ci starts bisection 2025-06-22 06:01:01.198074797 +0000 UTC m=+106552.618887492 bisecting cause commit starting from 5d4809e25903ab8e74034c1f23c787fd26d52934 building syzkaller on d6cdfb8a765c64793bc63cf630e68fbdd0ee0974 ensuring issue is reproducible on original commit 5d4809e25903ab8e74034c1f23c787fd26d52934 testing commit 5d4809e25903ab8e74034c1f23c787fd26d52934 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 7b5965d438eb2056d9a05c36a68b02226f6b403e2927808e53e7788c720e9b06 all runs: crashed: possible deadlock in btrfs_read_chunk_tree representative crash: possible deadlock in btrfs_read_chunk_tree, types: [LOCKDEP] check whether we can drop unnecessary instrumentation disabling configs for [BUG KASAN ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed testing commit 5d4809e25903ab8e74034c1f23c787fd26d52934 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: fc4513b357391900d93e4e6ed4ad5a19429c9ce60db40bccf552ed3bc151d843 all runs: crashed: possible deadlock in btrfs_read_chunk_tree representative crash: possible deadlock in btrfs_read_chunk_tree, types: [LOCKDEP] the bug reproduces without the instrumentation disabling configs for [LEAK UBSAN BUG KASAN ATOMIC_SLEEP HANG], they are not needed kconfig minimization: base=4095 full=8372 leaves diff=2121 split chunks (needed=false): <2121> split chunk #0 of len 2121 into 5 parts testing without sub-chunk 1/5 disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN BUG KASAN], they are not needed testing commit 5d4809e25903ab8e74034c1f23c787fd26d52934 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: d9501b25bd5d9ff62037eff43e1cd0d33494e3086a65d60fb9c0d7974ee78097 all runs: OK false negative chance: 0.000 testing without sub-chunk 2/5 disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN BUG KASAN], they are not needed testing commit 5d4809e25903ab8e74034c1f23c787fd26d52934 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 1a9503fc2fe802066319e08c5b776fdf50861ecb04b811d3b0025ae65d13227c all runs: crashed: possible deadlock in btrfs_read_chunk_tree representative crash: possible deadlock in btrfs_read_chunk_tree, types: [LOCKDEP] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [KASAN ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing commit 5d4809e25903ab8e74034c1f23c787fd26d52934 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: acc5cb6fa9fe7c1081ff6ce1d06284e5b055c4a02b3507d25d21dc4280b46111 all runs: crashed: possible deadlock in btrfs_read_chunk_tree representative crash: possible deadlock in btrfs_read_chunk_tree, types: [LOCKDEP] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [HANG LEAK UBSAN BUG KASAN ATOMIC_SLEEP], they are not needed testing commit 5d4809e25903ab8e74034c1f23c787fd26d52934 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: e002d2e832b95e32a218d3cc3096b735f015fd7222e52fee40f6d3a0f08d3afc all runs: crashed: possible deadlock in btrfs_read_chunk_tree representative crash: possible deadlock in btrfs_read_chunk_tree, types: [LOCKDEP] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [HANG LEAK UBSAN BUG KASAN ATOMIC_SLEEP], they are not needed testing commit 5d4809e25903ab8e74034c1f23c787fd26d52934 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 909977fa01a3fc23a59f5533e3461a6a0b5380093aa2c89ea1288267a8906b14 all runs: crashed: possible deadlock in btrfs_read_chunk_tree representative crash: possible deadlock in btrfs_read_chunk_tree, types: [LOCKDEP] the chunk can be dropped minimized to 425 configs; suspects: [6LOWPAN 6LOWPAN_GHC_EXT_HDR_DEST 6LOWPAN_GHC_EXT_HDR_FRAG 6LOWPAN_GHC_EXT_HDR_HOP 6LOWPAN_GHC_EXT_HDR_ROUTE 6LOWPAN_GHC_ICMPV6 6LOWPAN_GHC_UDP 6LOWPAN_NHC 6LOWPAN_NHC_DEST 6LOWPAN_NHC_FRAGMENT 6LOWPAN_NHC_HOP 6LOWPAN_NHC_IPV6 6LOWPAN_NHC_MOBILITY 6LOWPAN_NHC_ROUTING 6LOWPAN_NHC_UDP 6PACK 842_COMPRESS 842_DECOMPRESS 9P_FSCACHE 9P_FS_POSIX_ACL 9P_FS_SECURITY ACORN_PARTITION ACORN_PARTITION_ADFS ACORN_PARTITION_CUMANA ACORN_PARTITION_EESOX ACORN_PARTITION_ICS ACORN_PARTITION_POWERTEC ACORN_PARTITION_RISCIX ACPI_NFIT ACPI_NHLT ACPI_PLATFORM_PROFILE ADFS_FS AFFS_FS AFS_FS AFS_FSCACHE AF_KCM AF_RXRPC AF_RXRPC_IPV6 AIX_PARTITION AMD_SFH_HID AMIGA_PARTITION ANDROID_BINDERFS ANDROID_BINDER_IPC ANON_VMA_NAME APERTURE_HELPERS APPLE_MFI_FASTCHARGE AR5523 ARCH_ENABLE_MEMORY_HOTREMOVE ARCH_ENABLE_THP_MIGRATION ARCH_HAS_USER_SHADOW_STACK ARCH_SUPPORTS_HUGE_PFNMAP ARCH_SUPPORTS_PMD_PFNMAP ARCH_SUPPORTS_PUD_PFNMAP ARCH_WANT_PMD_MKWRITE ASM_MODVERSIONS ASUS_TF103C_DOCK ASYNC_CORE ASYNC_MEMCPY ASYNC_PQ ASYNC_RAID6_RECOV ASYNC_TX_DMA ASYNC_XOR ATARI_PARTITION ATA_GENERIC ATA_OVER_ETH ATH10K ATH10K_CE ATH10K_LEDS ATH10K_PCI ATH10K_USB ATH11K ATH6KL ATH6KL_USB ATH9K ATH9K_AHB ATH9K_BTCOEX_SUPPORT ATH9K_CHANNEL_CONTEXT ATH9K_COMMON ATH9K_COMMON_DEBUG ATH9K_COMMON_SPECTRAL ATH9K_DEBUGFS ATH9K_DYNACK ATH9K_HTC ATH9K_HTC_DEBUGFS ATH9K_HW ATH9K_PCI ATH9K_PCOEM ATH9K_RFKILL ATH_COMMON ATM ATM_BR2684 ATM_CLIP ATM_DRIVERS ATM_LANE ATM_MPOA ATM_TCP AUXILIARY_BUS AX25 AX25_DAMA_SLAVE AX88796B_PHY BAREUDP BATMAN_ADV BATMAN_ADV_BATMAN_V BATMAN_ADV_BLA BATMAN_ADV_DAT BATMAN_ADV_MCAST BATMAN_ADV_NC BCACHE BCACHEFS_DEBUG BCACHEFS_ERASURE_CODING BCACHEFS_FS BCACHEFS_POSIX_ACL BCACHEFS_QUOTA BCACHEFS_SIX_OPTIMISTIC_SPIN BCMA BCMA_HOST_PCI_POSSIBLE BEFS_FS BFQ_CGROUP_DEBUG BFQ_GROUP_IOSCHED BFS_FS BIG_KEYS BLK_CGROUP_PUNT_BIO BLK_CGROUP_RWSTAT BLK_DEV_BSGLIB BLK_DEV_INTEGRITY BLK_DEV_NBD BLK_DEV_NULL_BLK BLK_DEV_NULL_BLK_FAULT_INJECTION BLK_DEV_NVME BLK_DEV_PMEM BLK_DEV_RAM BLK_DEV_RNBD BLK_DEV_RNBD_CLIENT BLK_DEV_THROTTLING BLK_DEV_ZONED BLK_ICQ BLK_INLINE_ENCRYPTION BLK_INLINE_ENCRYPTION_FALLBACK BLK_WBT BLK_WBT_MQ BONDING BOOT_VESA_SUPPORT BPF_EVENTS BPF_JIT BPF_JIT_ALWAYS_ON BPF_JIT_DEFAULT_ON BPF_LSM BPF_PRELOAD BPF_PRELOAD_UMD BPF_STREAM_PARSER BPF_SYSCALL BPQETHER BRIDGE BRIDGE_CFM BRIDGE_EBT_802_3 BRIDGE_EBT_AMONG BRIDGE_EBT_ARP BRIDGE_EBT_ARPREPLY BRIDGE_EBT_BROUTE BRIDGE_EBT_DNAT BRIDGE_EBT_IP BRIDGE_EBT_IP6 BRIDGE_EBT_LIMIT BRIDGE_EBT_LOG BRIDGE_EBT_MARK BRIDGE_EBT_MARK_T BRIDGE_EBT_NFLOG BRIDGE_EBT_PKTTYPE BRIDGE_EBT_REDIRECT BRIDGE_EBT_SNAT BRIDGE_EBT_STP BRIDGE_EBT_T_FILTER BRIDGE_EBT_T_NAT BRIDGE_EBT_VLAN BRIDGE_IGMP_SNOOPING BRIDGE_MRP BRIDGE_NF_EBTABLES BRIDGE_NF_EBTABLES_LEGACY BRIDGE_VLAN_FILTERING BSD_DISKLABEL BSD_PROCESS_ACCT_V3 BT BTRFS_ASSERT BTRFS_FS BTRFS_FS_POSIX_ACL BTRFS_FS_REF_VERIFY BTT BT_6LOWPAN BT_ATH3K BT_BCM BT_BNEP BT_BNEP_MC_FILTER BT_BNEP_PROTO_FILTER BT_BREDR BT_HCIBCM203X BT_HCIBFUSB BT_HCIBPA10X BT_HCIBTUSB BT_HCIBTUSB_AUTOSUSPEND BT_HCIBTUSB_BCM BT_HCIBTUSB_MTK BT_HCIBTUSB_POLL_SYNC BT_HCIBTUSB_RTL BT_HCIUART BT_HCIUART_3WIRE BT_HCIUART_AG6XX BT_HCIUART_BCSP BT_HCIUART_H4 BT_HCIUART_LL BT_HCIUART_MRVL BT_HCIUART_QCA BT_HCIUART_SERDEV BT_HCIVHCI BT_INTEL BT_LE BT_LEDS BT_LE_L2CAP_ECRED BT_MRVL BT_MRVL_SDIO BT_MSFTEXT BT_MTK BT_MTKSDIO BT_MTKUART BT_QCA BT_RFCOMM BT_RFCOMM_TTY BT_RTL CACHEFILES CAIF CAIF_DEBUG CAIF_DRIVERS CAIF_NETDEV CAIF_TTY CAIF_USB CAIF_VIRTIO CAN CAN_8DEV_USB CAN_BCM CAN_CALC_BITTIMING CAN_DEV CAN_EMS_USB CAN_ESD_USB CAN_ETAS_ES58X CAN_F81604 CAN_GS_USB CAN_GW CAN_IFI_CANFD CAN_ISOTP CAN_J1939 CAN_KVASER_USB CAN_MCBA_USB CAN_NETLINK CAN_PEAK_USB CAN_RAW CAN_RX_OFFLOAD CAN_SLCAN CAN_UCAN CAN_VCAN CAN_VXCAN CARL9170 CARL9170_HWRNG CARL9170_LEDS CARL9170_WPC CEC_CORE CEPH_FS CEPH_FSCACHE CEPH_FS_POSIX_ACL CEPH_LIB CEPH_LIB_USE_DNS_RESOLVER CFG80211 CFG80211_CRDA_SUPPORT CFG80211_DEBUGFS CFG80211_DEFAULT_PS CFG80211_REQUIRE_SIGNED_REGDB CFG80211_USE_KERNEL_REGDB_KEYS CFG80211_WEXT CFS_BANDWIDTH CGROUP_BPF CHARGER_ISP1704 CHR_DEV_ST CIFS CIFS_ALLOW_INSECURE_LEGACY CIFS_DEBUG CIFS_DFS_UPCALL CIFS_FSCACHE CIFS_POSIX CIFS_SMB_DIRECT CIFS_SWN_UPCALL CIFS_UPCALL CIFS_XATTR CLOSURES CLS_U32_MARK CLS_U32_PERF CMA CMA_SIZE_SEL_MAX CMDLINE_PARTITION COMEDI COMEDI_DT9812 COMEDI_NI_USB6501 COMEDI_USBDUX COMEDI_USBDUXFAST COMEDI_USBDUXSIGMA COMEDI_USB_DRIVERS COMEDI_VMK80XX COMPAT_NETLINK_MESSAGES COUNTER CRAMFS CRAMFS_BLOCKDEV CRAMFS_MTD CRC64 CRC64_ARCH CRC8 CRC_CCITT CRC_ITU_T CRC_T10DIF CRC_T10DIF_ARCH CRYPTO_842 CRYPTO_ADIANTUM CRYPTO_AEGIS128 CRYPTO_AEGIS128_AESNI_SSE2 CRYPTO_AES_NI_INTEL CRYPTO_AES_TI CRYPTO_ANSI_CPRNG CRYPTO_ANUBIS CRYPTO_ARC4 CRYPTO_ARCH_HAVE_LIB_BLAKE2S CRYPTO_ARCH_HAVE_LIB_CHACHA CRYPTO_ARCH_HAVE_LIB_CURVE25519 CRYPTO_ARCH_HAVE_LIB_POLY1305 CRYPTO_ARIA CRYPTO_ARIA_AESNI_AVX_X86_64 CRYPTO_BLAKE2B CRYPTO_BLAKE2S_X86 CRYPTO_BLOWFISH CRYPTO_BLOWFISH_COMMON CRYPTO_BLOWFISH_X86_64 CRYPTO_CAMELLIA CRYPTO_CAMELLIA_AESNI_AVX2_X86_64 CRYPTO_CAMELLIA_AESNI_AVX_X86_64 CRYPTO_CAMELLIA_X86_64 CRYPTO_CAST5 CRYPTO_CAST5_AVX_X86_64 CRYPTO_CAST6 CRYPTO_CAST6_AVX_X86_64 CRYPTO_CAST_COMMON CRYPTO_CHACHA20 CRYPTO_CHACHA20POLY1305 CRYPTO_CHACHA20_X86_64 CRYPTO_CRC32C CRYPTO_CRYPTD CRYPTO_CTS CRYPTO_CURVE25519 CRYPTO_CURVE25519_X86 CRYPTO_DEFLATE CRYPTO_DES CRYPTO_DES3_EDE_X86_64 CRYPTO_DEV_CCP CRYPTO_DEV_CCP_DD CRYPTO_DEV_PADLOCK CRYPTO_DEV_PADLOCK_AES CRYPTO_DEV_PADLOCK_SHA CRYPTO_DEV_QAT CRYPTO_DEV_QAT_C3XXX CRYPTO_DEV_QAT_C3XXXVF CRYPTO_DEV_QAT_C62X CRYPTO_DEV_QAT_C62XVF CRYPTO_DEV_QAT_DH895xCC CRYPTO_DEV_QAT_DH895xCCVF CRYPTO_DEV_VIRTIO CRYPTO_DH CRYPTO_DRBG_CTR CRYPTO_DRBG_HASH CRYPTO_ECDH CRYPTO_ECRDSA CRYPTO_ENGINE CRYPTO_ESSIV CRYPTO_FCRYPT CRYPTO_GHASH_CLMUL_NI_INTEL CRYPTO_HCTR2 CRYPTO_HKDF CRYPTO_KDF800108_CTR CRYPTO_KHAZAD CRYPTO_KPP CRYPTO_KRB5 CRYPTO_KRB5ENC CRYPTO_LIB_ARC4 CRYPTO_LIB_CHACHA CRYPTO_LIB_CHACHA20POLY1305 CRYPTO_LIB_CHACHA_GENERIC CRYPTO_LIB_CURVE25519 CRYPTO_LIB_CURVE25519_GENERIC CRYPTO_LIB_CURVE25519_INTERNAL CRYPTO_LIB_DES CRYPTO_LIB_POLY1305 CRYPTO_LIB_POLY1305_GENERIC CRYPTO_LIB_SM3 CRYPTO_LRW CRYPTO_LZ4 CRYPTO_LZ4HC CRYPTO_MICHAEL_MIC CRYPTO_NHPOLY1305 CRYPTO_NHPOLY1305_AVX2 CRYPTO_NHPOLY1305_SSE2 CRYPTO_PCBC CRYPTO_PCRYPT CRYPTO_POLY1305_X86_64 CRYPTO_POLYVAL CRYPTO_POLYVAL_CLMUL_NI CRYPTO_RMD160 CRYPTO_SEED CRYPTO_SERPENT CRYPTO_SERPENT_AVX2_X86_64 CRYPTO_SERPENT_AVX_X86_64 CRYPTO_SERPENT_SSE2_X86_64 CRYPTO_SHA1_SSSE3 CRYPTO_SHA512_SSSE3 CRYPTO_SM3_AVX_X86_64 CRYPTO_SM4 CRYPTO_SM4_AESNI_AVX2_X86_64 CRYPTO_SM4_AESNI_AVX_X86_64 CRYPTO_SM4_GENERIC CRYPTO_STREEBOG CRYPTO_TEA CRYPTO_TWOFISH CRYPTO_TWOFISH_AVX_X86_64 CRYPTO_TWOFISH_COMMON CRYPTO_TWOFISH_X86_64 CRYPTO_TWOFISH_X86_64_3WAY CRYPTO_USER CRYPTO_USER_API CRYPTO_USER_API_AEAD CRYPTO_USER_API_ENABLE_OBSOLETE CRYPTO_USER_API_HASH CRYPTO_USER_API_RNG CRYPTO_USER_API_SKCIPHER CRYPTO_WP512 CRYPTO_XCBC CRYPTO_XCTR CRYPTO_XTS CRYPTO_XXHASH CRYPTO_ZSTD CUSE CYPRESS_FIRMWARE DAMON DAMON_PADDR DAMON_RECLAIM DAMON_VADDR DAX DCA DCB DEBUG_VFS DEFAULT_CODEL DEVICE_MIGRATION DEVICE_PRIVATE DEV_COREDUMP DEV_DAX DLN2_ADC DMABUF_HEAPS DMABUF_HEAPS_CMA DMABUF_HEAPS_SYSTEM DMABUF_MOVE_NOTIFY DMA_CMA DMA_ENGINE_RAID DM_AUDIT DM_BIO_PRISON DM_BUFIO DM_CACHE DM_CACHE_SMQ DM_CLONE DM_CRYPT DM_FLAKEY DM_INTEGRITY DM_MULTIPATH DM_MULTIPATH_QL DM_MULTIPATH_ST DM_PERSISTENT_DATA DM_RAID DM_SNAPSHOT DM_THIN_PROVISIONING DM_UEVENT DM_VERITY DM_VERITY_FEC DM_WRITECACHE DM_ZONED DRAGONRISE_FF DRM DRM_AUX_BRIDGE DRM_BOCHS DRM_BRIDGE DRM_BUDDY DRM_CIRRUS_QEMU DRM_CLIENT DRM_CLIENT_DEFAULT_FBDEV DRM_CLIENT_LIB DRM_CLIENT_SELECTION DRM_CLIENT_SETUP DRM_DEBUG_MM DRM_DISPLAY_DP_AUX_BUS DRM_DISPLAY_DP_HELPER DRM_DISPLAY_DSC_HELPER DRM_DISPLAY_HDCP_HELPER DRM_DISPLAY_HDMI_HELPER DRM_DISPLAY_HELPER DRM_FBDEV_EMULATION DRM_GEM_SHMEM_HELPER DRM_GM12U320 ENCRYPTED_KEYS FSCACHE FUSE_FS GPIOLIB HAMRADIO HID_DRAGONRISE IIO INFINIBAND INFINIBAND_ADDR_TRANS INFINIBAND_RTRS_CLIENT IOSCHED_BFQ LIBNVDIMM MAC80211 MAC80211_DEBUGFS MAC80211_LEDS MEDIA_SUPPORT MEMORY_HOTPLUG MEMORY_HOTREMOVE MFD_DLN2 MMC MTD NET_CLS_U32 NET_SCH_DEFAULT PARTITION_ADVANCED RFKILL SERIAL_DEV_BUS TLS TLS_DEVICE TRANSPARENT_HUGEPAGE TRUSTED_KEYS USB_GADGET USB_PHY VLAN_8021Q WANT_COMPAT_NETLINK_MESSAGES WEXT_CORE WIRELESS WLAN WLAN_VENDOR_ATH ZONE_DEVICE] disabling configs for [HANG LEAK UBSAN BUG KASAN ATOMIC_SLEEP], they are not needed picked [v6.15 v6.14 v6.13 v6.11 v6.9 v6.7 v6.5 v6.3 v6.0 v5.17 v5.14 v5.11 v5.8 v5.5 v5.2 v4.20 v4.19] out of 38 release tags testing release v6.15 testing commit 0ff41df1cb268fc69e703a08a57ee14ae967d0ca gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 0c680539e385ae03e9047ede8dc6d7a524b6de1c1134686b76a7151a25b741de all runs: OK false negative chance: 0.000 # git bisect start 5d4809e25903ab8e74034c1f23c787fd26d52934 0ff41df1cb268fc69e703a08a57ee14ae967d0ca Bisecting: 9201 revisions left to test after this (roughly 13 steps) [a4a45a9a72f3a9eaa17ec502d6e97c8eaa901825] fsdax: Remove unused trace events for dax insert mapping testing commit a4a45a9a72f3a9eaa17ec502d6e97c8eaa901825 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: a0733ad025866e230f20758561bad1ab203d5eb2999a4e8f891c782f28074a4c all runs: OK false negative chance: 0.000 # git bisect good a4a45a9a72f3a9eaa17ec502d6e97c8eaa901825 Bisecting: 4603 revisions left to test after this (roughly 12 steps) [d9864e7d151194b06c6cdbee8e69f0686238313a] Merge tag 'perf-urgent-2025-06-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip testing commit d9864e7d151194b06c6cdbee8e69f0686238313a gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 3bbcd3ae4794b4d050e279e4639ecb37e82aa2f519fb46b6a37f210207c051d5 all runs: OK false negative chance: 0.000 # git bisect good d9864e7d151194b06c6cdbee8e69f0686238313a Bisecting: 2476 revisions left to test after this (roughly 11 steps) [fe60fa2473fa928a35ff9bc6a5bb387ba7d22c00] Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git testing commit fe60fa2473fa928a35ff9bc6a5bb387ba7d22c00 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 610057eae0e5c46453924e4f3631cecf354f446a6331d69f1c57d75bd2d7c525 all runs: crashed: possible deadlock in btrfs_read_chunk_tree representative crash: possible deadlock in btrfs_read_chunk_tree, types: [LOCKDEP] # git bisect bad fe60fa2473fa928a35ff9bc6a5bb387ba7d22c00 Bisecting: 1059 revisions left to test after this (roughly 10 steps) [2ffa34cee97738d5522150112c39d2c6bee090c3] Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux.git testing commit 2ffa34cee97738d5522150112c39d2c6bee090c3 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: c97dc51b1c5a8ffb6c7afd34dfcee7982017a928de3cf0e6bcbebed84b2ed0d6 all runs: OK false negative chance: 0.000 # git bisect good 2ffa34cee97738d5522150112c39d2c6bee090c3 Bisecting: 686 revisions left to test after this (roughly 9 steps) [fda1842990d65b0d239a33287574335c1e39a999] Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git testing commit fda1842990d65b0d239a33287574335c1e39a999 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: e48bae83bf66edf99f67782fe5ded95283b6a6cbd616587d9e7fc3737448b347 all runs: crashed: possible deadlock in btrfs_read_chunk_tree representative crash: possible deadlock in btrfs_read_chunk_tree, types: [LOCKDEP] # git bisect bad fda1842990d65b0d239a33287574335c1e39a999 Bisecting: 163 revisions left to test after this (roughly 8 steps) [67b08453fbb5b41410ebe21893dde2dddd91493d] Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux.git testing commit 67b08453fbb5b41410ebe21893dde2dddd91493d gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 312c01f496ae0830d1f9336a96ea8d8fdc20a30ddcb48eb634409759a2cd294d all runs: crashed: possible deadlock in btrfs_read_chunk_tree representative crash: possible deadlock in btrfs_read_chunk_tree, types: [LOCKDEP] # git bisect bad 67b08453fbb5b41410ebe21893dde2dddd91493d Bisecting: 104 revisions left to test after this (roughly 7 steps) [446233fd0e8ec04ef8680df1ff1c11405ba32784] btrfs: switch all message helpers to be RCU safe testing commit 446233fd0e8ec04ef8680df1ff1c11405ba32784 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 30b2f7528ba87c1eab6bf0e65157b4abfeff914ba644c1aeaf5b40fbf77e8dc2 all runs: OK false negative chance: 0.000 # git bisect good 446233fd0e8ec04ef8680df1ff1c11405ba32784 Bisecting: 52 revisions left to test after this (roughly 6 steps) [e0d7c8ba392ec002d401d11c2706c298182a814e] bcachefs: bch2_trans_has_updates() testing commit e0d7c8ba392ec002d401d11c2706c298182a814e gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: e67e2bc22254ba2d53d44101e8647ede2dbbd9803d7a0d17ef0b1ffacc916c33 all runs: OK false negative chance: 0.000 # git bisect good e0d7c8ba392ec002d401d11c2706c298182a814e Bisecting: 26 revisions left to test after this (roughly 5 steps) [3f8a833f15d3deacd44f55922bb2b57aaa72bae0] btrfs: add btrfs prefix to free space tree exported functions testing commit 3f8a833f15d3deacd44f55922bb2b57aaa72bae0 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 49a652210365d4567f9cb32225deb5dc16e74548be00fb67f456f41a1dec4ec8 all runs: OK false negative chance: 0.000 # git bisect good 3f8a833f15d3deacd44f55922bb2b57aaa72bae0 Bisecting: 13 revisions left to test after this (roughly 4 steps) [9f28bf24430a388a14455d05182fef2dd73e5df3] btrfs: call bdev_fput() to reclaim the blk_holder immediately testing commit 9f28bf24430a388a14455d05182fef2dd73e5df3 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 5f35c05fd7e00d3323e67b61dfeb6d6e49eb5947f01d549b334c1c2232d7a1d6 all runs: OK false negative chance: 0.000 # git bisect good 9f28bf24430a388a14455d05182fef2dd73e5df3 Bisecting: 5 revisions left to test after this (roughly 3 steps) [74de5e3d5a52a01e550c3f9d4432e3afb8e0ea7d] Merge branch 'for-next-next-v6.16-20250619' into for-next-20250619 testing commit 74de5e3d5a52a01e550c3f9d4432e3afb8e0ea7d gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 9a2c7fcdea57d62021fc9b2648d93ec527d53536abc563ee9a90a6ca005d4df0 all runs: crashed: possible deadlock in btrfs_read_chunk_tree representative crash: possible deadlock in btrfs_read_chunk_tree, types: [LOCKDEP] # git bisect bad 74de5e3d5a52a01e550c3f9d4432e3afb8e0ea7d Bisecting: 2 revisions left to test after this (roughly 2 steps) [b848292c9838e0da9374a417ea9e48cb5e5f7cf3] Merge branch 'misc-next' into for-next-next-v6.16-20250619 testing commit b848292c9838e0da9374a417ea9e48cb5e5f7cf3 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: 77fffbf5aa5ac2d1b6a4012eb13b8d25213471b7069e3aef246c1bc84a3c6b30 all runs: crashed: possible deadlock in btrfs_read_chunk_tree representative crash: possible deadlock in btrfs_read_chunk_tree, types: [LOCKDEP] # git bisect bad b848292c9838e0da9374a417ea9e48cb5e5f7cf3 Bisecting: 2 revisions left to test after this (roughly 1 step) [0c1ef22a727df4289e5cb3ca546aa28d3bf2b928] btrfs: use the super_block as holder when mounting file systems testing commit 0c1ef22a727df4289e5cb3ca546aa28d3bf2b928 gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: d6576c1a06e8730d2b88030416af714f53947558f865ae60a5f1818dca16b414 all runs: crashed: possible deadlock in btrfs_read_chunk_tree representative crash: possible deadlock in btrfs_read_chunk_tree, types: [LOCKDEP] # git bisect bad 0c1ef22a727df4289e5cb3ca546aa28d3bf2b928 Bisecting: 0 revisions left to test after this (roughly 0 steps) [7aacdf6feed1ca882339ebd3895a233373b40a1e] btrfs: delay btrfs_open_devices() until super block is created testing commit 7aacdf6feed1ca882339ebd3895a233373b40a1e gcc compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6 kernel signature: fa27259d610ccd506c6109207ca3607c458de17d34c497842baa44b22c88197c all runs: crashed: possible deadlock in btrfs_read_chunk_tree representative crash: possible deadlock in btrfs_read_chunk_tree, types: [LOCKDEP] # git bisect bad 7aacdf6feed1ca882339ebd3895a233373b40a1e 7aacdf6feed1ca882339ebd3895a233373b40a1e is the first bad commit commit 7aacdf6feed1ca882339ebd3895a233373b40a1e Author: Qu Wenruo Date: Tue Jun 17 14:49:38 2025 +0930 btrfs: delay btrfs_open_devices() until super block is created Currently btrfs always call btrfs_open_devices() before creating the super block. It's fine for now because: - No blk_holder_ops is provided - btrfs_fs_type is used as a holder This means no matter who wins the device opening race, the holder will be the same thus not affecting the later sget_fc() race. And since no blk_holder_ops is provided, no bdev operation is depending on the holder. But this will no longer be true if we want to (we indeed want) implement a proper blk_holder_ops using fs_holder_ops. This means we will need a proper super block as the bdev holder. To prepare for such change, delay the btrfs_open_devices() call until we got a super block. This is done by extending uuid_mutex to cover sget_fc(), so that we can call btrfs_open_devices() after sget_fc(). Signed-off-by: Qu Wenruo Signed-off-by: David Sterba fs/btrfs/super.c | 38 +++++++++++++++++++++++--------------- 1 file changed, 23 insertions(+), 15 deletions(-) accumulated error probability: 0.00 culprit signature: fa27259d610ccd506c6109207ca3607c458de17d34c497842baa44b22c88197c parent signature: 5f35c05fd7e00d3323e67b61dfeb6d6e49eb5947f01d549b334c1c2232d7a1d6 revisions tested: 22, total time: 8h21m45.919153824s (build: 4h31m40.023478238s, test: 2h48m58.575965336s) first bad commit: 7aacdf6feed1ca882339ebd3895a233373b40a1e btrfs: delay btrfs_open_devices() until super block is created recipients (to): ["clm@fb.com" "dsterba@suse.com" "dsterba@suse.com" "josef@toxicpanda.com" "linux-btrfs@vger.kernel.org" "wqu@suse.com"] recipients (cc): ["linux-kernel@vger.kernel.org"] crash: possible deadlock in btrfs_read_chunk_tree BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop2 (7:2) scanned by syz.2.16 (3360) BTRFS info (device loop2): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d BTRFS info (device loop2): using sha256 (sha256-x86_64) checksum algorithm BTRFS info (device loop2): disk space caching is enabled BTRFS warning (device loop2): space cache v1 is being deprecated and will be removed in a future release, please use -o space_cache=v2 ====================================================== WARNING: possible circular locking dependency detected 6.16.0-rc2-syzkaller #0 Not tainted ------------------------------------------------------ syz.2.16/3360 is trying to acquire lock: ffffffff83e72c70 (uuid_mutex){+.+.}-{4:4}, at: btrfs_read_chunk_tree+0x52/0xcc0 fs/btrfs/volumes.c:7462 but task is already holding lock: ffff888101b860e0 (&type->s_umount_key#48/1){+.+.}-{4:4}, at: alloc_super+0xd2/0x3b0 fs/super.c:345 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&type->s_umount_key#48/1){+.+.}-{4:4}: down_write_nested+0x2d/0xc0 kernel/locking/rwsem.c:1693 alloc_super+0xd2/0x3b0 fs/super.c:345 sget_fc+0xe7/0x3a0 fs/super.c:761 btrfs_get_tree_super fs/btrfs/super.c:1867 [inline] btrfs_get_tree_subvol fs/btrfs/super.c:2060 [inline] btrfs_get_tree+0x199/0x6c0 fs/btrfs/super.c:2094 vfs_get_tree+0x29/0xb0 fs/super.c:1802 do_new_mount+0x13f/0x380 fs/namespace.c:3885 do_mount fs/namespace.c:4222 [inline] __do_sys_mount fs/namespace.c:4433 [inline] __se_sys_mount+0x173/0x1e0 fs/namespace.c:4410 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xa6/0x2c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (uuid_mutex){+.+.}-{4:4}: check_prev_add kernel/locking/lockdep.c:3168 [inline] check_prevs_add kernel/locking/lockdep.c:3287 [inline] validate_chain kernel/locking/lockdep.c:3911 [inline] __lock_acquire+0x12e6/0x2100 kernel/locking/lockdep.c:5240 lock_acquire+0xe9/0x270 kernel/locking/lockdep.c:5871 __mutex_lock_common kernel/locking/mutex.c:602 [inline] __mutex_lock+0xab/0xb20 kernel/locking/mutex.c:747 btrfs_read_chunk_tree+0x52/0xcc0 fs/btrfs/volumes.c:7462 open_ctree+0x8bf/0x1680 fs/btrfs/disk-io.c:3462 btrfs_fill_super fs/btrfs/super.c:984 [inline] btrfs_get_tree_super fs/btrfs/super.c:1923 [inline] btrfs_get_tree_subvol fs/btrfs/super.c:2060 [inline] btrfs_get_tree+0x427/0x6c0 fs/btrfs/super.c:2094 vfs_get_tree+0x29/0xb0 fs/super.c:1802 do_new_mount+0x13f/0x380 fs/namespace.c:3885 do_mount fs/namespace.c:4222 [inline] __do_sys_mount fs/namespace.c:4433 [inline] __se_sys_mount+0x173/0x1e0 fs/namespace.c:4410 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xa6/0x2c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&type->s_umount_key#48/1); lock(uuid_mutex); lock(&type->s_umount_key#48/1); lock(uuid_mutex); *** DEADLOCK *** 1 lock held by syz.2.16/3360: #0: ffff888101b860e0 (&type->s_umount_key#48/1){+.+.}-{4:4}, at: alloc_super+0xd2/0x3b0 fs/super.c:345 stack backtrace: CPU: 0 UID: 0 PID: 3360 Comm: syz.2.16 Not tainted 6.16.0-rc2-syzkaller #0 PREEMPT(undef) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: dump_stack_lvl+0xad/0x110 lib/dump_stack.c:120 print_circular_bug+0x29b/0x2b0 kernel/locking/lockdep.c:2046 check_noncircular+0x10e/0x130 kernel/locking/lockdep.c:2178 check_prev_add kernel/locking/lockdep.c:3168 [inline] check_prevs_add kernel/locking/lockdep.c:3287 [inline] validate_chain kernel/locking/lockdep.c:3911 [inline] __lock_acquire+0x12e6/0x2100 kernel/locking/lockdep.c:5240 lock_acquire+0xe9/0x270 kernel/locking/lockdep.c:5871 __mutex_lock_common kernel/locking/mutex.c:602 [inline] __mutex_lock+0xab/0xb20 kernel/locking/mutex.c:747 btrfs_read_chunk_tree+0x52/0xcc0 fs/btrfs/volumes.c:7462 open_ctree+0x8bf/0x1680 fs/btrfs/disk-io.c:3462 btrfs_fill_super fs/btrfs/super.c:984 [inline] btrfs_get_tree_super fs/btrfs/super.c:1923 [inline] btrfs_get_tree_subvol fs/btrfs/super.c:2060 [inline] btrfs_get_tree+0x427/0x6c0 fs/btrfs/super.c:2094 vfs_get_tree+0x29/0xb0 fs/super.c:1802 do_new_mount+0x13f/0x380 fs/namespace.c:3885 do_mount fs/namespace.c:4222 [inline] __do_sys_mount fs/namespace.c:4433 [inline] __se_sys_mount+0x173/0x1e0 fs/namespace.c:4410 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xa6/0x2c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f68d77900ca Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f68d858de68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f68d858def0 RCX: 00007f68d77900ca RDX: 00002000000004c0 RSI: 00002000000015c0 RDI: 00007f68d858deb0 RBP: 00002000000004c0 R08: 00007f68d858def0 R09: 0000000002000000 R10: 0000000002000000 R11: 0000000000000246 R12: 00002000000015c0 R13: 00007f68d858deb0 R14: 000000000000559e R15: 0000200000000100 BTRFS info (device loop2): rebuilding free space tree BTRFS info (device loop2): disabling free space tree BTRFS info (device loop2): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) BTRFS info (device loop2): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2)