======================================================
WARNING: possible circular locking dependency detected
6.0.0-rc2-next-20220826 #1 Not tainted
------------------------------------------------------
syz-executor.4/6548 is trying to acquire lock:
ffff88800c968400 (&sb->s_type->i_mutex_key#6){++++}-{3:3}, at: ext4_bmap+0x4e/0x470
FAULT_INJECTION: forcing a failure.
name fail_usercopy, interval 1, probability 0, space 0, times 0
but task is already holding lock:
ffff8880100e03f8
CPU: 1 PID: 6551 Comm: syz-executor.2 Not tainted 6.0.0-rc2-next-20220826 #1
(
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
&journal->j_checkpoint_mutex
Call Trace:
){+.+.}-{3:3}
dump_stack_lvl+0x8b/0xb3
, at: jbd2_journal_flush+0x48b/0xc00
should_fail.cold+0x5/0xa
which lock already depends on the new lock.
copyout+0x19/0x120
the existing dependency chain (in reverse order) is:
_copy_to_iter+0x1d4/0x1430
-> #3
(
&journal->j_checkpoint_mutex
){+.+.}-{3:3}
:
mutex_lock_io_nested+0x148/0x1310
jbd2_journal_flush+0x19a/0xc00
__ext4_ioctl+0x9e9/0x4090
__x64_sys_ioctl+0x19a/0x210
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
copy_page_to_iter+0x28b/0xe10
-> #2
pipe_read+0x41b/0xfc0
(
&journal->j_barrier
){+.+.}-{3:3}
:
vfs_read+0x802/0x930
__mutex_lock+0x136/0x14d0
jbd2_journal_lock_updates+0x15e/0x310
ext4_change_inode_journal_flag+0x17f/0x530
ext4_fileattr_set+0x140d/0x18a0
ksys_read+0x1f0/0x250
vfs_fileattr_set+0x77c/0xb80
do_vfs_ioctl+0xfc2/0x1610
__x64_sys_ioctl+0x10c/0x210
do_syscall_64+0x3b/0x90
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
entry_SYSCALL_64_after_hwframe+0x63/0xcd
-> #1
RIP: 0033:0x7f6fc2a4eb19
(
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
&sbi->s_writepages_rwsem
RSP: 002b:00007f6fbffc4188 EFLAGS: 00000246
){++++}-{0:0}
ORIG_RAX: 0000000000000000
:
RAX: ffffffffffffffda RBX: 00007f6fc2b61f60 RCX: 00007f6fc2a4eb19
percpu_down_write+0x4d/0x3d0
RDX: 0000000000000076 RSI: 00000000200000c0 RDI: 0000000000000003
ext4_ind_migrate+0x237/0x830
RBP: 00007f6fbffc41d0 R08: 0000000000000000 R09: 0000000000000000
ext4_fileattr_set+0x1434/0x18a0
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
vfs_fileattr_set+0x77c/0xb80
R13: 00007fffcbd80aef R14: 00007f6fbffc4300 R15: 0000000000022000
do_vfs_ioctl+0xfc2/0x1610
__x64_sys_ioctl+0x10c/0x210
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
-> #0 (&sb->s_type->i_mutex_key#6){++++}-{3:3}:
__lock_acquire+0x2a02/0x5e70
lock_acquire+0x1a2/0x530
down_read+0x98/0x450
ext4_bmap+0x4e/0x470
bmap+0xac/0x120
jbd2_journal_bmap+0xa8/0x180
jbd2_journal_flush+0x853/0xc00
__ext4_ioctl+0x9e9/0x4090
__x64_sys_ioctl+0x19a/0x210
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
other info that might help us debug this:
Chain exists of:
&sb->s_type->i_mutex_key#6 --> &journal->j_barrier --> &journal->j_checkpoint_mutex
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&journal->j_checkpoint_mutex);
lock(&journal->j_barrier);
lock(&journal->j_checkpoint_mutex);
lock(&sb->s_type->i_mutex_key#6);
*** DEADLOCK ***
2 locks held by syz-executor.4/6548:
#0: ffff8880100e0170 (&journal->j_barrier){+.+.}-{3:3}, at: jbd2_journal_lock_updates+0x15e/0x310
#1: ffff8880100e03f8 (&journal->j_checkpoint_mutex){+.+.}-{3:3}, at: jbd2_journal_flush+0x48b/0xc00
stack backtrace:
CPU: 0 PID: 6548 Comm: syz-executor.4 Not tainted 6.0.0-rc2-next-20220826 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
dump_stack_lvl+0x8b/0xb3
check_noncircular+0x263/0x2e0
__lock_acquire+0x2a02/0x5e70
lock_acquire+0x1a2/0x530
down_read+0x98/0x450
ext4_bmap+0x4e/0x470
bmap+0xac/0x120
jbd2_journal_bmap+0xa8/0x180
jbd2_journal_flush+0x853/0xc00
__ext4_ioctl+0x9e9/0x4090
__x64_sys_ioctl+0x19a/0x210
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f20ebb1cb19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f20e9092188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f20ebc2ff60 RCX: 00007f20ebb1cb19
RDX: 0000000020000440 RSI: 000000004004662b RDI: 0000000000000004
RBP: 00007f20ebb76f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fff993ad14f R14: 00007f20e9092300 R15: 0000000000022000
block device autoloading is deprecated and will be removed.
FAULT_INJECTION: forcing a failure.
name fail_usercopy, interval 1, probability 0, space 0, times 0
CPU: 0 PID: 6570 Comm: syz-executor.2 Not tainted 6.0.0-rc2-next-20220826 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
dump_stack_lvl+0x8b/0xb3
should_fail.cold+0x5/0xa
_copy_to_user+0x2a/0x140
simple_read_from_buffer+0xcc/0x160
proc_fail_nth_read+0x198/0x230
vfs_read+0x253/0x930
ksys_read+0x127/0x250
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f6fc2a0169c
Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48
RSP: 002b:00007f6fbffc4170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 0000000000000076 RCX: 00007f6fc2a0169c
RDX: 000000000000000f RSI: 00007f6fbffc41e0 RDI: 0000000000000005
RBP: 00007f6fbffc41d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fffcbd80aef R14: 00007f6fbffc4300 R15: 0000000000022000
----------------
Code disassembly (best guess), 1 bytes skipped:
0: ff c3 inc %ebx
2: 66 2e 0f 1f 84 00 00 nopw %cs:0x0(%rax,%rax,1)
9: 00 00 00
c: 0f 1f 40 00 nopl 0x0(%rax)
10: 48 89 f8 mov %rdi,%rax
13: 48 89 f7 mov %rsi,%rdi
16: 48 89 d6 mov %rdx,%rsi
19: 48 89 ca mov %rcx,%rdx
1c: 4d 89 c2 mov %r8,%r10
1f: 4d 89 c8 mov %r9,%r8
22: 4c 8b 4c 24 08 mov 0x8(%rsp),%r9
27: 0f 05 syscall
* 29: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction
2f: 73 01 jae 0x32
31: c3 retq
32: 48 c7 c1 bc ff ff ff mov $0xffffffffffffffbc,%rcx
39: f7 d8 neg %eax
3b: 64 89 01 mov %eax,%fs:(%rcx)
3e: 48 rex.W