[v5.15] possible deadlock in ocfs2_get_system_file_inode

Hello,

syzbot found the following issue on:

HEAD commit: 3a5928702e71 Linux 5.15.167
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=17a3d49f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=171882977b524c53
dashboard link: https://syzkaller.appspot.com/bug?extid=a68be11c78ba8af226e5
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/22ee27cb312d/disk-3a592870.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/90bf6a3e3d20/vmlinux-3a592870.xz
kernel image: https://storage.googleapis.com/syzbot-assets/096dd2c73ac3/Image-3a592870.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]

ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode.
======================================================
WARNING: possible circular locking dependency detected
5.15.167-syzkaller #0 Not tainted
------------------------------------------------------
syz.0.73/4479 is trying to acquire lock:
ffff0000d3c29488 (&osb->system_file_mutex){+.+.}-{3:3}, at: ocfs2_get_system_file_inode+0x180/0x6b8 fs/ocfs2/sysfile.c:101

but task is already holding lock:
ffff0000e6110660 (&ocfs2_file_ip_alloc_sem_key){++++}-{3:3}, at: ocfs2_write_begin+0x178/0x38c fs/ocfs2/aops.c:1904

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (&ocfs2_file_ip_alloc_sem_key){++++}-{3:3}:
down_read+0xc0/0x398 kernel/locking/rwsem.c:1498
ocfs2_read_virt_blocks+0x298/0x960 fs/ocfs2/extent_map.c:976
ocfs2_read_dir_block fs/ocfs2/dir.c:508 [inline]
ocfs2_find_entry_el fs/ocfs2/dir.c:715 [inline]
ocfs2_find_entry+0x3ac/0x2450 fs/ocfs2/dir.c:1080
ocfs2_find_files_on_disk+0x10c/0x3d0 fs/ocfs2/dir.c:1982
ocfs2_lookup_ino_from_name+0xb8/0x1d4 fs/ocfs2/dir.c:2004
_ocfs2_get_system_file_inode fs/ocfs2/sysfile.c:136 [inline]
ocfs2_get_system_file_inode+0x2c8/0x6b8 fs/ocfs2/sysfile.c:112
ocfs2_init_global_system_inodes+0x2bc/0x618 fs/ocfs2/super.c:458
ocfs2_initialize_super fs/ocfs2/super.c:2276 [inline]
ocfs2_fill_super+0x394c/0x498c fs/ocfs2/super.c:995
mount_bdev+0x274/0x370 fs/super.c:1398
ocfs2_mount+0x44/0x58 fs/ocfs2/super.c:1187
legacy_get_tree+0xd4/0x16c fs/fs_context.c:611
vfs_get_tree+0x90/0x274 fs/super.c:1528
do_new_mount+0x278/0x8fc fs/namespace.c:3005
path_mount+0x594/0x101c fs/namespace.c:3335
do_mount fs/namespace.c:3348 [inline]
__do_sys_mount fs/namespace.c:3556 [inline]
__se_sys_mount fs/namespace.c:3533 [inline]
__arm64_sys_mount+0x510/0x5e0 fs/namespace.c:3533
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

-> #0 (&osb->system_file_mutex){+.+.}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain kernel/locking/lockdep.c:3788 [inline]
__lock_acquire+0x32d4/0x7638 kernel/locking/lockdep.c:5012
lock_acquire+0x240/0x77c kernel/locking/lockdep.c:5623
__mutex_lock_common+0x194/0x2154 kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0xa4/0xf8 kernel/locking/mutex.c:743
ocfs2_get_system_file_inode+0x180/0x6b8 fs/ocfs2/sysfile.c:101
ocfs2_reserve_local_alloc_bits+0xe4/0x2474 fs/ocfs2/localalloc.c:626
ocfs2_reserve_clusters_with_limit+0x194/0xabc fs/ocfs2/suballoc.c:1162
ocfs2_reserve_clusters fs/ocfs2/suballoc.c:1223 [inline]
ocfs2_lock_allocators+0x294/0x584 fs/ocfs2/suballoc.c:2669
ocfs2_write_begin_nolock+0x2274/0x3e1c fs/ocfs2/aops.c:1742
ocfs2_write_begin+0x1ac/0x38c fs/ocfs2/aops.c:1906
generic_perform_write+0x24c/0x520 mm/filemap.c:3785
__generic_file_write_iter+0x230/0x454 mm/filemap.c:3912
ocfs2_file_write_iter+0x1478/0x1e00 fs/ocfs2/file.c:2459
do_iter_readv_writev+0x420/0x5f8
do_iter_write+0x1b8/0x66c fs/read_write.c:855
vfs_writev fs/read_write.c:928 [inline]
do_pwritev+0x1ec/0x334 fs/read_write.c:1025
__do_sys_pwritev2 fs/read_write.c:1084 [inline]
__se_sys_pwritev2 fs/read_write.c:1075 [inline]
__arm64_sys_pwritev2+0xd4/0x108 fs/read_write.c:1075
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

other info that might help us debug this:

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&ocfs2_file_ip_alloc_sem_key);
lock(&osb->system_file_mutex);
lock(&ocfs2_file_ip_alloc_sem_key);
lock(&osb->system_file_mutex);

*** DEADLOCK ***

3 locks held by syz.0.73/4479:
#0: ffff0000ca1ca460 (sb_writers#16){.+.+}-{0:0}, at: vfs_writev fs/read_write.c:927 [inline]
#0: ffff0000ca1ca460 (sb_writers#16){.+.+}-{0:0}, at: do_pwritev+0x1d8/0x334 fs/read_write.c:1025
#1: ffff0000e61109c8 (&sb->s_type->i_mutex_key#27){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:789 [inline]
#1: ffff0000e61109c8 (&sb->s_type->i_mutex_key#27){+.+.}-{3:3}, at: ocfs2_file_write_iter+0x38c/0x1e00 fs/ocfs2/file.c:2391
#2: ffff0000e6110660 (&ocfs2_file_ip_alloc_sem_key){++++}-{3:3}, at: ocfs2_write_begin+0x178/0x38c fs/ocfs2/aops.c:1904

stack backtrace:
CPU: 1 PID: 4479 Comm: syz.0.73 Not tainted 5.15.167-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
print_circular_bug+0x150/0x1b8 kernel/locking/lockdep.c:2011
check_noncircular+0x2cc/0x378 kernel/locking/lockdep.c:2133
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain kernel/locking/lockdep.c:3788 [inline]
__lock_acquire+0x32d4/0x7638 kernel/locking/lockdep.c:5012
lock_acquire+0x240/0x77c kernel/locking/lockdep.c:5623
__mutex_lock_common+0x194/0x2154 kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0xa4/0xf8 kernel/locking/mutex.c:743
ocfs2_get_system_file_inode+0x180/0x6b8 fs/ocfs2/sysfile.c:101
ocfs2_reserve_local_alloc_bits+0xe4/0x2474 fs/ocfs2/localalloc.c:626
ocfs2_reserve_clusters_with_limit+0x194/0xabc fs/ocfs2/suballoc.c:1162
ocfs2_reserve_clusters fs/ocfs2/suballoc.c:1223 [inline]
ocfs2_lock_allocators+0x294/0x584 fs/ocfs2/suballoc.c:2669
ocfs2_write_begin_nolock+0x2274/0x3e1c fs/ocfs2/aops.c:1742
ocfs2_write_begin+0x1ac/0x38c fs/ocfs2/aops.c:1906
generic_perform_write+0x24c/0x520 mm/filemap.c:3785
__generic_file_write_iter+0x230/0x454 mm/filemap.c:3912
ocfs2_file_write_iter+0x1478/0x1e00 fs/ocfs2/file.c:2459
do_iter_readv_writev+0x420/0x5f8
do_iter_write+0x1b8/0x66c fs/read_write.c:855
vfs_writev fs/read_write.c:928 [inline]
do_pwritev+0x1ec/0x334 fs/read_write.c:1025
__do_sys_pwritev2 fs/read_write.c:1084 [inline]
__se_sys_pwritev2 fs/read_write.c:1075 [inline]
__arm64_sys_pwritev2+0xd4/0x108 fs/read_write.c:1075
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at [email protected].

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

syzbot has found a reproducer for the following issue on:
console output: https://syzkaller.appspot.com/x/log.txt?x=118ae797980000
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1677aa8b980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=130d5d67980000
mounted in repro: https://storage.googleapis.com/syzbot-assets/4b107b65ba8e/mount_0.gz
loop0: detected capacity change from 0 to 32768
syz-executor112/4190 is trying to acquire lock:
ffff0000daee1488 (&osb->system_file_mutex){+.+.}-{3:3}, at: ocfs2_get_system_file_inode+0x180/0x6b8 fs/ocfs2/sysfile.c:101
ffff0000e20e5be0 (&ocfs2_file_ip_alloc_sem_key){++++}-{3:3}, at: ocfs2_write_begin+0x178/0x38c fs/ocfs2/aops.c:1904
3 locks held by syz-executor112/4190:
#0: ffff0000dc618460 (sb_writers#8){.+.+}-{0:0}, at: vfs_writev fs/read_write.c:927 [inline]
#0: ffff0000dc618460 (sb_writers#8){.+.+}-{0:0}, at: do_pwritev+0x1d8/0x334 fs/read_write.c:1025
#1: ffff0000e20e5f48 (&sb->s_type->i_mutex_key#17){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:789 [inline]
#1: ffff0000e20e5f48 (&sb->s_type->i_mutex_key#17){+.+.}-{3:3}, at: ocfs2_file_write_iter+0x38c/0x1e00 fs/ocfs2/file.c:2391
#2: ffff0000e20e5be0 (&ocfs2_file_ip_alloc_sem_key){++++}-{3:3}, at: ocfs2_write_begin+0x178/0x38c fs/ocfs2/aops.c:1904

stack backtrace:
CPU: 0 PID: 4190 Comm: syz-executor112 Not tainted 5.15.167-syzkaller #0
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

Hello,

syzbot found the following issue on:

HEAD commit: 5f55cad62cc9 Linux 6.1.110
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11ac349f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=625d3d5479b9ea13
dashboard link: https://syzkaller.appspot.com/bug?extid=11e1655d99d0461f26de
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/406d4fabf0c5/disk-5f55cad6.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/abc54e64f4c6/vmlinux-5f55cad6.xz
kernel image: https://storage.googleapis.com/syzbot-assets/5d3b04a9f829/Image-5f55cad6.gz.xz
Reported-by: [email protected]
6.1.110-syzkaller #0 Not tainted
------------------------------------------------------
syz.0.271/5711 is trying to acquire lock:
ffff0000e212d488 (&osb->system_file_mutex){+.+.}-{3:3}, at: ocfs2_get_system_file_inode+0x180/0x6b8 fs/ocfs2/sysfile.c:101
ffff0000f9893f60 (&ocfs2_file_ip_alloc_sem_key){++++}-{3:3}, at: ocfs2_write_begin+0x178/0x38c fs/ocfs2/aops.c:1903
down_read+0x64/0x308 kernel/locking/rwsem.c:1520
ocfs2_read_virt_blocks+0x2bc/0x9f8 fs/ocfs2/extent_map.c:976
ocfs2_find_entry+0x3ac/0x2620 fs/ocfs2/dir.c:1080
ocfs2_find_files_on_disk+0x130/0x468 fs/ocfs2/dir.c:1982
ocfs2_init_global_system_inodes+0x2bc/0x618 fs/ocfs2/super.c:457
ocfs2_initialize_super fs/ocfs2/super.c:2250 [inline]
ocfs2_fill_super+0x278c/0x4a0c fs/ocfs2/super.c:994
mount_bdev+0x274/0x370 fs/super.c:1443
ocfs2_mount+0x44/0x58 fs/ocfs2/super.c:1186
legacy_get_tree+0xd4/0x16c fs/fs_context.c:632
vfs_get_tree+0x90/0x274 fs/super.c:1573
do_new_mount+0x278/0x8fc fs/namespace.c:3051
path_mount+0x590/0xe5c fs/namespace.c:3381
do_mount fs/namespace.c:3394 [inline]
__do_sys_mount fs/namespace.c:3602 [inline]
__se_sys_mount fs/namespace.c:3579 [inline]
__arm64_sys_mount+0x45c/0x594 fs/namespace.c:3579
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
check_prev_add kernel/locking/lockdep.c:3090 [inline]
check_prevs_add kernel/locking/lockdep.c:3209 [inline]
validate_chain kernel/locking/lockdep.c:3825 [inline]
__lock_acquire+0x3338/0x7680 kernel/locking/lockdep.c:5049
lock_acquire+0x26c/0x7cc kernel/locking/lockdep.c:5662
__mutex_lock_common+0x190/0x21a0 kernel/locking/mutex.c:603
__mutex_lock kernel/locking/mutex.c:747 [inline]
mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799
ocfs2_get_system_file_inode+0x180/0x6b8 fs/ocfs2/sysfile.c:101
ocfs2_reserve_local_alloc_bits+0xe4/0x25dc fs/ocfs2/localalloc.c:626
ocfs2_write_begin_nolock+0x22fc/0x3f6c fs/ocfs2/aops.c:1741
ocfs2_write_begin+0x1ac/0x38c fs/ocfs2/aops.c:1905
generic_perform_write+0x278/0x55c mm/filemap.c:3817
__generic_file_write_iter+0x168/0x388 mm/filemap.c:3945
ocfs2_file_write_iter+0x15ac/0x1fbc fs/ocfs2/file.c:2456
do_iter_write+0x534/0x964 fs/read_write.c:861
vfs_writev fs/read_write.c:934 [inline]
do_pwritev+0x1ec/0x334 fs/read_write.c:1031
__do_sys_pwritev2 fs/read_write.c:1090 [inline]
__se_sys_pwritev2 fs/read_write.c:1081 [inline]
__arm64_sys_pwritev2+0xd4/0x108 fs/read_write.c:1081
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
3 locks held by syz.0.271/5711:
#0:
ffff0000c4286460 (sb_writers#16){.+.+}-{0:0}, at: vfs_writev fs/read_write.c:933 [inline]
ffff0000c4286460 (sb_writers#16){.+.+}-{0:0}, at: do_pwritev+0x1d8/0x334 fs/read_write.c:1031
#1: ffff0000f98942c8 (&sb->s_type->i_mutex_key#32){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline]
#1: ffff0000f98942c8 (&sb->s_type->i_mutex_key#32){+.+.}-{3:3}, at: ocfs2_file_write_iter+0x3b4/0x1fbc fs/ocfs2/file.c:2388
#2: ffff0000f9893f60 (&ocfs2_file_ip_alloc_sem_key){++++}-{3:3}, at: ocfs2_write_begin+0x178/0x38c fs/ocfs2/aops.c:1903

stack backtrace:
CPU: 1 PID: 5711 Comm: syz.0.271 Not tainted 6.1.110-syzkaller #0
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
print_circular_bug+0x150/0x1b8 kernel/locking/lockdep.c:2048
check_noncircular+0x2cc/0x378 kernel/locking/lockdep.c:2170
check_prev_add kernel/locking/lockdep.c:3090 [inline]
check_prevs_add kernel/locking/lockdep.c:3209 [inline]
validate_chain kernel/locking/lockdep.c:3825 [inline]
__lock_acquire+0x3338/0x7680 kernel/locking/lockdep.c:5049
lock_acquire+0x26c/0x7cc kernel/locking/lockdep.c:5662
__mutex_lock_common+0x190/0x21a0 kernel/locking/mutex.c:603
__mutex_lock kernel/locking/mutex.c:747 [inline]
mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799
ocfs2_get_system_file_inode+0x180/0x6b8 fs/ocfs2/sysfile.c:101
ocfs2_reserve_local_alloc_bits+0xe4/0x25dc fs/ocfs2/localalloc.c:626
ocfs2_write_begin_nolock+0x22fc/0x3f6c fs/ocfs2/aops.c:1741
ocfs2_write_begin+0x1ac/0x38c fs/ocfs2/aops.c:1905
generic_perform_write+0x278/0x55c mm/filemap.c:3817
__generic_file_write_iter+0x168/0x388 mm/filemap.c:3945
ocfs2_file_write_iter+0x15ac/0x1fbc fs/ocfs2/file.c:2456
do_iter_write+0x534/0x964 fs/read_write.c:861
vfs_writev fs/read_write.c:934 [inline]
do_pwritev+0x1ec/0x334 fs/read_write.c:1031
__do_sys_pwritev2 fs/read_write.c:1090 [inline]
__se_sys_pwritev2 fs/read_write.c:1081 [inline]
__arm64_sys_pwritev2+0xd4/0x108 fs/read_write.c:1081
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

syzbot has found a reproducer for the following issue on:

HEAD commit: 7ec6f9fa3d97 Linux 6.1.114
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14902287980000
kernel config: https://syzkaller.appspot.com/x/.config?x=b307f63ce6b5abc8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=108848a7980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=149e265f980000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c0647034d885/disk-7ec6f9fa.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/aba7028b0104/vmlinux-7ec6f9fa.xz
kernel image: https://storage.googleapis.com/syzbot-assets/7df6b29aa1f4/Image-7ec6f9fa.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/38c8a8b0f70c/mount_0.gz
JBD2: Ignoring recovery information on journal
6.1.114-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor283/4445 is trying to acquire lock:
ffff0000d889d488 (&osb->system_file_mutex){+.+.}-{3:3}, at: ocfs2_get_system_file_inode+0x180/0x6b8 fs/ocfs2/sysfile.c:101
ffff0000e4c13120 (&ocfs2_file_ip_alloc_sem_key){++++}-{3:3}, at: ocfs2_write_begin+0x178/0x38c fs/ocfs2/aops.c:1902
do_new_mount+0x278/0x8fc fs/namespace.c:3056
path_mount+0x590/0xe5c fs/namespace.c:3386
do_mount fs/namespace.c:3399 [inline]
__do_sys_mount fs/namespace.c:3607 [inline]
__se_sys_mount fs/namespace.c:3584 [inline]
__arm64_sys_mount+0x45c/0x594 fs/namespace.c:3584
ocfs2_write_begin_nolock+0x22fc/0x3f6c fs/ocfs2/aops.c:1740
ocfs2_write_begin+0x1ac/0x38c fs/ocfs2/aops.c:1904
generic_perform_write+0x278/0x55c mm/filemap.c:3845
__generic_file_write_iter+0x168/0x388 mm/filemap.c:3973
3 locks held by syz-executor283/4445:
#0: ffff0000dc2fa460 (sb_writers#8){.+.+}-{0:0}, at: vfs_writev fs/read_write.c:933 [inline]
#0: ffff0000dc2fa460 (sb_writers#8){.+.+}-{0:0}, at: do_pwritev+0x1d8/0x334 fs/read_write.c:1031
#1: ffff0000e4c13488 (&sb->s_type->i_mutex_key#17){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline]
#1: ffff0000e4c13488 (&sb->s_type->i_mutex_key#17){+.+.}-{3:3}, at: ocfs2_file_write_iter+0x3b4/0x1fbc fs/ocfs2/file.c:2388
#2: ffff0000e4c13120 (&ocfs2_file_ip_alloc_sem_key){++++}-{3:3}, at: ocfs2_write_begin+0x178/0x38c fs/ocfs2/aops.c:1902

stack backtrace:
CPU: 0 PID: 4445 Comm: syz-executor283 Not tainted 6.1.114-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
ocfs2_write_begin_nolock+0x22fc/0x3f6c fs/ocfs2/aops.c:1740
ocfs2_write_begin+0x1ac/0x38c fs/ocfs2/aops.c:1904
generic_perform_write+0x278/0x55c mm/filemap.c:3845
__generic_file_write_iter+0x168/0x388 mm/filemap.c:3973

syzbot suspects this issue could be fixed by backporting the following commit:

commit 7bf1823e010e8db2fb649c790bd1b449a75f52d8
git tree: upstream
Author: Mohammed Anees <[email protected]>
Date: Tue Sep 24 09:32:57 2024 +0000

ocfs2: fix deadlock in ocfs2_get_system_file_inode

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=179c255f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=c3430b5172170129
dashboard link: https://syzkaller.appspot.com/bug?extid=11e1655d99d0461f26de
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12acaca7980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15617e5f980000


Please keep in mind that other backports might be required as well.

For information about bisection process see: https://goo.gl/tpsmEJ#bisection