From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ed1-f47.google.com (mail-ed1-f47.google.com [209.85.208.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A751D2EF67A for ; Wed, 17 Jun 2026 02:41:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.47 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781664119; cv=none; b=gl0h1+C+Rus/QzIlU7kLjqJK7ucm4j7kNDpPgh172E2wFWPaPpap+1ycN1+MlL5MNT22tAtWgeDlK6+BJmK5w/zFHT9GdB5Jh0nUSlT1TdQdogckbViJiuB0k+letVm4SX+ZuWmct+kGZRKn2dz0Zzc+JwFsspb2t4JhdmV1SZI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781664119; c=relaxed/simple; bh=Lz55FVw/FiFzvvV1pJpJBW6xjuc9f4yAbDkp9gtshZo=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=t+YgxSZ16UTS1EtF4p60jFODhrBOWKWw8vLR/WU7FgWXeJj8CN9mOgJQLKIYMXZtZThT96Hllqpot70ZUh+/oqBVgW15xEniPImUMHwGhPu3rOFblRZ/2X5DghSjqnUaqa873yoWbBVP86/BAJICm9JBYv7up98gpTvDFvcFhLQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=suse.com; spf=pass smtp.mailfrom=suse.com; dkim=pass (2048-bit key) header.d=suse.com header.i=@suse.com header.b=G1Y7idRo; arc=none smtp.client-ip=209.85.208.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=suse.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=suse.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=suse.com header.i=@suse.com header.b="G1Y7idRo" Received: by mail-ed1-f47.google.com with SMTP id 4fb4d7f45d1cf-69574d247e0so7766a12.2 for ; Tue, 16 Jun 2026 19:41:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=google; t=1781664116; x=1782268916; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=vA+ON9BWXCgajXFSiirszaYnsVqaL1L7Vrh58zTSnCg=; b=G1Y7idRoLpP3tVy308+8I+AIHvg5QFzBzufQuuyMqMdUzACXll5GWKklUeC6Dabd9A //PRB5swi0n/aX13gKeqbnIzgkDbuBdwpYACKViTGOvZMUxWmZdmn5h6xsu78fkA9GMR yfHhMQcPPx4UlsEaWKe3klo5ihELDD+k4Ud7xOC4adH/tYdRFvyf/Dlzwvtb740wzCsA VfP/S9r6yd10jXIUvM1HCXEan/nHBaydKF6bWmAn8dvdPAJUDhlXMFA2voEKfzZl5NAY /Ytv5tsegg8R6G80XztikUEINmrgMEfM9GCqVOqAfNSELRv2+F/Y4eJOiJ6FEvhshcIR Esuw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781664116; x=1782268916; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=vA+ON9BWXCgajXFSiirszaYnsVqaL1L7Vrh58zTSnCg=; b=oJ6VMCrQFtlub7kfqWOpwUiYVYt3y38+CN5jjLa+i1x/gM5KIgknB/VxmU8g+JB7gI ZaiUiQws2u1nzIm8H7+In7tvj1C3Et1enWJVqwGSP94a4uUxUr2bMZdEgkG7jI+ZT/0a UabSRpVtb6qb16cRwBTpvx/G52d9pllR75gHAB9Qv+TkH758Ib/m+aXx1fRx9gHxuEWx /CRFjf364jYmkAkYmvwRMUK4mzW5vHWXtTpg9sjMiF4fTqeADDMRmJMo2Hi1UWkbq/bc f+Soq64mw1qQwkfylFd2GLLKKmJiOlSVE3B1Nw5o2+JIqEIEgFBbraUuvi4kZE83DdK3 eTTw== X-Forwarded-Encrypted: i=1; AFNElJ8BGmTsLOxi3oTd1GY5p02moxhkfBwowbnpUkMcgmsNhcEfPqznXeLKy+SQfcikrDVUNS6pRq9Yyhptvjg=@vger.kernel.org X-Gm-Message-State: AOJu0Ywezzh3quG3op3dc27T1hYfmPH0TAQBbMQzpTzllZEuiSFhTVH+ CMsIzJww1UEBGSMupK5WXr2V5li7UbFWc5Ji624xkPJkPlMncMgRn9yZP5M8ypp5Xaw= X-Gm-Gg: Acq92OHu7orxX+AVcucueC5zY1guQ7jdPD1jeqTu/xFukYD50k23X9FBMYhAce+FLha qUcZtV5EgFNhcctEHrOIb5r4dWdyh8JomtbOWUEsTznlOVSTa09VJsoHucivur5jA7knM7udMaI lwaepsE569qo2kT/ucavNTBEoQ/26izb4rRz8lD+fNmbgKobKbg92Q5ZiYahIaiEGPumf05NNSs xNwsYDUeG2e9Oh2XsajymqEzoimJX/oNmjDpX+7K6DJoDXlelYuBqhIYL14iEPkszb4TgY2yzfS cBY4sMxZ4G1/2d9VMUgR8BARfAbPKhQFgZBMhZCu34PS3uT6jDhwKW35POloRdI3sqWXy4e0EDi /tMCvAJhFG1+cXsEHXavhqLDq2LkcUza7yNGGcDYS2htV+nystfbbLMxY0PCUVxs9wI86kl2Gqa yUrrjcpI+suDs= X-Received: by 2002:a05:6402:3214:b0:68b:6b71:4114 with SMTP id 4fb4d7f45d1cf-69547443c00mr396857a12.6.1781664116104; Tue, 16 Jun 2026 19:41:56 -0700 (PDT) Received: from localhost ([202.127.77.110]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-8434accac96sm15635254b3a.14.2026.06.16.19.41.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 16 Jun 2026 19:41:55 -0700 (PDT) Date: Wed, 17 Jun 2026 10:41:52 +0800 From: Heming Zhao To: Joseph Qi Cc: syzbot , Aleksandr Nogikh , syzkaller-bugs@googlegroups.com, Joel Becker , Mark Fasheh , ocfs2-devel@lists.linux.dev, linux-kernel@vger.kernel.org, syzbot@lists.linux.dev Subject: Re: [PATCH] ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write Message-ID: References: <97c902a6-3bcf-43ea-9b70-f1f136a6c3f2@mail.kernel.org> <6f95cc40-3014-4628-9739-28f47bec825b@linux.alibaba.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <6f95cc40-3014-4628-9739-28f47bec825b@linux.alibaba.com> On Tue, Jun 16, 2026 at 02:00:40PM +0800, Joseph Qi wrote: > > > On 6/15/26 3:32 PM, Heming Zhao wrote: > > On Fri, Jun 12, 2026 at 11:50:20AM +0000, syzbot wrote: > >> From: Aleksandr Nogikh > >> > >> A circular locking dependency involves INODE_ALLOC_SYSTEM_INODE, > >> EXTENT_ALLOC_SYSTEM_INODE, and ORPHAN_DIR_SYSTEM_INODE. > >> > >> 1. ocfs2_mknod() acquires INODE_ALLOC then EXTENT_ALLOC. > >> 2. ocfs2_dio_end_io_write() acquires EXTENT_ALLOC for unwritten extents, > >> then ORPHAN_DIR via ocfs2_del_inode_from_orphan() while still holding > >> EXTENT_ALLOC. > >> 3. ocfs2_wipe_inode() acquires ORPHAN_DIR then INODE_ALLOC via > >> ocfs2_remove_inode. > >> > >> Break the cycle in ocfs2_dio_end_io_write() by freeing the allocation > >> contexts (releasing EXTENT_ALLOC) before acquiring ORPHAN_DIR. > >> > >> WARNING: possible circular locking dependency detected > >> ------------------------------------------------------ > >> is trying to acquire lock: > >> ffff8881e78b33a0 > >> (&ocfs2_sysfile_lock_key[INODE_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}, at: > >> ocfs2_evict_inode+0x1539/0x43b0 fs/ocfs2/inode.c:1299 > >> > >> but task is already holding lock: > >> ffff8881e78b4fa0 > >> (&ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE]){+.+.}-{4:4}, at: > >> ocfs2_evict_inode+0xe97/0x43b0 fs/ocfs2/inode.c:1299 > >> > >> the existing dependency chain (in reverse order) is: > >> > >> -> #2 (&ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE]){+.+.}-{4:4}: > >> inode_lock include/linux/fs.h:1029 [inline] > >> ocfs2_del_inode_from_orphan+0x12e/0x7a0 fs/ocfs2/namei.c:2728 > >> ocfs2_dio_end_io+0xf9c/0x1370 fs/ocfs2/aops.c:2418 > >> dio_complete+0x25b/0x790 fs/direct-io.c:281 > >> > >> -> #1 (&ocfs2_sysfile_lock_key[EXTENT_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}: > >> inode_lock include/linux/fs.h:1029 [inline] > >> ocfs2_reserve_suballoc_bits+0x16d/0x4840 fs/ocfs2/suballoc.c:882 > >> ocfs2_reserve_new_metadata_blocks+0x415/0x9a0 > >> fs/ocfs2/suballoc.c:1078 > >> ocfs2_mknod+0x10f3/0x2260 fs/ocfs2/namei.c:351 > >> > >> -> #0 (&ocfs2_sysfile_lock_key[INODE_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}: > >> __lock_acquire+0x15a5/0x2cf0 kernel/locking/lockdep.c:5237 > >> lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868 > >> down_write+0x96/0x200 kernel/locking/rwsem.c:1625 > >> inode_lock include/linux/fs.h:1029 [inline] > >> ocfs2_remove_inode fs/ocfs2/inode.c:733 [inline] > >> ocfs2_wipe_inode fs/ocfs2/inode.c:896 [inline] > >> ocfs2_delete_inode fs/ocfs2/inode.c:1157 [inline] > >> ocfs2_evict_inode+0x1539/0x43b0 fs/ocfs2/inode.c:1299 > >> > >> Chain exists of: > >> &ocfs2_sysfile_lock_key[INODE_ALLOC_SYSTEM_INODE] --> > >> &ocfs2_sysfile_lock_key[EXTENT_ALLOC_SYSTEM_INODE] --> > >> &ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE] > >> > >> Possible unsafe locking scenario: > >> > >> CPU0 CPU1 > >> ---- ---- > >> lock(&ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE]); > >> lock(&ocfs2_sysfile_lock_key[EXTENT_ALLOC_SYSTEM_INODE]); > >> lock(&ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE]); > >> lock(&ocfs2_sysfile_lock_key[INODE_ALLOC_SYSTEM_INODE]); > >> > >> *** DEADLOCK *** > >> > > Better to describe the solution here. > > >> Fixes: d647c5b2fbf8 ("ocfs2: split transactions in dio completion to avoid credit exhaustion") > >> Assisted-by: Gemini:gemini-3.1-pro-preview Gemini:gemini-3-flash-preview syzbot > >> Reported-by: syzbot+b225d4dfce6219600c42@syzkaller.appspotmail.com > >> Closes: https://syzkaller.appspot.com/bug?extid=b225d4dfce6219600c42 > >> Link: https://syzkaller.appspot.com/ai_job?id=0b53ce1e-2972-4192-aa85-8097a702762c > >> Signed-off-by: Aleksandr Nogikh > > > > LGTM. > > After d647c5b2fbf8, ocfs2_dio_end_io_write() spends a significant amount of time > > looping through the unwritten extent list before it finally acquires the > > ORPHAN_DIR lock. This gives other functions (such as ocfs2_wipe_inode() mentioned > > in this patch) a chance to preemptively grab the ORPHAN_DIR lock, thereby > > triggering the circular locking. > > What d647c5b2fbf8 actually did was widen the race window, turning a pre-existing, > > low-probability issue into an easily reproducible one. > > > > Ummm... before d647c5b2fbf8, ocfs2_del_inode_from_orphan() is called > before down_write(&ip_alloc_sem) and ocfs2_lock_allocators(). > So I think the 'Fixes' tag looks reasonable. > > Thanks, > Joseph Thanks for the info, your got the key. - Heming > > > Reviewed-by: Heming Zhao > >> > >> --- > >> diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c > >> index 6ec198bda..4acdbb708 100644 > >> --- a/fs/ocfs2/aops.c > >> +++ b/fs/ocfs2/aops.c > >> @@ -2372,6 +2372,15 @@ static int ocfs2_dio_end_io_write(struct inode *inode, > >> unlock: > >> up_write(&oi->ip_alloc_sem); > >> > >> + if (data_ac) { > >> + ocfs2_free_alloc_context(data_ac); > >> + data_ac = NULL; > >> + } > >> + if (meta_ac) { > >> + ocfs2_free_alloc_context(meta_ac); > >> + meta_ac = NULL; > >> + } > >> + > >> /* everything looks good, let's start the cleanup */ > >> if (!ret && dwc->dw_orphaned) { > >> BUG_ON(dwc->dw_writer_pid != task_pid_nr(current)); > >> @@ -2383,10 +2392,6 @@ static int ocfs2_dio_end_io_write(struct inode *inode, > >> ocfs2_inode_unlock(inode, 1); > >> brelse(di_bh); > >> out: > >> - if (data_ac) > >> - ocfs2_free_alloc_context(data_ac); > >> - if (meta_ac) > >> - ocfs2_free_alloc_context(meta_ac); > >> ocfs2_run_deallocs(osb, &dealloc); > >> ocfs2_dio_free_write_ctx(inode, dwc); > >> > >> > >> > >> base-commit: e7ae89a0c97ce2b68b0983cd01eda67cf373517d > >> -- > >> See https://goo.gle/syzbot-ai-patches for information about AI-generated patches. > >> You can comment on the patch as usual, syzbot will try to address > >> the comments and send a new version of the patch if necessary. > >> syzbot engineers can be reached at syzkaller@googlegroups.com. > >> >