[syzbot] [vfs?] [ntfs3?] WARNING in do_symlinkat

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 77856d911a8c Merge tag 'arm64-fixes' of git://git.kernel.o..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10600abf880000
kernel config: https://syzkaller.appspot.com/x/.config?x=f967143badd2fa39
dashboard link: https://syzkaller.appspot.com/bug?extid=e78eab0c1cf4649256ed
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16bddf1f880000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/4b424d9203f5/disk-77856d91.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/47fd68051834/vmlinux-77856d91.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d3091f087a86/bzImage-77856d91.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/93766764f567/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e78eab...@syzkaller.appspotmail.com

DEBUG_RWSEMS_WARN_ON((rwsem_owner(sem) != current) && !rwsem_test_oflags(sem, RWSEM_NONSPINNABLE)): count = 0x0, magic = 0xffff88806d8a8a90, owner = 0x0, curr 0xffff888075533a80, list empty
WARNING: CPU: 1 PID: 5295 at kernel/locking/rwsem.c:1361 __up_write kernel/locking/rwsem.c:1360 [inline]
WARNING: CPU: 1 PID: 5295 at kernel/locking/rwsem.c:1361 up_write+0x4f9/0x580 kernel/locking/rwsem.c:1615
Modules linked in:
CPU: 1 PID: 5295 Comm: syz-executor.1 Not tainted 6.1.0-syzkaller-13031-g77856d911a8c #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
RIP: 0010:__up_write kernel/locking/rwsem.c:1360 [inline]
RIP: 0010:up_write+0x4f9/0x580 kernel/locking/rwsem.c:1615
Code: c7 00 ac ed 8a 48 c7 c6 a0 ae ed 8a 48 8b 54 24 28 48 8b 4c 24 18 4d 89 e0 4c 8b 4c 24 30 31 c0 53 e8 9b 59 e8 ff 48 83 c4 08 <0f> 0b e9 6b fd ff ff 48 c7 c1 d8 83 96 8e 80 e1 07 80 c1 03 38 c1
RSP: 0018:ffffc9000496fd40 EFLAGS: 00010292
RAX: 161bb8d4b7118f00 RBX: ffffffff8aedace0 RCX: ffff888075533a80
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: ffffc9000496fe10 R08: ffffffff816f29ad R09: fffff5200092df61
R10: fffff5200092df61 R11: 1ffff9200092df60 R12: 0000000000000000
R13: ffff88806d8a8a90 R14: 1ffff9200092dfb0 R15: dffffc0000000000
FS: 00007ff7ee349700(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020023000 CR3: 000000007cc18000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
inode_unlock include/linux/fs.h:761 [inline]
done_path_create fs/namei.c:3857 [inline]
do_symlinkat+0x242/0x5f0 fs/namei.c:4433
__do_sys_symlinkat fs/namei.c:4447 [inline]
__se_sys_symlinkat fs/namei.c:4444 [inline]
__x64_sys_symlinkat+0x95/0xa0 fs/namei.c:4444
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7ff7ed68c0d9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ff7ee349168 EFLAGS: 00000246 ORIG_RAX: 000000000000010a
RAX: ffffffffffffffda RBX: 00007ff7ed7ac050 RCX: 00007ff7ed68c0d9
RDX: 0000000020000280 RSI: ffffffffffffff9c RDI: 00000000200004c0
RBP: 00007ff7ed6e7ae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffe963e7f2f R14: 00007ff7ee349300 R15: 0000000000022000
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 1b929c02afd3 Linux 6.2-rc1
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=11625c6c480000
kernel config: https://syzkaller.appspot.com/x/.config?x=68e0be42c8ee4bb4

dashboard link: https://syzkaller.appspot.com/bug?extid=e78eab0c1cf4649256ed
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11621288480000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=148ad5a8480000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2d8c5072480f/disk-1b929c02.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/46687f1395db/vmlinux-1b929c02.xz
kernel image: https://storage.googleapis.com/syzbot-assets/26f1afa5ec00/bzImage-1b929c02.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/6ad275e8bd72/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e78eab...@syzkaller.appspotmail.com

WARNING: CPU: 1 PID: 6646 at kernel/locking/rwsem.c:1361 __up_write kernel/locking/rwsem.c:1360 [inline]
WARNING: CPU: 1 PID: 6646 at kernel/locking/rwsem.c:1361 up_write+0x4f9/0x580 kernel/locking/rwsem.c:1615
Modules linked in:
CPU: 1 PID: 6646 Comm: syz-executor272 Not tainted 6.2.0-rc1-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
RIP: 0010:__up_write kernel/locking/rwsem.c:1360 [inline]
RIP: 0010:up_write+0x4f9/0x580 kernel/locking/rwsem.c:1615

Code: c7 e0 ab ed 8a 48 c7 c6 80 ae ed 8a 48 8b 54 24 28 48 8b 4c 24 18 4d 89 e0 4c 8b 4c 24 30 31 c0 53 e8 9b 59 e8 ff 48 83 c4 08 <0f> 0b e9 6b fd ff ff 48 c7 c1 18 9c 96 8e 80 e1 07 80 c1 03 38 c1
RSP: 0018:ffffc9000b807d40 EFLAGS: 00010292
RAX: 298a0fb209e0d400 RBX: ffffffff8aedacc0 RCX: ffff88801965d7c0

RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000

RBP: ffffc9000b807e10 R08: ffffffff816f2c9d R09: fffff52001700f61
R10: fffff52001700f61 R11: 1ffff92001700f60 R12: 0000000000000000
R13: ffff88806f2036d0 R14: 1ffff92001700fb0 R15: dffffc0000000000
FS: 00007f7a51ed8700(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007fff0eaf7c5c CR3: 000000007721d000 CR4: 00000000003506e0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
inode_unlock include/linux/fs.h:761 [inline]
done_path_create fs/namei.c:3857 [inline]
do_symlinkat+0x242/0x5f0 fs/namei.c:4433
__do_sys_symlinkat fs/namei.c:4447 [inline]
__se_sys_symlinkat fs/namei.c:4444 [inline]
__x64_sys_symlinkat+0x95/0xa0 fs/namei.c:4444
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

RIP: 0033:0x7f7a5a151049
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7a51ed82f8 EFLAGS: 00000246 ORIG_RAX: 000000000000010a
RAX: ffffffffffffffda RBX: 00007f7a5a1f5790 RCX: 00007f7a5a151049
RDX: 0000000020000280 RSI: 00000000ffffff9c RDI: 00000000200004c0
RBP: 00007f7a5a1c1fb8 R08: 00007f7a51ed8700 R09: 0000000000000000
R10: 00007f7a51ed8700 R11: 0000000000000246 R12: 00007f7a5a1a2640
R13: 00007f7a5a1c1eb8 R14: 0030656c69662f2e R15: 00007f7a5a1f5798
</TASK>

[syzbot]

syzbot suspects this issue was fixed by commit:

commit 267a36ba30a7425ad59d20e7e7e33bbdcc9cfb0a
Author: Konstantin Komarov <almaz.ale...@paragon-software.com>
Date: Mon Jan 16 08:52:10 2023 +0000

fs/ntfs3: Remove noacsrules

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=15fdf761280000
start commit: ec35307e18ba Merge tag 'drm-fixes-2023-02-17' of git://ano..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=5f0b8e3df6f76ec
dashboard link: https://syzkaller.appspot.com/bug?extid=e78eab0c1cf4649256ed
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12570890c80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14523acf480000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: fs/ntfs3: Remove noacsrules

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

[Aleksandr Nogikh]

This commit definitely removes one of the options used by the
reproducer, though at least from the stack trace it's not clear
whether the problem was in noacsrules or we're just now not mounting
the image because of invalid mount options.

Anyway, let's close the bug, it will reappear on syzbot if it's not fixed.