From: syzbot <syzbot+293a57918b36cfae3d48@syzkaller.appspotmail.com>
To: kartikey406@gmail.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [ext4?] kernel BUG in ext4_write_inline_data_end (3)
Date: Thu, 16 Jul 2026 21:39:03 -0700 [thread overview]
Message-ID: <6a59b1e7.5622734e.c905.003c.GAE@google.com> (raw)
In-Reply-To: <20260717000803.14708-1-kartikey406@gmail.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in ext4_write_inline_data_end
loop0: detected capacity change from 0 to 1024
EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
syz.0.17/5361 is trying to acquire lock:
ffff0000ee0c30f8 (&ei->i_data_sem#2){++++}-{4:4}, at: ext4_update_i_disksize fs/ext4/ext4.h:3569 [inline]
ffff0000ee0c30f8 (&ei->i_data_sem#2){++++}-{4:4}, at: ext4_update_inode_size fs/ext4/ext4.h:3585 [inline]
ffff0000ee0c30f8 (&ei->i_data_sem#2){++++}-{4:4}, at: ext4_write_inline_data_end+0x500/0x9d8 fs/ext4/inline.c:839
but task is already holding lock:
ffff0000ee0c30f8 (&ei->i_data_sem#2){++++}-{4:4}, at: ext4_write_end+0x16c/0x9fc fs/ext4/inode.c:1453
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&ei->i_data_sem#2);
lock(&ei->i_data_sem#2);
*** DEADLOCK ***
May be due to missing lock nesting notation
4 locks held by syz.0.17/5361:
#0: ffff0000d18615f0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x100/0x144 fs/file.c:1259
#1: ffff0000db5fc450 (sb_writers#3){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline]
#1: ffff0000db5fc450 (sb_writers#3){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683
#2: ffff0000ee0c3260 (&sb->s_type->i_mutex_key#10){++++}-{4:4}, at: inode_lock include/linux/fs.h:1024 [inline]
#2: ffff0000ee0c3260 (&sb->s_type->i_mutex_key#10){++++}-{4:4}, at: ext4_buffered_write_iter+0xa0/0x2ec fs/ext4/file.c:311
#3: ffff0000ee0c30f8 (&ei->i_data_sem#2){++++}-{4:4}, at: ext4_write_end+0x16c/0x9fc fs/ext4/inode.c:1453
stack backtrace:
CPU: 0 UID: 0 PID: 5361 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026
Call trace:
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
__dump_stack+0x30/0x40 lib/dump_stack.c:94
dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
dump_stack+0x1c/0x28 lib/dump_stack.c:129
print_deadlock_bug+0x2e8/0x2f0 kernel/locking/lockdep.c:3041
check_deadlock kernel/locking/lockdep.c:3093 [inline]
validate_chain kernel/locking/lockdep.c:3895 [inline]
__lock_acquire+0x2764/0x2ebc kernel/locking/lockdep.c:5237
lock_acquire+0x140/0x364 kernel/locking/lockdep.c:5868
down_write+0x50/0xc0 kernel/locking/rwsem.c:1631
ext4_update_i_disksize fs/ext4/ext4.h:3569 [inline]
ext4_update_inode_size fs/ext4/ext4.h:3585 [inline]
ext4_write_inline_data_end+0x500/0x9d8 fs/ext4/inline.c:839
ext4_write_end+0x328/0x9fc fs/ext4/inode.c:1457
ext4_da_write_end+0x90/0xba0 fs/ext4/inode.c:3303
generic_perform_write+0x504/0x7a4 mm/filemap.c:4379
ext4_buffered_write_iter+0xd0/0x2ec fs/ext4/file.c:316
ext4_file_write_iter+0x1dc/0x134c fs/ext4/file.c:-1
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x51c/0xa0c fs/read_write.c:687
ksys_write+0x12c/0x228 fs/read_write.c:739
__do_sys_write fs/read_write.c:750 [inline]
__se_sys_write fs/read_write.c:747 [inline]
__arm64_sys_write+0x7c/0x90 fs/read_write.c:747
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736
el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594
Tested on:
commit: a13c140c Linux 7.2-rc3
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=13068cb9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ecdef466b08b9772
dashboard link: https://syzkaller.appspot.com/bug?extid=293a57918b36cfae3d48
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=17dfcc32580000
next parent reply other threads:[~2026-07-17 4:39 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20260717000803.14708-1-kartikey406@gmail.com>
2026-07-17 4:39 ` syzbot [this message]
[not found] <20260718020535.46460-1-kartikey406@gmail.com>
2026-07-18 4:44 ` [syzbot] [ext4?] kernel BUG in ext4_write_inline_data_end (3) syzbot
[not found] <20260717134133.38390-1-kartikey406@gmail.com>
2026-07-17 14:48 ` syzbot
[not found] <20260717105327.37079-1-kartikey406@gmail.com>
2026-07-17 11:57 ` syzbot
[not found] <20260717091456.36085-1-kartikey406@gmail.com>
2026-07-17 10:36 ` syzbot
2026-07-16 7:50 syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a59b1e7.5622734e.c905.003c.GAE@google.com \
--to=syzbot+293a57918b36cfae3d48@syzkaller.appspotmail.com \
--cc=kartikey406@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.