All of lore.kernel.org
 help / color / mirror / Atom feed
From: syzbot <syzbot+293a57918b36cfae3d48@syzkaller.appspotmail.com>
To: kartikey406@gmail.com, linux-kernel@vger.kernel.org,
	 syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [ext4?] kernel BUG in ext4_write_inline_data_end (3)
Date: Thu, 16 Jul 2026 21:39:03 -0700	[thread overview]
Message-ID: <6a59b1e7.5622734e.c905.003c.GAE@google.com> (raw)
In-Reply-To: <20260717000803.14708-1-kartikey406@gmail.com>

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in ext4_write_inline_data_end

loop0: detected capacity change from 0 to 1024
EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
syz.0.17/5361 is trying to acquire lock:
ffff0000ee0c30f8 (&ei->i_data_sem#2){++++}-{4:4}, at: ext4_update_i_disksize fs/ext4/ext4.h:3569 [inline]
ffff0000ee0c30f8 (&ei->i_data_sem#2){++++}-{4:4}, at: ext4_update_inode_size fs/ext4/ext4.h:3585 [inline]
ffff0000ee0c30f8 (&ei->i_data_sem#2){++++}-{4:4}, at: ext4_write_inline_data_end+0x500/0x9d8 fs/ext4/inline.c:839

but task is already holding lock:
ffff0000ee0c30f8 (&ei->i_data_sem#2){++++}-{4:4}, at: ext4_write_end+0x16c/0x9fc fs/ext4/inode.c:1453

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&ei->i_data_sem#2);
  lock(&ei->i_data_sem#2);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

4 locks held by syz.0.17/5361:
 #0: ffff0000d18615f0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x100/0x144 fs/file.c:1259
 #1: ffff0000db5fc450 (sb_writers#3){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline]
 #1: ffff0000db5fc450 (sb_writers#3){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683
 #2: ffff0000ee0c3260 (&sb->s_type->i_mutex_key#10){++++}-{4:4}, at: inode_lock include/linux/fs.h:1024 [inline]
 #2: ffff0000ee0c3260 (&sb->s_type->i_mutex_key#10){++++}-{4:4}, at: ext4_buffered_write_iter+0xa0/0x2ec fs/ext4/file.c:311
 #3: ffff0000ee0c30f8 (&ei->i_data_sem#2){++++}-{4:4}, at: ext4_write_end+0x16c/0x9fc fs/ext4/inode.c:1453

stack backtrace:
CPU: 0 UID: 0 PID: 5361 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 print_deadlock_bug+0x2e8/0x2f0 kernel/locking/lockdep.c:3041
 check_deadlock kernel/locking/lockdep.c:3093 [inline]
 validate_chain kernel/locking/lockdep.c:3895 [inline]
 __lock_acquire+0x2764/0x2ebc kernel/locking/lockdep.c:5237
 lock_acquire+0x140/0x364 kernel/locking/lockdep.c:5868
 down_write+0x50/0xc0 kernel/locking/rwsem.c:1631
 ext4_update_i_disksize fs/ext4/ext4.h:3569 [inline]
 ext4_update_inode_size fs/ext4/ext4.h:3585 [inline]
 ext4_write_inline_data_end+0x500/0x9d8 fs/ext4/inline.c:839
 ext4_write_end+0x328/0x9fc fs/ext4/inode.c:1457
 ext4_da_write_end+0x90/0xba0 fs/ext4/inode.c:3303
 generic_perform_write+0x504/0x7a4 mm/filemap.c:4379
 ext4_buffered_write_iter+0xd0/0x2ec fs/ext4/file.c:316
 ext4_file_write_iter+0x1dc/0x134c fs/ext4/file.c:-1
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x51c/0xa0c fs/read_write.c:687
 ksys_write+0x12c/0x228 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:747
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736
 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594


Tested on:

commit:         a13c140c Linux 7.2-rc3
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=13068cb9580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=ecdef466b08b9772
dashboard link: https://syzkaller.appspot.com/bug?extid=293a57918b36cfae3d48
compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64
patch:          https://syzkaller.appspot.com/x/patch.diff?x=17dfcc32580000


       reply	other threads:[~2026-07-17  4:39 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <20260717000803.14708-1-kartikey406@gmail.com>
2026-07-17  4:39 ` syzbot [this message]
     [not found] <20260718020535.46460-1-kartikey406@gmail.com>
2026-07-18  4:44 ` [syzbot] [ext4?] kernel BUG in ext4_write_inline_data_end (3) syzbot
     [not found] <20260717134133.38390-1-kartikey406@gmail.com>
2026-07-17 14:48 ` syzbot
     [not found] <20260717105327.37079-1-kartikey406@gmail.com>
2026-07-17 11:57 ` syzbot
     [not found] <20260717091456.36085-1-kartikey406@gmail.com>
2026-07-17 10:36 ` syzbot
2026-07-16  7:50 syzbot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=6a59b1e7.5622734e.c905.003c.GAE@google.com \
    --to=syzbot+293a57918b36cfae3d48@syzkaller.appspotmail.com \
    --cc=kartikey406@gmail.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.