======================================================
WARNING: possible circular locking dependency detected
6.1.0-rc3-next-20221103 #1 Not tainted
------------------------------------------------------
syz-executor.6/51287 is trying to acquire lock:
ffff88800fd1e170 (&journal->j_barrier){+.+.}-{3:3}, at: jbd2_journal_lock_updates+0x15e/0x310

but task is already holding lock:
ffff88800fd1cb90 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_change_inode_journal_flag+0x177/0x530

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #3 (&sbi->s_writepages_rwsem){++++}-{0:0}:
       percpu_down_write+0x4d/0x350
       ext4_ind_migrate+0x237/0x830
       ext4_fileattr_set+0x144e/0x18c0
       vfs_fileattr_set+0x77c/0xb80
       do_vfs_ioctl+0xfa6/0x15d0
       __x64_sys_ioctl+0x10c/0x210
       do_syscall_64+0x3b/0x90
       entry_SYSCALL_64_after_hwframe+0x72/0xdc

-> #2 (&sb->s_type->i_mutex_key#6){++++}-{3:3}:
       down_read+0x98/0x450
       ext4_bmap+0x4e/0x470
       bmap+0xac/0x120
       jbd2_journal_bmap+0xa8/0x180
       jbd2_journal_flush+0x853/0xc00
       __ext4_ioctl+0x9c1/0x4140
       __x64_sys_ioctl+0x19a/0x210
       do_syscall_64+0x3b/0x90
       entry_SYSCALL_64_after_hwframe+0x72/0xdc

-> #1 (&journal->j_checkpoint_mutex){+.+.}-{3:3}:
       mutex_lock_io_nested+0x148/0x1310
       jbd2_journal_flush+0x19a/0xc00
       ext4_ioctl_group_add+0x2b3/0x580
       __ext4_ioctl+0x697/0x4140
       __x64_sys_ioctl+0x19a/0x210
       do_syscall_64+0x3b/0x90
       entry_SYSCALL_64_after_hwframe+0x72/0xdc

-> #0 (&journal->j_barrier){+.+.}-{3:3}:
       __lock_acquire+0x2a02/0x5e70
       lock_acquire+0x1a2/0x530
       __mutex_lock+0x136/0x14d0
       jbd2_journal_lock_updates+0x15e/0x310
       ext4_change_inode_journal_flag+0x17f/0x530
       ext4_fileattr_set+0x1427/0x18c0
       vfs_fileattr_set+0x77c/0xb80
       do_vfs_ioctl+0xfa6/0x15d0
       __x64_sys_ioctl+0x10c/0x210
       do_syscall_64+0x3b/0x90
       entry_SYSCALL_64_after_hwframe+0x72/0xdc

other info that might help us debug this:

Chain exists of:
  &journal->j_barrier --> &sb->s_type->i_mutex_key#6 --> &sbi->s_writepages_rwsem

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&sbi->s_writepages_rwsem);
                               lock(&sb->s_type->i_mutex_key#6);
                               lock(&sbi->s_writepages_rwsem);
  lock(&journal->j_barrier);

 *** DEADLOCK ***

4 locks held by syz-executor.6/51287:
 #0: ffff88800fd1a438 (sb_writers#3){.+.+}-{0:0}, at: do_vfs_ioctl+0xf6b/0x15d0
 #1: ffff88803f478400 (&sb->s_type->i_mutex_key#6){++++}-{3:3}, at: vfs_fileattr_set+0x148/0xb80
 #2: ffff88803f4785a0 (mapping.invalidate_lock){++++}-{3:3}, at: ext4_change_inode_journal_flag+0x11e/0x530
 #3: ffff88800fd1cb90 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_change_inode_journal_flag+0x177/0x530

stack backtrace:
CPU: 0 PID: 51287 Comm: syz-executor.6 Not tainted 6.1.0-rc3-next-20221103 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x8b/0xb3
 check_noncircular+0x263/0x2e0
 __lock_acquire+0x2a02/0x5e70
 lock_acquire+0x1a2/0x530
 __mutex_lock+0x136/0x14d0
 jbd2_journal_lock_updates+0x15e/0x310
 ext4_change_inode_journal_flag+0x17f/0x530
 ext4_fileattr_set+0x1427/0x18c0
 vfs_fileattr_set+0x77c/0xb80
 do_vfs_ioctl+0xfa6/0x15d0
 __x64_sys_ioctl+0x10c/0x210
 do_syscall_64+0x3b/0x90
 entry_SYSCALL_64_after_hwframe+0x72/0xdc
RIP: 0033:0x7f2cfd5e4b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f2cfab5a188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f2cfd6f7f60 RCX: 00007f2cfd5e4b19
RDX: 0000000020000080 RSI: 0000000040086602 RDI: 0000000000000005
RBP: 00007f2cfd63ef6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffccfd3a4cf R14: 00007f2cfab5a300 R15: 0000000000022000
 </TASK>
Bluetooth: hci7: command 0x0406 tx timeout
Process accounting resumed
Process accounting resumed
Process accounting resumed
Process accounting resumed
Process accounting resumed
Process accounting resumed
Process accounting resumed
Process accounting resumed
Process accounting resumed
Process accounting resumed
Process accounting resumed
cgroup: fork rejected by pids controller in /syz1
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'.
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.2'.
platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
platform regulatory.0: Direct firmware load for regulatory.db failed with error -2