====================================================== sg_write: data in/out 524252/251 bytes for SCSI command 0x0-- guessing data in; program syz-executor.2 not setting count and/or reply_len properly WARNING: possible circular locking dependency detected 6.0.0-rc1-next-20220822 #1 Not tainted ------------------------------------------------------ syz-executor.4/300 is trying to acquire lock: ffff88800fe643f8 (&journal->j_checkpoint_mutex){+.+.}-{3:3}, at: __jbd2_log_wait_for_space+0x234/0x460 but task is already holding lock: ffff888044d9c990 (&sb->s_type->i_mutex_key#6){++++}-{3:3}, at: vfs_unlink+0xd5/0x930 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&sb->s_type->i_mutex_key#6){++++}-{3:3}: down_read+0x98/0x450 ext4_bmap+0x4e/0x470 bmap+0xac/0x120 jbd2_journal_bmap+0xa8/0x180 jbd2_journal_flush+0x853/0xc00 __ext4_ioctl+0x9e9/0x4090 __x64_sys_ioctl+0x19a/0x210 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd -> #0 (&journal->j_checkpoint_mutex){+.+.}-{3:3}: __lock_acquire+0x2a02/0x5e70 lock_acquire+0x1a2/0x530 mutex_lock_io_nested+0x148/0x1310 __jbd2_log_wait_for_space+0x234/0x460 add_transaction_credits+0xa42/0xb80 start_this_handle+0x3ac/0x14c0 jbd2__journal_start+0x390/0x8d0 __ext4_journal_start_sb+0x391/0x470 ext4_unlink+0x4e4/0x8b0 vfs_unlink+0x35a/0x930 do_unlinkat+0x3a9/0x630 __x64_sys_unlink+0xc6/0x110 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&sb->s_type->i_mutex_key#6); lock(&journal->j_checkpoint_mutex); lock(&sb->s_type->i_mutex_key#6); lock(&journal->j_checkpoint_mutex); *** DEADLOCK *** 3 locks held by syz-executor.4/300: #0: ffff88800fe60438 (sb_writers#3){.+.+}-{0:0}, at: do_unlinkat+0x183/0x630 #1: ffff888044de17e0 (&type->i_mutex_dir_key#3/1){+.+.}-{3:3}, at: do_unlinkat+0x270/0x630 #2: ffff888044d9c990 (&sb->s_type->i_mutex_key#6){++++}-{3:3}, at: vfs_unlink+0xd5/0x930 stack backtrace: CPU: 0 PID: 300 Comm: syz-executor.4 Not tainted 6.0.0-rc1-next-20220822 #1 BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1521 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 300, name: syz-executor.4 preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 INFO: lockdep is turned off. irq event stamp: 1541947 hardirqs last enabled at (1541947): [] _raw_spin_unlock_irqrestore+0x28/0x60 hardirqs last disabled at (1541946): [] _raw_spin_lock_irqsave+0x52/0x60 softirqs last enabled at (1541680): [] __irq_exit_rcu+0x11b/0x180 softirqs last disabled at (1541657): [] __irq_exit_rcu+0x11b/0x180 Preemption disabled at: [] mutex_lock_io_nested+0x126/0x1310 CPU: 0 PID: 300 Comm: syz-executor.4 Not tainted 6.0.0-rc1-next-20220822 #1 syz-executor.4[300] cmdline: /syz-executor.4 exec Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x8b/0xb3 __might_resched.cold+0x222/0x26b down_read_killable+0x75/0x490 __access_remote_vm+0xac/0x6f0 get_mm_cmdline.part.0+0x214/0x600 get_task_cmdline_kernel+0x1e9/0x230 dump_stack_print_cmdline.part.0+0x82/0x150 dump_stack_print_info+0x185/0x190 dump_stack_lvl+0x7f/0xb3 check_noncircular+0x263/0x2e0 __lock_acquire+0x2a02/0x5e70 lock_acquire+0x1a2/0x530 mutex_lock_io_nested+0x148/0x1310 __jbd2_log_wait_for_space+0x234/0x460 add_transaction_credits+0xa42/0xb80 start_this_handle+0x3ac/0x14c0 jbd2__journal_start+0x390/0x8d0 __ext4_journal_start_sb+0x391/0x470 ext4_unlink+0x4e4/0x8b0 vfs_unlink+0x35a/0x930 do_unlinkat+0x3a9/0x630 __x64_sys_unlink+0xc6/0x110 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f8642895457 Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcf2a4cb28 EFLAGS: 00000206 ORIG_RAX: 0000000000000057 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f8642895457 RDX: 00007ffcf2a4cb60 RSI: 00007ffcf2a4cb60 RDI: 00007ffcf2a4cbf0 RBP: 00007ffcf2a4cbf0 R08: 0000000000000001 R09: 00007ffcf2a4c9c0 R10: 0000555556f76cbb R11: 0000000000000206 R12: 00007f86428ef105 R13: 00007ffcf2a4dcb0 R14: 0000555556f76c20 R15: 00007ffcf2a4dcf0 syz-executor.4[300] cmdline: /syz-executor.4 exec Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x8b/0xb3 check_noncircular+0x263/0x2e0 __lock_acquire+0x2a02/0x5e70 lock_acquire+0x1a2/0x530 mutex_lock_io_nested+0x148/0x1310 __jbd2_log_wait_for_space+0x234/0x460 add_transaction_credits+0xa42/0xb80 start_this_handle+0x3ac/0x14c0 jbd2__journal_start+0x390/0x8d0 __ext4_journal_start_sb+0x391/0x470 ext4_unlink+0x4e4/0x8b0 vfs_unlink+0x35a/0x930 do_unlinkat+0x3a9/0x630 __x64_sys_unlink+0xc6/0x110 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f8642895457 Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcf2a4cb28 EFLAGS: 00000206 ORIG_RAX: 0000000000000057 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f8642895457 RDX: 00007ffcf2a4cb60 RSI: 00007ffcf2a4cb60 RDI: 00007ffcf2a4cbf0 RBP: 00007ffcf2a4cbf0 R08: 0000000000000001 R09: 00007ffcf2a4c9c0 R10: 0000555556f76cbb R11: 0000000000000206 R12: 00007f86428ef105 R13: 00007ffcf2a4dcb0 R14: 0000555556f76c20 R15: 00007ffcf2a4dcf0 hpet: Lost 9 RTC interrupts netlink: 5280 bytes leftover after parsing attributes in process `syz-executor.1'. netlink: 5280 bytes leftover after parsing attributes in process `syz-executor.7'. audit: type=1401 audit(1661167421.173:41): op=fscreate invalid_context="system_u:" netlink: 5280 bytes leftover after parsing attributes in process `syz-executor.2'. audit: type=1401 audit(1661167421.366:42): op=fscreate invalid_context="system_u:" audit: type=1401 audit(1661167421.490:43): op=fscreate invalid_context="system_u:" hpet: Lost 2 RTC interrupts hpet: Lost 1 RTC interrupts hpet: Lost 2 RTC interrupts hpet: Lost 5 RTC interrupts hpet: Lost 5 RTC interrupts UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy misc raw-gadget: fail, usb_gadget_register_driver returned -16 UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy misc raw-gadget: fail, usb_gadget_register_driver returned -16 UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy misc raw-gadget: fail, usb_gadget_register_driver returned -16 UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy misc raw-gadget: fail, usb_gadget_register_driver returned -16 UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy misc raw-gadget: fail, usb_gadget_register_driver returned -16 hpet_rtc_timer_reinit: 1 callbacks suppressed hpet: Lost 1 RTC interrupts hpet: Lost 1 RTC interrupts EXT4-fs: Invalid want_extra_isize -2147483647 EXT4-fs: Invalid want_extra_isize -2147483647