Warning: Permanently added '10.128.1.160' (ED25519) to the list of known hosts. [*] Starting BTRFS deadlock reproducer... [+] Allocated 16 MiB image buffer. [+] Constructed valid BTRFS image in memory. [+] Written 16 MiB image to /tmp/btrfs.img. [+] Created target image at /tmp/target.img (size: 33555456). [+] Bound /tmp/btrfs.img to /dev/loop0 and closed fds. [+] Set block size of /dev/loop1 to 1024. [+] Bound /tmp/target.img to /dev/loop1 (bsz=1024) and closed fds. [+] Step 1: Read 4096 bytes from /dev/loop0 (registered bd_inode -> mmap_lock). [+] Step 1b: Read from /dev/loop1 and closed. [ 113.534148][ T6058] loop0: detected capacity change from 0 to 32768 [ 113.544609][ T6058] loop1: detected capacity change from 0 to 65538 [ 113.569533][ T6058] BTRFS: device fsid 42424242-4242-4242-4242-424242424242 devid 1 transid 1 /dev/loop0 (7:0) scanned by syz-executor324 (6058) [ 113.634456][ T6058] BTRFS info (device loop0): first mount of filesystem 42424242-4242-4242-4242-424242424242 [ 113.634493][ T6058] BTRFS info (device loop0): using crc32c checksum algorithm [+] Mounted /dev/loop0 at /tmp/btrfs_mnt successfully. [ 113.778023][ T6058] BTRFS info (device loop0): enabling ssd optimizations [ 113.778053][ T6058] BTRFS info (device loop0): turning on async discard [+] Step 2: Mmapped /tmp/btrfs_mnt/testfile successfully (registered mmap_lock -> writers). [+] Step 3: Created directory /tmp/btrfs_mnt/testdir (registered writers -> extwriters). [*] Step 4: Executing ioctl(BTRFS_IOC_ADD_DEV, /dev/loop1) to complete cycle... [ 113.865490][ T6058] [ 113.867857][ T6058] ====================================================== [ 113.874862][ T6058] WARNING: possible circular locking dependency detected [ 113.881875][ T6058] syzkaller #0 Not tainted [ 113.886286][ T6058] ------------------------------------------------------ [ 113.893305][ T6058] syz-executor324/6058 is trying to acquire lock: [ 113.899719][ T6058] ffff888024d4e3e8 (&sb->s_type->i_mutex_key#10){++++}-{4:4}, at: set_blocksize+0x1e6/0x440 [ 113.909851][ T6058] [ 113.909851][ T6058] but task is already holding lock: [ 113.917212][ T6058] ffff888027eb26a8 (btrfs_trans_num_extwriters){.+.+}-{0:0}, at: join_transaction+0x6b2/0xd40 [ 113.927502][ T6058] [ 113.927502][ T6058] which lock already depends on the new lock. [ 113.927502][ T6058] [ 113.937904][ T6058] [ 113.937904][ T6058] the existing dependency chain (in reverse order) is: [ 113.946955][ T6058] [ 113.946955][ T6058] -> #3 (btrfs_trans_num_extwriters){.+.+}-{0:0}: [ 113.955570][ T6058] join_transaction+0x18a/0xd40 [ 113.960950][ T6058] start_transaction+0x731/0x1830 [ 113.966513][ T6058] btrfs_create_common+0x15c/0x310 [ 113.972154][ T6058] lookup_open+0xedc/0x1970 [ 113.977201][ T6058] path_openat+0x70c/0x20f0 [ 113.982238][ T6058] do_file_open+0x23e/0x4a0 [ 113.987271][ T6058] do_sys_openat2+0x115/0x200 [ 113.992481][ T6058] __x64_sys_openat+0x138/0x170 [ 113.997867][ T6058] do_syscall_64+0x166/0x520 [ 114.003001][ T6058] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.009420][ T6058] [ 114.009420][ T6058] -> #2 (btrfs_trans_num_writers){.+.+}-{0:0}: [ 114.017774][ T6058] lock_release+0x1a3/0x3c0 [ 114.022809][ T6058] sb_end_intwrite+0x26/0x190 [ 114.028016][ T6058] __btrfs_end_transaction+0x237/0x640 [ 114.034007][ T6058] btrfs_dirty_inode+0x14c/0x190 [ 114.039477][ T6058] touch_atime+0x2f8/0x670 [ 114.044424][ T6058] btrfs_file_mmap_prepare+0x172/0x1f0 [ 114.050416][ T6058] mmap_region+0xe88/0x23c0 [ 114.055452][ T6058] do_mmap+0xe0a/0x1300 [ 114.060139][ T6058] vm_mmap_pgoff+0x272/0x4e0 [ 114.065261][ T6058] ksys_mmap_pgoff+0x4dc/0x760 [ 114.070558][ T6058] do_syscall_64+0x166/0x520 [ 114.075672][ T6058] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.082093][ T6058] [ 114.082093][ T6058] -> #1 (&mm->mmap_lock){++++}-{4:4}: [ 114.089669][ T6058] __might_fault+0xcb/0x130 [ 114.094716][ T6058] _copy_to_iter+0xf9/0x1810 [ 114.099846][ T6058] copy_page_to_iter+0x23f/0x330 [ 114.105312][ T6058] filemap_read+0x7af/0x11e0 [ 114.110435][ T6058] blkdev_read_iter+0x2f1/0x420 [ 114.115813][ T6058] vfs_read+0x595/0xa80 [ 114.120495][ T6058] ksys_read+0x150/0x270 [ 114.125264][ T6058] do_syscall_64+0x166/0x520 [ 114.130383][ T6058] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.136802][ T6058] [ 114.136802][ T6058] -> #0 (&sb->s_type->i_mutex_key#10){++++}-{4:4}: [ 114.145514][ T6058] __lock_acquire+0x164c/0x2de0 [ 114.150890][ T6058] lock_acquire+0x115/0x350 [ 114.155907][ T6058] down_write+0x91/0x200 [ 114.160662][ T6058] set_blocksize+0x1e6/0x440 [ 114.165774][ T6058] btrfs_init_new_device+0xa4e/0x1cf0 [ 114.171663][ T6058] btrfs_ioctl_add_dev+0x1ad/0x640 [ 114.177291][ T6058] __se_sys_ioctl+0xfc/0x170 [ 114.182395][ T6058] do_syscall_64+0x166/0x520 [ 114.187501][ T6058] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.193902][ T6058] [ 114.193902][ T6058] other info that might help us debug this: [ 114.193902][ T6058] [ 114.204109][ T6058] Chain exists of: [ 114.204109][ T6058] &sb->s_type->i_mutex_key#10 --> btrfs_trans_num_writers --> btrfs_trans_num_extwriters [ 114.204109][ T6058] [ 114.219852][ T6058] Possible unsafe locking scenario: [ 114.219852][ T6058] [ 114.227289][ T6058] CPU0 CPU1 [ 114.232637][ T6058] ---- ---- [ 114.237983][ T6058] rlock(btrfs_trans_num_extwriters); [ 114.243432][ T6058] lock(btrfs_trans_num_writers); [ 114.251051][ T6058] lock(btrfs_trans_num_extwriters); [ 114.258927][ T6058] lock(&sb->s_type->i_mutex_key#10); [ 114.264386][ T6058] [ 114.264386][ T6058] *** DEADLOCK *** [ 114.264386][ T6058] [ 114.272508][ T6058] locks held by syz-executor324/6058: 3, last CPU#0: [ 114.279168][ T6058] #0: ffff8880139a2650 (sb_internal#2){.+.+}-{0:0}, at: btrfs_init_new_device+0x7f3/0x1cf0 [ 114.289274][ T6058] #1: ffff888027eb2680 (btrfs_trans_num_writers){.+.+}-{0:0}, at: join_transaction+0x6b2/0xd40 [ 114.299717][ T6058] #2: ffff888027eb26a8 (btrfs_trans_num_extwriters){.+.+}-{0:0}, at: join_transaction+0x6b2/0xd40 [ 114.310419][ T6058] [ 114.310419][ T6058] stack backtrace: [ 114.316293][ T6058] CPU: 0 UID: 0 PID: 6058 Comm: syz-executor324 Not tainted syzkaller #0 PREEMPT(full) [ 114.325995][ T6058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 114.336036][ T6058] Call Trace: [ 114.339302][ T6058] [ 114.342218][ T6058] dump_stack_lvl+0xe8/0x150 [ 114.346810][ T6058] print_circular_bug+0x2e2/0x300 [ 114.351832][ T6058] check_noncircular+0x12f/0x150 [ 114.356770][ T6058] __lock_acquire+0x164c/0x2de0 [ 114.361625][ T6058] lock_acquire+0x115/0x350 [ 114.366120][ T6058] ? set_blocksize+0x1e6/0x440 [ 114.370887][ T6058] ? srso_alias_return_thunk+0x5/0xfbef5 [ 114.376516][ T6058] down_write+0x91/0x200 [ 114.380750][ T6058] ? set_blocksize+0x1e6/0x440 [ 114.385510][ T6058] ? __pfx_down_write+0x10/0x10 [ 114.390351][ T6058] ? srso_alias_return_thunk+0x5/0xfbef5 [ 114.395972][ T6058] ? start_transaction+0x482/0x1830 [ 114.401175][ T6058] set_blocksize+0x1e6/0x440 [ 114.405765][ T6058] btrfs_init_new_device+0xa4e/0x1cf0 [ 114.411135][ T6058] btrfs_ioctl_add_dev+0x1ad/0x640 [ 114.416237][ T6058] ? __pfx_btrfs_ioctl+0x10/0x10 [ 114.421175][ T6058] __se_sys_ioctl+0xfc/0x170 [ 114.425756][ T6058] do_syscall_64+0x166/0x520 [ 114.430337][ T6058] ? trace_irq_disable+0x3b/0x140 [ 114.435356][ T6058] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.441415][ T6058] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.447294][ T6058] RIP: 0033:0x7f8612ea2ebb [ 114.451695][ T6058] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 114.471286][ T6058] RSP: 002b:00007ffe693cf9a0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 114.479687][ T6058] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f8612ea2ebb [ 114.487644][ T6058] RDX: 00007ffe693d2bf0 RSI: 000000005000940a RDI: 0000000000000003 [ 114.495600][ T6058] RBP: 00007ffe693d2bf0 R08: 0000000000000000 R09: 0000000000000000 [ 114.503555][ T6058] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe693cfb20 [ 114.511508][ T6058] R13: 0000000000000000 R14: 00007f8612e71000 R15: 00007ffe693cff70 [ 114.519565][ T6058]