[v5.15] possible deadlock in exfat_get_block
0 views
Skip to first unread message
syzbot
Mar 10, 2023, 3:29:47 AM3/10/23
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: d9b4a0c83a2d Linux 5.15.98
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15b14eccc80000
kernel config: https://syzkaller.appspot.com/x/.config?x=b57cfa804330c3b7
dashboard link: https://syzkaller.appspot.com/bug?extid=3592f972960fdcc474fb
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8088989394e3/disk-d9b4a0c8.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2651d6753959/vmlinux-d9b4a0c8.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f3fa3f994f9a/Image-d9b4a0c8.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3592f9...@syzkaller.appspotmail.com
exFAT-fs (loop5): failed to load upcase table (idx : 0x00010000, chksum : 0x207c53fb, utbl_chksum : 0xe619d30d)
======================================================
WARNING: possible circular locking dependency detected
5.15.98-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.5/14156 is trying to acquire lock:
ffff0000ca1dc0e0 (&sbi->s_lock#2){+.+.}-{3:3}, at: exfat_get_block+0x16c/0x1b40 fs/exfat/inode.c:304
but task is already holding lock:
ffff000104a42b50 (mapping.invalidate_lock#4){.+.+}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:842 [inline]
ffff000104a42b50 (mapping.invalidate_lock#4){.+.+}-{3:3}, at: page_cache_ra_unbounded+0x158/0x654 mm/readahead.c:195
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (mapping.invalidate_lock#4){.+.+}-{3:3}:
down_read+0xbc/0x11c kernel/locking/rwsem.c:1480
filemap_invalidate_lock_shared include/linux/fs.h:842 [inline]
filemap_fault+0x52c/0xf5c mm/filemap.c:3072
__do_fault+0x120/0x5d0 mm/memory.c:3871
do_read_fault mm/memory.c:4207 [inline]
do_fault mm/memory.c:4335 [inline]
handle_pte_fault mm/memory.c:4594 [inline]
__handle_mm_fault mm/memory.c:4729 [inline]
handle_mm_fault+0x21ec/0x33c4 mm/memory.c:4827
__do_page_fault arch/arm64/mm/fault.c:505 [inline]
do_page_fault+0x700/0xb60 arch/arm64/mm/fault.c:605
do_translation_fault+0xe8/0x138 arch/arm64/mm/fault.c:686
do_mem_abort+0x70/0x1d8 arch/arm64/mm/fault.c:819
el1_abort+0x3c/0x5c arch/arm64/kernel/entry-common.c:358
el1h_64_sync_handler+0x5c/0x98 arch/arm64/kernel/entry-common.c:409
el1h_64_sync+0x78/0x7c <unknown>:579
do_strncpy_from_user lib/strncpy_from_user.c:41 [inline]
strncpy_from_user+0x240/0x580 lib/strncpy_from_user.c:139
getname_flags+0x104/0x480 fs/namei.c:149
getname+0x28/0x38 fs/namei.c:217
do_sys_openat2+0xd4/0x3d8 fs/open.c:1205
do_sys_open fs/open.c:1227 [inline]
__do_sys_openat fs/open.c:1243 [inline]
__se_sys_openat fs/open.c:1238 [inline]
__arm64_sys_openat+0x1f0/0x240 fs/open.c:1238
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 <unknown>:584
-> #1 (&mm->mmap_lock){++++}-{3:3}:
__might_fault+0xc8/0x128 mm/memory.c:5297
filldir64+0x2bc/0x9e4 fs/readdir.c:335
dir_emit_dot include/linux/fs.h:3603 [inline]
dir_emit_dots include/linux/fs.h:3614 [inline]
exfat_iterate+0x25c/0x2710 fs/exfat/dir.c:232
iterate_dir+0x1f4/0x4e4
__do_sys_getdents64 fs/readdir.c:369 [inline]
__se_sys_getdents64 fs/readdir.c:354 [inline]
__arm64_sys_getdents64+0x1c4/0x4c4 fs/readdir.c:354
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 <unknown>:584
-> #0 (&sbi->s_lock#2){+.+.}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain kernel/locking/lockdep.c:3787 [inline]
__lock_acquire+0x32cc/0x7620 kernel/locking/lockdep.c:5011
lock_acquire+0x2b8/0x894 kernel/locking/lockdep.c:5622
__mutex_lock_common+0x194/0x2154 kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0xa4/0xf8 kernel/locking/mutex.c:743
exfat_get_block+0x16c/0x1b40 fs/exfat/inode.c:304
do_mpage_readpage+0x6f8/0x1c68 fs/mpage.c:231
mpage_readahead+0x35c/0x844 fs/mpage.c:389
exfat_readahead+0x28/0x38 fs/exfat/inode.c:367
read_pages+0x13c/0x420 mm/readahead.c:130
page_cache_ra_unbounded+0x200/0x654 mm/readahead.c:211
do_page_cache_ra mm/readahead.c:269 [inline]
ondemand_readahead+0x614/0xc8c mm/readahead.c:552
page_cache_sync_ra+0x130/0x180 mm/readahead.c:580
page_cache_sync_readahead include/linux/pagemap.h:833 [inline]
filemap_get_pages mm/filemap.c:2551 [inline]
filemap_read+0x52c/0x1bd4 mm/filemap.c:2634
generic_file_read_iter+0xa0/0x3c4 mm/filemap.c:2785
call_read_iter include/linux/fs.h:2095 [inline]
new_sync_read fs/read_write.c:404 [inline]
vfs_read+0x86c/0xb10 fs/read_write.c:485
ksys_read+0x15c/0x26c fs/read_write.c:623
__do_sys_read fs/read_write.c:633 [inline]
__se_sys_read fs/read_write.c:631 [inline]
__arm64_sys_read+0x7c/0x90 fs/read_write.c:631
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 <unknown>:584
other info that might help us debug this:
Chain exists of:
&sbi->s_lock#2 --> &mm->mmap_lock --> mapping.invalidate_lock#4
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(mapping.invalidate_lock#4);
lock(&mm->mmap_lock);
lock(mapping.invalidate_lock#4);
lock(&sbi->s_lock#2);
*** DEADLOCK ***
2 locks held by syz-executor.5/14156:
#0: ffff0000db9ba5f0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xdc/0x108 fs/file.c:1072
#1: ffff000104a42b50 (mapping.invalidate_lock#4){.+.+}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:842 [inline]
#1: ffff000104a42b50 (mapping.invalidate_lock#4){.+.+}-{3:3}, at: page_cache_ra_unbounded+0x158/0x654 mm/readahead.c:195
stack backtrace:
CPU: 1 PID: 14156 Comm: syz-executor.5 Not tainted 5.15.98-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
print_circular_bug+0x150/0x1b8 kernel/locking/lockdep.c:2011
check_noncircular+0x2cc/0x378 kernel/locking/lockdep.c:2133
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain kernel/locking/lockdep.c:3787 [inline]
__lock_acquire+0x32cc/0x7620 kernel/locking/lockdep.c:5011
lock_acquire+0x2b8/0x894 kernel/locking/lockdep.c:5622
__mutex_lock_common+0x194/0x2154 kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0xa4/0xf8 kernel/locking/mutex.c:743
exfat_get_block+0x16c/0x1b40 fs/exfat/inode.c:304
do_mpage_readpage+0x6f8/0x1c68 fs/mpage.c:231
mpage_readahead+0x35c/0x844 fs/mpage.c:389
exfat_readahead+0x28/0x38 fs/exfat/inode.c:367
read_pages+0x13c/0x420 mm/readahead.c:130
page_cache_ra_unbounded+0x200/0x654 mm/readahead.c:211
do_page_cache_ra mm/readahead.c:269 [inline]
ondemand_readahead+0x614/0xc8c mm/readahead.c:552
page_cache_sync_ra+0x130/0x180 mm/readahead.c:580
page_cache_sync_readahead include/linux/pagemap.h:833 [inline]
filemap_get_pages mm/filemap.c:2551 [inline]
filemap_read+0x52c/0x1bd4 mm/filemap.c:2634
generic_file_read_iter+0xa0/0x3c4 mm/filemap.c:2785
call_read_iter include/linux/fs.h:2095 [inline]
new_sync_read fs/read_write.c:404 [inline]
vfs_read+0x86c/0xb10 fs/read_write.c:485
ksys_read+0x15c/0x26c fs/read_write.c:623
__do_sys_read fs/read_write.c:633 [inline]
__se_sys_read fs/read_write.c:631 [inline]
__arm64_sys_read+0x7c/0x90 fs/read_write.c:631
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 <unknown>:584
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following issue on:
HEAD commit: d9b4a0c83a2d Linux 5.15.98
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15b14eccc80000
kernel config: https://syzkaller.appspot.com/x/.config?x=b57cfa804330c3b7
dashboard link: https://syzkaller.appspot.com/bug?extid=3592f972960fdcc474fb
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8088989394e3/disk-d9b4a0c8.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2651d6753959/vmlinux-d9b4a0c8.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f3fa3f994f9a/Image-d9b4a0c8.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3592f9...@syzkaller.appspotmail.com
exFAT-fs (loop5): failed to load upcase table (idx : 0x00010000, chksum : 0x207c53fb, utbl_chksum : 0xe619d30d)
======================================================
WARNING: possible circular locking dependency detected
5.15.98-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.5/14156 is trying to acquire lock:
ffff0000ca1dc0e0 (&sbi->s_lock#2){+.+.}-{3:3}, at: exfat_get_block+0x16c/0x1b40 fs/exfat/inode.c:304
but task is already holding lock:
ffff000104a42b50 (mapping.invalidate_lock#4){.+.+}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:842 [inline]
ffff000104a42b50 (mapping.invalidate_lock#4){.+.+}-{3:3}, at: page_cache_ra_unbounded+0x158/0x654 mm/readahead.c:195
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (mapping.invalidate_lock#4){.+.+}-{3:3}:
down_read+0xbc/0x11c kernel/locking/rwsem.c:1480
filemap_invalidate_lock_shared include/linux/fs.h:842 [inline]
filemap_fault+0x52c/0xf5c mm/filemap.c:3072
__do_fault+0x120/0x5d0 mm/memory.c:3871
do_read_fault mm/memory.c:4207 [inline]
do_fault mm/memory.c:4335 [inline]
handle_pte_fault mm/memory.c:4594 [inline]
__handle_mm_fault mm/memory.c:4729 [inline]
handle_mm_fault+0x21ec/0x33c4 mm/memory.c:4827
__do_page_fault arch/arm64/mm/fault.c:505 [inline]
do_page_fault+0x700/0xb60 arch/arm64/mm/fault.c:605
do_translation_fault+0xe8/0x138 arch/arm64/mm/fault.c:686
do_mem_abort+0x70/0x1d8 arch/arm64/mm/fault.c:819
el1_abort+0x3c/0x5c arch/arm64/kernel/entry-common.c:358
el1h_64_sync_handler+0x5c/0x98 arch/arm64/kernel/entry-common.c:409
el1h_64_sync+0x78/0x7c <unknown>:579
do_strncpy_from_user lib/strncpy_from_user.c:41 [inline]
strncpy_from_user+0x240/0x580 lib/strncpy_from_user.c:139
getname_flags+0x104/0x480 fs/namei.c:149
getname+0x28/0x38 fs/namei.c:217
do_sys_openat2+0xd4/0x3d8 fs/open.c:1205
do_sys_open fs/open.c:1227 [inline]
__do_sys_openat fs/open.c:1243 [inline]
__se_sys_openat fs/open.c:1238 [inline]
__arm64_sys_openat+0x1f0/0x240 fs/open.c:1238
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 <unknown>:584
-> #1 (&mm->mmap_lock){++++}-{3:3}:
__might_fault+0xc8/0x128 mm/memory.c:5297
filldir64+0x2bc/0x9e4 fs/readdir.c:335
dir_emit_dot include/linux/fs.h:3603 [inline]
dir_emit_dots include/linux/fs.h:3614 [inline]
exfat_iterate+0x25c/0x2710 fs/exfat/dir.c:232
iterate_dir+0x1f4/0x4e4
__do_sys_getdents64 fs/readdir.c:369 [inline]
__se_sys_getdents64 fs/readdir.c:354 [inline]
__arm64_sys_getdents64+0x1c4/0x4c4 fs/readdir.c:354
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 <unknown>:584
-> #0 (&sbi->s_lock#2){+.+.}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain kernel/locking/lockdep.c:3787 [inline]
__lock_acquire+0x32cc/0x7620 kernel/locking/lockdep.c:5011
lock_acquire+0x2b8/0x894 kernel/locking/lockdep.c:5622
__mutex_lock_common+0x194/0x2154 kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0xa4/0xf8 kernel/locking/mutex.c:743
exfat_get_block+0x16c/0x1b40 fs/exfat/inode.c:304
do_mpage_readpage+0x6f8/0x1c68 fs/mpage.c:231
mpage_readahead+0x35c/0x844 fs/mpage.c:389
exfat_readahead+0x28/0x38 fs/exfat/inode.c:367
read_pages+0x13c/0x420 mm/readahead.c:130
page_cache_ra_unbounded+0x200/0x654 mm/readahead.c:211
do_page_cache_ra mm/readahead.c:269 [inline]
ondemand_readahead+0x614/0xc8c mm/readahead.c:552
page_cache_sync_ra+0x130/0x180 mm/readahead.c:580
page_cache_sync_readahead include/linux/pagemap.h:833 [inline]
filemap_get_pages mm/filemap.c:2551 [inline]
filemap_read+0x52c/0x1bd4 mm/filemap.c:2634
generic_file_read_iter+0xa0/0x3c4 mm/filemap.c:2785
call_read_iter include/linux/fs.h:2095 [inline]
new_sync_read fs/read_write.c:404 [inline]
vfs_read+0x86c/0xb10 fs/read_write.c:485
ksys_read+0x15c/0x26c fs/read_write.c:623
__do_sys_read fs/read_write.c:633 [inline]
__se_sys_read fs/read_write.c:631 [inline]
__arm64_sys_read+0x7c/0x90 fs/read_write.c:631
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 <unknown>:584
other info that might help us debug this:
Chain exists of:
&sbi->s_lock#2 --> &mm->mmap_lock --> mapping.invalidate_lock#4
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(mapping.invalidate_lock#4);
lock(&mm->mmap_lock);
lock(mapping.invalidate_lock#4);
lock(&sbi->s_lock#2);
*** DEADLOCK ***
2 locks held by syz-executor.5/14156:
#0: ffff0000db9ba5f0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xdc/0x108 fs/file.c:1072
#1: ffff000104a42b50 (mapping.invalidate_lock#4){.+.+}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:842 [inline]
#1: ffff000104a42b50 (mapping.invalidate_lock#4){.+.+}-{3:3}, at: page_cache_ra_unbounded+0x158/0x654 mm/readahead.c:195
stack backtrace:
CPU: 1 PID: 14156 Comm: syz-executor.5 Not tainted 5.15.98-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
print_circular_bug+0x150/0x1b8 kernel/locking/lockdep.c:2011
check_noncircular+0x2cc/0x378 kernel/locking/lockdep.c:2133
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain kernel/locking/lockdep.c:3787 [inline]
__lock_acquire+0x32cc/0x7620 kernel/locking/lockdep.c:5011
lock_acquire+0x2b8/0x894 kernel/locking/lockdep.c:5622
__mutex_lock_common+0x194/0x2154 kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0xa4/0xf8 kernel/locking/mutex.c:743
exfat_get_block+0x16c/0x1b40 fs/exfat/inode.c:304
do_mpage_readpage+0x6f8/0x1c68 fs/mpage.c:231
mpage_readahead+0x35c/0x844 fs/mpage.c:389
exfat_readahead+0x28/0x38 fs/exfat/inode.c:367
read_pages+0x13c/0x420 mm/readahead.c:130
page_cache_ra_unbounded+0x200/0x654 mm/readahead.c:211
do_page_cache_ra mm/readahead.c:269 [inline]
ondemand_readahead+0x614/0xc8c mm/readahead.c:552
page_cache_sync_ra+0x130/0x180 mm/readahead.c:580
page_cache_sync_readahead include/linux/pagemap.h:833 [inline]
filemap_get_pages mm/filemap.c:2551 [inline]
filemap_read+0x52c/0x1bd4 mm/filemap.c:2634
generic_file_read_iter+0xa0/0x3c4 mm/filemap.c:2785
call_read_iter include/linux/fs.h:2095 [inline]
new_sync_read fs/read_write.c:404 [inline]
vfs_read+0x86c/0xb10 fs/read_write.c:485
ksys_read+0x15c/0x26c fs/read_write.c:623
__do_sys_read fs/read_write.c:633 [inline]
__se_sys_read fs/read_write.c:631 [inline]
__arm64_sys_read+0x7c/0x90 fs/read_write.c:631
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 <unknown>:584
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Jul 23, 2023, 11:46:00 PM7/23/23
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: cdd3cdb682f4 Linux 5.15.121
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1152eff4a80000
kernel config: https://syzkaller.appspot.com/x/.config?x=79aad99346320272
dashboard link: https://syzkaller.appspot.com/bug?extid=3592f972960fdcc474fb
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=177b304aa80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1623ed06a80000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/5291ba931c67/disk-cdd3cdb6.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/fa00d94c6f9c/vmlinux-cdd3cdb6.xz
kernel image: https://storage.googleapis.com/syzbot-assets/50f21e701a54/Image-cdd3cdb6.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/2957d08fd103/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3592f9...@syzkaller.appspotmail.com
------------------------------------------------------
syz-executor401/15401 is trying to acquire lock:
ffff0000db8cc0e0 (&sbi->s_lock){+.+.}-{3:3}, at: exfat_get_block+0x16c/0x1b40 fs/exfat/inode.c:303
but task is already holding lock:
ffff0000df0f9150 (mapping.invalidate_lock#3){.+.+}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:842 [inline]
ffff0000df0f9150 (mapping.invalidate_lock#3){.+.+}-{3:3}, at: page_cache_ra_unbounded+0x158/0x654 mm/readahead.c:195
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (mapping.invalidate_lock#3){.+.+}-{3:3}:
down_read+0xc0/0x398 kernel/locking/rwsem.c:1488
do_read_fault mm/memory.c:4234 [inline]
do_fault mm/memory.c:4362 [inline]
handle_pte_fault mm/memory.c:4621 [inline]
__handle_mm_fault mm/memory.c:4756 [inline]
handle_mm_fault+0x21ec/0x33c4 mm/memory.c:4854
-> #1 (&mm->mmap_lock){++++}-{3:3}:
__might_fault+0xc8/0x128 mm/memory.c:5324
filldir64+0x2bc/0x9e4 fs/readdir.c:335
dir_emit_dot include/linux/fs.h:3605 [inline]
dir_emit_dots include/linux/fs.h:3616 [inline]
exfat_iterate+0x25c/0x27a0 fs/exfat/dir.c:232
-> #0 (&sbi->s_lock){+.+.}-{3:3}:
read_pages+0x13c/0x420 mm/readahead.c:130
page_cache_ra_unbounded+0x534/0x654 mm/readahead.c:239
do_page_cache_ra mm/readahead.c:269 [inline]
ondemand_readahead+0x62c/0xd0c mm/readahead.c:552
aio_read+0x318/0x468 fs/aio.c:1543
io_submit_one+0x838/0x161c fs/aio.c:2002
__do_sys_io_submit fs/aio.c:2061 [inline]
__se_sys_io_submit fs/aio.c:2031 [inline]
__arm64_sys_io_submit+0x26c/0x3ec fs/aio.c:2031
other info that might help us debug this:
Chain exists of:
&sbi->s_lock --> &mm->mmap_lock --> mapping.invalidate_lock#3
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(mapping.invalidate_lock#3);
lock(&mm->mmap_lock);
lock(mapping.invalidate_lock#3);
lock(&sbi->s_lock);
*** DEADLOCK ***
1 lock held by syz-executor401/15401:
#0: ffff0000df0f9150 (mapping.invalidate_lock#3){.+.+}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:842 [inline]
#0: ffff0000df0f9150 (mapping.invalidate_lock#3){.+.+}-{3:3}, at: page_cache_ra_unbounded+0x158/0x654 mm/readahead.c:195
stack backtrace:
CPU: 1 PID: 15401 Comm: syz-executor401 Not tainted 5.15.121-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
read_pages+0x13c/0x420 mm/readahead.c:130
page_cache_ra_unbounded+0x534/0x654 mm/readahead.c:239
do_page_cache_ra mm/readahead.c:269 [inline]
ondemand_readahead+0x62c/0xd0c mm/readahead.c:552
aio_read+0x318/0x468 fs/aio.c:1543
io_submit_one+0x838/0x161c fs/aio.c:2002
__do_sys_io_submit fs/aio.c:2061 [inline]
__se_sys_io_submit fs/aio.c:2031 [inline]
__arm64_sys_io_submit+0x26c/0x3ec fs/aio.c:2031
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: cdd3cdb682f4 Linux 5.15.121
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1152eff4a80000
kernel config: https://syzkaller.appspot.com/x/.config?x=79aad99346320272
dashboard link: https://syzkaller.appspot.com/bug?extid=3592f972960fdcc474fb
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=177b304aa80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1623ed06a80000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/5291ba931c67/disk-cdd3cdb6.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/fa00d94c6f9c/vmlinux-cdd3cdb6.xz
kernel image: https://storage.googleapis.com/syzbot-assets/50f21e701a54/Image-cdd3cdb6.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/2957d08fd103/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3592f9...@syzkaller.appspotmail.com
======================================================
WARNING: possible circular locking dependency detected
5.15.121-syzkaller #0 Not tainted
WARNING: possible circular locking dependency detected
------------------------------------------------------
syz-executor401/15401 is trying to acquire lock:
ffff0000db8cc0e0 (&sbi->s_lock){+.+.}-{3:3}, at: exfat_get_block+0x16c/0x1b40 fs/exfat/inode.c:303
but task is already holding lock:
ffff0000df0f9150 (mapping.invalidate_lock#3){.+.+}-{3:3}, at: page_cache_ra_unbounded+0x158/0x654 mm/readahead.c:195
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
down_read+0xc0/0x398 kernel/locking/rwsem.c:1488
filemap_invalidate_lock_shared include/linux/fs.h:842 [inline]
filemap_fault+0x52c/0xf5c mm/filemap.c:3072
__do_fault+0x120/0x5d0 mm/memory.c:3898
filemap_fault+0x52c/0xf5c mm/filemap.c:3072
do_read_fault mm/memory.c:4234 [inline]
do_fault mm/memory.c:4362 [inline]
handle_pte_fault mm/memory.c:4621 [inline]
__handle_mm_fault mm/memory.c:4756 [inline]
handle_mm_fault+0x21ec/0x33c4 mm/memory.c:4854
__do_page_fault arch/arm64/mm/fault.c:505 [inline]
do_page_fault+0x700/0xb60 arch/arm64/mm/fault.c:605
do_translation_fault+0xe8/0x138 arch/arm64/mm/fault.c:686
do_mem_abort+0x70/0x1d8 arch/arm64/mm/fault.c:819
el1_abort+0x3c/0x5c arch/arm64/kernel/entry-common.c:358
el1h_64_sync_handler+0x5c/0x98 arch/arm64/kernel/entry-common.c:409
el1h_64_sync+0x78/0x7c arch/arm64/kernel/entry.S:579
do_page_fault+0x700/0xb60 arch/arm64/mm/fault.c:605
do_translation_fault+0xe8/0x138 arch/arm64/mm/fault.c:686
do_mem_abort+0x70/0x1d8 arch/arm64/mm/fault.c:819
el1_abort+0x3c/0x5c arch/arm64/kernel/entry-common.c:358
el1h_64_sync_handler+0x5c/0x98 arch/arm64/kernel/entry-common.c:409
do_strncpy_from_user lib/strncpy_from_user.c:41 [inline]
strncpy_from_user+0x240/0x580 lib/strncpy_from_user.c:139
getname_flags+0x104/0x480 fs/namei.c:149
getname+0x28/0x38 fs/namei.c:217
do_sys_openat2+0xd4/0x3d8 fs/open.c:1205
do_sys_open fs/open.c:1227 [inline]
__do_sys_openat fs/open.c:1243 [inline]
__se_sys_openat fs/open.c:1238 [inline]
__arm64_sys_openat+0x1f0/0x240 fs/open.c:1238
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
strncpy_from_user+0x240/0x580 lib/strncpy_from_user.c:139
getname_flags+0x104/0x480 fs/namei.c:149
getname+0x28/0x38 fs/namei.c:217
do_sys_openat2+0xd4/0x3d8 fs/open.c:1205
do_sys_open fs/open.c:1227 [inline]
__do_sys_openat fs/open.c:1243 [inline]
__se_sys_openat fs/open.c:1238 [inline]
__arm64_sys_openat+0x1f0/0x240 fs/open.c:1238
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
-> #1 (&mm->mmap_lock){++++}-{3:3}:
filldir64+0x2bc/0x9e4 fs/readdir.c:335
dir_emit_dot include/linux/fs.h:3605 [inline]
dir_emit_dots include/linux/fs.h:3616 [inline]
exfat_iterate+0x25c/0x27a0 fs/exfat/dir.c:232
iterate_dir+0x1f4/0x4e4
__do_sys_getdents64 fs/readdir.c:369 [inline]
__se_sys_getdents64 fs/readdir.c:354 [inline]
__arm64_sys_getdents64+0x1c4/0x4c4 fs/readdir.c:354
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
__do_sys_getdents64 fs/readdir.c:369 [inline]
__se_sys_getdents64 fs/readdir.c:354 [inline]
__arm64_sys_getdents64+0x1c4/0x4c4 fs/readdir.c:354
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
-> #0 (&sbi->s_lock){+.+.}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain kernel/locking/lockdep.c:3787 [inline]
__lock_acquire+0x32cc/0x7620 kernel/locking/lockdep.c:5011
lock_acquire+0x240/0x77c kernel/locking/lockdep.c:5622
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain kernel/locking/lockdep.c:3787 [inline]
__lock_acquire+0x32cc/0x7620 kernel/locking/lockdep.c:5011
__mutex_lock_common+0x194/0x2154 kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0xa4/0xf8 kernel/locking/mutex.c:743
exfat_get_block+0x16c/0x1b40 fs/exfat/inode.c:303
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0xa4/0xf8 kernel/locking/mutex.c:743
do_mpage_readpage+0x6f8/0x1c68 fs/mpage.c:231
mpage_readahead+0x35c/0x844 fs/mpage.c:389
exfat_readahead+0x28/0x38 fs/exfat/inode.c:366
mpage_readahead+0x35c/0x844 fs/mpage.c:389
read_pages+0x13c/0x420 mm/readahead.c:130
page_cache_ra_unbounded+0x534/0x654 mm/readahead.c:239
do_page_cache_ra mm/readahead.c:269 [inline]
ondemand_readahead+0x62c/0xd0c mm/readahead.c:552
page_cache_sync_ra+0x130/0x180 mm/readahead.c:580
page_cache_sync_readahead include/linux/pagemap.h:833 [inline]
filemap_get_pages mm/filemap.c:2551 [inline]
filemap_read+0x52c/0x1bd4 mm/filemap.c:2634
generic_file_read_iter+0xa0/0x3c4 mm/filemap.c:2785
call_read_iter include/linux/fs.h:2097 [inline]
page_cache_sync_readahead include/linux/pagemap.h:833 [inline]
filemap_get_pages mm/filemap.c:2551 [inline]
filemap_read+0x52c/0x1bd4 mm/filemap.c:2634
generic_file_read_iter+0xa0/0x3c4 mm/filemap.c:2785
aio_read+0x318/0x468 fs/aio.c:1543
io_submit_one+0x838/0x161c fs/aio.c:2002
__do_sys_io_submit fs/aio.c:2061 [inline]
__se_sys_io_submit fs/aio.c:2031 [inline]
__arm64_sys_io_submit+0x26c/0x3ec fs/aio.c:2031
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
other info that might help us debug this:
Chain exists of:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&mm->mmap_lock);
lock(mapping.invalidate_lock#3);
lock(&sbi->s_lock);
*** DEADLOCK ***
1 lock held by syz-executor401/15401:
#0: ffff0000df0f9150 (mapping.invalidate_lock#3){.+.+}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:842 [inline]
#0: ffff0000df0f9150 (mapping.invalidate_lock#3){.+.+}-{3:3}, at: page_cache_ra_unbounded+0x158/0x654 mm/readahead.c:195
stack backtrace:
CPU: 1 PID: 15401 Comm: syz-executor401 Not tainted 5.15.121-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
print_circular_bug+0x150/0x1b8 kernel/locking/lockdep.c:2011
check_noncircular+0x2cc/0x378 kernel/locking/lockdep.c:2133
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain kernel/locking/lockdep.c:3787 [inline]
__lock_acquire+0x32cc/0x7620 kernel/locking/lockdep.c:5011
lock_acquire+0x240/0x77c kernel/locking/lockdep.c:5622
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
print_circular_bug+0x150/0x1b8 kernel/locking/lockdep.c:2011
check_noncircular+0x2cc/0x378 kernel/locking/lockdep.c:2133
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain kernel/locking/lockdep.c:3787 [inline]
__lock_acquire+0x32cc/0x7620 kernel/locking/lockdep.c:5011
__mutex_lock_common+0x194/0x2154 kernel/locking/mutex.c:596
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0xa4/0xf8 kernel/locking/mutex.c:743
exfat_get_block+0x16c/0x1b40 fs/exfat/inode.c:303
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0xa4/0xf8 kernel/locking/mutex.c:743
do_mpage_readpage+0x6f8/0x1c68 fs/mpage.c:231
mpage_readahead+0x35c/0x844 fs/mpage.c:389
exfat_readahead+0x28/0x38 fs/exfat/inode.c:366
mpage_readahead+0x35c/0x844 fs/mpage.c:389
read_pages+0x13c/0x420 mm/readahead.c:130
page_cache_ra_unbounded+0x534/0x654 mm/readahead.c:239
do_page_cache_ra mm/readahead.c:269 [inline]
ondemand_readahead+0x62c/0xd0c mm/readahead.c:552
page_cache_sync_ra+0x130/0x180 mm/readahead.c:580
page_cache_sync_readahead include/linux/pagemap.h:833 [inline]
filemap_get_pages mm/filemap.c:2551 [inline]
filemap_read+0x52c/0x1bd4 mm/filemap.c:2634
generic_file_read_iter+0xa0/0x3c4 mm/filemap.c:2785
call_read_iter include/linux/fs.h:2097 [inline]
page_cache_sync_readahead include/linux/pagemap.h:833 [inline]
filemap_get_pages mm/filemap.c:2551 [inline]
filemap_read+0x52c/0x1bd4 mm/filemap.c:2634
generic_file_read_iter+0xa0/0x3c4 mm/filemap.c:2785
aio_read+0x318/0x468 fs/aio.c:1543
io_submit_one+0x838/0x161c fs/aio.c:2002
__do_sys_io_submit fs/aio.c:2061 [inline]
__se_sys_io_submit fs/aio.c:2031 [inline]
__arm64_sys_io_submit+0x26c/0x3ec fs/aio.c:2031
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
syzbot
Oct 19, 2023, 10:45:51 AM10/19/23
to syzkaller...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages