possible deadlock in walk_component

14 views

Skip to first unread message

syzbot

unread,

Jul 6, 2020, 4:23:25 AM7/6/20

to syzkaller...@googlegroups.com

Hello,

syzbot found the following crash on:

HEAD commit: 399849e4 Linux 4.19.131
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=12111e7b100000
kernel config: https://syzkaller.appspot.com/x/.config?x=eada6d424d8bae1d
dashboard link: https://syzkaller.appspot.com/bug?extid=accdedfdaea55738ab96
compiler: gcc (GCC) 10.1.0-syz 20200507

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+accded...@syzkaller.appspotmail.com

overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off.
8021q: adding VLAN 0 to HW filter on device bond185
bond0: Enslaving bond185 as an active interface with an up link
======================================================
overlayfs: './bus' not a directory
WARNING: possible circular locking dependency detected
4.19.131-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.0/25360 is trying to acquire lock:
00000000ffd40627 (&ovl_i_mutex_dir_key[depth]#2){++++}, at: inode_lock_shared include/linux/fs.h:758 [inline]
00000000ffd40627 (&ovl_i_mutex_dir_key[depth]#2){++++}, at: lookup_slow fs/namei.c:1688 [inline]
00000000ffd40627 (&ovl_i_mutex_dir_key[depth]#2){++++}, at: walk_component+0x798/0xda0 fs/namei.c:1811

but task is already holding lock:
00000000f5fa923f (&sig->cred_guard_mutex){+.+.}, at: __do_sys_perf_event_open kernel/events/core.c:10616 [inline]
00000000f5fa923f (&sig->cred_guard_mutex){+.+.}, at: __se_sys_perf_event_open+0x18eb/0x2720 kernel/events/core.c:10525

which lock already depends on the new lock.

EXT4-fs (loop1): VFS: Can't find ext4 filesystem

the existing dependency chain (in reverse order) is:

-> #3 (&sig->cred_guard_mutex){+.+.}:
lock_trace fs/proc/base.c:402 [inline]
proc_pid_syscall+0xb8/0x2f0 fs/proc/base.c:635
proc_single_show+0xeb/0x170 fs/proc/base.c:755
seq_read+0x4be/0x1160 fs/seq_file.c:229
do_loop_readv_writev fs/read_write.c:701 [inline]
do_loop_readv_writev fs/read_write.c:688 [inline]
do_iter_read+0x471/0x630 fs/read_write.c:925
vfs_readv+0xe5/0x150 fs/read_write.c:987
do_preadv fs/read_write.c:1071 [inline]
__do_sys_preadv fs/read_write.c:1121 [inline]
__se_sys_preadv fs/read_write.c:1116 [inline]
__x64_sys_preadv+0x22b/0x310 fs/read_write.c:1116
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe

-> #2 (&p->lock){+.+.}:
seq_read+0x6b/0x1160 fs/seq_file.c:161
proc_reg_read+0x1bd/0x2d0 fs/proc/inode.c:231
do_loop_readv_writev fs/read_write.c:701 [inline]
do_loop_readv_writev fs/read_write.c:688 [inline]
do_iter_read+0x471/0x630 fs/read_write.c:925
vfs_readv+0xe5/0x150 fs/read_write.c:987
kernel_readv fs/splice.c:362 [inline]
default_file_splice_read+0x457/0xa00 fs/splice.c:417
do_splice_to+0x10e/0x160 fs/splice.c:881
splice_direct_to_actor+0x2b9/0x8d0 fs/splice.c:959
do_splice_direct+0x1a7/0x270 fs/splice.c:1068
do_sendfile+0x550/0xc30 fs/read_write.c:1447
__do_sys_sendfile64 fs/read_write.c:1508 [inline]
__se_sys_sendfile64+0x147/0x160 fs/read_write.c:1494
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe

-> #1 (sb_writers#3){.+.+}:
sb_start_write include/linux/fs.h:1579 [inline]
mnt_want_write+0x3a/0xb0 fs/namespace.c:360
ovl_create_object+0x96/0x290 fs/overlayfs/dir.c:600
lookup_open+0x893/0x1a20 fs/namei.c:3235
do_last fs/namei.c:3327 [inline]
path_openat+0x1094/0x2df0 fs/namei.c:3537
do_filp_open+0x18c/0x3f0 fs/namei.c:3567
do_sys_open+0x3b3/0x520 fs/open.c:1085
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe

-> #0 (&ovl_i_mutex_dir_key[depth]#2){++++}:
down_read+0x36/0x80 kernel/locking/rwsem.c:24
inode_lock_shared include/linux/fs.h:758 [inline]
lookup_slow fs/namei.c:1688 [inline]
walk_component+0x798/0xda0 fs/namei.c:1811
lookup_last fs/namei.c:2274 [inline]
path_lookupat+0x1ff/0x8d0 fs/namei.c:2319
filename_lookup+0x1ac/0x5a0 fs/namei.c:2349
create_local_trace_uprobe+0x82/0x490 kernel/trace/trace_uprobe.c:1356
perf_uprobe_init+0x128/0x200 kernel/trace/trace_event_perf.c:317
perf_uprobe_event_init+0xf8/0x190 kernel/events/core.c:8587
perf_try_init_event+0x124/0x2e0 kernel/events/core.c:9860
perf_init_event kernel/events/core.c:9891 [inline]
perf_event_alloc.part.0+0x1b16/0x2eb0 kernel/events/core.c:10165
perf_event_alloc kernel/events/core.c:10535 [inline]
__do_sys_perf_event_open kernel/events/core.c:10636 [inline]
__se_sys_perf_event_open+0x550/0x2720 kernel/events/core.c:10525
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe

other info that might help us debug this:

Chain exists of:
&ovl_i_mutex_dir_key[depth]#2 --> &p->lock --> &sig->cred_guard_mutex

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&sig->cred_guard_mutex);
lock(&p->lock);
lock(&sig->cred_guard_mutex);
lock(&ovl_i_mutex_dir_key[depth]#2);

*** DEADLOCK ***

2 locks held by syz-executor.0/25360:
#0: 00000000f5fa923f (&sig->cred_guard_mutex){+.+.}, at: __do_sys_perf_event_open kernel/events/core.c:10616 [inline]
#0: 00000000f5fa923f (&sig->cred_guard_mutex){+.+.}, at: __se_sys_perf_event_open+0x18eb/0x2720 kernel/events/core.c:10525
#1: 0000000060c056ce (&pmus_srcu){....}, at: perf_event_alloc.part.0+0xe6c/0x2eb0 kernel/events/core.c:10161

stack backtrace:
CPU: 1 PID: 25360 Comm: syz-executor.0 Not tainted 4.19.131-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1fc/0x2fe lib/dump_stack.c:118
print_circular_bug.constprop.0.cold+0x2d7/0x41e kernel/locking/lockdep.c:1221
check_prev_add kernel/locking/lockdep.c:1865 [inline]
check_prevs_add kernel/locking/lockdep.c:1978 [inline]
validate_chain kernel/locking/lockdep.c:2419 [inline]
__lock_acquire+0x30c9/0x3ff0 kernel/locking/lockdep.c:3415
lock_acquire+0x170/0x3c0 kernel/locking/lockdep.c:3907
down_read+0x36/0x80 kernel/locking/rwsem.c:24
inode_lock_shared include/linux/fs.h:758 [inline]
lookup_slow fs/namei.c:1688 [inline]
walk_component+0x798/0xda0 fs/namei.c:1811
lookup_last fs/namei.c:2274 [inline]
path_lookupat+0x1ff/0x8d0 fs/namei.c:2319
filename_lookup+0x1ac/0x5a0 fs/namei.c:2349
create_local_trace_uprobe+0x82/0x490 kernel/trace/trace_uprobe.c:1356
perf_uprobe_init+0x128/0x200 kernel/trace/trace_event_perf.c:317
perf_uprobe_event_init+0xf8/0x190 kernel/events/core.c:8587
perf_try_init_event+0x124/0x2e0 kernel/events/core.c:9860
perf_init_event kernel/events/core.c:9891 [inline]
perf_event_alloc.part.0+0x1b16/0x2eb0 kernel/events/core.c:10165
perf_event_alloc kernel/events/core.c:10535 [inline]
__do_sys_perf_event_open kernel/events/core.c:10636 [inline]
__se_sys_perf_event_open+0x550/0x2720 kernel/events/core.c:10525
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45cb29
Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f3da8434c78 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
RAX: ffffffffffffffda RBX: 00000000004fa880 RCX: 000000000045cb29
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000180
RBP: 000000000078c040 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000845 R14: 00000000004cb37d R15: 00007f3da84356d4
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'.
8021q: adding VLAN 0 to HW filter on device bond186
bond0: Enslaving bond186 as an active interface with an up link
EXT4-fs (loop1): VFS: Can't find ext4 filesystem
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'.
EXT4-fs (loop1): VFS: Can't find ext4 filesystem
8021q: adding VLAN 0 to HW filter on device bond187
bond0: Enslaving bond187 as an active interface with an up link
EXT4-fs (loop1): VFS: Can't find ext4 filesystem
EXT4-fs (loop1): VFS: Can't find ext4 filesystem
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'.
EXT4-fs (loop1): VFS: Can't find ext4 filesystem
8021q: adding VLAN 0 to HW filter on device bond188
bond0: Enslaving bond188 as an active interface with an up link
EXT4-fs (loop1): VFS: Can't find ext4 filesystem
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'.
8021q: adding VLAN 0 to HW filter on device bond189
bond0: Enslaving bond189 as an active interface with an up link
EXT4-fs (loop1): VFS: Can't find ext4 filesystem
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'.
8021q: adding VLAN 0 to HW filter on device bond190
bond0: Enslaving bond190 as an active interface with an up link
EXT4-fs (loop1): Can't read superblock on 2nd try
EXT4-fs (loop1): Can't read superblock on 2nd try
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'.
EXT4-fs (loop1): Can't read superblock on 2nd try
8021q: adding VLAN 0 to HW filter on device bond191
bond0: Enslaving bond191 as an active interface with an up link

---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,

Jul 18, 2021, 1:32:27 AM7/18/21

to syzkaller...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: fcfbdfe9626e Linux 4.19.197
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1235696a300000
kernel config: https://syzkaller.appspot.com/x/.config?x=2dedd11d3941c171
dashboard link: https://syzkaller.appspot.com/bug?extid=accdedfdaea55738ab96
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=143cbf78300000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+accded...@syzkaller.appspotmail.com

overlayfs: './bus' not a directory

overlayfs: './bus' not a directory
overlayfs: './bus' not a directory
overlayfs: './bus' not a directory

======================================================

WARNING: possible circular locking dependency detected

4.19.197-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.2/14753 is trying to acquire lock:

overlayfs: './bus' not a directory

00000000e101582f (&ovl_i_mutex_dir_key[depth]){++++}, at: inode_lock_shared include/linux/fs.h:758 [inline]
00000000e101582f (&ovl_i_mutex_dir_key[depth]){++++}, at: lookup_slow fs/namei.c:1688 [inline]
00000000e101582f (&ovl_i_mutex_dir_key[depth]){++++}, at: walk_component+0x798/0xda0 fs/namei.c:1811

but task is already holding lock:

000000007288cee2 (&sig->cred_guard_mutex){+.+.}, at: prepare_bprm_creds fs/exec.c:1419 [inline]
000000007288cee2 (&sig->cred_guard_mutex){+.+.}, at: __do_execve_file+0x38c/0x2360 fs/exec.c:1762

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #3 (&sig->cred_guard_mutex){+.+.}:
lock_trace fs/proc/base.c:402 [inline]

proc_pid_stack+0x160/0x350 fs/proc/base.c:452

-> #0 (&ovl_i_mutex_dir_key[depth]){++++}:

down_read+0x36/0x80 kernel/locking/rwsem.c:24
inode_lock_shared include/linux/fs.h:758 [inline]
lookup_slow fs/namei.c:1688 [inline]
walk_component+0x798/0xda0 fs/namei.c:1811

do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe

other info that might help us debug this:

Chain exists of:

&ovl_i_mutex_dir_key[depth] --> &p->lock --> &sig->cred_guard_mutex

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&sig->cred_guard_mutex);
lock(&p->lock);
lock(&sig->cred_guard_mutex);

lock(&ovl_i_mutex_dir_key[depth]);

*** DEADLOCK ***

1 lock held by syz-executor.2/14753:
#0: 000000007288cee2 (&sig->cred_guard_mutex){+.+.}, at: prepare_bprm_creds fs/exec.c:1419 [inline]
#0: 000000007288cee2 (&sig->cred_guard_mutex){+.+.}, at: __do_execve_file+0x38c/0x2360 fs/exec.c:1762

stack backtrace:
CPU: 0 PID: 14753 Comm: syz-executor.2 Not tainted 4.19.197-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]

dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
print_circular_bug.constprop.0.cold+0x2d7/0x41e kernel/locking/lockdep.c:1222
check_prev_add kernel/locking/lockdep.c:1866 [inline]
check_prevs_add kernel/locking/lockdep.c:1979 [inline]
validate_chain kernel/locking/lockdep.c:2420 [inline]
__lock_acquire+0x30c9/0x3ff0 kernel/locking/lockdep.c:3416
lock_acquire+0x170/0x3c0 kernel/locking/lockdep.c:3908

down_read+0x36/0x80 kernel/locking/rwsem.c:24
inode_lock_shared include/linux/fs.h:758 [inline]
lookup_slow fs/namei.c:1688 [inline]
walk_component+0x798/0xda0 fs/namei.c:1811

link_path_walk.part.0+0x901/0x1230 fs/namei.c:2142
link_path_walk fs/namei.c:2073 [inline]
path_openat+0x1db/0x2df0 fs/namei.c:3536
do_filp_open+0x18c/0x3f0 fs/namei.c:3567
do_open_execat+0x11d/0x5b0 fs/exec.c:853
__do_execve_file+0x1a8b/0x2360 fs/exec.c:1770
do_execveat_common fs/exec.c:1879 [inline]
do_execve+0x35/0x50 fs/exec.c:1896
__do_sys_execve fs/exec.c:1977 [inline]
__se_sys_execve fs/exec.c:1972 [inline]
__x64_sys_execve+0x7c/0xa0 fs/exec.c:1972
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4665d9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f4e4858d188 EFLAGS: 00000246 ORIG_RAX: 000000000000003b
RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665d9
RDX: 0000000020000f40 RSI: 0000000020000d80 RDI: 0000000020000780
RBP: 00000000004bfcb9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80
R13: 00007ffce1049c1f R14: 00007f4e4858d300 R15: 0000000000022000

overlayfs: './bus' not a directory
overlayfs: './bus' not a directory
overlayfs: './bus' not a directory
overlayfs: './bus' not a directory