[reiserfs?] possible deadlock in delete_one_xattr

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: a8ad60f2af58 Linux 4.14.305
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11e42da7480000
kernel config: https://syzkaller.appspot.com/x/.config?x=2f23dc9802022031
dashboard link: https://syzkaller.appspot.com/bug?extid=f638066b70cd49ab468e
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c38348fd389d/disk-a8ad60f2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3a775d221689/vmlinux-a8ad60f2.xz
kernel image: https://storage.googleapis.com/syzbot-assets/32e71e04d2b4/bzImage-a8ad60f2.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f63806...@syzkaller.appspotmail.com

REISERFS (device loop2): journal params: device loop2, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
REISERFS (device loop2): checking transaction log (loop2)
REISERFS (device loop2): Using r5 hash to sort names
REISERFS (device loop2): Created .reiserfs_priv - reserved for xattr storage.
======================================================
WARNING: possible circular locking dependency detected
4.14.305-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.2/11577 is trying to acquire lock:
(&type->i_mutex_dir_key#12/2){+.+.}, at: [<ffffffff81b3b23a>] inode_lock_nested include/linux/fs.h:754 [inline]
(&type->i_mutex_dir_key#12/2){+.+.}, at: [<ffffffff81b3b23a>] xattr_rmdir fs/reiserfs/xattr.c:106 [inline]
(&type->i_mutex_dir_key#12/2){+.+.}, at: [<ffffffff81b3b23a>] delete_one_xattr+0x11a/0x2a0 fs/reiserfs/xattr.c:338

but task is already holding lock:
(&type->i_mutex_dir_key#12/3){+.+.}, at: [<ffffffff81b3cae2>] inode_lock_nested include/linux/fs.h:754 [inline]
(&type->i_mutex_dir_key#12/3){+.+.}, at: [<ffffffff81b3cae2>] reiserfs_for_each_xattr+0x5f2/0x830 fs/reiserfs/xattr.c:309

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (&type->i_mutex_dir_key#12/3){+.+.}:
down_write_nested+0x36/0x90 kernel/locking/rwsem.c:172
inode_lock_nested include/linux/fs.h:754 [inline]
open_xa_root fs/reiserfs/xattr.c:127 [inline]
open_xa_dir+0x115/0x600 fs/reiserfs/xattr.c:152
reiserfs_for_each_xattr+0x159/0x830 fs/reiserfs/xattr.c:252
reiserfs_delete_xattrs+0x1c/0x90 fs/reiserfs/xattr.c:364
reiserfs_evict_inode+0x2b4/0x4a0 fs/reiserfs/inode.c:53
evict+0x2c8/0x700 fs/inode.c:554
iput_final fs/inode.c:1523 [inline]
iput+0x458/0x7e0 fs/inode.c:1550
dentry_unlink_inode+0x25c/0x310 fs/dcache.c:387
__dentry_kill+0x320/0x550 fs/dcache.c:591
dentry_kill fs/dcache.c:632 [inline]
dput.part.0+0x4b5/0x710 fs/dcache.c:847
dput+0x1b/0x30 fs/dcache.c:811
SYSC_renameat2 fs/namei.c:4650 [inline]
SyS_renameat2+0x96a/0xad0 fs/namei.c:4535
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x5e/0xd3

-> #0 (&type->i_mutex_dir_key#12/2){+.+.}:
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
down_write_nested+0x36/0x90 kernel/locking/rwsem.c:172
inode_lock_nested include/linux/fs.h:754 [inline]
xattr_rmdir fs/reiserfs/xattr.c:106 [inline]
delete_one_xattr+0x11a/0x2a0 fs/reiserfs/xattr.c:338
reiserfs_for_each_xattr+0x603/0x830 fs/reiserfs/xattr.c:311
reiserfs_delete_xattrs+0x1c/0x90 fs/reiserfs/xattr.c:364
reiserfs_evict_inode+0x2b4/0x4a0 fs/reiserfs/inode.c:53
evict+0x2c8/0x700 fs/inode.c:554
iput_final fs/inode.c:1523 [inline]
iput+0x458/0x7e0 fs/inode.c:1550
dentry_unlink_inode+0x25c/0x310 fs/dcache.c:387
d_delete+0x1c5/0x280 fs/dcache.c:2417
vfs_rmdir.part.0+0x260/0x390 fs/namei.c:3922
vfs_rmdir fs/namei.c:3895 [inline]
do_rmdir+0x334/0x3c0 fs/namei.c:3970
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x5e/0xd3

other info that might help us debug this:

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&type->i_mutex_dir_key#12/3);
lock(&type->i_mutex_dir_key#12/2);
lock(&type->i_mutex_dir_key#12/3);
lock(&type->i_mutex_dir_key#12/2);

*** DEADLOCK ***

3 locks held by syz-executor.2/11577:
#0: (sb_writers#19){.+.+}, at: [<ffffffff818e1f2a>] sb_start_write include/linux/fs.h:1551 [inline]
#0: (sb_writers#19){.+.+}, at: [<ffffffff818e1f2a>] mnt_want_write+0x3a/0xb0 fs/namespace.c:386
#1: (&type->i_mutex_dir_key#12/1){+.+.}, at: [<ffffffff818a9cde>] inode_lock_nested include/linux/fs.h:754 [inline]
#1: (&type->i_mutex_dir_key#12/1){+.+.}, at: [<ffffffff818a9cde>] do_rmdir+0x1de/0x3c0 fs/namei.c:3958
#2: (&type->i_mutex_dir_key#12/3){+.+.}, at: [<ffffffff81b3cae2>] inode_lock_nested include/linux/fs.h:754 [inline]
#2: (&type->i_mutex_dir_key#12/3){+.+.}, at: [<ffffffff81b3cae2>] reiserfs_for_each_xattr+0x5f2/0x830 fs/reiserfs/xattr.c:309

stack backtrace:
CPU: 1 PID: 11577 Comm: syz-executor.2 Not tainted 4.14.305-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
print_circular_bug.constprop.0.cold+0x2d7/0x41e kernel/locking/lockdep.c:1258
check_prev_add kernel/locking/lockdep.c:1905 [inline]
check_prevs_add kernel/locking/lockdep.c:2022 [inline]
validate_chain kernel/locking/lockdep.c:2464 [inline]
__lock_acquire+0x2e0e/0x3f20 kernel/locking/lockdep.c:3491
lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
down_write_nested+0x36/0x90 kernel/locking/rwsem.c:172
inode_lock_nested include/linux/fs.h:754 [inline]
xattr_rmdir fs/reiserfs/xattr.c:106 [inline]
delete_one_xattr+0x11a/0x2a0 fs/reiserfs/xattr.c:338
reiserfs_for_each_xattr+0x603/0x830 fs/reiserfs/xattr.c:311
reiserfs_delete_xattrs+0x1c/0x90 fs/reiserfs/xattr.c:364
reiserfs_evict_inode+0x2b4/0x4a0 fs/reiserfs/inode.c:53
evict+0x2c8/0x700 fs/inode.c:554
iput_final fs/inode.c:1523 [inline]
iput+0x458/0x7e0 fs/inode.c:1550
dentry_unlink_inode+0x25c/0x310 fs/dcache.c:387
d_delete+0x1c5/0x280 fs/dcache.c:2417
vfs_rmdir.part.0+0x260/0x390 fs/namei.c:3922
vfs_rmdir fs/namei.c:3895 [inline]
do_rmdir+0x334/0x3c0 fs/namei.c:3970
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x5e/0xd3
RIP: 0033:0x7f3b8a3510f9
RSP: 002b:00007f3b888c3168 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f3b8a470f80 RCX: 00007f3b8a3510f9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000100
RBP: 00007f3b8a3acae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffcca5e779f R14: 00007f3b888c3300 R15: 0000000000022000
REISERFS (device loop2): found reiserfs format "3.6" with non-standard journal
REISERFS (device loop2): using ordered data mode
reiserfs: using flush barriers
REISERFS (device loop2): journal params: device loop2, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
REISERFS (device loop3): found reiserfs format "3.6" with non-standard journal
REISERFS (device loop2): checking transaction log (loop2)
REISERFS (device loop3): using ordered data mode
reiserfs: using flush barriers
REISERFS (device loop3): journal params: device loop3, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
REISERFS (device loop2): Using r5 hash to sort names
REISERFS (device loop2): Created .reiserfs_priv - reserved for xattr storage.
REISERFS (device loop3): checking transaction log (loop3)
REISERFS (device loop3): Using r5 hash to sort names
REISERFS (device loop3): Created .reiserfs_priv - reserved for xattr storage.
REISERFS (device loop2): found reiserfs format "3.6" with non-standard journal
REISERFS (device loop2): using ordered data mode
reiserfs: using flush barriers
REISERFS (device loop2): journal params: device loop2, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
REISERFS (device loop2): checking transaction log (loop2)
REISERFS (device loop2): Using r5 hash to sort names
REISERFS (device loop2): Created .reiserfs_priv - reserved for xattr storage.
REISERFS (device loop3): found reiserfs format "3.6" with non-standard journal
REISERFS (device loop3): using ordered data mode
reiserfs: using flush barriers
REISERFS (device loop3): journal params: device loop3, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
REISERFS (device loop2): found reiserfs format "3.6" with non-standard journal
REISERFS (device loop2): using ordered data mode
reiserfs: using flush barriers
REISERFS (device loop2): journal params: device loop2, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
REISERFS (device loop3): checking transaction log (loop3)
REISERFS (device loop2): checking transaction log (loop2)
REISERFS (device loop3): Using r5 hash to sort names
REISERFS (device loop3): Created .reiserfs_priv - reserved for xattr storage.
REISERFS (device loop2): Using r5 hash to sort names
REISERFS (device loop2): Created .reiserfs_priv - reserved for xattr storage.
REISERFS (device loop3): found reiserfs format "3.6" with non-standard journal
REISERFS (device loop3): using ordered data mode
reiserfs: using flush barriers
REISERFS (device loop3): journal params: device loop3, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
REISERFS (device loop3): checking transaction log (loop3)
REISERFS (device loop3): Using r5 hash to sort names
REISERFS (device loop3): Created .reiserfs_priv - reserved for xattr storage.
ntfs: volume version 3.1.
ntfs: volume version 3.1.
ntfs: volume version 3.1.
ntfs: volume version 3.1.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'.
BTRFS info (device loop1): enabling inode map caching
BTRFS warning (device loop1): excessive commit interval 622039222
BTRFS info (device loop1): force zlib compression
BTRFS info (device loop1): using free space tree
BTRFS info (device loop1): has skinny extents
BTRFS info (device loop1): enabling inode map caching
BTRFS warning (device loop1): excessive commit interval 622039222
BTRFS info (device loop1): force zlib compression
BTRFS info (device loop1): using free space tree
BTRFS info (device loop1): has skinny extents


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.