[v6.1] possible deadlock in ext4_writepages
0 views
Skip to first unread message
syzbot
Sep 10, 2025, 6:18:33 PM (3 days ago) Sep 10
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: f97f1002271b Linux 6.1.151
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=12a0a934580000
kernel config: https://syzkaller.appspot.com/x/.config?x=68aa5a3af1cb953a
dashboard link: https://syzkaller.appspot.com/bug?extid=0bacd77c29cb89886c3a
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/24b13139fc78/disk-f97f1002.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8951515694cc/vmlinux-f97f1002.xz
kernel image: https://storage.googleapis.com/syzbot-assets/527104963c8c/Image-f97f1002.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0bacd7...@syzkaller.appspotmail.com
loop4: detected capacity change from 0 to 512
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.4.727/6281 is trying to acquire lock:
ffff0000fa58eb98 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages+0x188/0x284c fs/ext4/inode.c:2715
but task is already holding lock:
ffff0000e1d700c8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_write_trylock_xattr fs/ext4/xattr.h:162 [inline]
ffff0000e1d700c8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_try_to_expand_extra_isize fs/ext4/inode.c:6006 [inline]
ffff0000e1d700c8 (&ei->xattr_sem){++++}-{3:3}, at: __ext4_mark_inode_dirty+0x37c/0x790 fs/ext4/inode.c:6087
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&ei->xattr_sem){++++}-{3:3}:
down_write+0x5c/0x88 kernel/locking/rwsem.c:1573
ext4_write_lock_xattr fs/ext4/xattr.h:155 [inline]
ext4_inline_data_truncate+0x158/0x9f8 fs/ext4/inline.c:1971
ext4_truncate+0x39c/0x1078 fs/ext4/inode.c:4245
ext4_evict_inode+0xc04/0x1270 fs/ext4/inode.c:286
evict+0x3c8/0x810 fs/inode.c:705
iput_final fs/inode.c:1834 [inline]
iput+0x764/0x7f4 fs/inode.c:1860
ext4_process_orphan+0x240/0x2b4 fs/ext4/orphan.c:360
ext4_orphan_cleanup+0x908/0x104c fs/ext4/orphan.c:474
__ext4_fill_super fs/ext4/super.c:5537 [inline]
ext4_fill_super+0x6920/0x6e34 fs/ext4/super.c:5668
get_tree_bdev+0x358/0x544 fs/super.c:1366
ext4_get_tree+0x28/0x38 fs/ext4/super.c:5698
vfs_get_tree+0x90/0x274 fs/super.c:1573
do_new_mount+0x228/0x810 fs/namespace.c:3069
path_mount+0x5b4/0xe78 fs/namespace.c:3399
do_mount fs/namespace.c:3412 [inline]
__do_sys_mount fs/namespace.c:3620 [inline]
__se_sys_mount fs/namespace.c:3597 [inline]
__arm64_sys_mount+0x49c/0x584 fs/namespace.c:3597
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
-> #1 (sb_internal){.+.+}-{0:0}:
percpu_down_read+0x70/0x2a8 include/linux/percpu-rwsem.h:51
__sb_start_write include/linux/fs.h:1891 [inline]
sb_start_intwrite include/linux/fs.h:2013 [inline]
ext4_evict_inode+0x3dc/0x1270 fs/ext4/inode.c:240
evict+0x3c8/0x810 fs/inode.c:705
iput_final fs/inode.c:1834 [inline]
iput+0x764/0x7f4 fs/inode.c:1860
ext4_ext_migrate+0x9dc/0xbfc fs/ext4/migrate.c:587
__ext4_ioctl fs/ext4/ioctl.c:1396 [inline]
ext4_ioctl+0x1a38/0x4198 fs/ext4/ioctl.c:1614
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
-> #0 (&sbi->s_writepages_rwsem){++++}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3090 [inline]
check_prevs_add kernel/locking/lockdep.c:3209 [inline]
validate_chain kernel/locking/lockdep.c:3825 [inline]
__lock_acquire+0x293c/0x6544 kernel/locking/lockdep.c:5049
lock_acquire+0x20c/0x644 kernel/locking/lockdep.c:5662
percpu_down_read+0x70/0x2a8 include/linux/percpu-rwsem.h:51
ext4_writepages+0x188/0x284c fs/ext4/inode.c:2715
do_writepages+0x2c0/0x4fc mm/page-writeback.c:2491
__writeback_single_inode+0x164/0x157c fs/fs-writeback.c:1612
writeback_single_inode+0x1c0/0x720 fs/fs-writeback.c:1733
write_inode_now+0x144/0x1b0 fs/fs-writeback.c:2770
iput_final fs/inode.c:1821 [inline]
iput+0x5cc/0x7f4 fs/inode.c:1860
ext4_xattr_block_set+0x17a4/0x2810 fs/ext4/xattr.c:2157
ext4_xattr_move_to_block fs/ext4/xattr.c:2625 [inline]
ext4_xattr_make_inode_space fs/ext4/xattr.c:2700 [inline]
ext4_expand_extra_isize_ea+0xcb8/0x15cc fs/ext4/xattr.c:2792
__ext4_expand_extra_isize+0x298/0x358 fs/ext4/inode.c:5966
ext4_try_to_expand_extra_isize fs/ext4/inode.c:6009 [inline]
__ext4_mark_inode_dirty+0x3e4/0x790 fs/ext4/inode.c:6087
ext4_evict_inode+0xb58/0x1270 fs/ext4/inode.c:279
evict+0x3c8/0x810 fs/inode.c:705
iput_final fs/inode.c:1834 [inline]
iput+0x764/0x7f4 fs/inode.c:1860
ext4_process_orphan+0x240/0x2b4 fs/ext4/orphan.c:360
ext4_orphan_cleanup+0x908/0x104c fs/ext4/orphan.c:474
__ext4_fill_super fs/ext4/super.c:5537 [inline]
ext4_fill_super+0x6920/0x6e34 fs/ext4/super.c:5668
get_tree_bdev+0x358/0x544 fs/super.c:1366
ext4_get_tree+0x28/0x38 fs/ext4/super.c:5698
vfs_get_tree+0x90/0x274 fs/super.c:1573
do_new_mount+0x228/0x810 fs/namespace.c:3069
path_mount+0x5b4/0xe78 fs/namespace.c:3399
do_mount fs/namespace.c:3412 [inline]
__do_sys_mount fs/namespace.c:3620 [inline]
__se_sys_mount fs/namespace.c:3597 [inline]
__arm64_sys_mount+0x49c/0x584 fs/namespace.c:3597
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
other info that might help us debug this:
Chain exists of:
&sbi->s_writepages_rwsem --> sb_internal --> &ei->xattr_sem
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&ei->xattr_sem);
lock(sb_internal);
lock(&ei->xattr_sem);
lock(&sbi->s_writepages_rwsem);
*** DEADLOCK ***
3 locks held by syz.4.727/6281:
#0: ffff0000fa58c0e0 (&type->s_umount_key#26/1){+.+.}-{3:3}, at: alloc_super+0x1a4/0x804 fs/super.c:228
#1: ffff0000fa58c650 (sb_internal){.+.+}-{0:0}, at: __sb_start_write include/linux/fs.h:1891 [inline]
#1: ffff0000fa58c650 (sb_internal){.+.+}-{0:0}, at: sb_start_intwrite include/linux/fs.h:2013 [inline]
#1: ffff0000fa58c650 (sb_internal){.+.+}-{0:0}, at: ext4_evict_inode+0x3dc/0x1270 fs/ext4/inode.c:240
#2: ffff0000e1d700c8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_write_trylock_xattr fs/ext4/xattr.h:162 [inline]
#2: ffff0000e1d700c8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_try_to_expand_extra_isize fs/ext4/inode.c:6006 [inline]
#2: ffff0000e1d700c8 (&ei->xattr_sem){++++}-{3:3}, at: __ext4_mark_inode_dirty+0x37c/0x790 fs/ext4/inode.c:6087
stack backtrace:
CPU: 1 PID: 6281 Comm: syz.4.727 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
Call trace:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack+0x30/0x40 lib/dump_stack.c:88
dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106
dump_stack+0x1c/0x5c lib/dump_stack.c:113
print_circular_bug+0x148/0x1b0 kernel/locking/lockdep.c:2048
check_noncircular+0x240/0x2d4 kernel/locking/lockdep.c:2170
check_prev_add kernel/locking/lockdep.c:3090 [inline]
check_prevs_add kernel/locking/lockdep.c:3209 [inline]
validate_chain kernel/locking/lockdep.c:3825 [inline]
__lock_acquire+0x293c/0x6544 kernel/locking/lockdep.c:5049
lock_acquire+0x20c/0x644 kernel/locking/lockdep.c:5662
percpu_down_read+0x70/0x2a8 include/linux/percpu-rwsem.h:51
ext4_writepages+0x188/0x284c fs/ext4/inode.c:2715
do_writepages+0x2c0/0x4fc mm/page-writeback.c:2491
__writeback_single_inode+0x164/0x157c fs/fs-writeback.c:1612
writeback_single_inode+0x1c0/0x720 fs/fs-writeback.c:1733
write_inode_now+0x144/0x1b0 fs/fs-writeback.c:2770
iput_final fs/inode.c:1821 [inline]
iput+0x5cc/0x7f4 fs/inode.c:1860
ext4_xattr_block_set+0x17a4/0x2810 fs/ext4/xattr.c:2157
ext4_xattr_move_to_block fs/ext4/xattr.c:2625 [inline]
ext4_xattr_make_inode_space fs/ext4/xattr.c:2700 [inline]
ext4_expand_extra_isize_ea+0xcb8/0x15cc fs/ext4/xattr.c:2792
__ext4_expand_extra_isize+0x298/0x358 fs/ext4/inode.c:5966
ext4_try_to_expand_extra_isize fs/ext4/inode.c:6009 [inline]
__ext4_mark_inode_dirty+0x3e4/0x790 fs/ext4/inode.c:6087
ext4_evict_inode+0xb58/0x1270 fs/ext4/inode.c:279
evict+0x3c8/0x810 fs/inode.c:705
iput_final fs/inode.c:1834 [inline]
iput+0x764/0x7f4 fs/inode.c:1860
ext4_process_orphan+0x240/0x2b4 fs/ext4/orphan.c:360
ext4_orphan_cleanup+0x908/0x104c fs/ext4/orphan.c:474
__ext4_fill_super fs/ext4/super.c:5537 [inline]
ext4_fill_super+0x6920/0x6e34 fs/ext4/super.c:5668
get_tree_bdev+0x358/0x544 fs/super.c:1366
ext4_get_tree+0x28/0x38 fs/ext4/super.c:5698
vfs_get_tree+0x90/0x274 fs/super.c:1573
do_new_mount+0x228/0x810 fs/namespace.c:3069
path_mount+0x5b4/0xe78 fs/namespace.c:3399
do_mount fs/namespace.c:3412 [inline]
__do_sys_mount fs/namespace.c:3620 [inline]
__se_sys_mount fs/namespace.c:3597 [inline]
__arm64_sys_mount+0x49c/0x584 fs/namespace.c:3597
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
------------[ cut here ]------------
EA inode 11 i_nlink=2
WARNING: CPU: 0 PID: 6281 at fs/ext4/xattr.c:1021 ext4_xattr_inode_update_ref+0x468/0x4ac fs/ext4/xattr.c:-1
Modules linked in:
CPU: 0 PID: 6281 Comm: syz.4.727 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : ext4_xattr_inode_update_ref+0x468/0x4ac fs/ext4/xattr.c:-1
lr : ext4_xattr_inode_update_ref+0x464/0x4ac fs/ext4/xattr.c:1019
sp : ffff800021c76e80
x29: ffff800021c76f00 x28: 0000000000000000 x27: dfff800000000000
x26: 1fffe0001ec316da x25: ffff70000438edd0 x24: 0000000000000000
x23: ffff800017a8b000 x22: ffff800021c76e80 x21: 0000000000000002
x20: 0000000000000001 x19: ffff0000f618b4d8 x18: ffff800011abbcc0
x17: 1fffe00033ed797e x16: ffff800008042c8c x15: ffff8000150bd000
x14: 0000000000000100 x13: 0000000000000120 x12: 0000000000ff0100
x11: ff00800008047f18 x10: 0000000040000002 x9 : a294a6fe6c565600
x8 : a294a6fe6c565600 x7 : 0000000000000004 x6 : ffff800008251e10
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
x2 : ffff800021c76a20 x1 : 0000000000000000 x0 : ffff800008251ea4
Call trace:
ext4_xattr_inode_update_ref+0x468/0x4ac fs/ext4/xattr.c:-1
ext4_xattr_inode_dec_ref fs/ext4/xattr.c:1044 [inline]
ext4_xattr_set_entry+0x918/0x15ac fs/ext4/xattr.c:1682
ext4_xattr_ibody_set+0x204/0x600 fs/ext4/xattr.c:2229
ext4_xattr_move_to_block fs/ext4/xattr.c:2632 [inline]
ext4_xattr_make_inode_space fs/ext4/xattr.c:2700 [inline]
ext4_expand_extra_isize_ea+0xd00/0x15cc fs/ext4/xattr.c:2792
__ext4_expand_extra_isize+0x298/0x358 fs/ext4/inode.c:5966
ext4_try_to_expand_extra_isize fs/ext4/inode.c:6009 [inline]
__ext4_mark_inode_dirty+0x3e4/0x790 fs/ext4/inode.c:6087
ext4_evict_inode+0xb58/0x1270 fs/ext4/inode.c:279
evict+0x3c8/0x810 fs/inode.c:705
iput_final fs/inode.c:1834 [inline]
iput+0x764/0x7f4 fs/inode.c:1860
ext4_process_orphan+0x240/0x2b4 fs/ext4/orphan.c:360
ext4_orphan_cleanup+0x908/0x104c fs/ext4/orphan.c:474
__ext4_fill_super fs/ext4/super.c:5537 [inline]
ext4_fill_super+0x6920/0x6e34 fs/ext4/super.c:5668
get_tree_bdev+0x358/0x544 fs/super.c:1366
ext4_get_tree+0x28/0x38 fs/ext4/super.c:5698
vfs_get_tree+0x90/0x274 fs/super.c:1573
do_new_mount+0x228/0x810 fs/namespace.c:3069
path_mount+0x5b4/0xe78 fs/namespace.c:3399
do_mount fs/namespace.c:3412 [inline]
__do_sys_mount fs/namespace.c:3620 [inline]
__se_sys_mount fs/namespace.c:3597 [inline]
__arm64_sys_mount+0x49c/0x584 fs/namespace.c:3597
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 3573
hardirqs last enabled at (3573): [<ffff800011a42fdc>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last enabled at (3573): [<ffff800011a42fdc>] _raw_spin_unlock_irqrestore+0x48/0xac kernel/locking/spinlock.c:194
hardirqs last disabled at (3572): [<ffff800011a42df8>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (3572): [<ffff800011a42df8>] _raw_spin_lock_irqsave+0xa4/0xb4 kernel/locking/spinlock.c:162
softirqs last enabled at (3436): [<ffff8000081a967c>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last enabled at (3436): [<ffff8000081a967c>] handle_softirqs+0xaf8/0xc6c kernel/softirq.c:624
softirqs last disabled at (3415): [<ffff800008020164>] __do_softirq+0x14/0x20 kernel/softirq.c:630
---[ end trace 0000000000000000 ]---
EXT4-fs (loop4): 1 orphan inode deleted
EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none.
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: f97f1002271b Linux 6.1.151
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=12a0a934580000
kernel config: https://syzkaller.appspot.com/x/.config?x=68aa5a3af1cb953a
dashboard link: https://syzkaller.appspot.com/bug?extid=0bacd77c29cb89886c3a
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/24b13139fc78/disk-f97f1002.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8951515694cc/vmlinux-f97f1002.xz
kernel image: https://storage.googleapis.com/syzbot-assets/527104963c8c/Image-f97f1002.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0bacd7...@syzkaller.appspotmail.com
loop4: detected capacity change from 0 to 512
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.4.727/6281 is trying to acquire lock:
ffff0000fa58eb98 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages+0x188/0x284c fs/ext4/inode.c:2715
but task is already holding lock:
ffff0000e1d700c8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_write_trylock_xattr fs/ext4/xattr.h:162 [inline]
ffff0000e1d700c8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_try_to_expand_extra_isize fs/ext4/inode.c:6006 [inline]
ffff0000e1d700c8 (&ei->xattr_sem){++++}-{3:3}, at: __ext4_mark_inode_dirty+0x37c/0x790 fs/ext4/inode.c:6087
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&ei->xattr_sem){++++}-{3:3}:
down_write+0x5c/0x88 kernel/locking/rwsem.c:1573
ext4_write_lock_xattr fs/ext4/xattr.h:155 [inline]
ext4_inline_data_truncate+0x158/0x9f8 fs/ext4/inline.c:1971
ext4_truncate+0x39c/0x1078 fs/ext4/inode.c:4245
ext4_evict_inode+0xc04/0x1270 fs/ext4/inode.c:286
evict+0x3c8/0x810 fs/inode.c:705
iput_final fs/inode.c:1834 [inline]
iput+0x764/0x7f4 fs/inode.c:1860
ext4_process_orphan+0x240/0x2b4 fs/ext4/orphan.c:360
ext4_orphan_cleanup+0x908/0x104c fs/ext4/orphan.c:474
__ext4_fill_super fs/ext4/super.c:5537 [inline]
ext4_fill_super+0x6920/0x6e34 fs/ext4/super.c:5668
get_tree_bdev+0x358/0x544 fs/super.c:1366
ext4_get_tree+0x28/0x38 fs/ext4/super.c:5698
vfs_get_tree+0x90/0x274 fs/super.c:1573
do_new_mount+0x228/0x810 fs/namespace.c:3069
path_mount+0x5b4/0xe78 fs/namespace.c:3399
do_mount fs/namespace.c:3412 [inline]
__do_sys_mount fs/namespace.c:3620 [inline]
__se_sys_mount fs/namespace.c:3597 [inline]
__arm64_sys_mount+0x49c/0x584 fs/namespace.c:3597
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
-> #1 (sb_internal){.+.+}-{0:0}:
percpu_down_read+0x70/0x2a8 include/linux/percpu-rwsem.h:51
__sb_start_write include/linux/fs.h:1891 [inline]
sb_start_intwrite include/linux/fs.h:2013 [inline]
ext4_evict_inode+0x3dc/0x1270 fs/ext4/inode.c:240
evict+0x3c8/0x810 fs/inode.c:705
iput_final fs/inode.c:1834 [inline]
iput+0x764/0x7f4 fs/inode.c:1860
ext4_ext_migrate+0x9dc/0xbfc fs/ext4/migrate.c:587
__ext4_ioctl fs/ext4/ioctl.c:1396 [inline]
ext4_ioctl+0x1a38/0x4198 fs/ext4/ioctl.c:1614
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
-> #0 (&sbi->s_writepages_rwsem){++++}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3090 [inline]
check_prevs_add kernel/locking/lockdep.c:3209 [inline]
validate_chain kernel/locking/lockdep.c:3825 [inline]
__lock_acquire+0x293c/0x6544 kernel/locking/lockdep.c:5049
lock_acquire+0x20c/0x644 kernel/locking/lockdep.c:5662
percpu_down_read+0x70/0x2a8 include/linux/percpu-rwsem.h:51
ext4_writepages+0x188/0x284c fs/ext4/inode.c:2715
do_writepages+0x2c0/0x4fc mm/page-writeback.c:2491
__writeback_single_inode+0x164/0x157c fs/fs-writeback.c:1612
writeback_single_inode+0x1c0/0x720 fs/fs-writeback.c:1733
write_inode_now+0x144/0x1b0 fs/fs-writeback.c:2770
iput_final fs/inode.c:1821 [inline]
iput+0x5cc/0x7f4 fs/inode.c:1860
ext4_xattr_block_set+0x17a4/0x2810 fs/ext4/xattr.c:2157
ext4_xattr_move_to_block fs/ext4/xattr.c:2625 [inline]
ext4_xattr_make_inode_space fs/ext4/xattr.c:2700 [inline]
ext4_expand_extra_isize_ea+0xcb8/0x15cc fs/ext4/xattr.c:2792
__ext4_expand_extra_isize+0x298/0x358 fs/ext4/inode.c:5966
ext4_try_to_expand_extra_isize fs/ext4/inode.c:6009 [inline]
__ext4_mark_inode_dirty+0x3e4/0x790 fs/ext4/inode.c:6087
ext4_evict_inode+0xb58/0x1270 fs/ext4/inode.c:279
evict+0x3c8/0x810 fs/inode.c:705
iput_final fs/inode.c:1834 [inline]
iput+0x764/0x7f4 fs/inode.c:1860
ext4_process_orphan+0x240/0x2b4 fs/ext4/orphan.c:360
ext4_orphan_cleanup+0x908/0x104c fs/ext4/orphan.c:474
__ext4_fill_super fs/ext4/super.c:5537 [inline]
ext4_fill_super+0x6920/0x6e34 fs/ext4/super.c:5668
get_tree_bdev+0x358/0x544 fs/super.c:1366
ext4_get_tree+0x28/0x38 fs/ext4/super.c:5698
vfs_get_tree+0x90/0x274 fs/super.c:1573
do_new_mount+0x228/0x810 fs/namespace.c:3069
path_mount+0x5b4/0xe78 fs/namespace.c:3399
do_mount fs/namespace.c:3412 [inline]
__do_sys_mount fs/namespace.c:3620 [inline]
__se_sys_mount fs/namespace.c:3597 [inline]
__arm64_sys_mount+0x49c/0x584 fs/namespace.c:3597
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
other info that might help us debug this:
Chain exists of:
&sbi->s_writepages_rwsem --> sb_internal --> &ei->xattr_sem
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&ei->xattr_sem);
lock(sb_internal);
lock(&ei->xattr_sem);
lock(&sbi->s_writepages_rwsem);
*** DEADLOCK ***
3 locks held by syz.4.727/6281:
#0: ffff0000fa58c0e0 (&type->s_umount_key#26/1){+.+.}-{3:3}, at: alloc_super+0x1a4/0x804 fs/super.c:228
#1: ffff0000fa58c650 (sb_internal){.+.+}-{0:0}, at: __sb_start_write include/linux/fs.h:1891 [inline]
#1: ffff0000fa58c650 (sb_internal){.+.+}-{0:0}, at: sb_start_intwrite include/linux/fs.h:2013 [inline]
#1: ffff0000fa58c650 (sb_internal){.+.+}-{0:0}, at: ext4_evict_inode+0x3dc/0x1270 fs/ext4/inode.c:240
#2: ffff0000e1d700c8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_write_trylock_xattr fs/ext4/xattr.h:162 [inline]
#2: ffff0000e1d700c8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_try_to_expand_extra_isize fs/ext4/inode.c:6006 [inline]
#2: ffff0000e1d700c8 (&ei->xattr_sem){++++}-{3:3}, at: __ext4_mark_inode_dirty+0x37c/0x790 fs/ext4/inode.c:6087
stack backtrace:
CPU: 1 PID: 6281 Comm: syz.4.727 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
Call trace:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack+0x30/0x40 lib/dump_stack.c:88
dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106
dump_stack+0x1c/0x5c lib/dump_stack.c:113
print_circular_bug+0x148/0x1b0 kernel/locking/lockdep.c:2048
check_noncircular+0x240/0x2d4 kernel/locking/lockdep.c:2170
check_prev_add kernel/locking/lockdep.c:3090 [inline]
check_prevs_add kernel/locking/lockdep.c:3209 [inline]
validate_chain kernel/locking/lockdep.c:3825 [inline]
__lock_acquire+0x293c/0x6544 kernel/locking/lockdep.c:5049
lock_acquire+0x20c/0x644 kernel/locking/lockdep.c:5662
percpu_down_read+0x70/0x2a8 include/linux/percpu-rwsem.h:51
ext4_writepages+0x188/0x284c fs/ext4/inode.c:2715
do_writepages+0x2c0/0x4fc mm/page-writeback.c:2491
__writeback_single_inode+0x164/0x157c fs/fs-writeback.c:1612
writeback_single_inode+0x1c0/0x720 fs/fs-writeback.c:1733
write_inode_now+0x144/0x1b0 fs/fs-writeback.c:2770
iput_final fs/inode.c:1821 [inline]
iput+0x5cc/0x7f4 fs/inode.c:1860
ext4_xattr_block_set+0x17a4/0x2810 fs/ext4/xattr.c:2157
ext4_xattr_move_to_block fs/ext4/xattr.c:2625 [inline]
ext4_xattr_make_inode_space fs/ext4/xattr.c:2700 [inline]
ext4_expand_extra_isize_ea+0xcb8/0x15cc fs/ext4/xattr.c:2792
__ext4_expand_extra_isize+0x298/0x358 fs/ext4/inode.c:5966
ext4_try_to_expand_extra_isize fs/ext4/inode.c:6009 [inline]
__ext4_mark_inode_dirty+0x3e4/0x790 fs/ext4/inode.c:6087
ext4_evict_inode+0xb58/0x1270 fs/ext4/inode.c:279
evict+0x3c8/0x810 fs/inode.c:705
iput_final fs/inode.c:1834 [inline]
iput+0x764/0x7f4 fs/inode.c:1860
ext4_process_orphan+0x240/0x2b4 fs/ext4/orphan.c:360
ext4_orphan_cleanup+0x908/0x104c fs/ext4/orphan.c:474
__ext4_fill_super fs/ext4/super.c:5537 [inline]
ext4_fill_super+0x6920/0x6e34 fs/ext4/super.c:5668
get_tree_bdev+0x358/0x544 fs/super.c:1366
ext4_get_tree+0x28/0x38 fs/ext4/super.c:5698
vfs_get_tree+0x90/0x274 fs/super.c:1573
do_new_mount+0x228/0x810 fs/namespace.c:3069
path_mount+0x5b4/0xe78 fs/namespace.c:3399
do_mount fs/namespace.c:3412 [inline]
__do_sys_mount fs/namespace.c:3620 [inline]
__se_sys_mount fs/namespace.c:3597 [inline]
__arm64_sys_mount+0x49c/0x584 fs/namespace.c:3597
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
------------[ cut here ]------------
EA inode 11 i_nlink=2
WARNING: CPU: 0 PID: 6281 at fs/ext4/xattr.c:1021 ext4_xattr_inode_update_ref+0x468/0x4ac fs/ext4/xattr.c:-1
Modules linked in:
CPU: 0 PID: 6281 Comm: syz.4.727 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : ext4_xattr_inode_update_ref+0x468/0x4ac fs/ext4/xattr.c:-1
lr : ext4_xattr_inode_update_ref+0x464/0x4ac fs/ext4/xattr.c:1019
sp : ffff800021c76e80
x29: ffff800021c76f00 x28: 0000000000000000 x27: dfff800000000000
x26: 1fffe0001ec316da x25: ffff70000438edd0 x24: 0000000000000000
x23: ffff800017a8b000 x22: ffff800021c76e80 x21: 0000000000000002
x20: 0000000000000001 x19: ffff0000f618b4d8 x18: ffff800011abbcc0
x17: 1fffe00033ed797e x16: ffff800008042c8c x15: ffff8000150bd000
x14: 0000000000000100 x13: 0000000000000120 x12: 0000000000ff0100
x11: ff00800008047f18 x10: 0000000040000002 x9 : a294a6fe6c565600
x8 : a294a6fe6c565600 x7 : 0000000000000004 x6 : ffff800008251e10
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
x2 : ffff800021c76a20 x1 : 0000000000000000 x0 : ffff800008251ea4
Call trace:
ext4_xattr_inode_update_ref+0x468/0x4ac fs/ext4/xattr.c:-1
ext4_xattr_inode_dec_ref fs/ext4/xattr.c:1044 [inline]
ext4_xattr_set_entry+0x918/0x15ac fs/ext4/xattr.c:1682
ext4_xattr_ibody_set+0x204/0x600 fs/ext4/xattr.c:2229
ext4_xattr_move_to_block fs/ext4/xattr.c:2632 [inline]
ext4_xattr_make_inode_space fs/ext4/xattr.c:2700 [inline]
ext4_expand_extra_isize_ea+0xd00/0x15cc fs/ext4/xattr.c:2792
__ext4_expand_extra_isize+0x298/0x358 fs/ext4/inode.c:5966
ext4_try_to_expand_extra_isize fs/ext4/inode.c:6009 [inline]
__ext4_mark_inode_dirty+0x3e4/0x790 fs/ext4/inode.c:6087
ext4_evict_inode+0xb58/0x1270 fs/ext4/inode.c:279
evict+0x3c8/0x810 fs/inode.c:705
iput_final fs/inode.c:1834 [inline]
iput+0x764/0x7f4 fs/inode.c:1860
ext4_process_orphan+0x240/0x2b4 fs/ext4/orphan.c:360
ext4_orphan_cleanup+0x908/0x104c fs/ext4/orphan.c:474
__ext4_fill_super fs/ext4/super.c:5537 [inline]
ext4_fill_super+0x6920/0x6e34 fs/ext4/super.c:5668
get_tree_bdev+0x358/0x544 fs/super.c:1366
ext4_get_tree+0x28/0x38 fs/ext4/super.c:5698
vfs_get_tree+0x90/0x274 fs/super.c:1573
do_new_mount+0x228/0x810 fs/namespace.c:3069
path_mount+0x5b4/0xe78 fs/namespace.c:3399
do_mount fs/namespace.c:3412 [inline]
__do_sys_mount fs/namespace.c:3620 [inline]
__se_sys_mount fs/namespace.c:3597 [inline]
__arm64_sys_mount+0x49c/0x584 fs/namespace.c:3597
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 3573
hardirqs last enabled at (3573): [<ffff800011a42fdc>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last enabled at (3573): [<ffff800011a42fdc>] _raw_spin_unlock_irqrestore+0x48/0xac kernel/locking/spinlock.c:194
hardirqs last disabled at (3572): [<ffff800011a42df8>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (3572): [<ffff800011a42df8>] _raw_spin_lock_irqsave+0xa4/0xb4 kernel/locking/spinlock.c:162
softirqs last enabled at (3436): [<ffff8000081a967c>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last enabled at (3436): [<ffff8000081a967c>] handle_softirqs+0xaf8/0xc6c kernel/softirq.c:624
softirqs last disabled at (3415): [<ffff800008020164>] __do_softirq+0x14/0x20 kernel/softirq.c:630
---[ end trace 0000000000000000 ]---
EXT4-fs (loop4): 1 orphan inode deleted
EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none.
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Sep 10, 2025, 6:38:33 PM (3 days ago) Sep 10
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: f97f1002271b Linux 6.1.151
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=153b6642580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/24b13139fc78/disk-f97f1002.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8951515694cc/vmlinux-f97f1002.xz
kernel image: https://storage.googleapis.com/syzbot-assets/527104963c8c/Image-f97f1002.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/2c7466a2408b/mount_0.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=151e2b12580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0bacd7...@syzkaller.appspotmail.com
loop0: detected capacity change from 0 to 512
ffff0000cfbccb98 (&sbi->s_writepages_rwsem){.+.+}-{0:0}, at: ext4_writepages+0x188/0x284c fs/ext4/inode.c:2715
but task is already holding lock:
ffff0000e9ed4700 (&ei->xattr_sem){++++}-{3:3}, at: ext4_write_trylock_xattr fs/ext4/xattr.h:162 [inline]
ffff0000e9ed4700 (&ei->xattr_sem){++++}-{3:3}, at: ext4_try_to_expand_extra_isize fs/ext4/inode.c:6006 [inline]
ffff0000e9ed4700 (&ei->xattr_sem){++++}-{3:3}, at: __ext4_mark_inode_dirty+0x37c/0x790 fs/ext4/inode.c:6087
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&ei->xattr_sem){++++}-{3:3}:
down_read+0x64/0x304 kernel/locking/rwsem.c:1520
ext4_setattr+0x7c4/0x150c fs/ext4/inode.c:5501
notify_change+0xb0c/0xdcc fs/attr.c:499
chown_common+0x414/0x574 fs/open.c:736
do_fchownat+0x158/0x268 fs/open.c:767
__do_sys_fchownat fs/open.c:782 [inline]
__se_sys_fchownat fs/open.c:779 [inline]
__arm64_sys_fchownat+0xb8/0xd4 fs/open.c:779
start_this_handle+0xfe0/0x122c fs/jbd2/transaction.c:463
jbd2__journal_start+0x288/0x51c fs/jbd2/transaction.c:520
__ext4_journal_start_sb+0x2fc/0x674 fs/ext4/ext4_jbd2.c:105
__ext4_journal_start fs/ext4/ext4_jbd2.h:326 [inline]
ext4_writepages+0xa28/0x284c fs/ext4/inode.c:2838
__writeback_inodes_wb+0x110/0x394 fs/fs-writeback.c:1974
wb_writeback+0x414/0xfb0 fs/fs-writeback.c:2079
wb_check_background_flush fs/fs-writeback.c:2145 [inline]
wb_do_writeback fs/fs-writeback.c:2233 [inline]
wb_workfn+0xac0/0xd98 fs/fs-writeback.c:2260
process_one_work+0x7f4/0x13a8 kernel/workqueue.c:2292
worker_thread+0x8c8/0xfbc kernel/workqueue.c:2439
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
-> #0 (&sbi->s_writepages_rwsem){.+.+}-{0:0}:
&sbi->s_writepages_rwsem --> jbd2_handle --> &ei->xattr_sem
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&ei->xattr_sem);
lock(jbd2_handle);
#0: ffff0000cfbca0e0 (&type->s_umount_key#26/1){+.+.}-{3:3}, at: alloc_super+0x1a4/0x804 fs/super.c:228
#1: ffff0000cfbca650 (sb_internal){.+.+}-{0:0}, at: __sb_start_write include/linux/fs.h:1891 [inline]
#1: ffff0000cfbca650 (sb_internal){.+.+}-{0:0}, at: sb_start_intwrite include/linux/fs.h:2013 [inline]
#1: ffff0000cfbca650 (sb_internal){.+.+}-{0:0}, at: ext4_evict_inode+0x3dc/0x1270 fs/ext4/inode.c:240
#2: ffff0000e9ed4700 (&ei->xattr_sem){++++}-{3:3}, at: ext4_write_trylock_xattr fs/ext4/xattr.h:162 [inline]
#2: ffff0000e9ed4700 (&ei->xattr_sem){++++}-{3:3}, at: ext4_try_to_expand_extra_isize fs/ext4/inode.c:6006 [inline]
#2: ffff0000e9ed4700 (&ei->xattr_sem){++++}-{3:3}, at: __ext4_mark_inode_dirty+0x37c/0x790 fs/ext4/inode.c:6087
stack backtrace:
CPU: 1 PID: 4463 Comm: syz.0.17 Not tainted syzkaller #0
WARNING: CPU: 1 PID: 4463 at fs/ext4/xattr.c:1021 ext4_xattr_inode_update_ref+0x468/0x4ac fs/ext4/xattr.c:-1
Modules linked in:
CPU: 1 PID: 4463 Comm: syz.0.17 Not tainted syzkaller #0
x29: ffff800020f26f00 x28: 0000000000000000 x27: dfff800000000000
x26: 1fffe0001d3dad1f x25: ffff7000041e4dd0 x24: 0000000000000000
x23: ffff800017a8b000 x22: ffff800020f26e80 x21: 0000000000000002
x20: 0000000000000001 x19: ffff0000e9ed6700 x18: ffff800011abbcc0
x17: 0000000000000000 x16: ffff800008042c8c x15: 0000000000000000
x14: 00000000ffffffff x13: 0000000000000001 x12: 0000000000ff0100
x11: ff00800008191ca8 x10: 0000000000000000 x9 : d95b71c66b01c300
x8 : d95b71c66b01c300 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff800020f26918 x4 : ffff8000151a4820 x3 : ffff800008311d00
x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000000
irq event stamp: 4397
hardirqs last enabled at (4397): [<ffff800011a42fdc>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last enabled at (4397): [<ffff800011a42fdc>] _raw_spin_unlock_irqrestore+0x48/0xac kernel/locking/spinlock.c:194
hardirqs last disabled at (4396): [<ffff800011a42df8>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (4396): [<ffff800011a42df8>] _raw_spin_lock_irqsave+0xa4/0xb4 kernel/locking/spinlock.c:162
softirqs last enabled at (3018): [<ffff8000081a967c>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last enabled at (3018): [<ffff8000081a967c>] handle_softirqs+0xaf8/0xc6c kernel/softirq.c:624
softirqs last disabled at (2907): [<ffff800008020164>] __do_softirq+0x14/0x20 kernel/softirq.c:630
EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: f97f1002271b Linux 6.1.151
git tree: linux-6.1.y
kernel config: https://syzkaller.appspot.com/x/.config?x=68aa5a3af1cb953a
dashboard link: https://syzkaller.appspot.com/bug?extid=0bacd77c29cb89886c3a
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1720047c580000
dashboard link: https://syzkaller.appspot.com/bug?extid=0bacd77c29cb89886c3a
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
userspace arch: arm64
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/24b13139fc78/disk-f97f1002.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8951515694cc/vmlinux-f97f1002.xz
kernel image: https://storage.googleapis.com/syzbot-assets/527104963c8c/Image-f97f1002.gz.xz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=151e2b12580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0bacd7...@syzkaller.appspotmail.com
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.0.17/4463 is trying to acquire lock:
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
ffff0000cfbccb98 (&sbi->s_writepages_rwsem){.+.+}-{0:0}, at: ext4_writepages+0x188/0x284c fs/ext4/inode.c:2715
but task is already holding lock:
ffff0000e9ed4700 (&ei->xattr_sem){++++}-{3:3}, at: ext4_try_to_expand_extra_isize fs/ext4/inode.c:6006 [inline]
ffff0000e9ed4700 (&ei->xattr_sem){++++}-{3:3}, at: __ext4_mark_inode_dirty+0x37c/0x790 fs/ext4/inode.c:6087
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&ei->xattr_sem){++++}-{3:3}:
ext4_setattr+0x7c4/0x150c fs/ext4/inode.c:5501
notify_change+0xb0c/0xdcc fs/attr.c:499
chown_common+0x414/0x574 fs/open.c:736
do_fchownat+0x158/0x268 fs/open.c:767
__do_sys_fchownat fs/open.c:782 [inline]
__se_sys_fchownat fs/open.c:779 [inline]
__arm64_sys_fchownat+0xb8/0xd4 fs/open.c:779
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
-> #1 (jbd2_handle){.+.+}-{0:0}:
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
start_this_handle+0xfe0/0x122c fs/jbd2/transaction.c:463
jbd2__journal_start+0x288/0x51c fs/jbd2/transaction.c:520
__ext4_journal_start_sb+0x2fc/0x674 fs/ext4/ext4_jbd2.c:105
__ext4_journal_start fs/ext4/ext4_jbd2.h:326 [inline]
ext4_writepages+0xa28/0x284c fs/ext4/inode.c:2838
do_writepages+0x2c0/0x4fc mm/page-writeback.c:2491
__writeback_single_inode+0x164/0x157c fs/fs-writeback.c:1612
writeback_sb_inodes+0x824/0x1404 fs/fs-writeback.c:1903
__writeback_single_inode+0x164/0x157c fs/fs-writeback.c:1612
__writeback_inodes_wb+0x110/0x394 fs/fs-writeback.c:1974
wb_writeback+0x414/0xfb0 fs/fs-writeback.c:2079
wb_check_background_flush fs/fs-writeback.c:2145 [inline]
wb_do_writeback fs/fs-writeback.c:2233 [inline]
wb_workfn+0xac0/0xd98 fs/fs-writeback.c:2260
process_one_work+0x7f4/0x13a8 kernel/workqueue.c:2292
worker_thread+0x8c8/0xfbc kernel/workqueue.c:2439
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
-> #0 (&sbi->s_writepages_rwsem){.+.+}-{0:0}:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&ei->xattr_sem);
lock(&ei->xattr_sem);
lock(&sbi->s_writepages_rwsem);
*** DEADLOCK ***
3 locks held by syz.0.17/4463:
lock(&sbi->s_writepages_rwsem);
*** DEADLOCK ***
#0: ffff0000cfbca0e0 (&type->s_umount_key#26/1){+.+.}-{3:3}, at: alloc_super+0x1a4/0x804 fs/super.c:228
#1: ffff0000cfbca650 (sb_internal){.+.+}-{0:0}, at: __sb_start_write include/linux/fs.h:1891 [inline]
#1: ffff0000cfbca650 (sb_internal){.+.+}-{0:0}, at: sb_start_intwrite include/linux/fs.h:2013 [inline]
#1: ffff0000cfbca650 (sb_internal){.+.+}-{0:0}, at: ext4_evict_inode+0x3dc/0x1270 fs/ext4/inode.c:240
#2: ffff0000e9ed4700 (&ei->xattr_sem){++++}-{3:3}, at: ext4_write_trylock_xattr fs/ext4/xattr.h:162 [inline]
#2: ffff0000e9ed4700 (&ei->xattr_sem){++++}-{3:3}, at: ext4_try_to_expand_extra_isize fs/ext4/inode.c:6006 [inline]
#2: ffff0000e9ed4700 (&ei->xattr_sem){++++}-{3:3}, at: __ext4_mark_inode_dirty+0x37c/0x790 fs/ext4/inode.c:6087
stack backtrace:
CPU: 1 PID: 4463 Comm: syz.0.17 Not tainted syzkaller #0
Modules linked in:
CPU: 1 PID: 4463 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : ext4_xattr_inode_update_ref+0x468/0x4ac fs/ext4/xattr.c:-1
lr : ext4_xattr_inode_update_ref+0x464/0x4ac fs/ext4/xattr.c:1019
sp : ffff800020f26e80
pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : ext4_xattr_inode_update_ref+0x468/0x4ac fs/ext4/xattr.c:-1
lr : ext4_xattr_inode_update_ref+0x464/0x4ac fs/ext4/xattr.c:1019
x29: ffff800020f26f00 x28: 0000000000000000 x27: dfff800000000000
x26: 1fffe0001d3dad1f x25: ffff7000041e4dd0 x24: 0000000000000000
x23: ffff800017a8b000 x22: ffff800020f26e80 x21: 0000000000000002
x20: 0000000000000001 x19: ffff0000e9ed6700 x18: ffff800011abbcc0
x17: 0000000000000000 x16: ffff800008042c8c x15: 0000000000000000
x14: 00000000ffffffff x13: 0000000000000001 x12: 0000000000ff0100
x11: ff00800008191ca8 x10: 0000000000000000 x9 : d95b71c66b01c300
x8 : d95b71c66b01c300 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff800020f26918 x4 : ffff8000151a4820 x3 : ffff800008311d00
x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000000
hardirqs last enabled at (4397): [<ffff800011a42fdc>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last enabled at (4397): [<ffff800011a42fdc>] _raw_spin_unlock_irqrestore+0x48/0xac kernel/locking/spinlock.c:194
hardirqs last disabled at (4396): [<ffff800011a42df8>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (4396): [<ffff800011a42df8>] _raw_spin_lock_irqsave+0xa4/0xb4 kernel/locking/spinlock.c:162
softirqs last enabled at (3018): [<ffff8000081a967c>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last enabled at (3018): [<ffff8000081a967c>] handle_softirqs+0xaf8/0xc6c kernel/softirq.c:624
softirqs last disabled at (2907): [<ffff800008020164>] __do_softirq+0x14/0x20 kernel/softirq.c:630
---[ end trace 0000000000000000 ]---
EXT4-fs (loop0): 1 orphan inode deleted
EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
syzbot
Sep 12, 2025, 12:06:29 PM (yesterday) Sep 12
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 60a9e718726f Linux 6.6.106
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=10125642580000
kernel config: https://syzkaller.appspot.com/x/.config?x=12606d4b8832c7e4
dashboard link: https://syzkaller.appspot.com/bug?extid=8c223a3aa6865f107658
disk image: https://storage.googleapis.com/syzbot-assets/eca27e056a5a/disk-60a9e718.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/bc64d4eeb7f6/vmlinux-60a9e718.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a345041561ac/bzImage-60a9e718.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8c223a...@syzkaller.appspotmail.com
loop3: detected capacity change from 0 to 512
ffff888024f70bd8 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages_down_read fs/ext4/ext4.h:1767 [inline]
ffff888024f70bd8 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages+0x170/0x2f0 fs/ext4/inode.c:2806
but task is already holding lock:
ffff888076b71ec8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_write_trylock_xattr fs/ext4/xattr.h:162 [inline]
ffff888076b71ec8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_try_to_expand_extra_isize fs/ext4/inode.c:5993 [inline]
ffff888076b71ec8 (&ei->xattr_sem){++++}-{3:3}, at: __ext4_mark_inode_dirty+0x3dc/0x6e0 fs/ext4/inode.c:6074
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&ei->xattr_sem){++++}-{3:3}:
down_write+0x97/0x1f0 kernel/locking/rwsem.c:1573
ext4_write_lock_xattr fs/ext4/xattr.h:155 [inline]
ext4_destroy_inline_data+0x28/0xe0 fs/ext4/inline.c:1884
ext4_do_writepages+0x4c2/0x38d0 fs/ext4/inode.c:2604
ext4_writepages+0x1a8/0x2f0 fs/ext4/inode.c:2807
do_writepages+0x3a2/0x600 mm/page-writeback.c:2575
filemap_fdatawrite_wbc+0x122/0x180 mm/filemap.c:390
__filemap_fdatawrite_range mm/filemap.c:423 [inline]
file_write_and_wait_range+0x171/0x240 mm/filemap.c:781
generic_buffers_fsync_noflush+0x6f/0x160 fs/buffer.c:609
ext4_fsync_nojournal fs/ext4/fsync.c:88 [inline]
ext4_sync_file+0x454/0xc10 fs/ext4/fsync.c:151
generic_write_sync include/linux/fs.h:2651 [inline]
ext4_buffered_write_iter+0x2c0/0x350 fs/ext4/file.c:305
ext4_file_write_iter+0x1d9/0x1870 fs/ext4/file.c:-1
do_iter_readv_writev fs/read_write.c:-1 [inline]
do_iter_write+0x79a/0xc70 fs/read_write.c:860
vfs_writev fs/read_write.c:933 [inline]
do_pwritev+0x205/0x340 fs/read_write.c:1030
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
-> #0 (&sbi->s_writepages_rwsem){++++}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain kernel/locking/lockdep.c:3869 [inline]
__lock_acquire+0x2ddb/0x7c80 kernel/locking/lockdep.c:5137
lock_acquire+0x197/0x410 kernel/locking/lockdep.c:5754
percpu_down_read+0x44/0x1a0 include/linux/percpu-rwsem.h:51
ext4_writepages_down_read fs/ext4/ext4.h:1767 [inline]
ext4_writepages+0x170/0x2f0 fs/ext4/inode.c:2806
do_writepages+0x3a2/0x600 mm/page-writeback.c:2575
__writeback_single_inode+0x153/0xee0 fs/fs-writeback.c:1625
writeback_single_inode+0x211/0x720 fs/fs-writeback.c:1746
write_inode_now+0x161/0x1e0 fs/fs-writeback.c:2792
iput_final fs/inode.c:1807 [inline]
iput+0x5b2/0x920 fs/inode.c:1846
ext4_xattr_block_set+0x273a/0x32a0 fs/ext4/xattr.c:2206
ext4_xattr_move_to_block fs/ext4/xattr.c:2674 [inline]
ext4_xattr_make_inode_space fs/ext4/xattr.c:2749 [inline]
ext4_expand_extra_isize_ea+0x10ea/0x19e0 fs/ext4/xattr.c:2841
__ext4_expand_extra_isize+0x306/0x400 fs/ext4/inode.c:5953
ext4_try_to_expand_extra_isize fs/ext4/inode.c:5996 [inline]
__ext4_mark_inode_dirty+0x45d/0x6e0 fs/ext4/inode.c:6074
ext4_evict_inode+0x7ed/0xea0 fs/ext4/inode.c:252
evict+0x486/0x870 fs/inode.c:705
ext4_orphan_cleanup+0xbd4/0x1400 fs/ext4/orphan.c:474
__ext4_fill_super fs/ext4/super.c:5608 [inline]
ext4_fill_super+0x5de7/0x66c0 fs/ext4/super.c:5731
get_tree_bdev+0x3e4/0x510 fs/super.c:1591
vfs_get_tree+0x8c/0x280 fs/super.c:1764
do_new_mount+0x24b/0xa40 fs/namespace.c:3377
do_mount fs/namespace.c:3717 [inline]
__do_sys_mount fs/namespace.c:3926 [inline]
__se_sys_mount+0x2da/0x3c0 fs/namespace.c:3903
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
other info that might help us debug this:
lock(&ei->xattr_sem);
rlock(&sbi->s_writepages_rwsem);
*** DEADLOCK ***
3 locks held by syz.3.173/6334:
#0: ffff888024f720e0 (&type->s_umount_key#31){++++}-{3:3}, at: __super_lock fs/super.c:56 [inline]
#0: ffff888024f720e0 (&type->s_umount_key#31){++++}-{3:3}, at: __super_lock_excl fs/super.c:71 [inline]
#0: ffff888024f720e0 (&type->s_umount_key#31){++++}-{3:3}, at: get_tree_bdev+0x344/0x510 fs/super.c:1589
#1: ffff888024f72608 (sb_internal){.+.+}-{0:0}, at: __sb_start_write include/linux/fs.h:1633 [inline]
#1: ffff888024f72608 (sb_internal){.+.+}-{0:0}, at: sb_start_intwrite include/linux/fs.h:1755 [inline]
#1: ffff888024f72608 (sb_internal){.+.+}-{0:0}, at: ext4_evict_inode+0x2b9/0xea0 fs/ext4/inode.c:213
#2: ffff888076b71ec8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_write_trylock_xattr fs/ext4/xattr.h:162 [inline]
#2: ffff888076b71ec8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_try_to_expand_extra_isize fs/ext4/inode.c:5993 [inline]
#2: ffff888076b71ec8 (&ei->xattr_sem){++++}-{3:3}, at: __ext4_mark_inode_dirty+0x3dc/0x6e0 fs/ext4/inode.c:6074
stack backtrace:
CPU: 0 PID: 6334 Comm: syz.3.173 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
<TASK>
dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106
check_noncircular+0x2bd/0x3c0 kernel/locking/lockdep.c:2187
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain kernel/locking/lockdep.c:3869 [inline]
__lock_acquire+0x2ddb/0x7c80 kernel/locking/lockdep.c:5137
lock_acquire+0x197/0x410 kernel/locking/lockdep.c:5754
percpu_down_read+0x44/0x1a0 include/linux/percpu-rwsem.h:51
ext4_writepages_down_read fs/ext4/ext4.h:1767 [inline]
ext4_writepages+0x170/0x2f0 fs/ext4/inode.c:2806
do_writepages+0x3a2/0x600 mm/page-writeback.c:2575
__writeback_single_inode+0x153/0xee0 fs/fs-writeback.c:1625
writeback_single_inode+0x211/0x720 fs/fs-writeback.c:1746
write_inode_now+0x161/0x1e0 fs/fs-writeback.c:2792
iput_final fs/inode.c:1807 [inline]
iput+0x5b2/0x920 fs/inode.c:1846
ext4_xattr_block_set+0x273a/0x32a0 fs/ext4/xattr.c:2206
ext4_xattr_move_to_block fs/ext4/xattr.c:2674 [inline]
ext4_xattr_make_inode_space fs/ext4/xattr.c:2749 [inline]
ext4_expand_extra_isize_ea+0x10ea/0x19e0 fs/ext4/xattr.c:2841
__ext4_expand_extra_isize+0x306/0x400 fs/ext4/inode.c:5953
ext4_try_to_expand_extra_isize fs/ext4/inode.c:5996 [inline]
__ext4_mark_inode_dirty+0x45d/0x6e0 fs/ext4/inode.c:6074
ext4_evict_inode+0x7ed/0xea0 fs/ext4/inode.c:252
evict+0x486/0x870 fs/inode.c:705
ext4_orphan_cleanup+0xbd4/0x1400 fs/ext4/orphan.c:474
__ext4_fill_super fs/ext4/super.c:5608 [inline]
ext4_fill_super+0x5de7/0x66c0 fs/ext4/super.c:5731
get_tree_bdev+0x3e4/0x510 fs/super.c:1591
vfs_get_tree+0x8c/0x280 fs/super.c:1764
do_new_mount+0x24b/0xa40 fs/namespace.c:3377
do_mount fs/namespace.c:3717 [inline]
__do_sys_mount fs/namespace.c:3926 [inline]
__se_sys_mount+0x2da/0x3c0 fs/namespace.c:3903
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fb3e6b9034a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb3e7a71e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fb3e7a71ef0 RCX: 00007fb3e6b9034a
RDX: 0000200000000180 RSI: 00002000000001c0 RDI: 00007fb3e7a71eb0
RBP: 0000200000000180 R08: 00007fb3e7a71ef0 R09: 0000000000800700
R10: 0000000000800700 R11: 0000000000000246 R12: 00002000000001c0
R13: 00007fb3e7a71eb0 R14: 0000000000000473 R15: 0000200000000680
</TASK>
Modules linked in:
CPU: 0 PID: 6334 Comm: syz.3.173 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:ext4_xattr_inode_update_ref+0x521/0x580 fs/ext4/xattr.c:1068
Code: 24 50 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 31 43 9a ff 49 8b 37 48 c7 c7 00 d1 be 8a 44 89 f2 e8 cf 73 0d ff <0f> 0b 4c 8b 64 24 18 48 8b 5c 24 10 4c 8d 7c 24 60 e9 1f fe ff ff
RSP: 0018:ffffc9000c4af220 EFLAGS: 00010246
RAX: 45c1d3d1a024f400 RBX: 0000000000000001 RCX: 0000000000080000
RDX: ffffc9000d82d000 RSI: 000000000007ffff RDI: 0000000000080000
RBP: ffffc9000c4af318 R08: ffffc9000c4aee27 R09: 1ffff92001895dc4
R10: dffffc0000000000 R11: fffff52001895dc5 R12: ffff888076b73eb0
R13: dffffc0000000000 R14: 0000000000000002 R15: ffff888076b73f00
FS: 00007fb3e7a726c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6265c16000 CR3: 000000001dae7000 CR4: 00000000003506f0
Call Trace:
<TASK>
ext4_xattr_inode_dec_ref fs/ext4/xattr.c:1093 [inline]
ext4_xattr_set_entry+0xcda/0x1e90 fs/ext4/xattr.c:1731
ext4_xattr_ibody_set+0x254/0x6a0 fs/ext4/xattr.c:2278
ext4_xattr_move_to_block fs/ext4/xattr.c:2681 [inline]
ext4_xattr_make_inode_space fs/ext4/xattr.c:2749 [inline]
ext4_expand_extra_isize_ea+0x113a/0x19e0 fs/ext4/xattr.c:2841
__ext4_expand_extra_isize+0x306/0x400 fs/ext4/inode.c:5953
ext4_try_to_expand_extra_isize fs/ext4/inode.c:5996 [inline]
__ext4_mark_inode_dirty+0x45d/0x6e0 fs/ext4/inode.c:6074
ext4_evict_inode+0x7ed/0xea0 fs/ext4/inode.c:252
evict+0x486/0x870 fs/inode.c:705
ext4_orphan_cleanup+0xbd4/0x1400 fs/ext4/orphan.c:474
__ext4_fill_super fs/ext4/super.c:5608 [inline]
ext4_fill_super+0x5de7/0x66c0 fs/ext4/super.c:5731
get_tree_bdev+0x3e4/0x510 fs/super.c:1591
vfs_get_tree+0x8c/0x280 fs/super.c:1764
do_new_mount+0x24b/0xa40 fs/namespace.c:3377
do_mount fs/namespace.c:3717 [inline]
__do_sys_mount fs/namespace.c:3926 [inline]
__se_sys_mount+0x2da/0x3c0 fs/namespace.c:3903
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fb3e6b9034a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb3e7a71e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fb3e7a71ef0 RCX: 00007fb3e6b9034a
RDX: 0000200000000180 RSI: 00002000000001c0 RDI: 00007fb3e7a71eb0
RBP: 0000200000000180 R08: 00007fb3e7a71ef0 R09: 0000000000800700
R10: 0000000000800700 R11: 0000000000000246 R12: 00002000000001c0
R13: 00007fb3e7a71eb0 R14: 0000000000000473 R15: 0000200000000680
</TASK>
syzbot found the following issue on:
HEAD commit: 60a9e718726f Linux 6.6.106
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=10125642580000
kernel config: https://syzkaller.appspot.com/x/.config?x=12606d4b8832c7e4
dashboard link: https://syzkaller.appspot.com/bug?extid=8c223a3aa6865f107658
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/eca27e056a5a/disk-60a9e718.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/bc64d4eeb7f6/vmlinux-60a9e718.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a345041561ac/bzImage-60a9e718.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
loop3: detected capacity change from 0 to 512
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.3.173/6334 is trying to acquire lock:
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
ffff888024f70bd8 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages_down_read fs/ext4/ext4.h:1767 [inline]
ffff888024f70bd8 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages+0x170/0x2f0 fs/ext4/inode.c:2806
but task is already holding lock:
ffff888076b71ec8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_try_to_expand_extra_isize fs/ext4/inode.c:5993 [inline]
ffff888076b71ec8 (&ei->xattr_sem){++++}-{3:3}, at: __ext4_mark_inode_dirty+0x3dc/0x6e0 fs/ext4/inode.c:6074
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
down_write+0x97/0x1f0 kernel/locking/rwsem.c:1573
ext4_write_lock_xattr fs/ext4/xattr.h:155 [inline]
ext4_destroy_inline_data+0x28/0xe0 fs/ext4/inline.c:1884
ext4_do_writepages+0x4c2/0x38d0 fs/ext4/inode.c:2604
ext4_writepages+0x1a8/0x2f0 fs/ext4/inode.c:2807
do_writepages+0x3a2/0x600 mm/page-writeback.c:2575
filemap_fdatawrite_wbc+0x122/0x180 mm/filemap.c:390
__filemap_fdatawrite_range mm/filemap.c:423 [inline]
file_write_and_wait_range+0x171/0x240 mm/filemap.c:781
generic_buffers_fsync_noflush+0x6f/0x160 fs/buffer.c:609
ext4_fsync_nojournal fs/ext4/fsync.c:88 [inline]
ext4_sync_file+0x454/0xc10 fs/ext4/fsync.c:151
generic_write_sync include/linux/fs.h:2651 [inline]
ext4_buffered_write_iter+0x2c0/0x350 fs/ext4/file.c:305
ext4_file_write_iter+0x1d9/0x1870 fs/ext4/file.c:-1
do_iter_readv_writev fs/read_write.c:-1 [inline]
do_iter_write+0x79a/0xc70 fs/read_write.c:860
vfs_writev fs/read_write.c:933 [inline]
do_pwritev+0x205/0x340 fs/read_write.c:1030
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
-> #0 (&sbi->s_writepages_rwsem){++++}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain kernel/locking/lockdep.c:3869 [inline]
__lock_acquire+0x2ddb/0x7c80 kernel/locking/lockdep.c:5137
lock_acquire+0x197/0x410 kernel/locking/lockdep.c:5754
percpu_down_read+0x44/0x1a0 include/linux/percpu-rwsem.h:51
ext4_writepages_down_read fs/ext4/ext4.h:1767 [inline]
ext4_writepages+0x170/0x2f0 fs/ext4/inode.c:2806
do_writepages+0x3a2/0x600 mm/page-writeback.c:2575
__writeback_single_inode+0x153/0xee0 fs/fs-writeback.c:1625
writeback_single_inode+0x211/0x720 fs/fs-writeback.c:1746
write_inode_now+0x161/0x1e0 fs/fs-writeback.c:2792
iput_final fs/inode.c:1807 [inline]
iput+0x5b2/0x920 fs/inode.c:1846
ext4_xattr_block_set+0x273a/0x32a0 fs/ext4/xattr.c:2206
ext4_xattr_move_to_block fs/ext4/xattr.c:2674 [inline]
ext4_xattr_make_inode_space fs/ext4/xattr.c:2749 [inline]
ext4_expand_extra_isize_ea+0x10ea/0x19e0 fs/ext4/xattr.c:2841
__ext4_expand_extra_isize+0x306/0x400 fs/ext4/inode.c:5953
ext4_try_to_expand_extra_isize fs/ext4/inode.c:5996 [inline]
__ext4_mark_inode_dirty+0x45d/0x6e0 fs/ext4/inode.c:6074
ext4_evict_inode+0x7ed/0xea0 fs/ext4/inode.c:252
evict+0x486/0x870 fs/inode.c:705
ext4_orphan_cleanup+0xbd4/0x1400 fs/ext4/orphan.c:474
__ext4_fill_super fs/ext4/super.c:5608 [inline]
ext4_fill_super+0x5de7/0x66c0 fs/ext4/super.c:5731
get_tree_bdev+0x3e4/0x510 fs/super.c:1591
vfs_get_tree+0x8c/0x280 fs/super.c:1764
do_new_mount+0x24b/0xa40 fs/namespace.c:3377
do_mount fs/namespace.c:3717 [inline]
__do_sys_mount fs/namespace.c:3926 [inline]
__se_sys_mount+0x2da/0x3c0 fs/namespace.c:3903
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&ei->xattr_sem);
lock(&sbi->s_writepages_rwsem);
CPU0 CPU1
---- ----
lock(&ei->xattr_sem);
lock(&ei->xattr_sem);
rlock(&sbi->s_writepages_rwsem);
*** DEADLOCK ***
3 locks held by syz.3.173/6334:
#0: ffff888024f720e0 (&type->s_umount_key#31){++++}-{3:3}, at: __super_lock fs/super.c:56 [inline]
#0: ffff888024f720e0 (&type->s_umount_key#31){++++}-{3:3}, at: __super_lock_excl fs/super.c:71 [inline]
#0: ffff888024f720e0 (&type->s_umount_key#31){++++}-{3:3}, at: get_tree_bdev+0x344/0x510 fs/super.c:1589
#1: ffff888024f72608 (sb_internal){.+.+}-{0:0}, at: __sb_start_write include/linux/fs.h:1633 [inline]
#1: ffff888024f72608 (sb_internal){.+.+}-{0:0}, at: sb_start_intwrite include/linux/fs.h:1755 [inline]
#1: ffff888024f72608 (sb_internal){.+.+}-{0:0}, at: ext4_evict_inode+0x2b9/0xea0 fs/ext4/inode.c:213
#2: ffff888076b71ec8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_write_trylock_xattr fs/ext4/xattr.h:162 [inline]
#2: ffff888076b71ec8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_try_to_expand_extra_isize fs/ext4/inode.c:5993 [inline]
#2: ffff888076b71ec8 (&ei->xattr_sem){++++}-{3:3}, at: __ext4_mark_inode_dirty+0x3dc/0x6e0 fs/ext4/inode.c:6074
stack backtrace:
CPU: 0 PID: 6334 Comm: syz.3.173 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
<TASK>
dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106
check_noncircular+0x2bd/0x3c0 kernel/locking/lockdep.c:2187
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain kernel/locking/lockdep.c:3869 [inline]
__lock_acquire+0x2ddb/0x7c80 kernel/locking/lockdep.c:5137
lock_acquire+0x197/0x410 kernel/locking/lockdep.c:5754
percpu_down_read+0x44/0x1a0 include/linux/percpu-rwsem.h:51
ext4_writepages_down_read fs/ext4/ext4.h:1767 [inline]
ext4_writepages+0x170/0x2f0 fs/ext4/inode.c:2806
do_writepages+0x3a2/0x600 mm/page-writeback.c:2575
__writeback_single_inode+0x153/0xee0 fs/fs-writeback.c:1625
writeback_single_inode+0x211/0x720 fs/fs-writeback.c:1746
write_inode_now+0x161/0x1e0 fs/fs-writeback.c:2792
iput_final fs/inode.c:1807 [inline]
iput+0x5b2/0x920 fs/inode.c:1846
ext4_xattr_block_set+0x273a/0x32a0 fs/ext4/xattr.c:2206
ext4_xattr_move_to_block fs/ext4/xattr.c:2674 [inline]
ext4_xattr_make_inode_space fs/ext4/xattr.c:2749 [inline]
ext4_expand_extra_isize_ea+0x10ea/0x19e0 fs/ext4/xattr.c:2841
__ext4_expand_extra_isize+0x306/0x400 fs/ext4/inode.c:5953
ext4_try_to_expand_extra_isize fs/ext4/inode.c:5996 [inline]
__ext4_mark_inode_dirty+0x45d/0x6e0 fs/ext4/inode.c:6074
ext4_evict_inode+0x7ed/0xea0 fs/ext4/inode.c:252
evict+0x486/0x870 fs/inode.c:705
ext4_orphan_cleanup+0xbd4/0x1400 fs/ext4/orphan.c:474
__ext4_fill_super fs/ext4/super.c:5608 [inline]
ext4_fill_super+0x5de7/0x66c0 fs/ext4/super.c:5731
get_tree_bdev+0x3e4/0x510 fs/super.c:1591
vfs_get_tree+0x8c/0x280 fs/super.c:1764
do_new_mount+0x24b/0xa40 fs/namespace.c:3377
do_mount fs/namespace.c:3717 [inline]
__do_sys_mount fs/namespace.c:3926 [inline]
__se_sys_mount+0x2da/0x3c0 fs/namespace.c:3903
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fb3e6b9034a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb3e7a71e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fb3e7a71ef0 RCX: 00007fb3e6b9034a
RDX: 0000200000000180 RSI: 00002000000001c0 RDI: 00007fb3e7a71eb0
RBP: 0000200000000180 R08: 00007fb3e7a71ef0 R09: 0000000000800700
R10: 0000000000800700 R11: 0000000000000246 R12: 00002000000001c0
R13: 00007fb3e7a71eb0 R14: 0000000000000473 R15: 0000200000000680
</TASK>
------------[ cut here ]------------
EA inode 11 i_nlink=2
WARNING: CPU: 0 PID: 6334 at fs/ext4/xattr.c:1070 ext4_xattr_inode_update_ref+0x521/0x580 fs/ext4/xattr.c:1068
EA inode 11 i_nlink=2
Modules linked in:
CPU: 0 PID: 6334 Comm: syz.3.173 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:ext4_xattr_inode_update_ref+0x521/0x580 fs/ext4/xattr.c:1068
Code: 24 50 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 31 43 9a ff 49 8b 37 48 c7 c7 00 d1 be 8a 44 89 f2 e8 cf 73 0d ff <0f> 0b 4c 8b 64 24 18 48 8b 5c 24 10 4c 8d 7c 24 60 e9 1f fe ff ff
RSP: 0018:ffffc9000c4af220 EFLAGS: 00010246
RAX: 45c1d3d1a024f400 RBX: 0000000000000001 RCX: 0000000000080000
RDX: ffffc9000d82d000 RSI: 000000000007ffff RDI: 0000000000080000
RBP: ffffc9000c4af318 R08: ffffc9000c4aee27 R09: 1ffff92001895dc4
R10: dffffc0000000000 R11: fffff52001895dc5 R12: ffff888076b73eb0
R13: dffffc0000000000 R14: 0000000000000002 R15: ffff888076b73f00
FS: 00007fb3e7a726c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6265c16000 CR3: 000000001dae7000 CR4: 00000000003506f0
Call Trace:
<TASK>
ext4_xattr_inode_dec_ref fs/ext4/xattr.c:1093 [inline]
ext4_xattr_set_entry+0xcda/0x1e90 fs/ext4/xattr.c:1731
ext4_xattr_ibody_set+0x254/0x6a0 fs/ext4/xattr.c:2278
ext4_xattr_move_to_block fs/ext4/xattr.c:2681 [inline]
ext4_xattr_make_inode_space fs/ext4/xattr.c:2749 [inline]
ext4_expand_extra_isize_ea+0x113a/0x19e0 fs/ext4/xattr.c:2841
__ext4_expand_extra_isize+0x306/0x400 fs/ext4/inode.c:5953
ext4_try_to_expand_extra_isize fs/ext4/inode.c:5996 [inline]
__ext4_mark_inode_dirty+0x45d/0x6e0 fs/ext4/inode.c:6074
ext4_evict_inode+0x7ed/0xea0 fs/ext4/inode.c:252
evict+0x486/0x870 fs/inode.c:705
ext4_orphan_cleanup+0xbd4/0x1400 fs/ext4/orphan.c:474
__ext4_fill_super fs/ext4/super.c:5608 [inline]
ext4_fill_super+0x5de7/0x66c0 fs/ext4/super.c:5731
get_tree_bdev+0x3e4/0x510 fs/super.c:1591
vfs_get_tree+0x8c/0x280 fs/super.c:1764
do_new_mount+0x24b/0xa40 fs/namespace.c:3377
do_mount fs/namespace.c:3717 [inline]
__do_sys_mount fs/namespace.c:3926 [inline]
__se_sys_mount+0x2da/0x3c0 fs/namespace.c:3903
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fb3e6b9034a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb3e7a71e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fb3e7a71ef0 RCX: 00007fb3e6b9034a
RDX: 0000200000000180 RSI: 00002000000001c0 RDI: 00007fb3e7a71eb0
RBP: 0000200000000180 R08: 00007fb3e7a71ef0 R09: 0000000000800700
R10: 0000000000800700 R11: 0000000000000246 R12: 00002000000001c0
R13: 00007fb3e7a71eb0 R14: 0000000000000473 R15: 0000200000000680
</TASK>
syzbot
Sep 12, 2025, 12:31:08 PM (yesterday) Sep 12
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 60a9e718726f Linux 6.6.106
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15d31934580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/eca27e056a5a/disk-60a9e718.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/bc64d4eeb7f6/vmlinux-60a9e718.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a345041561ac/bzImage-60a9e718.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/24a395b97e1e/mount_0.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=148bb362580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8c223a...@syzkaller.appspotmail.com
syz.0.17[5953]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set
loop0: detected capacity change from 0 to 512
ffff88802bb4ebd8 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages_down_read fs/ext4/ext4.h:1767 [inline]
ffff88802bb4ebd8 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages+0x170/0x2f0 fs/ext4/inode.c:2806
but task is already holding lock:
ffff888071f56ec8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_write_trylock_xattr fs/ext4/xattr.h:162 [inline]
ffff888071f56ec8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_try_to_expand_extra_isize fs/ext4/inode.c:5993 [inline]
ffff888071f56ec8 (&ei->xattr_sem){++++}-{3:3}, at: __ext4_mark_inode_dirty+0x3dc/0x6e0 fs/ext4/inode.c:6074
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&ei->xattr_sem){++++}-{3:3}:
down_read+0x46/0x2e0 kernel/locking/rwsem.c:1520
ext4_setattr+0x86b/0x1c90 fs/ext4/inode.c:5476
notify_change+0xb0d/0xe10 fs/attr.c:499
chown_common+0x3f9/0x5a0 fs/open.c:783
do_fchownat+0x168/0x270 fs/open.c:814
__do_sys_chown fs/open.c:834 [inline]
__se_sys_chown fs/open.c:832 [inline]
__x64_sys_chown+0x82/0x90 fs/open.c:832
start_this_handle+0x1e9d/0x20c0 fs/jbd2/transaction.c:448
jbd2__journal_start+0x2bb/0x5b0 fs/jbd2/transaction.c:505
__ext4_journal_start_sb+0x203/0x570 fs/ext4/ext4_jbd2.c:112
__ext4_journal_start fs/ext4/ext4_jbd2.h:326 [inline]
ext4_do_writepages+0xf92/0x38d0 fs/ext4/inode.c:2701
vfs_fsync_range fs/sync.c:188 [inline]
vfs_fsync fs/sync.c:202 [inline]
do_fsync fs/sync.c:212 [inline]
__do_sys_fsync fs/sync.c:220 [inline]
__se_sys_fsync fs/sync.c:218 [inline]
__x64_sys_fsync+0x195/0x1d0 fs/sync.c:218
#0: ffff88802bb4c0e0 (&type->s_umount_key#31){++++}-{3:3}, at: __super_lock fs/super.c:56 [inline]
#0: ffff88802bb4c0e0 (&type->s_umount_key#31){++++}-{3:3}, at: __super_lock_excl fs/super.c:71 [inline]
#0: ffff88802bb4c0e0 (&type->s_umount_key#31){++++}-{3:3}, at: get_tree_bdev+0x344/0x510 fs/super.c:1589
#1: ffff88802bb4c608 (sb_internal){.+.+}-{0:0}, at: __sb_start_write include/linux/fs.h:1633 [inline]
#1: ffff88802bb4c608 (sb_internal){.+.+}-{0:0}, at: sb_start_intwrite include/linux/fs.h:1755 [inline]
#1: ffff88802bb4c608 (sb_internal){.+.+}-{0:0}, at: ext4_evict_inode+0x2b9/0xea0 fs/ext4/inode.c:213
#2: ffff888071f56ec8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_write_trylock_xattr fs/ext4/xattr.h:162 [inline]
#2: ffff888071f56ec8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_try_to_expand_extra_isize fs/ext4/inode.c:5993 [inline]
#2: ffff888071f56ec8 (&ei->xattr_sem){++++}-{3:3}, at: __ext4_mark_inode_dirty+0x3dc/0x6e0 fs/ext4/inode.c:6074
stack backtrace:
CPU: 1 PID: 5953 Comm: syz.0.17 Not tainted syzkaller #0
RIP: 0033:0x7fd1a8b9034a
RAX: ffffffffffffffda RBX: 00007ffe4ca90ec0 RCX: 00007fd1a8b9034a
RDX: 0000200000000180 RSI: 00002000000001c0 RDI: 00007ffe4ca90e80
RBP: 0000200000000180 R08: 00007ffe4ca90ec0 R09: 0000000000800700
Modules linked in:
CPU: 1 PID: 5953 Comm: syz.0.17 Not tainted syzkaller #0
RAX: 81b7d313f84f7a00 RBX: 0000000000000001 RCX: ffff88807a31bc00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: ffffc9000480f318 R08: ffffc9000480ee27 R09: 1ffff92000901dc4
R10: dffffc0000000000 R11: fffff52000901dc5 R12: ffff88805d9002b0
R13: dffffc0000000000 R14: 0000000000000002 R15: ffff88805d900300
FS: 0000555566fc3500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
RIP: 0033:0x7fd1a8b9034a
RAX: ffffffffffffffda RBX: 00007ffe4ca90ec0 RCX: 00007fd1a8b9034a
RDX: 0000200000000180 RSI: 00002000000001c0 RDI: 00007ffe4ca90e80
RBP: 0000200000000180 R08: 00007ffe4ca90ec0 R09: 0000000000800700
</TASK>
---
HEAD commit: 60a9e718726f Linux 6.6.106
git tree: linux-6.6.y
kernel config: https://syzkaller.appspot.com/x/.config?x=12606d4b8832c7e4
dashboard link: https://syzkaller.appspot.com/bug?extid=8c223a3aa6865f107658
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1072e362580000
dashboard link: https://syzkaller.appspot.com/bug?extid=8c223a3aa6865f107658
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/eca27e056a5a/disk-60a9e718.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/bc64d4eeb7f6/vmlinux-60a9e718.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a345041561ac/bzImage-60a9e718.xz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=148bb362580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8c223a...@syzkaller.appspotmail.com
loop0: detected capacity change from 0 to 512
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.0.17/5953 is trying to acquire lock:
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
ffff88802bb4ebd8 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages_down_read fs/ext4/ext4.h:1767 [inline]
ffff88802bb4ebd8 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages+0x170/0x2f0 fs/ext4/inode.c:2806
but task is already holding lock:
ffff888071f56ec8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_try_to_expand_extra_isize fs/ext4/inode.c:5993 [inline]
ffff888071f56ec8 (&ei->xattr_sem){++++}-{3:3}, at: __ext4_mark_inode_dirty+0x3dc/0x6e0 fs/ext4/inode.c:6074
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
down_read+0x46/0x2e0 kernel/locking/rwsem.c:1520
ext4_setattr+0x86b/0x1c90 fs/ext4/inode.c:5476
notify_change+0xb0d/0xe10 fs/attr.c:499
chown_common+0x3f9/0x5a0 fs/open.c:783
do_fchownat+0x168/0x270 fs/open.c:814
__do_sys_chown fs/open.c:834 [inline]
__se_sys_chown fs/open.c:832 [inline]
__x64_sys_chown+0x82/0x90 fs/open.c:832
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
-> #1 (jbd2_handle){++++}-{0:0}:
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
start_this_handle+0x1e9d/0x20c0 fs/jbd2/transaction.c:448
jbd2__journal_start+0x2bb/0x5b0 fs/jbd2/transaction.c:505
__ext4_journal_start_sb+0x203/0x570 fs/ext4/ext4_jbd2.c:112
__ext4_journal_start fs/ext4/ext4_jbd2.h:326 [inline]
ext4_do_writepages+0xf92/0x38d0 fs/ext4/inode.c:2701
ext4_writepages+0x1a8/0x2f0 fs/ext4/inode.c:2807
do_writepages+0x3a2/0x600 mm/page-writeback.c:2575
filemap_fdatawrite_wbc+0x122/0x180 mm/filemap.c:390
__filemap_fdatawrite_range mm/filemap.c:423 [inline]
file_write_and_wait_range+0x171/0x240 mm/filemap.c:781
ext4_sync_file+0x281/0xc10 fs/ext4/fsync.c:158
do_writepages+0x3a2/0x600 mm/page-writeback.c:2575
filemap_fdatawrite_wbc+0x122/0x180 mm/filemap.c:390
__filemap_fdatawrite_range mm/filemap.c:423 [inline]
file_write_and_wait_range+0x171/0x240 mm/filemap.c:781
vfs_fsync_range fs/sync.c:188 [inline]
vfs_fsync fs/sync.c:202 [inline]
do_fsync fs/sync.c:212 [inline]
__do_sys_fsync fs/sync.c:220 [inline]
__se_sys_fsync fs/sync.c:218 [inline]
__x64_sys_fsync+0x195/0x1d0 fs/sync.c:218
Chain exists of:
&sbi->s_writepages_rwsem --> jbd2_handle --> &ei->xattr_sem
&sbi->s_writepages_rwsem --> jbd2_handle --> &ei->xattr_sem
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&ei->xattr_sem);
lock(jbd2_handle);
CPU0 CPU1
---- ----
lock(&ei->xattr_sem);
lock(&ei->xattr_sem);
rlock(&sbi->s_writepages_rwsem);
*** DEADLOCK ***
3 locks held by syz.0.17/5953:
rlock(&sbi->s_writepages_rwsem);
*** DEADLOCK ***
#0: ffff88802bb4c0e0 (&type->s_umount_key#31){++++}-{3:3}, at: __super_lock fs/super.c:56 [inline]
#0: ffff88802bb4c0e0 (&type->s_umount_key#31){++++}-{3:3}, at: __super_lock_excl fs/super.c:71 [inline]
#0: ffff88802bb4c0e0 (&type->s_umount_key#31){++++}-{3:3}, at: get_tree_bdev+0x344/0x510 fs/super.c:1589
#1: ffff88802bb4c608 (sb_internal){.+.+}-{0:0}, at: __sb_start_write include/linux/fs.h:1633 [inline]
#1: ffff88802bb4c608 (sb_internal){.+.+}-{0:0}, at: sb_start_intwrite include/linux/fs.h:1755 [inline]
#1: ffff88802bb4c608 (sb_internal){.+.+}-{0:0}, at: ext4_evict_inode+0x2b9/0xea0 fs/ext4/inode.c:213
#2: ffff888071f56ec8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_write_trylock_xattr fs/ext4/xattr.h:162 [inline]
#2: ffff888071f56ec8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_try_to_expand_extra_isize fs/ext4/inode.c:5993 [inline]
#2: ffff888071f56ec8 (&ei->xattr_sem){++++}-{3:3}, at: __ext4_mark_inode_dirty+0x3dc/0x6e0 fs/ext4/inode.c:6074
stack backtrace:
CPU: 1 PID: 5953 Comm: syz.0.17 Not tainted syzkaller #0
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe4ca90e38 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffe4ca90ec0 RCX: 00007fd1a8b9034a
RDX: 0000200000000180 RSI: 00002000000001c0 RDI: 00007ffe4ca90e80
RBP: 0000200000000180 R08: 00007ffe4ca90ec0 R09: 0000000000800700
R10: 0000000000800700 R11: 0000000000000246 R12: 00002000000001c0
R13: 00007ffe4ca90e80 R14: 0000000000000473 R15: 0000200000000680
</TASK>
------------[ cut here ]------------
EA inode 11 i_nlink=2
WARNING: CPU: 1 PID: 5953 at fs/ext4/xattr.c:1070 ext4_xattr_inode_update_ref+0x521/0x580 fs/ext4/xattr.c:1068
------------[ cut here ]------------
EA inode 11 i_nlink=2
Modules linked in:
CPU: 1 PID: 5953 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:ext4_xattr_inode_update_ref+0x521/0x580 fs/ext4/xattr.c:1068
Code: 24 50 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 31 43 9a ff 49 8b 37 48 c7 c7 00 d1 be 8a 44 89 f2 e8 cf 73 0d ff <0f> 0b 4c 8b 64 24 18 48 8b 5c 24 10 4c 8d 7c 24 60 e9 1f fe ff ff
RSP: 0018:ffffc9000480f220 EFLAGS: 00010246
RIP: 0010:ext4_xattr_inode_update_ref+0x521/0x580 fs/ext4/xattr.c:1068
Code: 24 50 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 31 43 9a ff 49 8b 37 48 c7 c7 00 d1 be 8a 44 89 f2 e8 cf 73 0d ff <0f> 0b 4c 8b 64 24 18 48 8b 5c 24 10 4c 8d 7c 24 60 e9 1f fe ff ff
RAX: 81b7d313f84f7a00 RBX: 0000000000000001 RCX: ffff88807a31bc00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: ffffc9000480f318 R08: ffffc9000480ee27 R09: 1ffff92000901dc4
R10: dffffc0000000000 R11: fffff52000901dc5 R12: ffff88805d9002b0
R13: dffffc0000000000 R14: 0000000000000002 R15: ffff88805d900300
FS: 0000555566fc3500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055b084f10000 CR3: 00000000765a0000 CR4: 00000000003506e0
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe4ca90e38 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffe4ca90ec0 RCX: 00007fd1a8b9034a
RDX: 0000200000000180 RSI: 00002000000001c0 RDI: 00007ffe4ca90e80
RBP: 0000200000000180 R08: 00007ffe4ca90ec0 R09: 0000000000800700
R10: 0000000000800700 R11: 0000000000000246 R12: 00002000000001c0
R13: 00007ffe4ca90e80 R14: 0000000000000473 R15: 0000200000000680
</TASK>
---
Reply all
Reply to author
Forward
0 new messages