* [syzbot] [ocfs2?] possible deadlock in ocfs2_lock_global_qf
@ 2024-10-03 18:26 syzbot
2025-09-28 18:52 ` syzbot
0 siblings, 1 reply; 2+ messages in thread
From: syzbot @ 2024-10-03 18:26 UTC (permalink / raw)
To: jlbec, joseph.qi, linux-kernel, mark, ocfs2-devel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 7ec462100ef9 Merge tag 'pull-work.unaligned' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=121a6307980000
kernel config: https://syzkaller.appspot.com/x/.config?x=f8af0b3195caed62
dashboard link: https://syzkaller.appspot.com/bug?extid=b53d753ae8fb473e2397
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/a86fac80eb1e/disk-7ec46210.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0166dc055df6/vmlinux-7ec46210.xz
kernel image: https://storage.googleapis.com/syzbot-assets/8601fab0f89e/bzImage-7ec46210.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b53d753ae8fb473e2397@syzkaller.appspotmail.com
ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode.
======================================================
WARNING: possible circular locking dependency detected
6.12.0-rc1-syzkaller-00046-g7ec462100ef9 #0 Not tainted
------------------------------------------------------
syz.1.818/13312 is trying to acquire lock:
ffff88807f914da0 (&ocfs2_quota_ip_alloc_sem_key){++++}-{3:3}, at: ocfs2_lock_global_qf+0x225/0x2b0 fs/ocfs2/quota_global.c:314
but task is already holding lock:
ffff88807f915100 (&ocfs2_sysfile_lock_key[args->fi_sysfile_type]#7){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline]
ffff88807f915100 (&ocfs2_sysfile_lock_key[args->fi_sysfile_type]#7){+.+.}-{3:3}, at: ocfs2_lock_global_qf+0x206/0x2b0 fs/ocfs2/quota_global.c:313
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #5 (&ocfs2_sysfile_lock_key[args->fi_sysfile_type]#7){+.+.}-{3:3}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
down_write+0x99/0x220 kernel/locking/rwsem.c:1577
inode_lock include/linux/fs.h:815 [inline]
ocfs2_lock_global_qf+0x206/0x2b0 fs/ocfs2/quota_global.c:313
ocfs2_acquire_dquot+0x2b0/0xb80 fs/ocfs2/quota_global.c:823
dqget+0x770/0xeb0 fs/quota/dquot.c:976
dquot_set_dqblk+0x2b/0xf30 fs/quota/dquot.c:2819
quota_setquota+0x6dc/0x850 fs/quota/quota.c:310
__do_sys_quotactl fs/quota/quota.c:961 [inline]
__se_sys_quotactl+0x2c4/0xa30 fs/quota/quota.c:917
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #4 (&dquot->dq_lock){+.+.}-{3:3}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752
wait_on_dquot fs/quota/dquot.c:355 [inline]
dqget+0x6e6/0xeb0 fs/quota/dquot.c:971
dquot_transfer+0x2c2/0x6d0 fs/quota/dquot.c:2139
ext4_setattr+0xaf3/0x1bc0 fs/ext4/inode.c:5368
notify_change+0xbca/0xe90 fs/attr.c:503
chown_common+0x501/0x850 fs/open.c:793
do_fchownat+0x16a/0x240 fs/open.c:824
__do_sys_chown fs/open.c:844 [inline]
__se_sys_chown fs/open.c:842 [inline]
__x64_sys_chown+0x82/0x90 fs/open.c:842
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #3 (&ei->xattr_sem){++++}-{3:3}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
down_write+0x99/0x220 kernel/locking/rwsem.c:1577
ext4_write_lock_xattr fs/ext4/xattr.h:154 [inline]
ext4_xattr_set_handle+0x277/0x1580 fs/ext4/xattr.c:2373
ext4_initxattrs+0xa3/0x120 fs/ext4/xattr_security.c:44
security_inode_init_security+0x29c/0x480 security/security.c:1846
__ext4_new_inode+0x3635/0x4380 fs/ext4/ialloc.c:1323
ext4_create+0x279/0x550 fs/ext4/namei.c:2834
lookup_open fs/namei.c:3595 [inline]
open_last_lookups fs/namei.c:3694 [inline]
path_openat+0x1c03/0x3590 fs/namei.c:3930
do_filp_open+0x235/0x490 fs/namei.c:3960
do_sys_openat2+0x13e/0x1d0 fs/open.c:1415
do_sys_open fs/open.c:1430 [inline]
__do_sys_openat fs/open.c:1446 [inline]
__se_sys_openat fs/open.c:1441 [inline]
__x64_sys_openat+0x247/0x2a0 fs/open.c:1441
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #2 (jbd2_handle){++++}-{0:0}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
jbd2_journal_lock_updates+0xaa/0x380 fs/jbd2/transaction.c:865
__ocfs2_flush_truncate_log+0x2ea/0x1250 fs/ocfs2/alloc.c:6029
ocfs2_flush_truncate_log+0x4f/0x70 fs/ocfs2/alloc.c:6076
ocfs2_sync_fs+0x125/0x390 fs/ocfs2/super.c:402
sync_filesystem+0x1c8/0x230 fs/sync.c:66
generic_shutdown_super+0x72/0x2d0 fs/super.c:621
kill_block_super+0x44/0x90 fs/super.c:1696
deactivate_locked_super+0xc4/0x130 fs/super.c:473
cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1373
task_work_run+0x24f/0x310 kernel/task_work.c:228
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #1 (&ocfs2_sysfile_lock_key[args->fi_sysfile_type]#6){+.+.}-{3:3}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
down_write+0x99/0x220 kernel/locking/rwsem.c:1577
inode_lock include/linux/fs.h:815 [inline]
ocfs2_remove_btree_range+0x737/0x1860 fs/ocfs2/alloc.c:5742
ocfs2_remove_inode_range+0x166d/0x2690 fs/ocfs2/file.c:1896
__ocfs2_change_file_space+0x8e4/0xfd0 fs/ocfs2/file.c:2017
ocfs2_fallocate+0x2e4/0x350 fs/ocfs2/file.c:2127
vfs_fallocate+0x569/0x6e0 fs/open.c:333
ksys_fallocate fs/open.c:356 [inline]
__do_sys_fallocate fs/open.c:364 [inline]
__se_sys_fallocate fs/open.c:362 [inline]
__x64_sys_fallocate+0xbd/0x110 fs/open.c:362
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (&ocfs2_quota_ip_alloc_sem_key){++++}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904
__lock_acquire+0x1384/0x2050 kernel/locking/lockdep.c:5202
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
down_write+0x99/0x220 kernel/locking/rwsem.c:1577
ocfs2_lock_global_qf+0x225/0x2b0 fs/ocfs2/quota_global.c:314
ocfs2_acquire_dquot+0x2b0/0xb80 fs/ocfs2/quota_global.c:823
dqget+0x770/0xeb0 fs/quota/dquot.c:976
dquot_set_dqblk+0x2b/0xf30 fs/quota/dquot.c:2819
quota_setquota+0x6dc/0x850 fs/quota/quota.c:310
__do_sys_quotactl fs/quota/quota.c:961 [inline]
__se_sys_quotactl+0x2c4/0xa30 fs/quota/quota.c:917
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Chain exists of:
&ocfs2_quota_ip_alloc_sem_key --> &dquot->dq_lock --> &ocfs2_sysfile_lock_key[args->fi_sysfile_type]#7
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&ocfs2_sysfile_lock_key[args->fi_sysfile_type]#7);
lock(&dquot->dq_lock);
lock(&ocfs2_sysfile_lock_key[args->fi_sysfile_type]#7);
lock(&ocfs2_quota_ip_alloc_sem_key);
*** DEADLOCK ***
3 locks held by syz.1.818/13312:
#0: ffff888052da60e0 (&type->s_umount_key#56){++++}-{3:3}, at: __super_lock fs/super.c:58 [inline]
#0: ffff888052da60e0 (&type->s_umount_key#56){++++}-{3:3}, at: super_lock+0x27c/0x400 fs/super.c:120
#1: ffff888079a3a0a8 (&dquot->dq_lock){+.+.}-{3:3}
, at: ocfs2_acquire_dquot+0x2a3/0xb80 fs/ocfs2/quota_global.c:818
#2: ffff88807f915100 (&ocfs2_sysfile_lock_key[args->fi_sysfile_type]#7){+.+.}-{3:3}
, at: inode_lock include/linux/fs.h:815 [inline]
, at: ocfs2_lock_global_qf+0x206/0x2b0 fs/ocfs2/quota_global.c:313
stack backtrace:
CPU: 1 UID: 0 PID: 13312 Comm: syz.1.818 Not tainted 6.12.0-rc1-syzkaller-00046-g7ec462100ef9 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2074
check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2206
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904
__lock_acquire+0x1384/0x2050 kernel/locking/lockdep.c:5202
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
down_write+0x99/0x220 kernel/locking/rwsem.c:1577
ocfs2_lock_global_qf+0x225/0x2b0 fs/ocfs2/quota_global.c:314
ocfs2_acquire_dquot+0x2b0/0xb80 fs/ocfs2/quota_global.c:823
dqget+0x770/0xeb0 fs/quota/dquot.c:976
dquot_set_dqblk+0x2b/0xf30 fs/quota/dquot.c:2819
quota_setquota+0x6dc/0x850 fs/quota/quota.c:310
__do_sys_quotactl fs/quota/quota.c:961 [inline]
__se_sys_quotactl+0x2c4/0xa30 fs/quota/quota.c:917
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2c12f7dff9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f2c13e59038 EFLAGS: 00000246 ORIG_RAX: 00000000000000b3
RAX: ffffffffffffffda RBX: 00007f2c13135f80 RCX: 00007f2c12f7dff9
RDX: 0000000000000000 RSI: 0000000020000080 RDI: ffffffff80000800
RBP: 00007f2c12ff0296 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000020000240 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f2c13135f80 R15: 00007ffeac575038
</TASK>
ocfs2: Unmounting device (7,1) on (node local)
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [syzbot] [ocfs2?] possible deadlock in ocfs2_lock_global_qf
2024-10-03 18:26 [syzbot] [ocfs2?] possible deadlock in ocfs2_lock_global_qf syzbot
@ 2025-09-28 18:52 ` syzbot
0 siblings, 0 replies; 2+ messages in thread
From: syzbot @ 2025-09-28 18:52 UTC (permalink / raw)
To: jlbec, joseph.qi, linux-kernel, mark, ocfs2-devel, syzkaller-bugs
syzbot has found a reproducer for the following issue on:
HEAD commit: 2213e57a69f0 Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=177a0334580000
kernel config: https://syzkaller.appspot.com/x/.config?x=714d45b6135c308e
dashboard link: https://syzkaller.appspot.com/bug?extid=b53d753ae8fb473e2397
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15f4bf12580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14840ae2580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/bf4625d47a8f/disk-2213e57a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/270abffcbf3c/vmlinux-2213e57a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/1f0f6eb3e385/Image-2213e57a.gz.xz
mounted in repro #1: https://storage.googleapis.com/syzbot-assets/bd16abd3a6ee/mount_0.gz
fsck result: OK (log: https://syzkaller.appspot.com/x/fsck.log?x=15a3f142580000)
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/6b6e68c02efc/mount_5.gz
fsck result: OK (log: https://syzkaller.appspot.com/x/fsck.log?x=11096ae2580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b53d753ae8fb473e2397@syzkaller.appspotmail.com
ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode.
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.4.50/6831 is trying to acquire lock:
ffff0000faf15100 (&ocfs2_sysfile_lock_key[USER_QUOTA_SYSTEM_INODE]){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:870 [inline]
ffff0000faf15100 (&ocfs2_sysfile_lock_key[USER_QUOTA_SYSTEM_INODE]){+.+.}-{4:4}, at: ocfs2_lock_global_qf+0x18c/0x22c fs/ocfs2/quota_global.c:313
but task is already holding lock:
ffff0000e39a00a8 (&dquot->dq_lock){+.+.}-{4:4}, at: ocfs2_acquire_dquot+0x24c/0xa10 fs/ocfs2/quota_global.c:823
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #6 (&dquot->dq_lock){+.+.}-{4:4}:
__mutex_lock_common+0x1d0/0x2678 kernel/locking/mutex.c:598
__mutex_lock kernel/locking/mutex.c:760 [inline]
mutex_lock_nested+0x2c/0x38 kernel/locking/mutex.c:812
wait_on_dquot fs/quota/dquot.c:354 [inline]
dqget+0x5e4/0xccc fs/quota/dquot.c:972
dquot_transfer+0x238/0x560 fs/quota/dquot.c:2140
ext4_setattr+0x738/0x1810 fs/ext4/inode.c:5902
notify_change+0x9a4/0xc50 fs/attr.c:552
chown_common+0x374/0x4dc fs/open.c:791
vfs_fchown fs/open.c:859 [inline]
ksys_fchown+0xe0/0x158 fs/open.c:871
__do_sys_fchown fs/open.c:876 [inline]
__se_sys_fchown fs/open.c:874 [inline]
__arm64_sys_fchown+0x7c/0x94 fs/open.c:874
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x5c/0x254 arch/arm64/kernel/entry-common.c:744
el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:763
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
-> #5 (&ei->xattr_sem){++++}-{4:4}:
down_write+0x50/0xc0 kernel/locking/rwsem.c:1590
ext4_write_lock_xattr fs/ext4/xattr.h:157 [inline]
ext4_xattr_set_handle+0x11c/0x1260 fs/ext4/xattr.c:2362
ext4_initxattrs+0xa4/0x11c fs/ext4/xattr_security.c:44
security_inode_init_security+0x6dc/0x7f4 security/security.c:1852
ext4_init_security+0x44/0x58 fs/ext4/xattr_security.c:58
__ext4_new_inode+0x27f4/0x3190 fs/ext4/ialloc.c:1325
ext4_create+0x1f8/0x3fc fs/ext4/namei.c:2822
lookup_open fs/namei.c:3708 [inline]
open_last_lookups fs/namei.c:3807 [inline]
path_openat+0x12d8/0x2c40 fs/namei.c:4043
do_filp_open+0x18c/0x36c fs/namei.c:4073
do_sys_openat2+0x11c/0x1b4 fs/open.c:1435
do_sys_open fs/open.c:1450 [inline]
__do_sys_openat fs/open.c:1466 [inline]
__se_sys_openat fs/open.c:1461 [inline]
__arm64_sys_openat+0x120/0x158 fs/open.c:1461
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x5c/0x254 arch/arm64/kernel/entry-common.c:744
el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:763
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
-> #4 (jbd2_handle){++++}-{0:0}:
start_this_handle+0xe74/0x10dc fs/jbd2/transaction.c:444
jbd2__journal_start+0x288/0x51c fs/jbd2/transaction.c:501
jbd2_journal_start+0x3c/0x4c fs/jbd2/transaction.c:540
ocfs2_start_trans+0x368/0x6b0 fs/ocfs2/journal.c:374
ocfs2_modify_bh+0xe4/0x43c fs/ocfs2/quota_local.c:101
ocfs2_local_read_info+0x104c/0x1364 fs/ocfs2/quota_local.c:767
dquot_load_quota_sb+0x6bc/0xa90 fs/quota/dquot.c:2459
dquot_load_quota_inode+0x274/0x4e4 fs/quota/dquot.c:2496
ocfs2_enable_quotas+0x17c/0x3b4 fs/ocfs2/super.c:930
ocfs2_fill_super+0x4004/0x532c fs/ocfs2/super.c:1140
get_tree_bdev_flags+0x360/0x414 fs/super.c:1692
get_tree_bdev+0x2c/0x3c fs/super.c:1715
ocfs2_get_tree+0x28/0x38 fs/ocfs2/super.c:1184
vfs_get_tree+0x90/0x28c fs/super.c:1815
do_new_mount+0x278/0x7f4 fs/namespace.c:3808
path_mount+0x5b4/0xde0 fs/namespace.c:4123
do_mount fs/namespace.c:4136 [inline]
__do_sys_mount fs/namespace.c:4347 [inline]
__se_sys_mount fs/namespace.c:4324 [inline]
__arm64_sys_mount+0x3e8/0x468 fs/namespace.c:4324
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x5c/0x254 arch/arm64/kernel/entry-common.c:744
el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:763
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
-> #3 (&journal->j_trans_barrier){.+.+}-{4:4}:
down_read+0x58/0x2f8 kernel/locking/rwsem.c:1537
ocfs2_start_trans+0x35c/0x6b0 fs/ocfs2/journal.c:372
ocfs2_modify_bh+0xe4/0x43c fs/ocfs2/quota_local.c:101
ocfs2_local_read_info+0x104c/0x1364 fs/ocfs2/quota_local.c:767
dquot_load_quota_sb+0x6bc/0xa90 fs/quota/dquot.c:2459
dquot_load_quota_inode+0x274/0x4e4 fs/quota/dquot.c:2496
ocfs2_enable_quotas+0x17c/0x3b4 fs/ocfs2/super.c:930
ocfs2_fill_super+0x4004/0x532c fs/ocfs2/super.c:1140
get_tree_bdev_flags+0x360/0x414 fs/super.c:1692
get_tree_bdev+0x2c/0x3c fs/super.c:1715
ocfs2_get_tree+0x28/0x38 fs/ocfs2/super.c:1184
vfs_get_tree+0x90/0x28c fs/super.c:1815
do_new_mount+0x278/0x7f4 fs/namespace.c:3808
path_mount+0x5b4/0xde0 fs/namespace.c:4123
do_mount fs/namespace.c:4136 [inline]
__do_sys_mount fs/namespace.c:4347 [inline]
__se_sys_mount fs/namespace.c:4324 [inline]
__arm64_sys_mount+0x3e8/0x468 fs/namespace.c:4324
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x5c/0x254 arch/arm64/kernel/entry-common.c:744
el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:763
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
-> #2 (sb_internal#2){.+.+}-{0:0}:
percpu_down_read_internal include/linux/percpu-rwsem.h:53 [inline]
percpu_down_read_freezable include/linux/percpu-rwsem.h:83 [inline]
__sb_start_write include/linux/fs.h:1799 [inline]
sb_start_intwrite include/linux/fs.h:1982 [inline]
ocfs2_start_trans+0x1f4/0x6b0 fs/ocfs2/journal.c:370
ocfs2_write_info+0x114/0x324 fs/ocfs2/quota_global.c:997
dquot_set_dqinfo+0x370/0x5d4 fs/quota/dquot.c:2897
quota_setinfo+0x2c4/0x2cc fs/quota/quota.c:174
do_quotactl+0x59c/0x738 fs/quota/quota.c:796
__do_sys_quotactl fs/quota/quota.c:961 [inline]
__se_sys_quotactl fs/quota/quota.c:917 [inline]
__arm64_sys_quotactl+0x298/0xb34 fs/quota/quota.c:917
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x5c/0x254 arch/arm64/kernel/entry-common.c:744
el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:763
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
-> #1 (&ocfs2_quota_ip_alloc_sem_key){++++}-{4:4}:
down_write+0x50/0xc0 kernel/locking/rwsem.c:1590
ocfs2_lock_global_qf+0x1a8/0x22c fs/ocfs2/quota_global.c:314
ocfs2_write_info+0xdc/0x324 fs/ocfs2/quota_global.c:994
dquot_set_dqinfo+0x370/0x5d4 fs/quota/dquot.c:2897
quota_setinfo+0x2c4/0x2cc fs/quota/quota.c:174
do_quotactl+0x59c/0x738 fs/quota/quota.c:796
__do_sys_quotactl fs/quota/quota.c:961 [inline]
__se_sys_quotactl fs/quota/quota.c:917 [inline]
__arm64_sys_quotactl+0x298/0xb34 fs/quota/quota.c:917
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x5c/0x254 arch/arm64/kernel/entry-common.c:744
el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:763
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
-> #0 (&ocfs2_sysfile_lock_key[USER_QUOTA_SYSTEM_INODE]){+.+.}-{4:4}:
check_prev_add kernel/locking/lockdep.c:3165 [inline]
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain kernel/locking/lockdep.c:3908 [inline]
__lock_acquire+0x1774/0x30a4 kernel/locking/lockdep.c:5237
lock_acquire+0x14c/0x2e0 kernel/locking/lockdep.c:5868
down_write+0x50/0xc0 kernel/locking/rwsem.c:1590
inode_lock include/linux/fs.h:870 [inline]
ocfs2_lock_global_qf+0x18c/0x22c fs/ocfs2/quota_global.c:313
ocfs2_acquire_dquot+0x258/0xa10 fs/ocfs2/quota_global.c:828
dqget+0x654/0xccc fs/quota/dquot.c:977
__dquot_initialize+0x2d4/0xa80 fs/quota/dquot.c:1505
dquot_initialize+0x24/0x34 fs/quota/dquot.c:1567
ocfs2_get_init_inode+0x134/0x1a8 fs/ocfs2/namei.c:205
ocfs2_mknod+0x734/0x1cf0 fs/ocfs2/namei.c:313
ocfs2_create+0x190/0x474 fs/ocfs2/namei.c:676
lookup_open fs/namei.c:3708 [inline]
open_last_lookups fs/namei.c:3807 [inline]
path_openat+0x12d8/0x2c40 fs/namei.c:4043
do_filp_open+0x18c/0x36c fs/namei.c:4073
do_sys_openat2+0x11c/0x1b4 fs/open.c:1435
do_sys_open fs/open.c:1450 [inline]
__do_sys_openat fs/open.c:1466 [inline]
__se_sys_openat fs/open.c:1461 [inline]
__arm64_sys_openat+0x120/0x158 fs/open.c:1461
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x5c/0x254 arch/arm64/kernel/entry-common.c:744
el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:763
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
other info that might help us debug this:
Chain exists of:
&ocfs2_sysfile_lock_key[USER_QUOTA_SYSTEM_INODE] --> &ei->xattr_sem --> &dquot->dq_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&dquot->dq_lock);
lock(&ei->xattr_sem);
lock(&dquot->dq_lock);
lock(&ocfs2_sysfile_lock_key[USER_QUOTA_SYSTEM_INODE]);
*** DEADLOCK ***
4 locks held by syz.4.50/6831:
#0: ffff0000c92ca428 (sb_writers#11){.+.+}-{0:0}, at: mnt_want_write+0x44/0x9c fs/namespace.c:557
#1: ffff0000faf109c0 (&type->i_mutex_dir_key#8){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:870 [inline]
#1: ffff0000faf109c0 (&type->i_mutex_dir_key#8){+.+.}-{4:4}, at: open_last_lookups fs/namei.c:3804 [inline]
#1: ffff0000faf109c0 (&type->i_mutex_dir_key#8){+.+.}-{4:4}, at: path_openat+0x638/0x2c40 fs/namei.c:4043
#2: ffff0000fad09800 (&ocfs2_sysfile_lock_key[INODE_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:870 [inline]
#2: ffff0000fad09800 (&ocfs2_sysfile_lock_key[INODE_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}, at: ocfs2_reserve_suballoc_bits+0x12c/0x3b9c fs/ocfs2/suballoc.c:788
#3: ffff0000e39a00a8 (&dquot->dq_lock){+.+.}-{4:4}, at: ocfs2_acquire_dquot+0x24c/0xa10 fs/ocfs2/quota_global.c:823
stack backtrace:
CPU: 0 UID: 0 PID: 6831 Comm: syz.4.50 Not tainted syzkaller #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
Call trace:
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
__dump_stack+0x30/0x40 lib/dump_stack.c:94
dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
dump_stack+0x1c/0x28 lib/dump_stack.c:129
print_circular_bug+0x324/0x32c kernel/locking/lockdep.c:2043
check_noncircular+0x154/0x174 kernel/locking/lockdep.c:2175
check_prev_add kernel/locking/lockdep.c:3165 [inline]
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain kernel/locking/lockdep.c:3908 [inline]
__lock_acquire+0x1774/0x30a4 kernel/locking/lockdep.c:5237
lock_acquire+0x14c/0x2e0 kernel/locking/lockdep.c:5868
down_write+0x50/0xc0 kernel/locking/rwsem.c:1590
inode_lock include/linux/fs.h:870 [inline]
ocfs2_lock_global_qf+0x18c/0x22c fs/ocfs2/quota_global.c:313
ocfs2_acquire_dquot+0x258/0xa10 fs/ocfs2/quota_global.c:828
dqget+0x654/0xccc fs/quota/dquot.c:977
__dquot_initialize+0x2d4/0xa80 fs/quota/dquot.c:1505
dquot_initialize+0x24/0x34 fs/quota/dquot.c:1567
ocfs2_get_init_inode+0x134/0x1a8 fs/ocfs2/namei.c:205
ocfs2_mknod+0x734/0x1cf0 fs/ocfs2/namei.c:313
ocfs2_create+0x190/0x474 fs/ocfs2/namei.c:676
lookup_open fs/namei.c:3708 [inline]
open_last_lookups fs/namei.c:3807 [inline]
path_openat+0x12d8/0x2c40 fs/namei.c:4043
do_filp_open+0x18c/0x36c fs/namei.c:4073
do_sys_openat2+0x11c/0x1b4 fs/open.c:1435
do_sys_open fs/open.c:1450 [inline]
__do_sys_openat fs/open.c:1466 [inline]
__se_sys_openat fs/open.c:1461 [inline]
__arm64_sys_openat+0x120/0x158 fs/open.c:1461
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x5c/0x254 arch/arm64/kernel/entry-common.c:744
el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:763
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
(syz.4.50,6831,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0x2c7b5077, computed 0x28030c75. Applying ECC.
(syz.4.50,6831,0):ocfs2_block_check_validate:416 ERROR: Fixed CRC32 failed: stored: 0x2c7b5077, computed 0x28d1d8ae
(syz.4.50,6831,0):ocfs2_read_quota_phys_block:160 ERROR: status = -5
(syz.4.50,6831,0):ocfs2_quota_read:201 ERROR: status = -5
Quota error (device loop4): find_tree_dqentry: Can't read quota tree block 5
Quota error (device loop4): qtree_read_dquot: Can't read quota structure for id 0
(syz.4.50,6831,0):ocfs2_acquire_dquot:890 ERROR: status = -5
(syz.4.50,6831,0):ocfs2_mknod:317 ERROR: status = -5
(syz.4.50,6831,0):ocfs2_mknod:505 ERROR: status = -5
(syz.4.50,6831,0):ocfs2_create:678 ERROR: status = -5
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-09-28 18:52 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-10-03 18:26 [syzbot] [ocfs2?] possible deadlock in ocfs2_lock_global_qf syzbot
2025-09-28 18:52 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox