mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: syzbot <syzbot+293a57918b36cfae3d48@syzkaller.appspotmail.com>
To: kartikey406@gmail.com, linux-kernel@vger.kernel.org,
	 syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [ext4?] kernel BUG in ext4_write_inline_data_end (3)
Date: Thu, 16 Jul 2026 21:39:03 -0700	[thread overview]
Message-ID: <6a59b1e7.5622734e.c905.003c.GAE@google.com> (raw)
In-Reply-To: <20260717000803.14708-1-kartikey406@gmail.com>

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in ext4_write_inline_data_end

loop0: detected capacity change from 0 to 1024
EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
============================================
WARNING: possible recursive locking detected
syzkaller #0 Not tainted
--------------------------------------------
syz.0.17/5361 is trying to acquire lock:
ffff0000ee0c30f8 (&ei->i_data_sem#2){++++}-{4:4}, at: ext4_update_i_disksize fs/ext4/ext4.h:3569 [inline]
ffff0000ee0c30f8 (&ei->i_data_sem#2){++++}-{4:4}, at: ext4_update_inode_size fs/ext4/ext4.h:3585 [inline]
ffff0000ee0c30f8 (&ei->i_data_sem#2){++++}-{4:4}, at: ext4_write_inline_data_end+0x500/0x9d8 fs/ext4/inline.c:839

but task is already holding lock:
ffff0000ee0c30f8 (&ei->i_data_sem#2){++++}-{4:4}, at: ext4_write_end+0x16c/0x9fc fs/ext4/inode.c:1453

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&ei->i_data_sem#2);
  lock(&ei->i_data_sem#2);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

4 locks held by syz.0.17/5361:
 #0: ffff0000d18615f0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x100/0x144 fs/file.c:1259
 #1: ffff0000db5fc450 (sb_writers#3){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline]
 #1: ffff0000db5fc450 (sb_writers#3){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683
 #2: ffff0000ee0c3260 (&sb->s_type->i_mutex_key#10){++++}-{4:4}, at: inode_lock include/linux/fs.h:1024 [inline]
 #2: ffff0000ee0c3260 (&sb->s_type->i_mutex_key#10){++++}-{4:4}, at: ext4_buffered_write_iter+0xa0/0x2ec fs/ext4/file.c:311
 #3: ffff0000ee0c30f8 (&ei->i_data_sem#2){++++}-{4:4}, at: ext4_write_end+0x16c/0x9fc fs/ext4/inode.c:1453

stack backtrace:
CPU: 0 UID: 0 PID: 5361 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 print_deadlock_bug+0x2e8/0x2f0 kernel/locking/lockdep.c:3041
 check_deadlock kernel/locking/lockdep.c:3093 [inline]
 validate_chain kernel/locking/lockdep.c:3895 [inline]
 __lock_acquire+0x2764/0x2ebc kernel/locking/lockdep.c:5237
 lock_acquire+0x140/0x364 kernel/locking/lockdep.c:5868
 down_write+0x50/0xc0 kernel/locking/rwsem.c:1631
 ext4_update_i_disksize fs/ext4/ext4.h:3569 [inline]
 ext4_update_inode_size fs/ext4/ext4.h:3585 [inline]
 ext4_write_inline_data_end+0x500/0x9d8 fs/ext4/inline.c:839
 ext4_write_end+0x328/0x9fc fs/ext4/inode.c:1457
 ext4_da_write_end+0x90/0xba0 fs/ext4/inode.c:3303
 generic_perform_write+0x504/0x7a4 mm/filemap.c:4379
 ext4_buffered_write_iter+0xd0/0x2ec fs/ext4/file.c:316
 ext4_file_write_iter+0x1dc/0x134c fs/ext4/file.c:-1
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x51c/0xa0c fs/read_write.c:687
 ksys_write+0x12c/0x228 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:747
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736
 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594


Tested on:

commit:         a13c140c Linux 7.2-rc3
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=13068cb9580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=ecdef466b08b9772
dashboard link: https://syzkaller.appspot.com/bug?extid=293a57918b36cfae3d48
compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64
patch:          https://syzkaller.appspot.com/x/patch.diff?x=17dfcc32580000


       reply	other threads:[~2026-07-17  4:39 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <20260717000803.14708-1-kartikey406@gmail.com>
2026-07-17  4:39 ` syzbot [this message]
     [not found] <20260718020535.46460-1-kartikey406@gmail.com>
2026-07-18  4:44 ` syzbot
     [not found] <20260717134133.38390-1-kartikey406@gmail.com>
2026-07-17 14:48 ` syzbot
     [not found] <20260717105327.37079-1-kartikey406@gmail.com>
2026-07-17 11:57 ` syzbot
     [not found] <20260717091456.36085-1-kartikey406@gmail.com>
2026-07-17 10:36 ` syzbot
2026-07-16  7:50 syzbot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=6a59b1e7.5622734e.c905.003c.GAE@google.com \
    --to=syzbot+293a57918b36cfae3d48@syzkaller.appspotmail.com \
    --cc=kartikey406@gmail.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox