[v6.1] possible deadlock in exfat_get_block

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: e3a87a10f259 Linux 6.1.21
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=17e4a6d1c80000
kernel config: https://syzkaller.appspot.com/x/.config?x=b49b0405a60858ed
dashboard link: https://syzkaller.appspot.com/bug?extid=52857f945a44ca96bdd2
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ed3d1f3e75e6/disk-e3a87a10.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6d8e44c8c75c/vmlinux-e3a87a10.xz
kernel image: https://storage.googleapis.com/syzbot-assets/cebe803ea4fa/bzImage-e3a87a10.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+52857f...@syzkaller.appspotmail.com

exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0xf444b3c9, utbl_chksum : 0xe619d30d)
======================================================
WARNING: possible circular locking dependency detected
6.1.21-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.1/6989 is trying to acquire lock:
ffff888080e580e0 (&sbi->s_lock){+.+.}-{3:3}, at: exfat_get_block+0x1e1/0x2040 fs/exfat/inode.c:281

but task is already holding lock:
ffff88803e844bd0 (mapping.invalidate_lock#4){.+.+}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:811 [inline]
ffff88803e844bd0 (mapping.invalidate_lock#4){.+.+}-{3:3}, at: page_cache_ra_unbounded+0xed/0x7b0 mm/readahead.c:226

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (mapping.invalidate_lock#4){.+.+}-{3:3}:
lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5669
down_read+0x39/0x50 kernel/locking/rwsem.c:1520
filemap_invalidate_lock_shared include/linux/fs.h:811 [inline]
filemap_fault+0x640/0x17e0 mm/filemap.c:3128
__do_fault+0x136/0x4f0 mm/memory.c:4198
do_read_fault mm/memory.c:4549 [inline]
do_fault mm/memory.c:4678 [inline]
handle_pte_fault mm/memory.c:4950 [inline]
__handle_mm_fault mm/memory.c:5092 [inline]
handle_mm_fault+0x3301/0x5140 mm/memory.c:5213
do_user_addr_fault arch/x86/mm/fault.c:1428 [inline]
handle_page_fault arch/x86/mm/fault.c:1519 [inline]
exc_page_fault+0x58d/0x790 arch/x86/mm/fault.c:1575
asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:570
strncpy_from_user+0x159/0x360 lib/strncpy_from_user.c:139
getname_flags+0xf5/0x4e0 fs/namei.c:150
do_sys_openat2+0xd2/0x500 fs/open.c:1304
do_sys_open fs/open.c:1326 [inline]
__do_sys_creat fs/open.c:1402 [inline]
__se_sys_creat fs/open.c:1396 [inline]
__x64_sys_creat+0x11f/0x160 fs/open.c:1396
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

-> #1 (&mm->mmap_lock#2){++++}-{3:3}:
lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5669
down_read+0x39/0x50 kernel/locking/rwsem.c:1520
mmap_read_lock include/linux/mmap_lock.h:117 [inline]
do_user_addr_fault arch/x86/mm/fault.c:1379 [inline]
handle_page_fault arch/x86/mm/fault.c:1519 [inline]
exc_page_fault+0x46a/0x790 arch/x86/mm/fault.c:1575
asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:570
filldir+0x307/0x6f0 fs/readdir.c:249
dir_emit_dot include/linux/fs.h:3583 [inline]
dir_emit_dots include/linux/fs.h:3594 [inline]
exfat_iterate+0x28a/0x3290 fs/exfat/dir.c:231
iterate_dir+0x224/0x560
__do_sys_getdents fs/readdir.c:286 [inline]
__se_sys_getdents+0x1eb/0x4c0 fs/readdir.c:271
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

-> #0 (&sbi->s_lock){+.+.}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3098 [inline]
check_prevs_add kernel/locking/lockdep.c:3217 [inline]
validate_chain+0x1667/0x58e0 kernel/locking/lockdep.c:3832
__lock_acquire+0x125b/0x1f80 kernel/locking/lockdep.c:5056
lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5669
__mutex_lock_common+0x1d4/0x2520 kernel/locking/mutex.c:603
__mutex_lock kernel/locking/mutex.c:747 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:799
exfat_get_block+0x1e1/0x2040 fs/exfat/inode.c:281
do_mpage_readpage+0x8d2/0x2040 fs/mpage.c:208
mpage_readahead+0x450/0x920 fs/mpage.c:361
read_pages+0x17f/0x830 mm/readahead.c:161
page_cache_ra_unbounded+0x68b/0x7b0 mm/readahead.c:270
page_cache_sync_readahead include/linux/pagemap.h:1213 [inline]
filemap_get_pages mm/filemap.c:2582 [inline]
filemap_read+0x7fa/0x31d0 mm/filemap.c:2676
__kernel_read+0x41e/0x8a0 fs/read_write.c:428
integrity_kernel_read+0xac/0xf0 security/integrity/iint.c:199
ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:485 [inline]
ima_calc_file_shash security/integrity/ima/ima_crypto.c:516 [inline]
ima_calc_file_hash+0xa57/0x1c00 security/integrity/ima/ima_crypto.c:573
ima_collect_measurement+0x4d4/0x970 security/integrity/ima/ima_api.c:292
process_measurement+0x1018/0x1cf0 security/integrity/ima/ima_main.c:337
ima_file_check+0xed/0x170 security/integrity/ima/ima_main.c:520
do_open fs/namei.c:3559 [inline]
path_openat+0x2687/0x2e60 fs/namei.c:3714
do_filp_open+0x230/0x480 fs/namei.c:3741
do_sys_openat2+0x13b/0x500 fs/open.c:1310
do_sys_open fs/open.c:1326 [inline]
__do_sys_open fs/open.c:1334 [inline]
__se_sys_open fs/open.c:1330 [inline]
__x64_sys_open+0x221/0x270 fs/open.c:1330
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

other info that might help us debug this:

Chain exists of:
&sbi->s_lock --> &mm->mmap_lock#2 --> mapping.invalidate_lock#4

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(mapping.invalidate_lock#4);
lock(&mm->mmap_lock#2);
lock(mapping.invalidate_lock#4);
lock(&sbi->s_lock);

*** DEADLOCK ***

2 locks held by syz-executor.1/6989:
#0: ffff888075d97f20 (&iint->mutex){+.+.}-{3:3}, at: process_measurement+0x7fe/0x1cf0 security/integrity/ima/ima_main.c:260
#1: ffff88803e844bd0 (mapping.invalidate_lock#4){.+.+}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:811 [inline]
#1: ffff88803e844bd0 (mapping.invalidate_lock#4){.+.+}-{3:3}, at: page_cache_ra_unbounded+0xed/0x7b0 mm/readahead.c:226

stack backtrace:
CPU: 0 PID: 6989 Comm: syz-executor.1 Not tainted 6.1.21-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/17/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
check_noncircular+0x2fa/0x3b0 kernel/locking/lockdep.c:2178
check_prev_add kernel/locking/lockdep.c:3098 [inline]
check_prevs_add kernel/locking/lockdep.c:3217 [inline]
validate_chain+0x1667/0x58e0 kernel/locking/lockdep.c:3832
__lock_acquire+0x125b/0x1f80 kernel/locking/lockdep.c:5056
lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5669
__mutex_lock_common+0x1d4/0x2520 kernel/locking/mutex.c:603
__mutex_lock kernel/locking/mutex.c:747 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:799
exfat_get_block+0x1e1/0x2040 fs/exfat/inode.c:281
do_mpage_readpage+0x8d2/0x2040 fs/mpage.c:208
mpage_readahead+0x450/0x920 fs/mpage.c:361
read_pages+0x17f/0x830 mm/readahead.c:161
page_cache_ra_unbounded+0x68b/0x7b0 mm/readahead.c:270
page_cache_sync_readahead include/linux/pagemap.h:1213 [inline]
filemap_get_pages mm/filemap.c:2582 [inline]
filemap_read+0x7fa/0x31d0 mm/filemap.c:2676
__kernel_read+0x41e/0x8a0 fs/read_write.c:428
integrity_kernel_read+0xac/0xf0 security/integrity/iint.c:199
ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:485 [inline]
ima_calc_file_shash security/integrity/ima/ima_crypto.c:516 [inline]
ima_calc_file_hash+0xa57/0x1c00 security/integrity/ima/ima_crypto.c:573
ima_collect_measurement+0x4d4/0x970 security/integrity/ima/ima_api.c:292
process_measurement+0x1018/0x1cf0 security/integrity/ima/ima_main.c:337
ima_file_check+0xed/0x170 security/integrity/ima/ima_main.c:520
do_open fs/namei.c:3559 [inline]
path_openat+0x2687/0x2e60 fs/namei.c:3714
do_filp_open+0x230/0x480 fs/namei.c:3741
do_sys_openat2+0x13b/0x500 fs/open.c:1310
do_sys_open fs/open.c:1326 [inline]
__do_sys_open fs/open.c:1334 [inline]
__se_sys_open fs/open.c:1330 [inline]
__x64_sys_open+0x221/0x270 fs/open.c:1330
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fcf6ea8c0f9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fcf6f815168 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00007fcf6ebabf80 RCX: 00007fcf6ea8c0f9
RDX: 0000000000000000 RSI: 0000000000143042 RDI: 0000000020000380
RBP: 00007fcf6eae7b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd8e935e8f R14: 00007fcf6f815300 R15: 0000000000022000
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: bf4ad6fa4e53 Linux 6.1.28
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=17282fca280000
kernel config: https://syzkaller.appspot.com/x/.config?x=26fca33e75c97e43

dashboard link: https://syzkaller.appspot.com/bug?extid=52857f945a44ca96bdd2
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16700256280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/058ee41df9de/disk-bf4ad6fa.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/480706160d27/vmlinux-bf4ad6fa.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e6a9f4f20a23/bzImage-bf4ad6fa.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/e87644b86107/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+52857f...@syzkaller.appspotmail.com

======================================================
WARNING: possible circular locking dependency detected

6.1.28-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.2/3707 is trying to acquire lock:
ffff88801fbc40e0 (

&sbi->s_lock){+.+.}-{3:3}, at: exfat_get_block+0x1e1/0x2040 fs/exfat/inode.c:281

but task is already holding lock:

ffff88806989df50 (mapping.invalidate_lock#3){.+.+}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:811 [inline]
ffff88806989df50 (mapping.invalidate_lock#3){.+.+}-{3:3}, at: page_cache_ra_unbounded+0xed/0x7b0 mm/readahead.c:226

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (mapping.invalidate_lock#3){.+.+}-{3:3}:

lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5669
down_read+0x39/0x50 kernel/locking/rwsem.c:1520
filemap_invalidate_lock_shared include/linux/fs.h:811 [inline]
filemap_fault+0x640/0x17e0 mm/filemap.c:3128

__do_fault+0x136/0x4f0 mm/memory.c:4212
do_read_fault mm/memory.c:4563 [inline]
do_fault mm/memory.c:4692 [inline]
handle_pte_fault mm/memory.c:4964 [inline]
__handle_mm_fault mm/memory.c:5106 [inline]
handle_mm_fault+0x3407/0x5330 mm/memory.c:5227

do_user_addr_fault arch/x86/mm/fault.c:1428 [inline]
handle_page_fault arch/x86/mm/fault.c:1519 [inline]
exc_page_fault+0x58d/0x790 arch/x86/mm/fault.c:1575
asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:570
strncpy_from_user+0x159/0x360 lib/strncpy_from_user.c:139
getname_flags+0xf5/0x4e0 fs/namei.c:150
do_sys_openat2+0xd2/0x500 fs/open.c:1304
do_sys_open fs/open.c:1326 [inline]

__do_sys_openat fs/open.c:1342 [inline]
__se_sys_openat fs/open.c:1337 [inline]
__x64_sys_openat+0x243/0x290 fs/open.c:1337

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

-> #1 (&mm->mmap_lock#2){++++}-{3:3}:
lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5669
down_read+0x39/0x50 kernel/locking/rwsem.c:1520
mmap_read_lock include/linux/mmap_lock.h:117 [inline]
do_user_addr_fault arch/x86/mm/fault.c:1379 [inline]
handle_page_fault arch/x86/mm/fault.c:1519 [inline]
exc_page_fault+0x46a/0x790 arch/x86/mm/fault.c:1575
asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:570

filldir64+0x307/0x6f0 fs/readdir.c:331

dir_emit_dot include/linux/fs.h:3583 [inline]
dir_emit_dots include/linux/fs.h:3594 [inline]
exfat_iterate+0x28a/0x3290 fs/exfat/dir.c:231
iterate_dir+0x224/0x560

__do_sys_getdents64 fs/readdir.c:369 [inline]
__se_sys_getdents64+0x209/0x4f0 fs/readdir.c:354

__do_sys_openat fs/open.c:1342 [inline]
__se_sys_openat fs/open.c:1337 [inline]
__x64_sys_openat+0x243/0x290 fs/open.c:1337

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

other info that might help us debug this:

Chain exists of:

&sbi->s_lock --> &mm->mmap_lock#2 --> mapping.invalidate_lock#3

Possible unsafe locking scenario:

CPU0 CPU1
---- ----

lock(mapping.invalidate_lock#3);
lock(&mm->mmap_lock#2);
lock(mapping.invalidate_lock#3);

lock(&sbi->s_lock);

*** DEADLOCK ***

3 locks held by syz-executor.2/3707:
#0: ffff888014246460 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x3b/0x80 fs/namespace.c:393
#1: ffff888025aa9ce0 (&iint->mutex){+.+.}-{3:3}, at: process_measurement+0x7fe/0x1cf0 security/integrity/ima/ima_main.c:260
#2: ffff88806989df50 (mapping.invalidate_lock#3){.+.+}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:811 [inline]
#2: ffff88806989df50 (mapping.invalidate_lock#3){.+.+}-{3:3}, at: page_cache_ra_unbounded+0xed/0x7b0 mm/readahead.c:226

stack backtrace:
CPU: 1 PID: 3707 Comm: syz-executor.2 Not tainted 6.1.28-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023

__do_sys_openat fs/open.c:1342 [inline]
__se_sys_openat fs/open.c:1337 [inline]
__x64_sys_openat+0x243/0x290 fs/open.c:1337

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

RIP: 0033:0x7f5320c8c169

Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007f5321970168 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f5320dabf80 RCX: 00007f5320c8c169
RDX: 000000000000275a RSI: 0000000020006ac0 RDI: ffffffffffffff9c
RBP: 00007f5320ce7ca1 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007ffd7b66416f R14: 00007f5321970300 R15: 0000000000022000
</TASK>
syz-executor.2 (3707) used greatest stack depth: 18648 bytes left


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.