Hello, syzbot found the following issue on: HEAD commit: f017d9a92a73 Add linux-next specific files for 20231024 git tree: linux-next console output: https://syzkaller.appspot.com/x/log.txt?x=114f9135680000 kernel config: https://syzkaller.appspot.com/x/.config?x=8fd5ab06ad389b6f dashboard link: https://syzkaller.appspot.com/bug?extid=1e19c0a6b5e324635721 compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 Unfortunately, I don't have any reproducer for this issue yet. Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/feca2ffa52fd/disk-f017d9a9.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/c2643e9e7d02/vmlinux-f017d9a9.xz kernel image: https://storage.googleapis.com/syzbot-assets/7492edb5b60c/bzImage-f017d9a9.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+1e19c0a6b5e324635721@xxxxxxxxxxxxxxxxxxxxxxxxx ====================================================== WARNING: possible circular locking dependency detected 6.6.0-rc7-next-20231024-syzkaller #0 Not tainted ------------------------------------------------------ kworker/u4:0/24418 is trying to acquire lock: ffff888039a1e1c0 (&indx->run_lock){.+.+}-{3:3}, at: indx_read+0x251/0xcd0 fs/ntfs3/index.c:1066 but task is already holding lock: ffff888039a1e0e0 (&ni->ni_lock#2){+.+.}-{3:3}, at: ni_trylock fs/ntfs3/ntfs_fs.h:1144 [inline] ffff888039a1e0e0 (&ni->ni_lock#2){+.+.}-{3:3}, at: ni_update_parent fs/ntfs3/frecord.c:3230 [inline] ffff888039a1e0e0 (&ni->ni_lock#2){+.+.}-{3:3}, at: ni_write_inode+0x15a4/0x2850 fs/ntfs3/frecord.c:3321 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #4 (&ni->ni_lock#2){+.+.}-{3:3}: __mutex_lock_common kernel/locking/mutex.c:603 [inline] __mutex_lock+0x181/0x1330 kernel/locking/mutex.c:747 ntfs_set_state+0x1d2/0x6a0 fs/ntfs3/fsntfs.c:946 ni_remove_name+0x2ff/0x670 fs/ntfs3/frecord.c:2926 ntfs_unlink_inode+0x37a/0x740 fs/ntfs3/inode.c:1772 ntfs_rename+0x387/0xec0 fs/ntfs3/namei.c:288 vfs_rename+0xe20/0x1c30 fs/namei.c:4843 do_renameat2+0xc3c/0xdc0 fs/namei.c:4995 __do_sys_rename fs/namei.c:5041 [inline] __se_sys_rename fs/namei.c:5039 [inline] __x64_sys_rename+0x81/0xa0 fs/namei.c:5039 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x62/0x6a -> #3 (&ni->ni_lock#2/4){+.+.}-{3:3}: __mutex_lock_common kernel/locking/mutex.c:603 [inline] __mutex_lock+0x181/0x1330 kernel/locking/mutex.c:747 ni_lock fs/ntfs3/ntfs_fs.h:1124 [inline] ntfs_fallocate+0x73d/0x1260 fs/ntfs3/file.c:499 vfs_fallocate+0x46c/0xe50 fs/open.c:324 ksys_fallocate fs/open.c:347 [inline] __do_sys_fallocate fs/open.c:355 [inline] __se_sys_fallocate fs/open.c:353 [inline] __x64_sys_fallocate+0xd5/0x140 fs/open.c:353 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x62/0x6a -> #2 (mapping.invalidate_lock#5){++++}-{3:3}: down_read+0x9c/0x470 kernel/locking/rwsem.c:1526 filemap_invalidate_lock_shared include/linux/fs.h:857 [inline] filemap_fault+0x28c/0x3570 mm/filemap.c:3225 __do_fault+0x107/0x5f0 mm/memory.c:4268 do_read_fault mm/memory.c:4631 [inline] do_fault mm/memory.c:4765 [inline] do_pte_missing mm/memory.c:3733 [inline] handle_pte_fault mm/memory.c:5041 [inline] __handle_mm_fault+0x2682/0x3d60 mm/memory.c:5182 handle_mm_fault+0x474/0x9f0 mm/memory.c:5347 faultin_page mm/gup.c:956 [inline] __get_user_pages+0x4b1/0x1480 mm/gup.c:1239 populate_vma_page_range+0x2d4/0x410 mm/gup.c:1677 __mm_populate+0x1d6/0x380 mm/gup.c:1786 mm_populate include/linux/mm.h:3379 [inline] vm_mmap_pgoff+0x2cc/0x3b0 mm/util.c:551 ksys_mmap_pgoff+0x421/0x5a0 mm/mmap.c:1428 __do_sys_mmap arch/x86/kernel/sys_x86_64.c:93 [inline] __se_sys_mmap arch/x86/kernel/sys_x86_64.c:86 [inline] __x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:86 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x62/0x6a -> #1 (&mm->mmap_lock){++++}-{3:3}: __might_fault mm/memory.c:5958 [inline] __might_fault+0x11b/0x190 mm/memory.c:5951 _copy_to_user+0x2b/0xb0 lib/usercopy.c:36 copy_to_user include/linux/uaccess.h:191 [inline] fiemap_fill_next_extent+0x232/0x380 fs/ioctl.c:145 ni_fiemap+0x440/0xc00 fs/ntfs3/frecord.c:2065 ntfs_fiemap+0xc9/0x110 fs/ntfs3/file.c:1164 ioctl_fiemap fs/ioctl.c:220 [inline] do_vfs_ioctl+0x339/0x1920 fs/ioctl.c:811 __do_sys_ioctl fs/ioctl.c:869 [inline] __se_sys_ioctl fs/ioctl.c:857 [inline] __x64_sys_ioctl+0x112/0x210 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x62/0x6a -> #0 (&indx->run_lock){.+.+}-{3:3}: check_prev_add kernel/locking/lockdep.c:3134 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain kernel/locking/lockdep.c:3868 [inline] __lock_acquire+0x2e22/0x5dc0 kernel/locking/lockdep.c:5136 lock_acquire kernel/locking/lockdep.c:5753 [inline] lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718 down_read+0x9c/0x470 kernel/locking/rwsem.c:1526 indx_read+0x251/0xcd0 fs/ntfs3/index.c:1066 indx_find+0x4a9/0x980 fs/ntfs3/index.c:1181 indx_update_dup+0x166/0x440 fs/ntfs3/index.c:2659 ni_update_parent fs/ntfs3/frecord.c:3233 [inline] ni_write_inode+0x1650/0x2850 fs/ntfs3/frecord.c:3321 write_inode fs/fs-writeback.c:1473 [inline] __writeback_single_inode+0xa84/0xe60 fs/fs-writeback.c:1690 writeback_sb_inodes+0x5a2/0x1090 fs/fs-writeback.c:1916 __writeback_inodes_wb+0xff/0x2d0 fs/fs-writeback.c:1987 wb_writeback+0x7fe/0xaa0 fs/fs-writeback.c:2094 wb_check_old_data_flush fs/fs-writeback.c:2198 [inline] wb_do_writeback fs/fs-writeback.c:2251 [inline] wb_workfn+0x9f8/0xfd0 fs/fs-writeback.c:2279 process_one_work+0x8a2/0x15e0 kernel/workqueue.c:2630 process_scheduled_works kernel/workqueue.c:2703 [inline] worker_thread+0x8b6/0x1280 kernel/workqueue.c:2784 kthread+0x337/0x440 kernel/kthread.c:388 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 other info that might help us debug this: Chain exists of: &indx->run_lock --> &ni->ni_lock#2/4 --> &ni->ni_lock#2 Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&ni->ni_lock#2); lock(&ni->ni_lock#2/4); lock(&ni->ni_lock#2); rlock(&indx->run_lock); *** DEADLOCK *** 5 locks held by kworker/u4:0/24418: #0: ffff88814226d938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work+0x78a/0x15e0 kernel/workqueue.c:2605 #1: ffffc9000326fd80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work+0x7f4/0x15e0 kernel/workqueue.c:2606 #2: ffff888030fde0e0 (&type->s_umount_key#65){++++}-{3:3}, at: super_trylock_shared+0x1e/0xf0 fs/super.c:610 #3: ffff888039a1e840 (&ni->ni_lock#2){+.+.}-{3:3}, at: ni_trylock fs/ntfs3/ntfs_fs.h:1144 [inline] #3: ffff888039a1e840 (&ni->ni_lock#2){+.+.}-{3:3}, at: ni_write_inode+0x1c6/0x2850 fs/ntfs3/frecord.c:3262 #4: ffff888039a1e0e0 (&ni->ni_lock#2){+.+.}-{3:3}, at: ni_trylock fs/ntfs3/ntfs_fs.h:1144 [inline] #4: ffff888039a1e0e0 (&ni->ni_lock#2){+.+.}-{3:3}, at: ni_update_parent fs/ntfs3/frecord.c:3230 [inline] #4: ffff888039a1e0e0 (&ni->ni_lock#2){+.+.}-{3:3}, at: ni_write_inode+0x15a4/0x2850 fs/ntfs3/frecord.c:3321 stack backtrace: CPU: 1 PID: 24418 Comm: kworker/u4:0 Not tainted 6.6.0-rc7-next-20231024-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 Workqueue: writeback wb_workfn (flush-7:4) Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106 check_noncircular+0x310/0x3f0 kernel/locking/lockdep.c:2187 check_prev_add kernel/locking/lockdep.c:3134 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain kernel/locking/lockdep.c:3868 [inline] __lock_acquire+0x2e22/0x5dc0 kernel/locking/lockdep.c:5136 lock_acquire kernel/locking/lockdep.c:5753 [inline] lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718 down_read+0x9c/0x470 kernel/locking/rwsem.c:1526 indx_read+0x251/0xcd0 fs/ntfs3/index.c:1066 indx_find+0x4a9/0x980 fs/ntfs3/index.c:1181 indx_update_dup+0x166/0x440 fs/ntfs3/index.c:2659 ni_update_parent fs/ntfs3/frecord.c:3233 [inline] ni_write_inode+0x1650/0x2850 fs/ntfs3/frecord.c:3321 write_inode fs/fs-writeback.c:1473 [inline] __writeback_single_inode+0xa84/0xe60 fs/fs-writeback.c:1690 writeback_sb_inodes+0x5a2/0x1090 fs/fs-writeback.c:1916 __writeback_inodes_wb+0xff/0x2d0 fs/fs-writeback.c:1987 wb_writeback+0x7fe/0xaa0 fs/fs-writeback.c:2094 wb_check_old_data_flush fs/fs-writeback.c:2198 [inline] wb_do_writeback fs/fs-writeback.c:2251 [inline] wb_workfn+0x9f8/0xfd0 fs/fs-writeback.c:2279 process_one_work+0x8a2/0x15e0 kernel/workqueue.c:2630 process_scheduled_works kernel/workqueue.c:2703 [inline] worker_thread+0x8b6/0x1280 kernel/workqueue.c:2784 kthread+0x337/0x440 kernel/kthread.c:388 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 </TASK> --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@xxxxxxxxxxxxxxxx. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the bug is already fixed, let syzbot know by replying with: #syz fix: exact-commit-title If you want to overwrite bug's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the bug is a duplicate of another bug, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup
