possible deadlock in fuse_reverse_inval_entry

7 views
Skip to first unread message

syzbot

unread,
Aug 10, 2021, 12:41:19 AM8/10/21
to syzkaller...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: 46914f96189b Linux 4.14.243
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14ac5dbe300000
kernel config: https://syzkaller.appspot.com/x/.config?x=4d036f77f7dc4ac4
dashboard link: https://syzkaller.appspot.com/bug?extid=37916bd093148488c883
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12e315e6300000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11746029300000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+37916b...@syzkaller.appspotmail.com

============================================
WARNING: possible recursive locking detected
4.14.243-syzkaller #0 Not tainted
--------------------------------------------
syz-executor847/7985 is trying to acquire lock:
(&type->i_mutex_dir_key#7){++++}, at: [<ffffffff822e2273>] inode_lock include/linux/fs.h:719 [inline]
(&type->i_mutex_dir_key#7){++++}, at: [<ffffffff822e2273>] fuse_reverse_inval_entry+0x2a3/0x5e0 fs/fuse/dir.c:991

but task is already holding lock:
(&type->i_mutex_dir_key#7){++++}, at: [<ffffffff822e2069>] inode_lock include/linux/fs.h:719 [inline]
(&type->i_mutex_dir_key#7){++++}, at: [<ffffffff822e2069>] fuse_reverse_inval_entry+0x99/0x5e0 fs/fuse/dir.c:972

other info that might help us debug this:
Possible unsafe locking scenario:

CPU0
----
lock(&type->i_mutex_dir_key#7);
lock(&type->i_mutex_dir_key#7);

*** DEADLOCK ***

May be due to missing lock nesting notation

2 locks held by syz-executor847/7985:
#0: (&fc->killsb){.+.+}, at: [<ffffffff822d6e67>] fuse_notify_delete fs/fuse/dev.c:1575 [inline]
#0: (&fc->killsb){.+.+}, at: [<ffffffff822d6e67>] fuse_notify fs/fuse/dev.c:1812 [inline]
#0: (&fc->killsb){.+.+}, at: [<ffffffff822d6e67>] fuse_dev_do_write+0x1ec7/0x25c0 fs/fuse/dev.c:1887
#1: (&type->i_mutex_dir_key#7){++++}, at: [<ffffffff822e2069>] inode_lock include/linux/fs.h:719 [inline]
#1: (&type->i_mutex_dir_key#7){++++}, at: [<ffffffff822e2069>] fuse_reverse_inval_entry+0x99/0x5e0 fs/fuse/dir.c:972

stack backtrace:
CPU: 0 PID: 7985 Comm: syz-executor847 Not tainted 4.14.243-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
print_deadlock_bug kernel/locking/lockdep.c:1800 [inline]
check_deadlock kernel/locking/lockdep.c:1847 [inline]
validate_chain kernel/locking/lockdep.c:2448 [inline]
__lock_acquire.cold+0x180/0x97c kernel/locking/lockdep.c:3491
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
down_write+0x34/0x90 kernel/locking/rwsem.c:54
inode_lock include/linux/fs.h:719 [inline]
fuse_reverse_inval_entry+0x2a3/0x5e0 fs/fuse/dir.c:991
fuse_notify_delete fs/fuse/dev.c:1578 [inline]
fuse_notify fs/fuse/dev.c:1812 [inline]
fuse_dev_do_write+0x1f22/0x25c0 fs/fuse/dev.c:1887
fuse_dev_write+0x125/0x1a0 fs/fuse/dev.c:1971
call_write_iter include/linux/fs.h:1778 [inline]
new_sync_write fs/read_write.c:469 [inline]
__vfs_write+0x44c/0x630 fs/read_write.c:482
vfs_write+0x17f/0x4d0 fs/read_write.c:544
SYSC_write fs/read_write.c:590 [inline]
SyS_write+0xf2/0x210 fs/read_write.c:582
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x4455e9
RSP: 002b:00007f89e31302f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00000000004ce4e0 RCX: 00000000004455e9
RDX: 000000000000002e RSI: 00000000200000c0 RDI: 0000000000000003
RBP: 000000000049e0d4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000049c0d0
R13: 65


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
Reply all
Reply to author
Forward
0 new messages