From: sanan.hasanou@gmail.com
To: mark@fasheh.com, jlbec@evilplan.org, joseph.qi@linux.alibaba.com,
ocfs2-devel@lists.linux.dev, linux-kernel@vger.kernel.org
Cc: syzkaller@googlegroups.com, contact@pgazz.com
Subject: possible deadlock in ocfs2_reserve_suballoc_bits
Date: Fri, 26 Jun 2026 14:27:19 -0700 (PDT) [thread overview]
Message-ID: <6a3eeeb7.39484e70.323465.3909@mx.google.com> (raw)
Good day, dear maintainers,
We found a bug using a modified version of syzkaller.
Kernel Branch: 7.0-rc1
Kernel Config: <https://drive.google.com/open?id=1zJHAs5GUroGFBkxAlzfDaWAd_NVPZTfJ>
Unfortunately, we don't have any reproducer for this bug yet.
Thank you!
Best regards,
Sanan Hasanov
======================================================
WARNING: possible circular locking dependency detected
7.0.0-rc1 #1 Tainted: G L
------------------------------------------------------
syz.3.30336/128034 is trying to acquire lock:
ffff888058ac2640 (&ocfs2_sysfile_lock_key[EXTENT_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1028 [inline]
ffff888058ac2640 (&ocfs2_sysfile_lock_key[EXTENT_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}, at: ocfs2_reserve_suballoc_bits+0x168/0x46a0 fs/ocfs2/suballoc.c:857
but task is already holding lock:
ffff888058a6ce38 (&oi->ip_xattr_sem){++++}-{4:4}, at: ocfs2_xattr_set+0x42c/0x1210 fs/ocfs2/xattr.c:3614
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #4 (&oi->ip_xattr_sem){++++}-{4:4}:
down_read+0x4c/0x2e0 kernel/locking/rwsem.c:1537
ocfs2_init_acl+0x2f7/0x7a0 fs/ocfs2/acl.c:367
ocfs2_mknod+0x1327/0x20c0 fs/ocfs2/namei.c:414
ocfs2_mkdir+0x181/0x470 fs/ocfs2/namei.c:660
vfs_mkdir+0x41a/0x630 fs/namei.c:5233
filename_mkdirat+0x27b/0x500 fs/namei.c:5266
__do_sys_mkdirat fs/namei.c:5287 [inline]
__se_sys_mkdirat+0x38/0x160 fs/namei.c:5284
__x64_sys_mkdirat+0x7f/0x90 fs/namei.c:5284
x64_sys_call+0x26a0/0x2900 arch/x86/include/generated/asm/syscalls_64.h:259
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x160/0xfc0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x4b/0x53
-> #3 (&journal->j_trans_barrier){.+.+}-{4:4}:
down_read+0x4c/0x2e0 kernel/locking/rwsem.c:1537
ocfs2_start_trans+0x36a/0x6d0 fs/ocfs2/journal.c:369
ocfs2_mknod+0xe97/0x20c0 fs/ocfs2/namei.c:365
ocfs2_create+0x195/0x470 fs/ocfs2/namei.c:677
lookup_open fs/namei.c:4483 [inline]
open_last_lookups fs/namei.c:4583 [inline]
path_openat+0x1388/0x3740 fs/namei.c:4827
do_file_open+0x203/0x440 fs/namei.c:4859
do_sys_openat2+0x105/0x1e0 fs/open.c:1366
do_sys_open fs/open.c:1372 [inline]
__do_sys_openat fs/open.c:1388 [inline]
__se_sys_openat fs/open.c:1383 [inline]
__x64_sys_openat+0x139/0x160 fs/open.c:1383
x64_sys_call+0x1c0b/0x2900 arch/x86/include/generated/asm/syscalls_64.h:258
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x160/0xfc0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x4b/0x53
-> #2 (sb_internal#2){.+.+}-{0:0}:
percpu_down_read_internal include/linux/percpu-rwsem.h:53 [inline]
percpu_down_read_freezable include/linux/percpu-rwsem.h:83 [inline]
__sb_start_write include/linux/fs/super.h:19 [inline]
sb_start_intwrite include/linux/fs/super.h:177 [inline]
ocfs2_start_trans+0x26b/0x6d0 fs/ocfs2/journal.c:367
ocfs2_mknod+0xe97/0x20c0 fs/ocfs2/namei.c:365
ocfs2_create+0x195/0x470 fs/ocfs2/namei.c:677
lookup_open fs/namei.c:4483 [inline]
open_last_lookups fs/namei.c:4583 [inline]
path_openat+0x1388/0x3740 fs/namei.c:4827
do_file_open+0x203/0x440 fs/namei.c:4859
do_sys_openat2+0x105/0x1e0 fs/open.c:1366
do_sys_open fs/open.c:1372 [inline]
__do_sys_openat fs/open.c:1388 [inline]
__se_sys_openat fs/open.c:1383 [inline]
__x64_sys_openat+0x139/0x160 fs/open.c:1383
x64_sys_call+0x1c0b/0x2900 arch/x86/include/generated/asm/syscalls_64.h:258
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x160/0xfc0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x4b/0x53
-> #1 (&ocfs2_sysfile_lock_key[LOCAL_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}:
down_write+0x96/0x1f0 kernel/locking/rwsem.c:1590
inode_lock include/linux/fs.h:1028 [inline]
ocfs2_reserve_local_alloc_bits+0x125/0x2580 fs/ocfs2/localalloc.c:636
ocfs2_reserve_clusters_with_limit+0x1be/0xba0 fs/ocfs2/suballoc.c:1237
ocfs2_reserve_clusters+0x30/0x40 fs/ocfs2/suballoc.c:1298
ocfs2_mknod+0xe35/0x20c0 fs/ocfs2/namei.c:358
ocfs2_create+0x195/0x470 fs/ocfs2/namei.c:677
lookup_open fs/namei.c:4483 [inline]
open_last_lookups fs/namei.c:4583 [inline]
path_openat+0x1388/0x3740 fs/namei.c:4827
do_file_open+0x203/0x440 fs/namei.c:4859
do_sys_openat2+0x105/0x1e0 fs/open.c:1366
do_sys_open fs/open.c:1372 [inline]
__do_sys_openat fs/open.c:1388 [inline]
__se_sys_openat fs/open.c:1383 [inline]
__x64_sys_openat+0x139/0x160 fs/open.c:1383
x64_sys_call+0x1c0b/0x2900 arch/x86/include/generated/asm/syscalls_64.h:258
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x160/0xfc0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x4b/0x53
-> #0 (&ocfs2_sysfile_lock_key[EXTENT_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}:
check_prev_add kernel/locking/lockdep.c:3165 [inline]
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain kernel/locking/lockdep.c:3908 [inline]
__lock_acquire+0x16f8/0x2f60 kernel/locking/lockdep.c:5237
lock_acquire+0xf0/0x2d0 kernel/locking/lockdep.c:5868
down_write+0x96/0x1f0 kernel/locking/rwsem.c:1590
inode_lock include/linux/fs.h:1028 [inline]
ocfs2_reserve_suballoc_bits+0x168/0x46a0 fs/ocfs2/suballoc.c:857
ocfs2_reserve_new_metadata_blocks+0x403/0x940 fs/ocfs2/suballoc.c:1053
ocfs2_init_xattr_set_ctxt+0x2e8/0x780 fs/ocfs2/xattr.c:3308
ocfs2_xattr_set+0xb99/0x1210 fs/ocfs2/xattr.c:3665
ocfs2_xattr_trusted_set+0x40/0x50 fs/ocfs2/xattr.c:7371
__vfs_setxattr+0x489/0x4d0 fs/xattr.c:200
__vfs_setxattr_noperm+0x12e/0x660 fs/xattr.c:234
__vfs_setxattr_locked+0x113/0x2a0 fs/xattr.c:295
vfs_setxattr+0x163/0x360 fs/xattr.c:321
do_setxattr fs/xattr.c:636 [inline]
filename_setxattr+0x286/0x610 fs/xattr.c:664
path_setxattrat+0x356/0x3a0 fs/xattr.c:708
__do_sys_setxattr fs/xattr.c:742 [inline]
__se_sys_setxattr fs/xattr.c:738 [inline]
__x64_sys_setxattr+0xca/0xe0 fs/xattr.c:738
x64_sys_call+0x2836/0x2900 arch/x86/include/generated/asm/syscalls_64.h:189
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x160/0xfc0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x4b/0x53
other info that might help us debug this:
Chain exists of:
&ocfs2_sysfile_lock_key[EXTENT_ALLOC_SYSTEM_INODE] --> &journal->j_trans_barrier --> &oi->ip_xattr_sem
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&oi->ip_xattr_sem);
lock(&journal->j_trans_barrier);
lock(&oi->ip_xattr_sem);
lock(&ocfs2_sysfile_lock_key[EXTENT_ALLOC_SYSTEM_INODE]);
*** DEADLOCK ***
3 locks held by syz.3.30336/128034:
#0: ffff88802382a420 (sb_writers#16){.+.+}-{0:0}, at: mnt_want_write+0x44/0x90 fs/namespace.c:493
#1: ffff888058a6d100 (&sb->s_type->i_mutex_key#30){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1028 [inline]
#1: ffff888058a6d100 (&sb->s_type->i_mutex_key#30){+.+.}-{4:4}, at: vfs_setxattr+0x13e/0x360 fs/xattr.c:320
#2: ffff888058a6ce38 (&oi->ip_xattr_sem){++++}-{4:4}, at: ocfs2_xattr_set+0x42c/0x1210 fs/ocfs2/xattr.c:3614
stack backtrace:
CPU: 0 UID: 0 PID: 128034 Comm: syz.3.30336 Tainted: G L 7.0.0-rc1 #1 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
__dump_stack+0x21/0x30 lib/dump_stack.c:94
dump_stack_lvl+0xee/0x150 lib/dump_stack.c:120
dump_stack+0x19/0x20 lib/dump_stack.c:129
print_circular_bug+0x2ee/0x300 kernel/locking/lockdep.c:2043
check_noncircular+0x12f/0x150 kernel/locking/lockdep.c:2175
check_prev_add kernel/locking/lockdep.c:3165 [inline]
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain kernel/locking/lockdep.c:3908 [inline]
__lock_acquire+0x16f8/0x2f60 kernel/locking/lockdep.c:5237
lock_acquire+0xf0/0x2d0 kernel/locking/lockdep.c:5868
down_write+0x96/0x1f0 kernel/locking/rwsem.c:1590
inode_lock include/linux/fs.h:1028 [inline]
ocfs2_reserve_suballoc_bits+0x168/0x46a0 fs/ocfs2/suballoc.c:857
ocfs2_reserve_new_metadata_blocks+0x403/0x940 fs/ocfs2/suballoc.c:1053
ocfs2_init_xattr_set_ctxt+0x2e8/0x780 fs/ocfs2/xattr.c:3308
ocfs2_xattr_set+0xb99/0x1210 fs/ocfs2/xattr.c:3665
ocfs2_xattr_trusted_set+0x40/0x50 fs/ocfs2/xattr.c:7371
__vfs_setxattr+0x489/0x4d0 fs/xattr.c:200
__vfs_setxattr_noperm+0x12e/0x660 fs/xattr.c:234
__vfs_setxattr_locked+0x113/0x2a0 fs/xattr.c:295
vfs_setxattr+0x163/0x360 fs/xattr.c:321
do_setxattr fs/xattr.c:636 [inline]
filename_setxattr+0x286/0x610 fs/xattr.c:664
path_setxattrat+0x356/0x3a0 fs/xattr.c:708
__do_sys_setxattr fs/xattr.c:742 [inline]
__se_sys_setxattr fs/xattr.c:738 [inline]
__x64_sys_setxattr+0xca/0xe0 fs/xattr.c:738
x64_sys_call+0x2836/0x2900 arch/x86/include/generated/asm/syscalls_64.h:189
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x160/0xfc0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x4b/0x53
RIP: 0033:0x7f3797fa3b6d
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3798d71018 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc
RAX: ffffffffffffffda RBX: 00007f3798216090 RCX: 00007f3797fa3b6d
RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000200000000240
RBP: 00007f3798047c3e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3798216128 R14: 00007f3798216090 R15: 00007fff5ebf9540
</TASK>
<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>
next reply other threads:[~2026-06-26 21:27 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-26 21:27 sanan.hasanou [this message]
-- strict thread matches above, loose matches on Subject: below --
2026-06-26 21:27 possible deadlock in ocfs2_reserve_suballoc_bits sanan.hasanou
2024-12-31 6:02 Liebes Wang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a3eeeb7.39484e70.323465.3909@mx.google.com \
--to=sanan.hasanou@gmail.com \
--cc=contact@pgazz.com \
--cc=jlbec@evilplan.org \
--cc=joseph.qi@linux.alibaba.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mark@fasheh.com \
--cc=ocfs2-devel@lists.linux.dev \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox