SND_VMASTER SND_X86 SOCK_VALIDATE_XMIT SOLARIS_X86_PARTITION SONY_FF SOUND SOUNDWIRE SOUND_OSS_CORE SOUND_OSS_CORE_PRECLAIM SPI SPI_DLN2 SPI_DYNAMIC SPI_LJCA SPI_MASTER SQUASHFS SQUASHFS_4K_DEVBLK_SIZE SQUASHFS_COMPILE_DECOMP_MULTI SQUASHFS_DECOMP_MULTI SQUASHFS_FILE_DIRECT SQUASHFS_LZ4 SQUASHFS_LZO SQUASHFS_XATTR SQUASHFS_XZ SQUASHFS_ZLIB SQUASHFS_ZSTD SSB SSB_PCIHOST_POSSIBLE SSB_PCMCIAHOST_POSSIBLE SSB_SDIOHOST_POSSIBLE STEAM_FF STP STREAM_PARSER SUNRPC_BACKCHANNEL SUN_PARTITION SURFACE_AGGREGATOR SURFACE_AGGREGATOR_BUS SURFACE_AGGREGATOR_REGISTRY SURFACE_HID SURFACE_HID_CORE SURFACE_KBD SW_SYNC SYSFB SYSFS_SYSCALL SYSV68_PARTITION TABLET_USB_ACECAD TABLET_USB_AIPTEK TABLET_USB_HANWANG TABLET_USB_KBTAB TABLET_USB_PEGASUS TAHVO_USB TAHVO_USB_HOST_BY_DEFAULT TCG_CRB TCG_TIS TCG_TIS_CORE TCG_TPM TCP_CONG_BBR TCP_CONG_BIC TCP_CONG_CDG TCP_CONG_DCTCP TCP_CONG_HSTCP TCP_CONG_HTCP TCP_CONG_HYBLA TCP_CONG_ILLINOIS TCP_CONG_LP TCP_CONG_NV TCP_CONG_SCALABLE TCP_CONG_VEGAS TCP_CONG_VENO TCP_CONG_WESTWOOD TCP_CONG_YEAH TEE TEXTSEARCH TEXTSEARCH_BM TEXTSEARCH_FSM TEXTSEARCH_KMP THRUSTMASTER_FF TIPC TIPC_CRYPTO TIPC_DIAG TIPC_MEDIA_IB TIPC_MEDIA_UDP TLS TLS_TOE TMPFS_QUOTA TOOLS_SUPPORT_RELR TOUCHSCREEN_SUR40 TOUCHSCREEN_USB_3M TOUCHSCREEN_USB_COMPOSITE TOUCHSCREEN_USB_DMC_TSC10 TOUCHSCREEN_USB_E2I TOUCHSCREEN_USB_EASYTOUCH TOUCHSCREEN_USB_EGALAX TOUCHSCREEN_USB_ELO TOUCHSCREEN_USB_ETT_TC45USB TOUCHSCREEN_USB_ETURBO TOUCHSCREEN_USB_GENERAL_TOUCH TOUCHSCREEN_USB_GOTOP TOUCHSCREEN_USB_GUNZE TOUCHSCREEN_USB_IDEALTEK TOUCHSCREEN_USB_IRTOUCH TOUCHSCREEN_USB_ITM TOUCHSCREEN_USB_JASTEC TOUCHSCREEN_USB_NEXIO TOUCHSCREEN_USB_PANJIT TOUCHSCREEN_USB_ZYTRONIC TTPCI_EEPROM TTY_PRINTK TUN_VNET_CROSS_LE TWL4030_CORE TYPEC TYPEC_ANX7411 TYPEC_DP_ALTMODE TYPEC_FUSB302 TYPEC_HD3SS3220 TYPEC_MT6360 TYPEC_MUX_FSA4480 TYPEC_MUX_GPIO_SBU TYPEC_MUX_INTEL_PMC TYPEC_MUX_NB7VPQ904M TYPEC_MUX_PTN36502 TYPEC_MUX_WCD939X_USBSS TYPEC_NVIDIA_ALTMODE TYPEC_RT1711H TYPEC_RT1719 TYPEC_STUSB160X TYPEC_TCPCI TYPEC_TCPCI_MAXIM TYPEC_TCPCI_MT6370 TYPEC_TCPM TYPEC_TPS6598X TYPEC_UCSI TYPEC_WCOVE TYPEC_WUSB3801 UBIFS_ATIME_SUPPORT UBIFS_FS UBIFS_FS_ADVANCED_COMPR UBIFS_FS_LZO UBIFS_FS_SECURITY UBIFS_FS_XATTR UBIFS_FS_ZLIB UBIFS_FS_ZSTD UCSI_ACPI UCSI_CCG UCSI_STM32G0 UDF_FS UDMABUF UFS_FS UFS_FS_WRITE UHID ULTRIX_PARTITION UNICODE UNIXWARE_DISKLABEL UNIX_DIAG USB4 USB4_NET USBIP_CORE USBIP_HOST USBIP_VHCI_HCD USBIP_VUDC USBPCWATCHDOG USB_ACM USB_ADUTUX USB_DWC2 USB_GADGET USB_LJCA USB_MUSB_HDRC USB_ROLE_SWITCH USB_STORAGE_REALTEK USB_ULPI_BUS VIDEO_DEV VXLAN WIRELESS WLAN WLAN_VENDOR_PURELIFI ZONE_DEVICE] disabling configs for [ubsan bug_or_warning kasan atomic_sleep hang memleak], they are not needed testing current HEAD 43e9ad0c55a369ecc84a4788d06a8a6bfa634f1c testing commit 43e9ad0c55a369ecc84a4788d06a8a6bfa634f1c gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 8e32c8199f0a407cc8eab55dea0dedece1a6e2ba3f14fc8c181424c8110c3d99 run #0: ignore: lost connection to test machine run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK false negative chance: 0.000 # git bisect start 43e9ad0c55a369ecc84a4788d06a8a6bfa634f1c c330cb607721bae34c404604e2867be53e6c6949 Bisecting: 6884 revisions left to test after this (roughly 13 steps) [58809f614e0e3f4e12b489bddf680bfeb31c0a20] Merge tag 'drm-next-2025-10-01' of https://gitlab.freedesktop.org/drm/kernel determine whether the revision contains the guilty commit revision c330cb607721bae34c404604e2867be53e6c6949 crashed and is reachable testing commit 58809f614e0e3f4e12b489bddf680bfeb31c0a20 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 3882a237cd4cdc7e2a2239e14fcdfafbb08b5835b2464bfe306d81c7e71d9a4e all runs: OK false negative chance: 0.000 # git bisect bad 58809f614e0e3f4e12b489bddf680bfeb31c0a20 Bisecting: 3865 revisions left to test after this (roughly 12 steps) [5fb024931949f3475260c84a0e4b0997af9c5530] Merge tag 'pinctrl-v6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl determine whether the revision contains the guilty commit revision c330cb607721bae34c404604e2867be53e6c6949 crashed and is reachable testing commit 5fb024931949f3475260c84a0e4b0997af9c5530 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 8d52889efe65eba26780097408c73037e9b7da22082fc49f75067c7aa5948e8c all runs: OK false negative chance: 0.000 # git bisect bad 5fb024931949f3475260c84a0e4b0997af9c5530 Bisecting: 2005 revisions left to test after this (roughly 11 steps) [fe68bb2861808ed5c48d399bd7e670ab76829d55] Merge tag 'microblaze-v6.18' of git://git.monstr.eu/linux-2.6-microblaze determine whether the revision contains the guilty commit revision c330cb607721bae34c404604e2867be53e6c6949 crashed and is reachable testing commit fe68bb2861808ed5c48d399bd7e670ab76829d55 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 97250343d1fde4d33b02c1862d55ddeaa198424a48100a294917edbf2bb0d4b2 all runs: OK false negative chance: 0.000 # git bisect bad fe68bb2861808ed5c48d399bd7e670ab76829d55 Bisecting: 964 revisions left to test after this (roughly 10 steps) [86cc796e5e9bff0c3993607f4301b8188095516c] Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm determine whether the revision contains the guilty commit revision c330cb607721bae34c404604e2867be53e6c6949 crashed and is reachable testing commit 86cc796e5e9bff0c3993607f4301b8188095516c gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: aa4213a7b91277c34024b22b48fbb606780565b2b655f02d21f955df19adf967 all runs: OK false negative chance: 0.000 # git bisect bad 86cc796e5e9bff0c3993607f4301b8188095516c Bisecting: 470 revisions left to test after this (roughly 9 steps) [d69eb204c255c35abd9e8cb621484e8074c75eaa] Merge tag 'net-6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net determine whether the revision contains the guilty commit revision c330cb607721bae34c404604e2867be53e6c6949 crashed and is reachable testing commit d69eb204c255c35abd9e8cb621484e8074c75eaa gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 94ade2ad31a31d8bca746c1babcf8d232c7fa9c54e0be7490ff4e532dd4a5e4d all runs: crashed: possible deadlock in ocfs2_fiemap representative crash: possible deadlock in ocfs2_fiemap, types: [LOCKDEP] # git bisect good d69eb204c255c35abd9e8cb621484e8074c75eaa Bisecting: 240 revisions left to test after this (roughly 8 steps) [e59a039119c3ec241228adf12dca0dd4398104d0] Merge tag 's390-6.17-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux determine whether the revision contains the guilty commit revision d69eb204c255c35abd9e8cb621484e8074c75eaa crashed and is reachable testing commit e59a039119c3ec241228adf12dca0dd4398104d0 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 05c06bc7bc40ddbca09787f4a804306560a4fa428210d921423069d392c961c1 all runs: OK false negative chance: 0.000 # git bisect bad e59a039119c3ec241228adf12dca0dd4398104d0 Bisecting: 116 revisions left to test after this (roughly 7 steps) [2c3bac60853ed8f67e42451c7810321ff1df9c7c] Merge tag 'edac_urgent_for_v6.17_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras determine whether the revision contains the guilty commit revision c330cb607721bae34c404604e2867be53e6c6949 crashed and is reachable testing commit 2c3bac60853ed8f67e42451c7810321ff1df9c7c gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 8e9ac4a87758b9de2293229822062487dbfe05eb9d02ec309a5ec246475bbfd4 all runs: crashed: possible deadlock in ocfs2_fiemap representative crash: possible deadlock in ocfs2_fiemap, types: [LOCKDEP] # git bisect good 2c3bac60853ed8f67e42451c7810321ff1df9c7c Bisecting: 57 revisions left to test after this (roughly 6 steps) [223ba8ee0a3986718c874b66ed24e7f87f6b8124] Merge tag 'vmscape-for-linus-20250904' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip determine whether the revision contains the guilty commit revision 2c3bac60853ed8f67e42451c7810321ff1df9c7c crashed and is reachable testing commit 223ba8ee0a3986718c874b66ed24e7f87f6b8124 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 5c0bbb43f73d4d861ee6cf74c776655ef7bc5997a5f6e32b9d2243d2e6fe40ad all runs: crashed: possible deadlock in ocfs2_fiemap representative crash: possible deadlock in ocfs2_fiemap, types: [LOCKDEP] # git bisect good 223ba8ee0a3986718c874b66ed24e7f87f6b8124 Bisecting: 36 revisions left to test after this (roughly 5 steps) [4f553c1e2c7b81e957b5463bd7efad2465a586f8] Merge tag 'mm-hotfixes-stable-2025-09-10-20-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm determine whether the revision contains the guilty commit revision 2c3bac60853ed8f67e42451c7810321ff1df9c7c crashed and is reachable testing commit 4f553c1e2c7b81e957b5463bd7efad2465a586f8 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 4b0b8b5ec568fd8f87bef30f73716e67da88ba13e70fec94160c9e3e719c104c all runs: OK false negative chance: 0.000 # git bisect bad 4f553c1e2c7b81e957b5463bd7efad2465a586f8 Bisecting: 10 revisions left to test after this (roughly 3 steps) [e67f0bd05519012eaabaae68618ffc4ed30ab680] s390: kexec: initialize kexec_buf struct determine whether the revision contains the guilty commit revision c330cb607721bae34c404604e2867be53e6c6949 crashed and is reachable testing commit e67f0bd05519012eaabaae68618ffc4ed30ab680 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: dc4081e02617d6473357cf8c3af563a68ca9c94c57e9906a869dce563cb47a75 all runs: crashed: possible deadlock in ocfs2_fiemap representative crash: possible deadlock in ocfs2_fiemap, types: [LOCKDEP] # git bisect good e67f0bd05519012eaabaae68618ffc4ed30ab680 Bisecting: 5 revisions left to test after this (roughly 3 steps) [04100f775c2ea501927f508f17ad824ad1f23c8d] ocfs2: fix recursive semaphore deadlock in fiemap call determine whether the revision contains the guilty commit revision e67f0bd05519012eaabaae68618ffc4ed30ab680 crashed and is reachable testing commit 04100f775c2ea501927f508f17ad824ad1f23c8d gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 616bab36880dd5ff5a7947e09f62808d0c8271f52194464fbe5d2afaf6208231 all runs: OK false negative chance: 0.000 # git bisect bad 04100f775c2ea501927f508f17ad824ad1f23c8d Bisecting: 2 revisions left to test after this (roughly 1 step) [7989fdce69ec0a928e136477da2aa208a191fba2] percpu: fix race on alloc failed warning limit determine whether the revision contains the guilty commit revision e67f0bd05519012eaabaae68618ffc4ed30ab680 crashed and is reachable testing commit 7989fdce69ec0a928e136477da2aa208a191fba2 gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 42f9ea491aec03962856724a0e4c2dd1ece25d06c943fdd7d6c7f9d3f90376dd all runs: crashed: possible deadlock in ocfs2_fiemap representative crash: possible deadlock in ocfs2_fiemap, types: [LOCKDEP] # git bisect good 7989fdce69ec0a928e136477da2aa208a191fba2 Bisecting: 0 revisions left to test after this (roughly 1 step) [d613f53c83ec47089c4e25859d5e8e0359f6f8da] mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory determine whether the revision contains the guilty commit revision e67f0bd05519012eaabaae68618ffc4ed30ab680 crashed and is reachable testing commit d613f53c83ec47089c4e25859d5e8e0359f6f8da gcc compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 kernel signature: 52eb08ed7d3b9dc00c8a04b0cf559f86543f2160e115f21cdcbcdd9723451023 all runs: crashed: possible deadlock in ocfs2_fiemap representative crash: possible deadlock in ocfs2_fiemap, types: [LOCKDEP] # git bisect good d613f53c83ec47089c4e25859d5e8e0359f6f8da 04100f775c2ea501927f508f17ad824ad1f23c8d is the first bad commit commit 04100f775c2ea501927f508f17ad824ad1f23c8d Author: Mark Tinguely Date: Fri Aug 29 10:18:15 2025 -0500 ocfs2: fix recursive semaphore deadlock in fiemap call syzbot detected a OCFS2 hang due to a recursive semaphore on a FS_IOC_FIEMAP of the extent list on a specially crafted mmap file. context_switch kernel/sched/core.c:5357 [inline] __schedule+0x1798/0x4cc0 kernel/sched/core.c:6961 __schedule_loop kernel/sched/core.c:7043 [inline] schedule+0x165/0x360 kernel/sched/core.c:7058 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7115 rwsem_down_write_slowpath+0x872/0xfe0 kernel/locking/rwsem.c:1185 __down_write_common kernel/locking/rwsem.c:1317 [inline] __down_write kernel/locking/rwsem.c:1326 [inline] down_write+0x1ab/0x1f0 kernel/locking/rwsem.c:1591 ocfs2_page_mkwrite+0x2ff/0xc40 fs/ocfs2/mmap.c:142 do_page_mkwrite+0x14d/0x310 mm/memory.c:3361 wp_page_shared mm/memory.c:3762 [inline] do_wp_page+0x268d/0x5800 mm/memory.c:3981 handle_pte_fault mm/memory.c:6068 [inline] __handle_mm_fault+0x1033/0x5440 mm/memory.c:6195 handle_mm_fault+0x40a/0x8e0 mm/memory.c:6364 do_user_addr_fault+0x764/0x1390 arch/x86/mm/fault.c:1387 handle_page_fault arch/x86/mm/fault.c:1476 [inline] exc_page_fault+0x76/0xf0 arch/x86/mm/fault.c:1532 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0010:copy_user_generic arch/x86/include/asm/uaccess_64.h:126 [inline] RIP: 0010:raw_copy_to_user arch/x86/include/asm/uaccess_64.h:147 [inline] RIP: 0010:_inline_copy_to_user include/linux/uaccess.h:197 [inline] RIP: 0010:_copy_to_user+0x85/0xb0 lib/usercopy.c:26 Code: e8 00 bc f7 fc 4d 39 fc 72 3d 4d 39 ec 77 38 e8 91 b9 f7 fc 4c 89 f7 89 de e8 47 25 5b fd 0f 01 cb 4c 89 ff 48 89 d9 4c 89 f6 a4 0f 1f 00 48 89 cb 0f 01 ca 48 89 d8 5b 41 5c 41 5d 41 5e 41 RSP: 0018:ffffc9000403f950 EFLAGS: 00050256 RAX: ffffffff84c7f101 RBX: 0000000000000038 RCX: 0000000000000038 RDX: 0000000000000000 RSI: ffffc9000403f9e0 RDI: 0000200000000060 RBP: ffffc9000403fa90 R08: ffffc9000403fa17 R09: 1ffff92000807f42 R10: dffffc0000000000 R11: fffff52000807f43 R12: 0000200000000098 R13: 00007ffffffff000 R14: ffffc9000403f9e0 R15: 0000200000000060 copy_to_user include/linux/uaccess.h:225 [inline] fiemap_fill_next_extent+0x1c0/0x390 fs/ioctl.c:145 ocfs2_fiemap+0x888/0xc90 fs/ocfs2/extent_map.c:806 ioctl_fiemap fs/ioctl.c:220 [inline] do_vfs_ioctl+0x1173/0x1430 fs/ioctl.c:532 __do_sys_ioctl fs/ioctl.c:596 [inline] __se_sys_ioctl+0x82/0x170 fs/ioctl.c:584 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5f13850fd9 RSP: 002b:00007ffe3b3518b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007f5f13850fd9 RDX: 0000200000000040 RSI: 00000000c020660b RDI: 0000000000000004 RBP: 6165627472616568 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe3b3518f0 R13: 00007ffe3b351b18 R14: 431bde82d7b634db R15: 00007f5f1389a03b ocfs2_fiemap() takes a read lock of the ip_alloc_sem semaphore (since v2.6.22-527-g7307de80510a) and calls fiemap_fill_next_extent() to read the extent list of this running mmap executable. The user supplied buffer to hold the fiemap information page faults calling ocfs2_page_mkwrite() which will take a write lock (since v2.6.27-38-g00dc417fa3e7) of the same semaphore. This recursive semaphore will hold filesystem locks and causes a hang of the fileystem. The ip_alloc_sem protects the inode extent list and size. Release the read semphore before calling fiemap_fill_next_extent() in ocfs2_fiemap() and ocfs2_fiemap_inline(). This does an unnecessary semaphore lock/unlock on the last extent but simplifies the error path. Link: https://lkml.kernel.org/r/61d1a62b-2631-4f12-81e2-cd689914360b@oracle.com Fixes: 00dc417fa3e7 ("ocfs2: fiemap support") Signed-off-by: Mark Tinguely Reported-by: syzbot+541dcc6ee768f77103e7@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=541dcc6ee768f77103e7 Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Signed-off-by: Andrew Morton fs/ocfs2/extent_map.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) accumulated error probability: 0.00 culprit signature: 616bab36880dd5ff5a7947e09f62808d0c8271f52194464fbe5d2afaf6208231 parent signature: 52eb08ed7d3b9dc00c8a04b0cf559f86543f2160e115f21cdcbcdd9723451023 revisions tested: 21, total time: 5h40m41.784604186s (build: 2h3m24.223386983s, test: 3h13m11.077463975s) first good commit: 04100f775c2ea501927f508f17ad824ad1f23c8d ocfs2: fix recursive semaphore deadlock in fiemap call recipients (to): ["akpm@linux-foundation.org" "joseph.qi@linux.alibaba.com" "mark.tinguely@oracle.com"] recipients (cc): []