[ext4?] WARNING: locking bug in ext4_xattr_inode_update_ref

12 views
Skip to first unread message

syzbot

unread,
Jan 16, 2023, 10:56:51 AM1/16/23
to syzkaller...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: c4215ee4771b Linux 4.14.302
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=17f85096480000
kernel config: https://syzkaller.appspot.com/x/.config?x=4a9988fe055c9527
dashboard link: https://syzkaller.appspot.com/bug?extid=adb181e90f6aa46b5713
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=144ad329480000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c93ba055d204/disk-c4215ee4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/bfbc929a33c1/vmlinux-c4215ee4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/444658051770/bzImage-c4215ee4.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/9873eab59283/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+adb181...@syzkaller.appspotmail.com

EXT4-fs (loop4): mounted filesystem without journal. Opts: quota,jqfmt=vfsv0,nouid32,,errors=continue
EXT4-fs (loop1): mounted filesystem without journal. Opts: quota,jqfmt=vfsv0,nouid32,,errors=continue
EXT4-fs (loop2): mounted filesystem without journal. Opts: quota,jqfmt=vfsv0,nouid32,,errors=continue
EXT4-fs (loop3): Quota format mount options ignored when QUOTA feature is enabled
------------[ cut here ]------------
WARNING: CPU: 0 PID: 9586 at kernel/locking/lockdep.c:722 look_up_lock_class kernel/locking/lockdep.c:689 [inline]
WARNING: CPU: 0 PID: 9586 at kernel/locking/lockdep.c:722 register_lock_class+0x85c/0x1180 kernel/locking/lockdep.c:756
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 9586 Comm: syz-executor.2 Not tainted 4.14.302-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
panic+0x1f9/0x42d kernel/panic.c:183
__warn.cold+0x20/0x44 kernel/panic.c:547
report_bug+0x208/0x250 lib/bug.c:183
fixup_bug arch/x86/kernel/traps.c:177 [inline]
fixup_bug arch/x86/kernel/traps.c:172 [inline]
do_error_trap+0x195/0x2d0 arch/x86/kernel/traps.c:295
invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:967
RIP: 0010:look_up_lock_class kernel/locking/lockdep.c:722 [inline]
RIP: 0010:register_lock_class+0x85c/0x1180 kernel/locking/lockdep.c:756
RSP: 0018:ffff88809b7df0f8 EFLAGS: 00010087
EXT4-fs (loop5): Quota format mount options ignored when QUOTA feature is enabled
RAX: dffffc0000000000 RBX: ffffffff87933140 RCX: 0000000000000001
RDX: 1ffff1101135c151 RSI: 0000000000000002 RDI: ffff888089ae0a88
RBP: ffffffff8907d210 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: ffff8880b48c4040 R12: ffffffff8becfdc0
R13: ffff888089ae0a70 R14: 0000000000000000 R15: ffffffff8ba3ff30
__lock_acquire+0x167/0x3f20 kernel/locking/lockdep.c:3378
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
down_write+0x34/0x90 kernel/locking/rwsem.c:54
inode_lock include/linux/fs.h:719 [inline]
ext4_xattr_inode_update_ref+0xe6/0x4d0 fs/ext4/xattr.c:1027
ext4_xattr_inode_inc_ref fs/ext4/xattr.c:1091 [inline]
ext4_xattr_inode_lookup_create fs/ext4/xattr.c:1530 [inline]
ext4_xattr_set_entry+0x23cf/0x31c0 fs/ext4/xattr.c:1669
ext4_xattr_block_set+0x52a/0x2b30 fs/ext4/xattr.c:1892
ext4_xattr_set_handle+0x881/0xda0 fs/ext4/xattr.c:2416
ext4_xattr_set+0x118/0x230 fs/ext4/xattr.c:2516
__vfs_setxattr+0xdc/0x130 fs/xattr.c:150
__vfs_setxattr_noperm+0xfd/0x3d0 fs/xattr.c:181
__vfs_setxattr_locked+0x14d/0x250 fs/xattr.c:239
vfs_setxattr+0xcf/0x230 fs/xattr.c:256
setxattr+0x1a9/0x300 fs/xattr.c:523
path_setxattr+0x118/0x130 fs/xattr.c:542
SYSC_setxattr fs/xattr.c:557 [inline]
SyS_setxattr+0x36/0x50 fs/xattr.c:553
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x5e/0xd3
RIP: 0033:0x7f6809b4d0c9
RSP: 002b:00007f6808ebf168 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc
RAX: ffffffffffffffda RBX: 00007f6809c6cf80 RCX: 00007f6809b4d0c9
RDX: 00000000200005c0 RSI: 0000000020000180 RDI: 0000000020000080
RBP: 00007f6809ba8ae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000002000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffefe88394f R14: 00007f6808ebf300 R15: 0000000000022000
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

syzbot

unread,
Jan 21, 2023, 3:53:39 PM1/21/23
to syzkaller...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: 3f8a27f9e27b Linux 4.19.211
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11d6a2a9480000
kernel config: https://syzkaller.appspot.com/x/.config?x=9b9277b418617afe
dashboard link: https://syzkaller.appspot.com/bug?extid=d3c53f53f16808163b78
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10b6ca96480000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17eeb3ee480000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/98c0bdb4abb3/disk-3f8a27f9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ea228ff02669/vmlinux-3f8a27f9.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/75a2de4787fd/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d3c53f...@syzkaller.appspotmail.com

WARNING: CPU: 0 PID: 8234 at kernel/locking/lockdep.c:698 arch_local_save_flags arch/x86/include/asm/paravirt.h:784 [inline]
WARNING: CPU: 0 PID: 8234 at kernel/locking/lockdep.c:698 look_up_lock_class kernel/locking/lockdep.c:689 [inline]
WARNING: CPU: 0 PID: 8234 at kernel/locking/lockdep.c:698 register_lock_class+0x77b/0x11c0 kernel/locking/lockdep.c:749
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 8234 Comm: syz-executor351 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
panic+0x26a/0x50e kernel/panic.c:186
__warn.cold+0x20/0x5a kernel/panic.c:541
report_bug+0x262/0x2b0 lib/bug.c:183
fixup_bug arch/x86/kernel/traps.c:178 [inline]
fixup_bug arch/x86/kernel/traps.c:173 [inline]
do_error_trap+0x1d7/0x310 arch/x86/kernel/traps.c:296
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1038
RIP: 0010:look_up_lock_class kernel/locking/lockdep.c:698 [inline]
RIP: 0010:register_lock_class+0x77b/0x11c0 kernel/locking/lockdep.c:749
Code: 8b 05 c9 63 ec 0b 85 c0 0f 85 17 ff ff ff 48 c7 c6 e0 1b 6a 88 48 c7 c7 40 19 6a 88 e8 c3 29 a8 06 0f 0b e9 fd fe ff ff 0f 0b <0f> 0b e9 b3 fa ff ff 48 8d 70 01 48 69 c0 50 01 00 00 48 89 35 ac
RSP: 0018:ffff8880a1e57190 EFLAGS: 00010083
RAX: dffffc0000000000 RBX: ffff88808ac3fa28 RCX: 0000000000000000
RDX: 1ffff11011587f48 RSI: 0000000000000000 RDI: ffff88808ac3fa40
RBP: 0000000000000000 R08: 0000000000000000 R09: 1ffff110143cae3a
R10: ffffffff8d243760 R11: 0000000000000000 R12: ffffffff8cdb7c60
R13: ffffffff8874b000 R14: 1ffff110143cae3a R15: 0000000000000000
__lock_acquire+0x17d/0x3ff0 kernel/locking/lockdep.c:3304
lock_acquire+0x170/0x3c0 kernel/locking/lockdep.c:3908
down_write+0x34/0x90 kernel/locking/rwsem.c:70
inode_lock include/linux/fs.h:748 [inline]
ext4_xattr_inode_update_ref+0xfc/0x780 fs/ext4/xattr.c:1028
ext4_xattr_inode_dec_ref fs/ext4/xattr.c:1097 [inline]
ext4_xattr_block_set+0x29c/0x2eb0 fs/ext4/xattr.c:2153
ext4_xattr_set_handle+0xa1f/0x1030 fs/ext4/xattr.c:2415
ext4_xattr_set+0x135/0x2a0 fs/ext4/xattr.c:2515
__vfs_setxattr+0x10e/0x170 fs/xattr.c:149
__vfs_setxattr_noperm+0x11a/0x420 fs/xattr.c:180
__vfs_setxattr_locked+0x176/0x250 fs/xattr.c:238
vfs_setxattr+0xe5/0x270 fs/xattr.c:255
setxattr+0x23d/0x330 fs/xattr.c:520
path_setxattr+0x170/0x190 fs/xattr.c:539
__do_sys_setxattr fs/xattr.c:554 [inline]
__se_sys_setxattr fs/xattr.c:550 [inline]
__x64_sys_setxattr+0xc0/0x160 fs/xattr.c:550
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f5d2554e009
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5d1d1192f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc
RAX: ffffffffffffffda RBX: 0000000000000031 RCX: 00007f5d2554e009
RDX: 00000000200005c0 RSI: 0000000020000180 RDI: 00000000200000c0
RBP: 00007f5d255d26d8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000002000 R11: 0000000000000246 R12: 00007f5d255d26d0
R13: 0030656c69662f2e R14: 66763d746d66716a R15: 2f30656c69662f2e

syzbot

unread,
Jan 22, 2023, 8:42:38 AM1/22/23
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:

HEAD commit: 97205fccccdc Linux 4.14.303
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=139ea4fe480000
kernel config: https://syzkaller.appspot.com/x/.config?x=9082325d51b8e29e
dashboard link: https://syzkaller.appspot.com/bug?extid=adb181e90f6aa46b5713
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16eb0589480000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17554cde480000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/743935faa88a/disk-97205fcc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/c24286de77a6/vmlinux-97205fcc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a69348a09157/bzImage-97205fcc.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/53a746398e86/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+adb181...@syzkaller.appspotmail.com

------------[ cut here ]------------
WARNING: CPU: 0 PID: 20194 at kernel/locking/lockdep.c:722 look_up_lock_class kernel/locking/lockdep.c:689 [inline]
WARNING: CPU: 0 PID: 20194 at kernel/locking/lockdep.c:722 register_lock_class+0x85c/0x1180 kernel/locking/lockdep.c:756
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 20194 Comm: syz-executor104 Not tainted 4.14.303-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
panic+0x1f9/0x42d kernel/panic.c:183
__warn.cold+0x20/0x44 kernel/panic.c:547
report_bug+0x208/0x250 lib/bug.c:183
fixup_bug arch/x86/kernel/traps.c:177 [inline]
fixup_bug arch/x86/kernel/traps.c:172 [inline]
do_error_trap+0x195/0x2d0 arch/x86/kernel/traps.c:295
invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:967
RIP: 0010:look_up_lock_class kernel/locking/lockdep.c:722 [inline]
RIP: 0010:register_lock_class+0x85c/0x1180 kernel/locking/lockdep.c:756
RSP: 0018:ffff88809241f2c0 EFLAGS: 00010083
RAX: dffffc0000000000 RBX: ffffffff87933180 RCX: 0000000000000001
RDX: 1ffff11011cc2159 RSI: 0000000000000002 RDI: ffff88808e610ac8
RBP: ffffffff8907d290 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: ffff8880b28004c0 R12: ffffffff8bed0dc0
R13: ffff88808e610ab0 R14: 0000000000000000 R15: ffffffff8ba40f30
__lock_acquire+0x167/0x3f20 kernel/locking/lockdep.c:3378
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
down_write+0x34/0x90 kernel/locking/rwsem.c:54
inode_lock include/linux/fs.h:719 [inline]
ext4_xattr_inode_update_ref+0xe6/0x4d0 fs/ext4/xattr.c:1027
ext4_xattr_inode_dec_ref fs/ext4/xattr.c:1096 [inline]
ext4_xattr_block_set+0x275/0x2a60 fs/ext4/xattr.c:2147
ext4_xattr_set_handle+0x881/0xda0 fs/ext4/xattr.c:2411
ext4_xattr_set+0x118/0x230 fs/ext4/xattr.c:2511
__vfs_setxattr+0xdc/0x130 fs/xattr.c:150
__vfs_setxattr_noperm+0xfd/0x3d0 fs/xattr.c:181
__vfs_setxattr_locked+0x14d/0x250 fs/xattr.c:239
vfs_setxattr+0xcf/0x230 fs/xattr.c:256
setxattr+0x1a9/0x300 fs/xattr.c:523
path_setxattr+0x118/0x130 fs/xattr.c:542
SYSC_setxattr fs/xattr.c:557 [inline]
SyS_setxattr+0x36/0x50 fs/xattr.c:553
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x5e/0xd3
RIP: 0033:0x7f838e165289
RSP: 002b:00007f8385d302f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f838e165289
RDX: 00000000200005c0 RSI: 0000000020000180 RDI: 00000000200000c0
RBP: 00007f838e1e97b8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000002000 R11: 0000000000000246 R12: 00007f838e1e97b0
R13: 0000000020000a00 R14: 0030656c69662f2e R15: 2f30656c69662f2e
Reply all
Reply to author
Forward
0 new messages