[syzbot] possible deadlock in filename_create
11 views
Skip to first unread message
syzbot
Nov 9, 2022, 12:02:57 PM11/9/22
to linux-...@vger.kernel.org, reiserf...@vger.kernel.org, syzkall...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: f141df371335 Merge tag 'audit-pr-20221107' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11802789880000
kernel config: https://syzkaller.appspot.com/x/.config?x=771b06c41e08f95b
dashboard link: https://syzkaller.appspot.com/bug?extid=95cb07e3840546a4827b
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/25bd3ddd1720/disk-f141df37.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e2a12f518443/vmlinux-f141df37.xz
kernel image: https://storage.googleapis.com/syzbot-assets/09ba7134ea9d/bzImage-f141df37.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+95cb07...@syzkaller.appspotmail.com
======================================================
WARNING: possible circular locking dependency detected
6.1.0-rc4-syzkaller-00015-gf141df371335 #0 Not tainted
------------------------------------------------------
syz-executor.3/25735 is trying to acquire lock:
ffff88807a8a8090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock+0x77/0xd0 fs/reiserfs/lock.c:27
but task is already holding lock:
ffff8880361c0980 (&type->i_mutex_dir_key#19/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:791 [inline]
ffff8880361c0980 (&type->i_mutex_dir_key#19/1){+.+.}-{3:3}, at: filename_create+0x22a/0x4f0 fs/namei.c:3806
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&type->i_mutex_dir_key#19/1){+.+.}-{3:3}:
lock_acquire+0x182/0x3c0 kernel/locking/lockdep.c:5668
down_write_nested+0xa2/0x280 kernel/locking/rwsem.c:1672
inode_lock_nested include/linux/fs.h:791 [inline]
filename_create+0x22a/0x4f0 fs/namei.c:3806
do_symlinkat+0xe4/0x600 fs/namei.c:4419
__do_sys_symlinkat fs/namei.c:4446 [inline]
__se_sys_symlinkat fs/namei.c:4443 [inline]
__x64_sys_symlinkat+0x95/0xa0 fs/namei.c:4443
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
-> #1 (sb_writers#28){.+.+}-{0:0}:
lock_acquire+0x182/0x3c0 kernel/locking/lockdep.c:5668
percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
__sb_start_write include/linux/fs.h:1826 [inline]
sb_start_write+0x4d/0x1a0 include/linux/fs.h:1901
mnt_want_write_file+0x5a/0x1f0 fs/namespace.c:437
reiserfs_ioctl+0x16e/0x340 fs/reiserfs/ioctl.c:103
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl+0xfb/0x170 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
-> #0 (&sbi->lock){+.+.}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3097 [inline]
check_prevs_add kernel/locking/lockdep.c:3216 [inline]
validate_chain+0x1898/0x6ae0 kernel/locking/lockdep.c:3831
__lock_acquire+0x1292/0x1f60 kernel/locking/lockdep.c:5055
lock_acquire+0x182/0x3c0 kernel/locking/lockdep.c:5668
__mutex_lock_common+0x1bd/0x26e0 kernel/locking/mutex.c:603
__mutex_lock kernel/locking/mutex.c:747 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:799
reiserfs_write_lock+0x77/0xd0 fs/reiserfs/lock.c:27
reiserfs_lookup+0x147/0x490 fs/reiserfs/namei.c:364
__lookup_hash+0x115/0x240 fs/namei.c:1601
filename_create+0x25f/0x4f0 fs/namei.c:3807
do_symlinkat+0xe4/0x600 fs/namei.c:4419
__do_sys_symlinkat fs/namei.c:4446 [inline]
__se_sys_symlinkat fs/namei.c:4443 [inline]
__x64_sys_symlinkat+0x95/0xa0 fs/namei.c:4443
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
other info that might help us debug this:
Chain exists of:
&sbi->lock --> sb_writers#28 --> &type->i_mutex_dir_key#19/1
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&type->i_mutex_dir_key#19/1);
lock(sb_writers#28);
lock(&type->i_mutex_dir_key#19/1);
lock(&sbi->lock);
*** DEADLOCK ***
2 locks held by syz-executor.3/25735:
#0: ffff888075a1e460 (sb_writers#28){.+.+}-{0:0}, at: mnt_want_write+0x3b/0x80 fs/namespace.c:393
#1: ffff8880361c0980 (&type->i_mutex_dir_key#19/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:791 [inline]
#1: ffff8880361c0980 (&type->i_mutex_dir_key#19/1){+.+.}-{3:3}, at: filename_create+0x22a/0x4f0 fs/namei.c:3806
stack backtrace:
CPU: 0 PID: 25735 Comm: syz-executor.3 Not tainted 6.1.0-rc4-syzkaller-00015-gf141df371335 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106
check_noncircular+0x2cc/0x390 kernel/locking/lockdep.c:2177
check_prev_add kernel/locking/lockdep.c:3097 [inline]
check_prevs_add kernel/locking/lockdep.c:3216 [inline]
validate_chain+0x1898/0x6ae0 kernel/locking/lockdep.c:3831
__lock_acquire+0x1292/0x1f60 kernel/locking/lockdep.c:5055
lock_acquire+0x182/0x3c0 kernel/locking/lockdep.c:5668
__mutex_lock_common+0x1bd/0x26e0 kernel/locking/mutex.c:603
__mutex_lock kernel/locking/mutex.c:747 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:799
reiserfs_write_lock+0x77/0xd0 fs/reiserfs/lock.c:27
reiserfs_lookup+0x147/0x490 fs/reiserfs/namei.c:364
__lookup_hash+0x115/0x240 fs/namei.c:1601
filename_create+0x25f/0x4f0 fs/namei.c:3807
do_symlinkat+0xe4/0x600 fs/namei.c:4419
__do_sys_symlinkat fs/namei.c:4446 [inline]
__se_sys_symlinkat fs/namei.c:4443 [inline]
__x64_sys_symlinkat+0x95/0xa0 fs/namei.c:4443
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fb4f468b639
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb4f399c168 EFLAGS: 00000246 ORIG_RAX: 000000000000010a
RAX: ffffffffffffffda RBX: 00007fb4f47ac2c0 RCX: 00007fb4f468b639
RDX: 0000000020000980 RSI: 0000000000000007 RDI: 00000000200001c0
RBP: 00007fb4f46e67e1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc2217a09f R14: 00007fb4f399c300 R15: 0000000000022000
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following issue on:
HEAD commit: f141df371335 Merge tag 'audit-pr-20221107' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11802789880000
kernel config: https://syzkaller.appspot.com/x/.config?x=771b06c41e08f95b
dashboard link: https://syzkaller.appspot.com/bug?extid=95cb07e3840546a4827b
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/25bd3ddd1720/disk-f141df37.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e2a12f518443/vmlinux-f141df37.xz
kernel image: https://storage.googleapis.com/syzbot-assets/09ba7134ea9d/bzImage-f141df37.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+95cb07...@syzkaller.appspotmail.com
======================================================
WARNING: possible circular locking dependency detected
6.1.0-rc4-syzkaller-00015-gf141df371335 #0 Not tainted
------------------------------------------------------
syz-executor.3/25735 is trying to acquire lock:
ffff88807a8a8090 (&sbi->lock){+.+.}-{3:3}, at: reiserfs_write_lock+0x77/0xd0 fs/reiserfs/lock.c:27
but task is already holding lock:
ffff8880361c0980 (&type->i_mutex_dir_key#19/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:791 [inline]
ffff8880361c0980 (&type->i_mutex_dir_key#19/1){+.+.}-{3:3}, at: filename_create+0x22a/0x4f0 fs/namei.c:3806
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&type->i_mutex_dir_key#19/1){+.+.}-{3:3}:
lock_acquire+0x182/0x3c0 kernel/locking/lockdep.c:5668
down_write_nested+0xa2/0x280 kernel/locking/rwsem.c:1672
inode_lock_nested include/linux/fs.h:791 [inline]
filename_create+0x22a/0x4f0 fs/namei.c:3806
do_symlinkat+0xe4/0x600 fs/namei.c:4419
__do_sys_symlinkat fs/namei.c:4446 [inline]
__se_sys_symlinkat fs/namei.c:4443 [inline]
__x64_sys_symlinkat+0x95/0xa0 fs/namei.c:4443
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
-> #1 (sb_writers#28){.+.+}-{0:0}:
lock_acquire+0x182/0x3c0 kernel/locking/lockdep.c:5668
percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
__sb_start_write include/linux/fs.h:1826 [inline]
sb_start_write+0x4d/0x1a0 include/linux/fs.h:1901
mnt_want_write_file+0x5a/0x1f0 fs/namespace.c:437
reiserfs_ioctl+0x16e/0x340 fs/reiserfs/ioctl.c:103
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl+0xfb/0x170 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
-> #0 (&sbi->lock){+.+.}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3097 [inline]
check_prevs_add kernel/locking/lockdep.c:3216 [inline]
validate_chain+0x1898/0x6ae0 kernel/locking/lockdep.c:3831
__lock_acquire+0x1292/0x1f60 kernel/locking/lockdep.c:5055
lock_acquire+0x182/0x3c0 kernel/locking/lockdep.c:5668
__mutex_lock_common+0x1bd/0x26e0 kernel/locking/mutex.c:603
__mutex_lock kernel/locking/mutex.c:747 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:799
reiserfs_write_lock+0x77/0xd0 fs/reiserfs/lock.c:27
reiserfs_lookup+0x147/0x490 fs/reiserfs/namei.c:364
__lookup_hash+0x115/0x240 fs/namei.c:1601
filename_create+0x25f/0x4f0 fs/namei.c:3807
do_symlinkat+0xe4/0x600 fs/namei.c:4419
__do_sys_symlinkat fs/namei.c:4446 [inline]
__se_sys_symlinkat fs/namei.c:4443 [inline]
__x64_sys_symlinkat+0x95/0xa0 fs/namei.c:4443
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
other info that might help us debug this:
Chain exists of:
&sbi->lock --> sb_writers#28 --> &type->i_mutex_dir_key#19/1
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&type->i_mutex_dir_key#19/1);
lock(sb_writers#28);
lock(&type->i_mutex_dir_key#19/1);
lock(&sbi->lock);
*** DEADLOCK ***
2 locks held by syz-executor.3/25735:
#0: ffff888075a1e460 (sb_writers#28){.+.+}-{0:0}, at: mnt_want_write+0x3b/0x80 fs/namespace.c:393
#1: ffff8880361c0980 (&type->i_mutex_dir_key#19/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:791 [inline]
#1: ffff8880361c0980 (&type->i_mutex_dir_key#19/1){+.+.}-{3:3}, at: filename_create+0x22a/0x4f0 fs/namei.c:3806
stack backtrace:
CPU: 0 PID: 25735 Comm: syz-executor.3 Not tainted 6.1.0-rc4-syzkaller-00015-gf141df371335 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106
check_noncircular+0x2cc/0x390 kernel/locking/lockdep.c:2177
check_prev_add kernel/locking/lockdep.c:3097 [inline]
check_prevs_add kernel/locking/lockdep.c:3216 [inline]
validate_chain+0x1898/0x6ae0 kernel/locking/lockdep.c:3831
__lock_acquire+0x1292/0x1f60 kernel/locking/lockdep.c:5055
lock_acquire+0x182/0x3c0 kernel/locking/lockdep.c:5668
__mutex_lock_common+0x1bd/0x26e0 kernel/locking/mutex.c:603
__mutex_lock kernel/locking/mutex.c:747 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:799
reiserfs_write_lock+0x77/0xd0 fs/reiserfs/lock.c:27
reiserfs_lookup+0x147/0x490 fs/reiserfs/namei.c:364
__lookup_hash+0x115/0x240 fs/namei.c:1601
filename_create+0x25f/0x4f0 fs/namei.c:3807
do_symlinkat+0xe4/0x600 fs/namei.c:4419
__do_sys_symlinkat fs/namei.c:4446 [inline]
__se_sys_symlinkat fs/namei.c:4443 [inline]
__x64_sys_symlinkat+0x95/0xa0 fs/namei.c:4443
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fb4f468b639
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb4f399c168 EFLAGS: 00000246 ORIG_RAX: 000000000000010a
RAX: ffffffffffffffda RBX: 00007fb4f47ac2c0 RCX: 00007fb4f468b639
RDX: 0000000020000980 RSI: 0000000000000007 RDI: 00000000200001c0
RBP: 00007fb4f46e67e1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc2217a09f R14: 00007fb4f399c300 R15: 0000000000022000
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Oct 10, 2023, 3:38:45 PM10/10/23
to linux-...@vger.kernel.org, linux-...@vger.kernel.org, reiserf...@vger.kernel.org, syzkall...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 19af4a4ed414 Merge branch 'for-next/core', remote-tracking..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=15da0ec9680000
kernel config: https://syzkaller.appspot.com/x/.config?x=80eedef55cd21fa4
dashboard link: https://syzkaller.appspot.com/bug?extid=95cb07e3840546a4827b
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11957c65680000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1304e6ba680000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/702d996331e0/disk-19af4a4e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2a48ce0aeb32/vmlinux-19af4a4e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/332eb4a803d2/Image-19af4a4e.gz.xz
mounted in repro #1: https://storage.googleapis.com/syzbot-assets/a4536cf3a09f/mount_0.gz
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/88a36e03ffba/mount_3.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+95cb07...@syzkaller.appspotmail.com
REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage.
------------------------------------------------------
syz-executor324/6098 is trying to acquire lock:
ffff0000dd376640 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:837 [inline]
ffff0000dd376640 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: filename_create+0x204/0x468 fs/namei.c:3889
but task is already holding lock:
ffff0000d494e410 (sb_writers#8){.+.+}-{0:0}, at: mnt_want_write+0x44/0x9c fs/namespace.c:403
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (sb_writers#8){.+.+}-{0:0}:
percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
__sb_start_write include/linux/fs.h:1571 [inline]
sb_start_write+0x60/0x2ec include/linux/fs.h:1646
mnt_want_write_file+0x64/0x1e8 fs/namespace.c:447
reiserfs_ioctl+0x188/0x42c fs/reiserfs/ioctl.c:103
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl fs/ioctl.c:857 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:857
__invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155
el0_svc+0x58/0x16c arch/arm64/kernel/entry-common.c:678
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595
-> #1 (&sbi->lock){+.+.}-{3:3}:
__mutex_lock_common+0x190/0x21a0 kernel/locking/mutex.c:603
__mutex_lock kernel/locking/mutex.c:747 [inline]
mutex_lock_nested+0x2c/0x38 kernel/locking/mutex.c:799
reiserfs_write_lock+0x7c/0xe8 fs/reiserfs/lock.c:27
reiserfs_lookup+0x128/0x45c fs/reiserfs/namei.c:364
lookup_one_qstr_excl+0x108/0x230 fs/namei.c:1608
filename_create+0x230/0x468 fs/namei.c:3890
do_mkdirat+0xac/0x610 fs/namei.c:4135
__do_sys_mkdirat fs/namei.c:4158 [inline]
__se_sys_mkdirat fs/namei.c:4156 [inline]
__arm64_sys_mkdirat+0x90/0xa8 fs/namei.c:4156
__invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155
el0_svc+0x58/0x16c arch/arm64/kernel/entry-common.c:678
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595
-> #0 (
&type->i_mutex_dir_key#6/1){+.+.}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x3370/0x75e8 kernel/locking/lockdep.c:5136
lock_acquire+0x23c/0x71c kernel/locking/lockdep.c:5753
down_write_nested+0x58/0xcc kernel/locking/rwsem.c:1689
inode_lock_nested include/linux/fs.h:837 [inline]
filename_create+0x204/0x468 fs/namei.c:3889
do_mkdirat+0xac/0x610 fs/namei.c:4135
__do_sys_mkdirat fs/namei.c:4158 [inline]
__se_sys_mkdirat fs/namei.c:4156 [inline]
__arm64_sys_mkdirat+0x90/0xa8 fs/namei.c:4156
__invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155
el0_svc+0x58/0x16c arch/arm64/kernel/entry-common.c:678
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595
other info that might help us debug this:
Chain exists of:
&type->i_mutex_dir_key#6/1 --> &sbi->lock --> sb_writers#8
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
rlock(sb_writers#8);
lock(&sbi->lock);
lock(sb_writers#8);
lock(&type->i_mutex_dir_key#6/1);
*** DEADLOCK ***
1 lock held by syz-executor324/6098:
#0: ffff0000d494e410 (sb_writers#8){.+.+}-{0:0}, at: mnt_want_write+0x44/0x9c fs/namespace.c:403
stack backtrace:
CPU: 1 PID: 6098 Comm: syz-executor324 Not tainted 6.6.0-rc4-syzkaller-g19af4a4ed414 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023
Call trace:
dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:233
show_stack+0x2c/0x44 arch/arm64/kernel/stacktrace.c:240
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106
dump_stack+0x1c/0x28 lib/dump_stack.c:113
print_circular_bug+0x150/0x1b8 kernel/locking/lockdep.c:2060
check_noncircular+0x310/0x404 kernel/locking/lockdep.c:2187
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x3370/0x75e8 kernel/locking/lockdep.c:5136
lock_acquire+0x23c/0x71c kernel/locking/lockdep.c:5753
down_write_nested+0x58/0xcc kernel/locking/rwsem.c:1689
inode_lock_nested include/linux/fs.h:837 [inline]
filename_create+0x204/0x468 fs/namei.c:3889
do_mkdirat+0xac/0x610 fs/namei.c:4135
__do_sys_mkdirat fs/namei.c:4158 [inline]
__se_sys_mkdirat fs/namei.c:4156 [inline]
__arm64_sys_mkdirat+0x90/0xa8 fs/namei.c:4156
__invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155
el0_svc+0x58/0x16c arch/arm64/kernel/entry-common.c:678
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: 19af4a4ed414 Merge branch 'for-next/core', remote-tracking..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=15da0ec9680000
kernel config: https://syzkaller.appspot.com/x/.config?x=80eedef55cd21fa4
dashboard link: https://syzkaller.appspot.com/bug?extid=95cb07e3840546a4827b
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11957c65680000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1304e6ba680000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/702d996331e0/disk-19af4a4e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2a48ce0aeb32/vmlinux-19af4a4e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/332eb4a803d2/Image-19af4a4e.gz.xz
mounted in repro #1: https://storage.googleapis.com/syzbot-assets/a4536cf3a09f/mount_0.gz
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/88a36e03ffba/mount_3.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+95cb07...@syzkaller.appspotmail.com
======================================================
WARNING: possible circular locking dependency detected
6.6.0-rc4-syzkaller-g19af4a4ed414 #0 Not tainted
WARNING: possible circular locking dependency detected
------------------------------------------------------
syz-executor324/6098 is trying to acquire lock:
ffff0000dd376640 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:837 [inline]
ffff0000dd376640 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: filename_create+0x204/0x468 fs/namei.c:3889
but task is already holding lock:
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
__sb_start_write include/linux/fs.h:1571 [inline]
sb_start_write+0x60/0x2ec include/linux/fs.h:1646
mnt_want_write_file+0x64/0x1e8 fs/namespace.c:447
reiserfs_ioctl+0x188/0x42c fs/reiserfs/ioctl.c:103
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl fs/ioctl.c:857 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:857
__invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155
el0_svc+0x58/0x16c arch/arm64/kernel/entry-common.c:678
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595
-> #1 (&sbi->lock){+.+.}-{3:3}:
__mutex_lock_common+0x190/0x21a0 kernel/locking/mutex.c:603
__mutex_lock kernel/locking/mutex.c:747 [inline]
mutex_lock_nested+0x2c/0x38 kernel/locking/mutex.c:799
reiserfs_write_lock+0x7c/0xe8 fs/reiserfs/lock.c:27
reiserfs_lookup+0x128/0x45c fs/reiserfs/namei.c:364
lookup_one_qstr_excl+0x108/0x230 fs/namei.c:1608
filename_create+0x230/0x468 fs/namei.c:3890
do_mkdirat+0xac/0x610 fs/namei.c:4135
__do_sys_mkdirat fs/namei.c:4158 [inline]
__se_sys_mkdirat fs/namei.c:4156 [inline]
__arm64_sys_mkdirat+0x90/0xa8 fs/namei.c:4156
__invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155
el0_svc+0x58/0x16c arch/arm64/kernel/entry-common.c:678
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595
-> #0 (
&type->i_mutex_dir_key#6/1){+.+.}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x3370/0x75e8 kernel/locking/lockdep.c:5136
lock_acquire+0x23c/0x71c kernel/locking/lockdep.c:5753
down_write_nested+0x58/0xcc kernel/locking/rwsem.c:1689
inode_lock_nested include/linux/fs.h:837 [inline]
filename_create+0x204/0x468 fs/namei.c:3889
do_mkdirat+0xac/0x610 fs/namei.c:4135
__do_sys_mkdirat fs/namei.c:4158 [inline]
__se_sys_mkdirat fs/namei.c:4156 [inline]
__arm64_sys_mkdirat+0x90/0xa8 fs/namei.c:4156
__invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155
el0_svc+0x58/0x16c arch/arm64/kernel/entry-common.c:678
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595
other info that might help us debug this:
Chain exists of:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&sbi->lock);
lock(sb_writers#8);
lock(&type->i_mutex_dir_key#6/1);
*** DEADLOCK ***
1 lock held by syz-executor324/6098:
#0: ffff0000d494e410 (sb_writers#8){.+.+}-{0:0}, at: mnt_want_write+0x44/0x9c fs/namespace.c:403
stack backtrace:
CPU: 1 PID: 6098 Comm: syz-executor324 Not tainted 6.6.0-rc4-syzkaller-g19af4a4ed414 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023
Call trace:
dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:233
show_stack+0x2c/0x44 arch/arm64/kernel/stacktrace.c:240
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106
dump_stack+0x1c/0x28 lib/dump_stack.c:113
print_circular_bug+0x150/0x1b8 kernel/locking/lockdep.c:2060
check_noncircular+0x310/0x404 kernel/locking/lockdep.c:2187
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x3370/0x75e8 kernel/locking/lockdep.c:5136
lock_acquire+0x23c/0x71c kernel/locking/lockdep.c:5753
down_write_nested+0x58/0xcc kernel/locking/rwsem.c:1689
inode_lock_nested include/linux/fs.h:837 [inline]
filename_create+0x204/0x468 fs/namei.c:3889
do_mkdirat+0xac/0x610 fs/namei.c:4135
__do_sys_mkdirat fs/namei.c:4158 [inline]
__se_sys_mkdirat fs/namei.c:4156 [inline]
__arm64_sys_mkdirat+0x90/0xa8 fs/namei.c:4156
__invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155
el0_svc+0x58/0x16c arch/arm64/kernel/entry-common.c:678
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
Hillf Danton
Oct 11, 2023, 8:36:14 AM10/11/23
to syzbot, linux-...@vger.kernel.org, syzkall...@googlegroups.com
On Tue, 10 Oct 2023 12:38:42 -0700
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
--- x/fs/reiserfs/ioctl.c
+++ y/fs/reiserfs/ioctl.c
@@ -78,6 +78,9 @@ long reiserfs_ioctl(struct file *filp, u
struct inode *inode = file_inode(filp);
int err = 0;
+ err = mnt_want_write_file(filp);
+ if (err)
+ return err;
reiserfs_write_lock(inode->i_sb);
switch (cmd) {
@@ -100,23 +103,19 @@ long reiserfs_ioctl(struct file *filp, u
err = -EPERM;
break;
}
- err = mnt_want_write_file(filp);
- if (err)
- break;
if (get_user(inode->i_generation, (int __user *)arg)) {
err = -EFAULT;
- goto setversion_out;
+ break;
}
inode_set_ctime_current(inode);
mark_inode_dirty(inode);
-setversion_out:
- mnt_drop_write_file(filp);
break;
default:
err = -ENOTTY;
}
reiserfs_write_unlock(inode->i_sb);
+ mnt_drop_write_file(filp);
return err;
}
--
> HEAD commit: 19af4a4ed414 Merge branch 'for-next/core', remote-tracking..
> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1304e6ba680000
> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
--- x/fs/reiserfs/ioctl.c
+++ y/fs/reiserfs/ioctl.c
@@ -78,6 +78,9 @@ long reiserfs_ioctl(struct file *filp, u
struct inode *inode = file_inode(filp);
int err = 0;
+ err = mnt_want_write_file(filp);
+ if (err)
+ return err;
reiserfs_write_lock(inode->i_sb);
switch (cmd) {
@@ -100,23 +103,19 @@ long reiserfs_ioctl(struct file *filp, u
err = -EPERM;
break;
}
- err = mnt_want_write_file(filp);
- if (err)
- break;
if (get_user(inode->i_generation, (int __user *)arg)) {
err = -EFAULT;
- goto setversion_out;
+ break;
}
inode_set_ctime_current(inode);
mark_inode_dirty(inode);
-setversion_out:
- mnt_drop_write_file(filp);
break;
default:
err = -ENOTTY;
}
reiserfs_write_unlock(inode->i_sb);
+ mnt_drop_write_file(filp);
return err;
}
--
syzbot
Oct 11, 2023, 9:17:37 AM10/11/23
to hda...@sina.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+95cb07...@syzkaller.appspotmail.com
Tested on:
commit: 1c8b86a3 Merge tag 'xsa441-6.6-tag' of git://git.kerne..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=10539c65680000
kernel config: https://syzkaller.appspot.com/x/.config?x=1b8c825e0d5f3f72
Note: testing is done by a robot and is best-effort only.
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+95cb07...@syzkaller.appspotmail.com
Tested on:
commit: 1c8b86a3 Merge tag 'xsa441-6.6-tag' of git://git.kerne..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=10539c65680000
kernel config: https://syzkaller.appspot.com/x/.config?x=1b8c825e0d5f3f72
dashboard link: https://syzkaller.appspot.com/bug?extid=95cb07e3840546a4827b
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=170ed9b5680000
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
Note: testing is done by a robot and is best-effort only.
syzbot
Mar 25, 2024, 12:40:14 AMMar 25
to syzkall...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages