possible deadlock in __nilfs_error

9 views

Skip to first unread message

syzbot

unread,

Oct 11, 2022, 8:06:40 AM10/11/22

to syzkaller...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: 3f8a27f9e27b Linux 4.19.211
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15e9583a880000
kernel config: https://syzkaller.appspot.com/x/.config?x=9b9277b418617afe
dashboard link: https://syzkaller.appspot.com/bug?extid=d31afa0015eb217097f9
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/98c0bdb4abb3/disk-3f8a27f9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ea228ff02669/vmlinux-3f8a27f9.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d31afa...@syzkaller.appspotmail.com

NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
======================================================
WARNING: possible circular locking dependency detected
4.19.211-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.2/28982 is trying to acquire lock:
0000000089f3757e (&nilfs->ns_sem){++++}, at: nilfs_set_error fs/nilfs2/super.c:86 [inline]
0000000089f3757e (&nilfs->ns_sem){++++}, at: __nilfs_error+0x195/0x401 fs/nilfs2/super.c:131

but task is already holding lock:
000000005f1d6dbd (&dat_lock_key){.+.+}, at: nilfs_get_block+0x18f/0x970 fs/nilfs2/inode.c:79

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #1 (&dat_lock_key){.+.+}:
nilfs_count_free_blocks+0x68/0x180 fs/nilfs2/the_nilfs.c:698
nilfs_set_log_cursor fs/nilfs2/super.c:237 [inline]
nilfs_cleanup_super+0x133/0x490 fs/nilfs2/super.c:319
nilfs_put_super+0x152/0x1a0 fs/nilfs2/super.c:473
generic_shutdown_super+0x144/0x370 fs/super.c:456
kill_block_super+0x97/0xf0 fs/super.c:1185
deactivate_locked_super+0x94/0x160 fs/super.c:329
deactivate_super+0x174/0x1a0 fs/super.c:360
cleanup_mnt+0x1a8/0x290 fs/namespace.c:1098
task_work_run+0x148/0x1c0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:193 [inline]
exit_to_usermode_loop+0x251/0x2a0 arch/x86/entry/common.c:167
prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe

-> #0 (&nilfs->ns_sem){++++}:
down_write+0x34/0x90 kernel/locking/rwsem.c:70
nilfs_set_error fs/nilfs2/super.c:86 [inline]
__nilfs_error+0x195/0x401 fs/nilfs2/super.c:131
nilfs_bmap_convert_error fs/nilfs2/bmap.c:35 [inline]
nilfs_bmap_lookup_contig+0x13d/0x180 fs/nilfs2/bmap.c:95
nilfs_get_block+0x1ce/0x970 fs/nilfs2/inode.c:80
do_mpage_readpage+0x8fb/0x1ca0 fs/mpage.c:231
mpage_readpages+0x33a/0x630 fs/mpage.c:404
read_pages.isra.0+0xf6/0x5d0 mm/readahead.c:123
__do_page_cache_readahead+0x5c6/0x6c0 mm/readahead.c:211
ra_submit mm/internal.h:66 [inline]
ondemand_readahead.isra.0+0x575/0xd40 mm/readahead.c:493
page_cache_sync_readahead mm/readahead.c:528 [inline]
page_cache_sync_readahead+0x275/0x520 mm/readahead.c:510
generic_file_buffered_read mm/filemap.c:2115 [inline]
generic_file_read_iter+0x1497/0x2b60 mm/filemap.c:2385
call_read_iter include/linux/fs.h:1815 [inline]
new_sync_read fs/read_write.c:406 [inline]
__vfs_read+0x518/0x750 fs/read_write.c:418
integrity_kernel_read+0x147/0x1f0 security/integrity/iint.c:200
ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:364 [inline]
ima_calc_file_shash security/integrity/ima/ima_crypto.c:393 [inline]
ima_calc_file_hash+0x4b2/0x8a0 security/integrity/ima/ima_crypto.c:450
ima_collect_measurement+0x4c4/0x570 security/integrity/ima/ima_api.c:231
process_measurement+0xddd/0x1440 security/integrity/ima/ima_main.c:284
ima_file_check+0xb9/0x100 security/integrity/ima/ima_main.c:391
do_last fs/namei.c:3425 [inline]
path_openat+0x7e4/0x2df0 fs/namei.c:3537
do_filp_open+0x18c/0x3f0 fs/namei.c:3567
do_sys_open+0x3b3/0x520 fs/open.c:1085
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe

other info that might help us debug this:

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&dat_lock_key);
lock(&nilfs->ns_sem);
lock(&dat_lock_key);
lock(&nilfs->ns_sem);

*** DEADLOCK ***

2 locks held by syz-executor.2/28982:
#0: 000000004b479b08 (&iint->mutex){+.+.}, at: process_measurement+0x316/0x1440 security/integrity/ima/ima_main.c:224
#1: 000000005f1d6dbd (&dat_lock_key){.+.+}, at: nilfs_get_block+0x18f/0x970 fs/nilfs2/inode.c:79

stack backtrace:
CPU: 1 PID: 28982 Comm: syz-executor.2 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
print_circular_bug.constprop.0.cold+0x2d7/0x41e kernel/locking/lockdep.c:1222
check_prev_add kernel/locking/lockdep.c:1866 [inline]
check_prevs_add kernel/locking/lockdep.c:1979 [inline]
validate_chain kernel/locking/lockdep.c:2420 [inline]
__lock_acquire+0x30c9/0x3ff0 kernel/locking/lockdep.c:3416
lock_acquire+0x170/0x3c0 kernel/locking/lockdep.c:3908
down_write+0x34/0x90 kernel/locking/rwsem.c:70
nilfs_set_error fs/nilfs2/super.c:86 [inline]
__nilfs_error+0x195/0x401 fs/nilfs2/super.c:131
nilfs_bmap_convert_error fs/nilfs2/bmap.c:35 [inline]
nilfs_bmap_lookup_contig+0x13d/0x180 fs/nilfs2/bmap.c:95
nilfs_get_block+0x1ce/0x970 fs/nilfs2/inode.c:80
do_mpage_readpage+0x8fb/0x1ca0 fs/mpage.c:231
mpage_readpages+0x33a/0x630 fs/mpage.c:404
read_pages.isra.0+0xf6/0x5d0 mm/readahead.c:123
__do_page_cache_readahead+0x5c6/0x6c0 mm/readahead.c:211
ra_submit mm/internal.h:66 [inline]
ondemand_readahead.isra.0+0x575/0xd40 mm/readahead.c:493
page_cache_sync_readahead mm/readahead.c:528 [inline]
page_cache_sync_readahead+0x275/0x520 mm/readahead.c:510
generic_file_buffered_read mm/filemap.c:2115 [inline]
generic_file_read_iter+0x1497/0x2b60 mm/filemap.c:2385
call_read_iter include/linux/fs.h:1815 [inline]
new_sync_read fs/read_write.c:406 [inline]
__vfs_read+0x518/0x750 fs/read_write.c:418
integrity_kernel_read+0x147/0x1f0 security/integrity/iint.c:200
ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:364 [inline]
ima_calc_file_shash security/integrity/ima/ima_crypto.c:393 [inline]
ima_calc_file_hash+0x4b2/0x8a0 security/integrity/ima/ima_crypto.c:450
ima_collect_measurement+0x4c4/0x570 security/integrity/ima/ima_api.c:231
process_measurement+0xddd/0x1440 security/integrity/ima/ima_main.c:284
ima_file_check+0xb9/0x100 security/integrity/ima/ima_main.c:391
do_last fs/namei.c:3425 [inline]
path_openat+0x7e4/0x2df0 fs/namei.c:3537
do_filp_open+0x18c/0x3f0 fs/namei.c:3567
do_sys_open+0x3b3/0x520 fs/open.c:1085
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f5d9c6385a9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5d9afab168 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00007f5d9c758f80 RCX: 00007f5d9c6385a9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000080
RBP: 00007f5d9c693580 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd22a1666f R14: 00007f5d9afab300 R15: 0000000000022000
Remounting filesystem read-only
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
audit: type=1800 audit(1665489955.068:25): pid=28982 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="file3" dev="loop2" ino=16 res=0
syz-executor.2 (28982) used greatest stack depth: 22464 bytes left
NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
Remounting filesystem read-only
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
audit: type=1800 audit(1665489955.598:26): pid=29057 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="file3" dev="loop2" ino=16 res=0
NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
Remounting filesystem read-only
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
audit: type=1800 audit(1665489956.108:27): pid=29091 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="file3" dev="loop2" ino=16 res=0
netlink: 'syz-executor.1': attribute type 3 has an invalid length.
caif:caif_disconnect_client(): nothing to disconnect
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'.
caif:caif_disconnect_client(): nothing to disconnect
caif:caif_disconnect_client(): nothing to disconnect
netlink: 'syz-executor.5': attribute type 3 has an invalid length.
caif:caif_disconnect_client(): nothing to disconnect
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 'syz-executor.2': attribute type 1 has an invalid length.
netlink: 36 bytes leftover after parsing attributes in process `syz-executor.4'.
netlink: 'syz-executor.0': attribute type 1 has an invalid length.
netlink: 'syz-executor.0': attribute type 3 has an invalid length.
TCP: request_sock_TCP: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters.
TCP: request_sock_TCP: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters.
TCP: request_sock_TCP: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters.
TCP: request_sock_TCP: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters.
TCP: request_sock_TCP: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters.
TCP: request_sock_TCP: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters.
TCP: request_sock_TCP: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters.
netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'.
IPVS: ftp: loaded support on port[0] = 21
audit: type=1800 audit(1665489961.478:28): pid=29897 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="file0" dev="sda1" ino=15769 res=0
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.3'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.3'.
IPVS: ftp: loaded support on port[0] = 21

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,

Oct 13, 2022, 12:15:36 AM10/13/22

to syzkaller...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: 3f8a27f9e27b Linux 4.19.211
git tree: linux-4.19.y

console output: https://syzkaller.appspot.com/x/log.txt?x=1050d5a4880000

kernel config: https://syzkaller.appspot.com/x/.config?x=9b9277b418617afe
dashboard link: https://syzkaller.appspot.com/bug?extid=d31afa0015eb217097f9
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1181de94880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1012bf1c880000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/98c0bdb4abb3/disk-3f8a27f9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ea228ff02669/vmlinux-3f8a27f9.xz

mounted in repro: https://storage.googleapis.com/syzbot-assets/0f5233fdc849/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d31afa...@syzkaller.appspotmail.com

NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
======================================================
WARNING: possible circular locking dependency detected
4.19.211-syzkaller #0 Not tainted

Remounting filesystem read-only
------------------------------------------------------
syz-executor339/8108 is trying to acquire lock:
000000007e2e1d9f (&nilfs->ns_sem){++++}, at: nilfs_set_error fs/nilfs2/super.c:86 [inline]
000000007e2e1d9f (&nilfs->ns_sem){++++}, at: __nilfs_error+0x195/0x401 fs/nilfs2/super.c:131

but task is already holding lock:

000000000bad9add (&dat_lock_key){.+.+}, at: nilfs_get_block+0x18f/0x970 fs/nilfs2/inode.c:79

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #1 (&dat_lock_key){.+.+}:

NILFS (loop0): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

nilfs_count_free_blocks+0x68/0x180 fs/nilfs2/the_nilfs.c:698
nilfs_set_log_cursor fs/nilfs2/super.c:237 [inline]
nilfs_cleanup_super+0x133/0x490 fs/nilfs2/super.c:319
nilfs_put_super+0x152/0x1a0 fs/nilfs2/super.c:473

Remounting filesystem read-only

generic_shutdown_super+0x144/0x370 fs/super.c:456
kill_block_super+0x97/0xf0 fs/super.c:1185
deactivate_locked_super+0x94/0x160 fs/super.c:329
deactivate_super+0x174/0x1a0 fs/super.c:360
cleanup_mnt+0x1a8/0x290 fs/namespace.c:1098
task_work_run+0x148/0x1c0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:193 [inline]
exit_to_usermode_loop+0x251/0x2a0 arch/x86/entry/common.c:167

Remounting filesystem read-only

prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe

-> #0 (&nilfs->ns_sem){++++}:

NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

down_write+0x34/0x90 kernel/locking/rwsem.c:70
nilfs_set_error fs/nilfs2/super.c:86 [inline]
__nilfs_error+0x195/0x401 fs/nilfs2/super.c:131

Remounting filesystem read-only

nilfs_bmap_convert_error fs/nilfs2/bmap.c:35 [inline]
nilfs_bmap_lookup_contig+0x13d/0x180 fs/nilfs2/bmap.c:95
nilfs_get_block+0x1ce/0x970 fs/nilfs2/inode.c:80
do_mpage_readpage+0x8fb/0x1ca0 fs/mpage.c:231

NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

mpage_readpages+0x33a/0x630 fs/mpage.c:404
read_pages.isra.0+0xf6/0x5d0 mm/readahead.c:123
__do_page_cache_readahead+0x5c6/0x6c0 mm/readahead.c:211

NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

ra_submit mm/internal.h:66 [inline]
ondemand_readahead.isra.0+0x575/0xd40 mm/readahead.c:493
page_cache_sync_readahead mm/readahead.c:528 [inline]
page_cache_sync_readahead+0x275/0x520 mm/readahead.c:510
generic_file_buffered_read mm/filemap.c:2115 [inline]
generic_file_read_iter+0x1497/0x2b60 mm/filemap.c:2385
call_read_iter include/linux/fs.h:1815 [inline]
new_sync_read fs/read_write.c:406 [inline]
__vfs_read+0x518/0x750 fs/read_write.c:418
integrity_kernel_read+0x147/0x1f0 security/integrity/iint.c:200
ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:364 [inline]
ima_calc_file_shash security/integrity/ima/ima_crypto.c:393 [inline]
ima_calc_file_hash+0x4b2/0x8a0 security/integrity/ima/ima_crypto.c:450
ima_collect_measurement+0x4c4/0x570 security/integrity/ima/ima_api.c:231

NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

process_measurement+0xddd/0x1440 security/integrity/ima/ima_main.c:284
ima_file_check+0xb9/0x100 security/integrity/ima/ima_main.c:391
do_last fs/namei.c:3425 [inline]
path_openat+0x7e4/0x2df0 fs/namei.c:3537
do_filp_open+0x18c/0x3f0 fs/namei.c:3567

NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

do_sys_open+0x3b3/0x520 fs/open.c:1085
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe

other info that might help us debug this:

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&dat_lock_key);
lock(&nilfs->ns_sem);
lock(&dat_lock_key);
lock(&nilfs->ns_sem);

NILFS error (device loop0): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

*** DEADLOCK ***

2 locks held by syz-executor339/8108:
#0: 000000000707fddd (&iint->mutex){+.+.}, at: process_measurement+0x316/0x1440 security/integrity/ima/ima_main.c:224

NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

#1: 000000000bad9add (&dat_lock_key){.+.+}, at: nilfs_get_block+0x18f/0x970 fs/nilfs2/inode.c:79

stack backtrace:
NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
CPU: 1 PID: 8108 Comm: syz-executor339 Not tainted 4.19.211-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
print_circular_bug.constprop.0.cold+0x2d7/0x41e kernel/locking/lockdep.c:1222
check_prev_add kernel/locking/lockdep.c:1866 [inline]
check_prevs_add kernel/locking/lockdep.c:1979 [inline]
validate_chain kernel/locking/lockdep.c:2420 [inline]
__lock_acquire+0x30c9/0x3ff0 kernel/locking/lockdep.c:3416

NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop0): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
lock_acquire+0x170/0x3c0 kernel/locking/lockdep.c:3908
NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
down_write+0x34/0x90 kernel/locking/rwsem.c:70

NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

nilfs_set_error fs/nilfs2/super.c:86 [inline]
__nilfs_error+0x195/0x401 fs/nilfs2/super.c:131
nilfs_bmap_convert_error fs/nilfs2/bmap.c:35 [inline]
nilfs_bmap_lookup_contig+0x13d/0x180 fs/nilfs2/bmap.c:95

NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

nilfs_get_block+0x1ce/0x970 fs/nilfs2/inode.c:80
do_mpage_readpage+0x8fb/0x1ca0 fs/mpage.c:231

NILFS error (device loop0): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

mpage_readpages+0x33a/0x630 fs/mpage.c:404
NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop0): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
read_pages.isra.0+0xf6/0x5d0 mm/readahead.c:123

NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

__do_page_cache_readahead+0x5c6/0x6c0 mm/readahead.c:211
NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

generic_file_buffered_read mm/filemap.c:2115 [inline]
generic_file_read_iter+0x1497/0x2b60 mm/filemap.c:2385
call_read_iter include/linux/fs.h:1815 [inline]
new_sync_read fs/read_write.c:406 [inline]
__vfs_read+0x518/0x750 fs/read_write.c:418

NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
integrity_kernel_read+0x147/0x1f0 security/integrity/iint.c:200
NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:364 [inline]
ima_calc_file_shash security/integrity/ima/ima_crypto.c:393 [inline]
ima_calc_file_hash+0x4b2/0x8a0 security/integrity/ima/ima_crypto.c:450

NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
ima_collect_measurement+0x4c4/0x570 security/integrity/ima/ima_api.c:231
NILFS error (device loop0): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
process_measurement+0xddd/0x1440 security/integrity/ima/ima_main.c:284

NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

NILFS (loop0): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
ima_file_check+0xb9/0x100 security/integrity/ima/ima_main.c:391
NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

do_last fs/namei.c:3425 [inline]
path_openat+0x7e4/0x2df0 fs/namei.c:3537
do_filp_open+0x18c/0x3f0 fs/namei.c:3567

NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

do_sys_open+0x3b3/0x520 fs/open.c:1085
NILFS error (device loop0): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f14e0d85099

Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48

NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
RSP: 002b:00007f14e0d302f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00007f14e0e0c4a0 RCX: 00007f14e0d85099

RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000080

RBP: 00007f14e0dd7730 R08: 0000000000000000 R09: 0000000000000000
NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f14e0dd7308
R13: 00007f14e0dd70c8 R14: 0030656c69662f2e R15: 00007f14e0e0c4a8

NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
Remounting filesystem read-only
NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop3): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop0): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop3): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop4): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop3): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop0): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop3): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop0): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
Remounting filesystem read-only
NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop3): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop3): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop3): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop3): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop0): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop3): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop4): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS (loop4): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop0): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop4): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop3): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop4): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop4): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop4): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop0): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop3): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop0): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop4): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop4): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop0): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS error (device loop0): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

audit: type=1800 audit(1665634372.437:2): pid=8115 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor339" name="file3" dev="loop5" ino=16 res=0
NILFS (loop3): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop0): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop0): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS error (device loop3): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop0): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

NILFS (loop4): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop0): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop3): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop0): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop3): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop0): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS (loop3): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop0): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

NILFS (loop4): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop0): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop3): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

Remounting filesystem read-only
NILFS error (device loop0): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop3): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS (loop4): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop0): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
audit: type=1800 audit(1665634372.887:3): pid=8109 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor339" name="file3" dev="loop1" ino=16 res=0
NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop3): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

NILFS (loop4): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop0): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop3): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
audit: type=1800 audit(1665634373.007:4): pid=8113 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor339" name="file3" dev="loop0" ino=16 res=0
NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
syz-executor339 (8113) used greatest stack depth: 23128 bytes left
NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
NILFS error (device loop3): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop4): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
audit: type=1800 audit(1665634373.077:5): pid=8138 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor339" name="file3" dev="loop2" ino=16 res=0
NILFS (loop3): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop3): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop3): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
Remounting filesystem read-only
NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop3): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop3): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop4): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop3): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop3): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop3): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
audit: type=1800 audit(1665634373.347:6): pid=8108 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor339" name="file3" dev="loop3" ino=16 res=0
NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
audit: type=1800 audit(1665634373.347:7): pid=8148 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor339" name="file3" dev="loop4" ino=16 res=0
NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds

NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
NILFS (loop4): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
Remounting filesystem read-only
NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop4): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop4): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop5): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop4): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop5): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds

NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
audit: type=1800 audit(1665634374.257:8): pid=8161 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor339" name="file3" dev="loop5" ino=16 res=0
NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
NILFS (loop4): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop4): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop4): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds

NILFS (loop4): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop1): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop4): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
NILFS (loop5): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
NILFS (loop4): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16)
Remounting filesystem read-only
NILFS error (device loop1): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

NILFS (loop4): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0
audit: type=1800 audit(1665634374.827:9): pid=8169 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor339" name="file3" dev="loop1" ino=16 res=0
NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS error (device loop2): nilfs_bmap_lookup_contig: broken bmap (inode number=16)

NILFS (loop4): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

NILFS (loop2): bad btree node (ino=16, blocknr=15): level = 0, flags = 0x0, nchildren = 0

NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=16)