sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer ====================================================== WARNING: possible circular locking dependency detected 6.0.0-rc3-next-20220829 #1 Not tainted ------------------------------------------------------ syz-executor.5/4942 is trying to acquire lock: ffff88800bd80400 (&sb->s_type->i_mutex_key#6){++++}-{3:3}, at: ext4_bmap+0x4e/0x470 but task is already holding lock: sr 1:0:0:0: [sr0] tag#0 unaligned transfer ffff8880100123f8 (&journal->j_checkpoint_mutex){+.+.}-{3:3}, at: jbd2_journal_flush+0x48b/0xc00 sr 1:0:0:0: [sr0] tag#0 unaligned transfer which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (&journal->j_checkpoint_mutex sr 1:0:0:0: [sr0] tag#0 unaligned transfer ){+.+.}-{3:3}: mutex_lock_io_nested+0x148/0x1310 sr 1:0:0:0: [sr0] tag#0 unaligned transfer jbd2_journal_flush+0x19a/0xc00 sr 1:0:0:0: [sr0] tag#0 unaligned transfer __ext4_ioctl+0x30c7/0x4090 sr 1:0:0:0: [sr0] tag#0 unaligned transfer __x64_sys_ioctl+0x19a/0x210 sr 1:0:0:0: [sr0] tag#0 unaligned transfer do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd sr 1:0:0:0: [sr0] tag#0 unaligned transfer -> #2 (&journal->j_barrier){+.+.}-{3:3}: sr 1:0:0:0: [sr0] tag#0 unaligned transfer __mutex_lock+0x136/0x14d0 jbd2_journal_lock_updates+0x15e/0x310 sr 1:0:0:0: [sr0] tag#0 unaligned transfer ext4_change_inode_journal_flag+0x17f/0x530 sr 1:0:0:0: [sr0] tag#0 unaligned transfer ext4_fileattr_set+0x140d/0x18a0 sr 1:0:0:0: [sr0] tag#0 unaligned transfer vfs_fileattr_set+0x77c/0xb80 do_vfs_ioctl+0xfc2/0x1610 sr 1:0:0:0: [sr0] tag#0 unaligned transfer __x64_sys_ioctl+0x10c/0x210 do_syscall_64+0x3b/0x90 sr 1:0:0:0: [sr0] tag#0 unaligned transfer entry_SYSCALL_64_after_hwframe+0x63/0xcd -> #1 (&sbi->s_writepages_rwsem){++++}-{0:0}: sr 1:0:0:0: [sr0] tag#0 unaligned transfer percpu_down_write+0x4d/0x3d0 ext4_ind_migrate+0x237/0x830 sr 1:0:0:0: [sr0] tag#0 unaligned transfer ext4_fileattr_set+0x1434/0x18a0 vfs_fileattr_set+0x77c/0xb80 sr 1:0:0:0: [sr0] tag#0 unaligned transfer do_vfs_ioctl+0xfc2/0x1610 __x64_sys_ioctl+0x10c/0x210 sr 1:0:0:0: [sr0] tag#0 unaligned transfer do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd sr 1:0:0:0: [sr0] tag#0 unaligned transfer -> #0 (&sb->s_type->i_mutex_key#6){++++}-{3:3}: sr 1:0:0:0: [sr0] tag#0 unaligned transfer __lock_acquire+0x2a02/0x5e70 sr 1:0:0:0: [sr0] tag#0 unaligned transfer lock_acquire+0x1a2/0x530 down_read+0x98/0x450 sr 1:0:0:0: [sr0] tag#0 unaligned transfer ext4_bmap+0x4e/0x470 bmap+0xac/0x120 sr 1:0:0:0: [sr0] tag#0 unaligned transfer jbd2_journal_bmap+0xa8/0x180 jbd2_journal_flush+0x853/0xc00 sr 1:0:0:0: [sr0] tag#0 unaligned transfer __ext4_ioctl+0x9e9/0x4090 sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer __x64_sys_ioctl+0x19a/0x210 do_syscall_64+0x3b/0x90 sr 1:0:0:0: [sr0] tag#0 unaligned transfer entry_SYSCALL_64_after_hwframe+0x63/0xcd sr 1:0:0:0: [sr0] tag#0 unaligned transfer other info that might help us debug this: sr 1:0:0:0: [sr0] tag#0 unaligned transfer Chain exists of: &sb->s_type->i_mutex_key#6 --> &journal->j_barrier --> &journal->j_checkpoint_mutex sr 1:0:0:0: [sr0] tag#0 unaligned transfer Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&journal->j_checkpoint_mutex sr 1:0:0:0: [sr0] tag#0 unaligned transfer ); lock(&journal->j_barrier); lock( sr 1:0:0:0: [sr0] tag#0 unaligned transfer &journal->j_checkpoint_mutex); lock(&sb->s_type->i_mutex_key#6 sr 1:0:0:0: [sr0] tag#0 unaligned transfer ); sr 1:0:0:0: [sr0] tag#0 unaligned transfer *** DEADLOCK *** 2 locks held by syz-executor.5/4942: sr 1:0:0:0: [sr0] tag#0 unaligned transfer #0: sr 1:0:0:0: [sr0] tag#0 unaligned transfer ffff888010012170 sr 1:0:0:0: [sr0] tag#0 unaligned transfer (&journal->j_barrier sr 1:0:0:0: [sr0] tag#0 unaligned transfer ){+.+.}-{3:3}, at: jbd2_journal_lock_updates+0x15e/0x310 sr 1:0:0:0: [sr0] tag#0 unaligned transfer #1: ffff8880100123f8 ( sr 1:0:0:0: [sr0] tag#0 unaligned transfer &journal->j_checkpoint_mutex){+.+.}-{3:3}, at: jbd2_journal_flush+0x48b/0xc00 sr 1:0:0:0: [sr0] tag#0 unaligned transfer stack backtrace: CPU: 0 PID: 4942 Comm: syz-executor.5 Not tainted 6.0.0-rc3-next-20220829 #1 sr 1:0:0:0: [sr0] tag#0 unaligned transfer Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: sr 1:0:0:0: [sr0] tag#0 unaligned transfer dump_stack_lvl+0x8b/0xb3 sr 1:0:0:0: [sr0] tag#0 unaligned transfer check_noncircular+0x263/0x2e0 sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer __lock_acquire+0x2a02/0x5e70 sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer lock_acquire+0x1a2/0x530 sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer down_read+0x98/0x450 sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer ext4_bmap+0x4e/0x470 sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer bmap+0xac/0x120 jbd2_journal_bmap+0xa8/0x180 sr 1:0:0:0: [sr0] tag#0 unaligned transfer jbd2_journal_flush+0x853/0xc00 sr 1:0:0:0: [sr0] tag#0 unaligned transfer __ext4_ioctl+0x9e9/0x4090 sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer __x64_sys_ioctl+0x19a/0x210 do_syscall_64+0x3b/0x90 sr 1:0:0:0: [sr0] tag#0 unaligned transfer entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fc9c8106b19 sr 1:0:0:0: [sr0] tag#0 unaligned transfer Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fc9c567c188 EFLAGS: 00000246 sr 1:0:0:0: [sr0] tag#0 unaligned transfer ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fc9c8219f60 RCX: 00007fc9c8106b19 RDX: 0000000020000240 RSI: 000000004004662b RDI: 0000000000000006 sr 1:0:0:0: [sr0] tag#0 unaligned transfer RBP: 00007fc9c8160f6d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 sr 1:0:0:0: [sr0] tag#0 unaligned transfer R13: 00007ffef1ab76af R14: 00007fc9c567c300 R15: 0000000000022000 sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=4965 comm=syz-executor.3 device lo entered promiscuous mode loop6: detected capacity change from 0 to 131072 device lo left promiscuous mode 9pnet_fd: Insufficient options for proto=fd SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=4980 comm=syz-executor.3 device lo entered promiscuous mode device lo left promiscuous mode loop5: detected capacity change from 0 to 512 sr 1:0:0:0: [sr0] tag#0 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s sr 1:0:0:0: [sr0] tag#0 Sense Key : Not Ready [current] sr 1:0:0:0: [sr0] tag#0 Add. Sense: Medium not present sr 1:0:0:0: [sr0] tag#0 CDB: Read(10) 28 00 00 00 00 00 00 00 08 00 EXT4-fs (loop5): corrupt root inode, run e2fsck EXT4-fs (loop5): mount failed sr 1:0:0:0: [sr0] tag#0 unaligned transfer loop5: detected capacity change from 0 to 512 9pnet_fd: Insufficient options for proto=fd SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=4995 comm=syz-executor.3 sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer EXT4-fs (loop5): corrupt root inode, run e2fsck EXT4-fs (loop5): mount failed 9pnet_fd: Insufficient options for proto=fd SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=5011 comm=syz-executor.3 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=5016 comm=syz-executor.3 UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy 9pnet_fd: Insufficient options for proto=fd SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=5021 comm=syz-executor.6 misc raw-gadget: fail, usb_gadget_register_driver returned -16 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=5033 comm=syz-executor.3 9pnet_fd: Insufficient options for proto=fd SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=5032 comm=syz-executor.6 loop7: detected capacity change from 0 to 264192 isofs_fill_super: get root inode failed loop7: detected capacity change from 0 to 264192 isofs_fill_super: get root inode failed UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy misc raw-gadget: fail, usb_gadget_register_driver returned -16 ---------------- Code disassembly (best guess), 1 bytes skipped: 0: ff c3 inc %ebx 2: 66 2e 0f 1f 84 00 00 nopw %cs:0x0(%rax,%rax,1) 9: 00 00 00 c: 0f 1f 40 00 nopl 0x0(%rax) 10: 48 89 f8 mov %rdi,%rax 13: 48 89 f7 mov %rsi,%rdi 16: 48 89 d6 mov %rdx,%rsi 19: 48 89 ca mov %rcx,%rdx 1c: 4d 89 c2 mov %r8,%r10 1f: 4d 89 c8 mov %r9,%r8 22: 4c 8b 4c 24 08 mov 0x8(%rsp),%r9 27: 0f 05 syscall * 29: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction 2f: 73 01 jae 0x32 31: c3 retq 32: 48 c7 c1 bc ff ff ff mov $0xffffffffffffffbc,%rcx 39: f7 d8 neg %eax 3b: 64 89 01 mov %eax,%fs:(%rcx) 3e: 48 rex.W