ci2 starts bisection 2026-11-06 08:04:20.889848771 +0000 UTC m=+43857.154737104 bisecting fixing commit since eceeec79dbc646d6dace49ed1ba2f656683d5537 building syzkaller on 5a630be623a83f54a0e7a5a72d78827acdc85248 ensuring issue is reproducible on original commit eceeec79dbc646d6dace49ed1ba2f656683d5537 testing commit eceeec79dbc646d6dace49ed1ba2f656683d5537 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 6302ddb10589c19762c2d5ab2a5bdc565c2cd4ba908804a6eb3addc2495241ae all runs: crashed: possible deadlock in ext4_destroy_inline_data representative crash: possible deadlock in ext4_destroy_inline_data, types: [LOCKDEP] check whether we can drop unnecessary instrumentation disabling configs for [kasan atomic_sleep hang memleak ubsan bug_or_warning], they are not needed testing commit eceeec79dbc646d6dace49ed1ba2f656683d5537 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: ae3c0f36faa015beef8e5a78d297b08a70cde7ff2a2e33762d72ba054df37fac all runs: crashed: possible deadlock in ext4_destroy_inline_data representative crash: possible deadlock in ext4_destroy_inline_data, types: [LOCKDEP] the bug reproduces without the instrumentation disabling configs for [ubsan bug_or_warning kasan atomic_sleep hang memleak], they are not needed kconfig minimization: base=3708 full=7425 leaves diff=2098 split chunks (needed=false): <2098> split chunk #0 of len 2098 into 5 parts testing without sub-chunk 1/5 disabling configs for [hang memleak ubsan bug_or_warning kasan atomic_sleep], they are not needed testing commit eceeec79dbc646d6dace49ed1ba2f656683d5537 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 90fd6cbf7847887567b293df5b7498df9b4457c7710fdefda82d9a6e2ff95b23 run #0: crashed: possible deadlock in do_writepages run #1: crashed: possible deadlock in ext4_destroy_inline_data run #2: crashed: possible deadlock in do_writepages run #3: crashed: possible deadlock in ext4_destroy_inline_data run #4: crashed: possible deadlock in ext4_destroy_inline_data run #5: crashed: possible deadlock in ext4_destroy_inline_data run #6: crashed: possible deadlock in ext4_destroy_inline_data run #7: crashed: possible deadlock in ext4_destroy_inline_data run #8: crashed: possible deadlock in ext4_destroy_inline_data run #9: crashed: possible deadlock in ext4_destroy_inline_data representative crash: possible deadlock in do_writepages, types: [LOCKDEP] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [ubsan bug_or_warning kasan atomic_sleep hang memleak], they are not needed testing commit eceeec79dbc646d6dace49ed1ba2f656683d5537 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 1d26e576fc95f96332e179ba5e6593069fe0186c877a03e92af7e441f8c89566 all runs: crashed: possible deadlock in ext4_destroy_inline_data representative crash: possible deadlock in ext4_destroy_inline_data, types: [LOCKDEP] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [atomic_sleep hang memleak ubsan bug_or_warning kasan], they are not needed testing commit eceeec79dbc646d6dace49ed1ba2f656683d5537 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 93dcc3c3064a1a0a2803307addc91c84569f570c0b3cffb10f2740af51fd859b all runs: crashed: possible deadlock in ext4_destroy_inline_data representative crash: possible deadlock in ext4_destroy_inline_data, types: [LOCKDEP] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [kasan atomic_sleep hang memleak ubsan bug_or_warning], they are not needed testing commit eceeec79dbc646d6dace49ed1ba2f656683d5537 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 2c324fab4b94b432bfee98e489e127cc73c12287b321bb1220a001598ed1db9c all runs: crashed: possible deadlock in ext4_destroy_inline_data representative crash: possible deadlock in ext4_destroy_inline_data, types: [LOCKDEP] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [kasan atomic_sleep hang memleak ubsan bug_or_warning], they are not needed testing commit eceeec79dbc646d6dace49ed1ba2f656683d5537 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 33b957c3c015267c5171bd32bf74623040b9749ebc5af5d2393761cba8df4b45 all runs: crashed: possible deadlock in ext4_destroy_inline_data representative crash: possible deadlock in ext4_destroy_inline_data, types: [LOCKDEP] the chunk can be dropped disabling configs for [memleak ubsan bug_or_warning kasan atomic_sleep hang], they are not needed testing current HEAD 700e62ea909a70b9f72692d8b7a192ac7ebde0aa testing commit 700e62ea909a70b9f72692d8b7a192ac7ebde0aa gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 793a7ec81ff611697b12035c3d307f63e9265ead2c8aa00bd07fbd4f32cca11f all runs: OK false negative chance: 0.000 # git bisect start 700e62ea909a70b9f72692d8b7a192ac7ebde0aa eceeec79dbc646d6dace49ed1ba2f656683d5537 Bisecting: 2019 revisions left to test after this (roughly 11 steps) [81171ccf55f0a4648ebe95a2f0a4de407a3c5754] tracing/mmiotrace: Remove reference to unused per CPU data pointer determine whether the revision contains the guilty commit revision eceeec79dbc646d6dace49ed1ba2f656683d5537 crashed and is reachable testing commit 81171ccf55f0a4648ebe95a2f0a4de407a3c5754 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: d8aeb8d44747ef300742034da8f0353a639b2d00376c50a02672c4f92dd8055f run #0: crashed: possible deadlock in ext4_destroy_inline_data run #1: crashed: possible deadlock in wait_transaction_locked run #2: crashed: possible deadlock in ext4_destroy_inline_data run #3: crashed: possible deadlock in ext4_destroy_inline_data run #4: crashed: possible deadlock in ext4_destroy_inline_data run #5: crashed: possible deadlock in ext4_destroy_inline_data run #6: crashed: possible deadlock in ext4_destroy_inline_data run #7: crashed: possible deadlock in ext4_destroy_inline_data run #8: crashed: possible deadlock in ext4_destroy_inline_data run #9: crashed: possible deadlock in ext4_destroy_inline_data representative crash: possible deadlock in ext4_destroy_inline_data, types: [LOCKDEP] # git bisect good 81171ccf55f0a4648ebe95a2f0a4de407a3c5754 Bisecting: 1009 revisions left to test after this (roughly 10 steps) [413e04adcc1fd263cf02b1b83b4a0dbdc66bcee9] net/mlx5: E-Switch, prevent mc_list repopulation during vport disable determine whether the revision contains the guilty commit revision eceeec79dbc646d6dace49ed1ba2f656683d5537 crashed and is reachable testing commit 413e04adcc1fd263cf02b1b83b4a0dbdc66bcee9 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 0976346742faa0284391e6b39ad5298637f678316213256590037214efc7f9e5 all runs: OK false negative chance: 0.000 # git bisect bad 413e04adcc1fd263cf02b1b83b4a0dbdc66bcee9 Bisecting: 504 revisions left to test after this (roughly 9 steps) [1027b1d4e29756dfbf74ef8743456a1efa3679f0] phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend determine whether the revision contains the guilty commit revision 81171ccf55f0a4648ebe95a2f0a4de407a3c5754 crashed and is reachable testing commit 1027b1d4e29756dfbf74ef8743456a1efa3679f0 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 60bb18a5d7975e3c1823cd999a1651317a12175f4922787a6d9bbd321d2763ac all runs: OK false negative chance: 0.000 # git bisect bad 1027b1d4e29756dfbf74ef8743456a1efa3679f0 Bisecting: 252 revisions left to test after this (roughly 8 steps) [309558f3c8bfedab565ccb904718545fc128ceca] iommu/amd: Fix false positive in SB IOAPIC IVRS validation determine whether the revision contains the guilty commit revision 81171ccf55f0a4648ebe95a2f0a4de407a3c5754 crashed and is reachable testing commit 309558f3c8bfedab565ccb904718545fc128ceca gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 9e2fc925066856003d55a0f7b81baa48d3fa533ccf49da28676ed2e1c199e7ab all runs: crashed: possible deadlock in ext4_destroy_inline_data representative crash: possible deadlock in ext4_destroy_inline_data, types: [LOCKDEP] # git bisect good 309558f3c8bfedab565ccb904718545fc128ceca Bisecting: 126 revisions left to test after this (roughly 7 steps) [c0cdd1838efd4fccccfd1ac4a0a4cb40db4100a4] arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix determine whether the revision contains the guilty commit revision 309558f3c8bfedab565ccb904718545fc128ceca crashed and is reachable testing commit c0cdd1838efd4fccccfd1ac4a0a4cb40db4100a4 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 4dc835e14672fede6d3260c59a78e95b1d206f4c44f309f2b61e14c274b6d0e9 all runs: OK false negative chance: 0.000 # git bisect bad c0cdd1838efd4fccccfd1ac4a0a4cb40db4100a4 Bisecting: 62 revisions left to test after this (roughly 6 steps) [1f45f9994fb02f4a5eb207c9a85cb8ef3024e074] misc: ad525x_dpot: Make ad_dpot_remove() return void determine whether the revision contains the guilty commit revision eceeec79dbc646d6dace49ed1ba2f656683d5537 crashed and is reachable testing commit 1f45f9994fb02f4a5eb207c9a85cb8ef3024e074 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: adfe05775a518203fecb981cbc480fa192863921146bf15670eaf636d73323bd run #0: crashed: possible deadlock in ext4_destroy_inline_data run #1: crashed: possible deadlock in wait_transaction_locked run #2: crashed: possible deadlock in ext4_destroy_inline_data run #3: crashed: possible deadlock in ext4_destroy_inline_data run #4: crashed: possible deadlock in ext4_destroy_inline_data run #5: crashed: possible deadlock in ext4_destroy_inline_data run #6: crashed: possible deadlock in ext4_destroy_inline_data run #7: crashed: possible deadlock in ext4_destroy_inline_data run #8: crashed: possible deadlock in ext4_destroy_inline_data run #9: crashed: possible deadlock in ext4_destroy_inline_data representative crash: possible deadlock in ext4_destroy_inline_data, types: [LOCKDEP] # git bisect good 1f45f9994fb02f4a5eb207c9a85cb8ef3024e074 Bisecting: 31 revisions left to test after this (roughly 5 steps) [84c30c130f52cd0c83922b8ffa12bc88bc65c2d6] thermal: int340x_thermal: Consolidate priv->data_vault checks determine whether the revision contains the guilty commit revision 81171ccf55f0a4648ebe95a2f0a4de407a3c5754 crashed and is reachable testing commit 84c30c130f52cd0c83922b8ffa12bc88bc65c2d6 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: df2a8ee59efc244ae718ad587bbbbc33f150983c6a9e05b5cff233bff78c398e all runs: OK false negative chance: 0.000 # git bisect bad 84c30c130f52cd0c83922b8ffa12bc88bc65c2d6 Bisecting: 15 revisions left to test after this (roughly 4 steps) [333cba2b16315194c8211d315c3e4a5fc439370a] arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe determine whether the revision contains the guilty commit revision 309558f3c8bfedab565ccb904718545fc128ceca crashed and is reachable testing commit 333cba2b16315194c8211d315c3e4a5fc439370a gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: bb6fd521b05a963db68d24b1868188caf27b7606231fff76062a45c07f15ced9 all runs: crashed: possible deadlock in ext4_destroy_inline_data representative crash: possible deadlock in ext4_destroy_inline_data, types: [LOCKDEP] # git bisect good 333cba2b16315194c8211d315c3e4a5fc439370a Bisecting: 7 revisions left to test after this (roughly 3 steps) [3d49f3d2975fb7e85fa68da8079114f35f05f3ea] RDMA/srpt: Pass the mapped task attribute to target_init_cmd() determine whether the revision contains the guilty commit revision 81171ccf55f0a4648ebe95a2f0a4de407a3c5754 crashed and is reachable testing commit 3d49f3d2975fb7e85fa68da8079114f35f05f3ea gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: df2a8ee59efc244ae718ad587bbbbc33f150983c6a9e05b5cff233bff78c398e all runs: OK false negative chance: 0.000 # git bisect bad 3d49f3d2975fb7e85fa68da8079114f35f05f3ea Bisecting: 3 revisions left to test after this (roughly 2 steps) [ff82e3374e9103d046b2a82f4315d9a422ff097d] ACPI: processor: validate MADT IOAPIC entry bounds determine whether the revision contains the guilty commit revision eceeec79dbc646d6dace49ed1ba2f656683d5537 crashed and is reachable testing commit ff82e3374e9103d046b2a82f4315d9a422ff097d gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: b165f726a5bad824e4edf8d78121ec886717123c13af37043bfe0e42552fa388 run #0: crashed: possible deadlock in wait_transaction_locked run #1: crashed: possible deadlock in ext4_destroy_inline_data run #2: crashed: possible deadlock in ext4_destroy_inline_data run #3: crashed: possible deadlock in ext4_destroy_inline_data run #4: crashed: possible deadlock in ext4_destroy_inline_data run #5: crashed: possible deadlock in ext4_destroy_inline_data run #6: crashed: possible deadlock in ext4_destroy_inline_data run #7: crashed: possible deadlock in ext4_destroy_inline_data run #8: crashed: possible deadlock in ext4_destroy_inline_data run #9: crashed: possible deadlock in ext4_destroy_inline_data representative crash: possible deadlock in wait_transaction_locked, types: [LOCKDEP] # git bisect good ff82e3374e9103d046b2a82f4315d9a422ff097d Bisecting: 1 revision left to test after this (roughly 1 step) [d1e7c186555ad65554fd2f2b02f5a539aa35ae48] ext4: fix out-of-bounds read in ext4_read_inline_dir() determine whether the revision contains the guilty commit revision ff82e3374e9103d046b2a82f4315d9a422ff097d crashed and is reachable testing commit d1e7c186555ad65554fd2f2b02f5a539aa35ae48 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: d9425b6a3382b52f432e3f77a9aaa3609a6f815fd87879244be74f3e578abbf1 run #0: crashed: possible deadlock in wait_transaction_locked run #1: crashed: possible deadlock in ext4_destroy_inline_data run #2: crashed: possible deadlock in ext4_destroy_inline_data run #3: crashed: possible deadlock in ext4_destroy_inline_data run #4: crashed: possible deadlock in ext4_destroy_inline_data run #5: crashed: possible deadlock in ext4_destroy_inline_data run #6: crashed: possible deadlock in ext4_destroy_inline_data run #7: crashed: possible deadlock in ext4_destroy_inline_data run #8: crashed: possible deadlock in ext4_destroy_inline_data run #9: crashed: possible deadlock in ext4_destroy_inline_data representative crash: possible deadlock in wait_transaction_locked, types: [LOCKDEP] # git bisect good d1e7c186555ad65554fd2f2b02f5a539aa35ae48 Bisecting: 0 revisions left to test after this (roughly 0 steps) [9c3469377b1d8caba6bec6ef3c460810bbfb02cc] ext4: skip extra isize expansion during mount to prevent deadlock determine whether the revision contains the guilty commit revision 81171ccf55f0a4648ebe95a2f0a4de407a3c5754 crashed and is reachable testing commit 9c3469377b1d8caba6bec6ef3c460810bbfb02cc gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: df2a8ee59efc244ae718ad587bbbbc33f150983c6a9e05b5cff233bff78c398e run #0: basic kernel testing failed: failed to run command in VM: broken console: Permission denied (publickey) run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK false negative chance: 0.000 # git bisect bad 9c3469377b1d8caba6bec6ef3c460810bbfb02cc 9c3469377b1d8caba6bec6ef3c460810bbfb02cc is the first bad commit commit 9c3469377b1d8caba6bec6ef3c460810bbfb02cc Author: Yun Zhou Date: Tue Jun 23 14:19:02 2026 +0800 ext4: skip extra isize expansion during mount to prevent deadlock [ Upstream commit 7461c60b9c6a839b13ad4c3490681a0cf5aa0637 ] ext4_try_to_expand_extra_isize() is called from __ext4_mark_inode_dirty() while holding an active jbd2 handle. During mount (!SB_ACTIVE), the expand path may move xattrs to external blocks and release ea_inodes via iput(). When !SB_ACTIVE, iput() calls write_inode_now() which acquires s_writepages_rwsem, creating a circular lock dependency: s_writepages_rwsem --> jbd2_handle --> xattr_sem --> s_writepages_rwsem This can be triggered via: ext4_process_orphan() -> ext4_truncate() -> ext4_mark_inode_dirty() -> ext4_try_to_expand_extra_isize() or: ext4_evict_inode() -> ext4_mark_inode_dirty() -> ext4_try_to_expand_extra_isize() Skip expansion when !SB_ACTIVE. This is a minor loss of functionality (extra isize won't grow for these inodes during mount), which e2fsck can resolve later if needed. Reported-by: syzbot+5d19358d7eb30ffb0cc5@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5d19358d7eb30ffb0cc5 Fixes: c8585c6fcaf2 ("ext4: fix races between changing inode journal mode and ext4_writepages") Signed-off-by: Yun Zhou Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260623061903.2148767-1-yun.zhou@windriver.com Signed-off-by: Theodore Ts'o Signed-off-by: Sasha Levin fs/ext4/inode.c | 10 ++++++++++ 1 file changed, 10 insertions(+) accumulated error probability: 0.00 culprit signature: df2a8ee59efc244ae718ad587bbbbc33f150983c6a9e05b5cff233bff78c398e parent signature: d9425b6a3382b52f432e3f77a9aaa3609a6f815fd87879244be74f3e578abbf1 revisions tested: 20, total time: 6h27m58.681343253s (build: 2h9m35.407301876s, test: 3h46m21.349070695s) first good commit: 9c3469377b1d8caba6bec6ef3c460810bbfb02cc ext4: skip extra isize expansion during mount to prevent deadlock recipients (to): ["jack@suse.cz" "sashal@kernel.org" "tytso@mit.edu" "yun.zhou@windriver.com"] recipients (cc): []