[syzbot] [ext4?] WARNING: locking bug in ext4_xattr_inode_iget
10 views
Skip to first unread message
syzbot
May 8, 2023, 7:06:58 PM5/8/23
to adilger...@dilger.ca, linux...@vger.kernel.org, linux-...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com, ty...@mit.edu
Hello,
syzbot found the following issue on:
HEAD commit: 1a5304fecee5 Merge tag 'parisc-for-6.4-1' of git://git.ker..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=17680612280000
kernel config: https://syzkaller.appspot.com/x/.config?x=73a06f6ef2d5b492
dashboard link: https://syzkaller.appspot.com/bug?extid=e44749b6ba4d0434cd47
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=124dd084280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1266af88280000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/dd767dde3306/disk-1a5304fe.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/21e0fbeccd39/vmlinux-1a5304fe.xz
kernel image: https://storage.googleapis.com/syzbot-assets/dada79d4407c/bzImage-1a5304fe.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/96c8988d43c2/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e44749...@syzkaller.appspotmail.com
EXT4-fs error (device loop0): ext4_xattr_inode_iget:436: inode #12: comm syz-executor308: casefold flag without casefold feature
------------[ cut here ]------------
Looking for class "&ea_inode->i_rwsem" with key ext4_fs_type, but found a different class "&type->i_mutex_dir_key" with the same key
WARNING: CPU: 1 PID: 4993 at kernel/locking/lockdep.c:941 look_up_lock_class+0xc2/0x140 kernel/locking/lockdep.c:938
Modules linked in:
CPU: 1 PID: 4993 Comm: syz-executor308 Not tainted 6.3.0-syzkaller-13027-g1a5304fecee5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
RIP: 0010:look_up_lock_class+0xc2/0x140 kernel/locking/lockdep.c:938
Code: 8b 16 48 c7 c0 60 91 1e 90 48 39 c2 74 46 f6 05 92 87 92 03 01 75 3d c6 05 89 87 92 03 01 48 c7 c7 40 af ea 8a e8 ee 29 a4 f6 <0f> 0b eb 26 e8 15 2f 81 f9 48 c7 c7 80 ae ea 8a 89 de e8 37 ca fd
RSP: 0018:ffffc90003b7f090 EFLAGS: 00010046
RAX: adf3f2136120b500 RBX: ffffffff9005c4e0 RCX: ffff88802d63d940
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90003b7f190 R08: ffffffff81531182 R09: ffffed1017325163
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000001
R13: 1ffff9200076fe20 R14: ffff888078b36800 R15: ffffffff8d0df979
FS: 0000555555f12300(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000005fdeb8 CR3: 000000002c0ce000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
register_lock_class+0x104/0x990 kernel/locking/lockdep.c:1290
lockdep_init_map_type+0x37a/0x8e0 kernel/locking/lockdep.c:4875
ext4_xattr_inode_set_class fs/ext4/xattr.c:124 [inline]
ext4_xattr_inode_iget+0x2fa/0x5e0 fs/ext4/xattr.c:461
ext4_xattr_inode_get+0x164/0x430 fs/ext4/xattr.c:551
ext4_xattr_move_to_block fs/ext4/xattr.c:2640 [inline]
ext4_xattr_make_inode_space fs/ext4/xattr.c:2742 [inline]
ext4_expand_extra_isize_ea+0xf28/0x1d10 fs/ext4/xattr.c:2834
__ext4_expand_extra_isize+0x2f7/0x3d0 fs/ext4/inode.c:5769
ext4_try_to_expand_extra_isize fs/ext4/inode.c:5812 [inline]
__ext4_mark_inode_dirty+0x53e/0x870 fs/ext4/inode.c:5890
ext4_evict_inode+0x839/0xf20 fs/ext4/inode.c:251
evict+0x2a4/0x620 fs/inode.c:665
ext4_orphan_cleanup+0xb1e/0x13c0 fs/ext4/orphan.c:474
__ext4_fill_super fs/ext4/super.c:5556 [inline]
ext4_fill_super+0x62f7/0x6bd0 fs/ext4/super.c:5672
get_tree_bdev+0x405/0x620 fs/super.c:1303
vfs_get_tree+0x8c/0x270 fs/super.c:1510
do_new_mount+0x28f/0xae0 fs/namespace.c:3039
do_mount fs/namespace.c:3382 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3568
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f63b52faf0a
Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff577b2cd8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f63b52faf0a
RDX: 0000000020000180 RSI: 00000000200000c0 RDI: 00007fff577b2cf0
RBP: 00007fff577b2cf0 R08: 00007fff577b2d30 R09: 0000000000000435
R10: 0000000000800700 R11: 0000000000000206 R12: 0000000000000004
R13: 0000555555f122c0 R14: 0000000000800700 R15: 00007fff577b2d30
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 1a5304fecee5 Merge tag 'parisc-for-6.4-1' of git://git.ker..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=17680612280000
kernel config: https://syzkaller.appspot.com/x/.config?x=73a06f6ef2d5b492
dashboard link: https://syzkaller.appspot.com/bug?extid=e44749b6ba4d0434cd47
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=124dd084280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1266af88280000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/dd767dde3306/disk-1a5304fe.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/21e0fbeccd39/vmlinux-1a5304fe.xz
kernel image: https://storage.googleapis.com/syzbot-assets/dada79d4407c/bzImage-1a5304fe.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/96c8988d43c2/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e44749...@syzkaller.appspotmail.com
EXT4-fs error (device loop0): ext4_xattr_inode_iget:436: inode #12: comm syz-executor308: casefold flag without casefold feature
------------[ cut here ]------------
Looking for class "&ea_inode->i_rwsem" with key ext4_fs_type, but found a different class "&type->i_mutex_dir_key" with the same key
WARNING: CPU: 1 PID: 4993 at kernel/locking/lockdep.c:941 look_up_lock_class+0xc2/0x140 kernel/locking/lockdep.c:938
Modules linked in:
CPU: 1 PID: 4993 Comm: syz-executor308 Not tainted 6.3.0-syzkaller-13027-g1a5304fecee5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
RIP: 0010:look_up_lock_class+0xc2/0x140 kernel/locking/lockdep.c:938
Code: 8b 16 48 c7 c0 60 91 1e 90 48 39 c2 74 46 f6 05 92 87 92 03 01 75 3d c6 05 89 87 92 03 01 48 c7 c7 40 af ea 8a e8 ee 29 a4 f6 <0f> 0b eb 26 e8 15 2f 81 f9 48 c7 c7 80 ae ea 8a 89 de e8 37 ca fd
RSP: 0018:ffffc90003b7f090 EFLAGS: 00010046
RAX: adf3f2136120b500 RBX: ffffffff9005c4e0 RCX: ffff88802d63d940
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90003b7f190 R08: ffffffff81531182 R09: ffffed1017325163
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000001
R13: 1ffff9200076fe20 R14: ffff888078b36800 R15: ffffffff8d0df979
FS: 0000555555f12300(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000005fdeb8 CR3: 000000002c0ce000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
register_lock_class+0x104/0x990 kernel/locking/lockdep.c:1290
lockdep_init_map_type+0x37a/0x8e0 kernel/locking/lockdep.c:4875
ext4_xattr_inode_set_class fs/ext4/xattr.c:124 [inline]
ext4_xattr_inode_iget+0x2fa/0x5e0 fs/ext4/xattr.c:461
ext4_xattr_inode_get+0x164/0x430 fs/ext4/xattr.c:551
ext4_xattr_move_to_block fs/ext4/xattr.c:2640 [inline]
ext4_xattr_make_inode_space fs/ext4/xattr.c:2742 [inline]
ext4_expand_extra_isize_ea+0xf28/0x1d10 fs/ext4/xattr.c:2834
__ext4_expand_extra_isize+0x2f7/0x3d0 fs/ext4/inode.c:5769
ext4_try_to_expand_extra_isize fs/ext4/inode.c:5812 [inline]
__ext4_mark_inode_dirty+0x53e/0x870 fs/ext4/inode.c:5890
ext4_evict_inode+0x839/0xf20 fs/ext4/inode.c:251
evict+0x2a4/0x620 fs/inode.c:665
ext4_orphan_cleanup+0xb1e/0x13c0 fs/ext4/orphan.c:474
__ext4_fill_super fs/ext4/super.c:5556 [inline]
ext4_fill_super+0x62f7/0x6bd0 fs/ext4/super.c:5672
get_tree_bdev+0x405/0x620 fs/super.c:1303
vfs_get_tree+0x8c/0x270 fs/super.c:1510
do_new_mount+0x28f/0xae0 fs/namespace.c:3039
do_mount fs/namespace.c:3382 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3568
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f63b52faf0a
Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff577b2cd8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f63b52faf0a
RDX: 0000000020000180 RSI: 00000000200000c0 RDI: 00007fff577b2cf0
RBP: 00007fff577b2cf0 R08: 00007fff577b2d30 R09: 0000000000000435
R10: 0000000000800700 R11: 0000000000000206 R12: 0000000000000004
R13: 0000555555f122c0 R14: 0000000000800700 R15: 00007fff577b2d30
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Theodore Ts'o
May 22, 2023, 11:44:25 PM5/22/23
to syzbot, syzkall...@googlegroups.com
#syz test git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git test
commit 5f0839acb99f87e162cee1bfb8a9e964f2bfd7e6 (HEAD -> dev, ext4/test)
Author: Theodore Ts'o <ty...@mit.edu>
Date: Mon May 22 23:29:20 2023 -0400
ext4: set lockdep subclass for the ea_inode in ext4_xattr_inode_cache_find()
If the ea_inode has been pushed out of the inode cache while there is
still a reference in the mb_cache, the lockdep subclass will not be
set on the inode, which can lead to some lockdep false positives.
Fixes: 33d201e0277b ("xt4: fix lockdep warning about recursive inode locking")
Cc: sta...@kernel.org
Reported-by: syzbot+d4b971...@syzkaller.appspotmail.com
Reported-by: syzbot+e44749...@syzkaller.appspotmail.com
Signed-off-by: Theodore Ts'o <ty...@mit.edu>
commit 5f0839acb99f87e162cee1bfb8a9e964f2bfd7e6 (HEAD -> dev, ext4/test)
Author: Theodore Ts'o <ty...@mit.edu>
Date: Mon May 22 23:29:20 2023 -0400
ext4: set lockdep subclass for the ea_inode in ext4_xattr_inode_cache_find()
If the ea_inode has been pushed out of the inode cache while there is
still a reference in the mb_cache, the lockdep subclass will not be
set on the inode, which can lead to some lockdep false positives.
Fixes: 33d201e0277b ("xt4: fix lockdep warning about recursive inode locking")
Cc: sta...@kernel.org
Reported-by: syzbot+d4b971...@syzkaller.appspotmail.com
Reported-by: syzbot+e44749...@syzkaller.appspotmail.com
Signed-off-by: Theodore Ts'o <ty...@mit.edu>
syzbot
May 23, 2023, 12:50:32 AM5/23/23
to syzkall...@googlegroups.com, ty...@mit.edu
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING: locking bug in ext4_xattr_inode_iget
EXT4-fs error (device loop0): ext4_xattr_inode_iget:436: inode #12: comm syz-executor.0: casefold flag without casefold feature
Modules linked in:
CPU: 1 PID: 5415 Comm: syz-executor.0 Not tainted 6.4.0-rc2-syzkaller-00002-g5f0839acb99f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
RSP: 0018:ffffc90004f1f090 EFLAGS: 00010046
RAX: ec813201e1b69c00 RBX: ffffffff9005b420 RCX: ffff888027905940
FS: 00007f3eb7db1700(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
ext4_xattr_inode_get+0x164/0x430 fs/ext4/xattr.c:531
ext4_xattr_move_to_block fs/ext4/xattr.c:2620 [inline]
ext4_xattr_make_inode_space fs/ext4/xattr.c:2722 [inline]
ext4_expand_extra_isize_ea+0xf21/0x1ce0 fs/ext4/xattr.c:2814
__ext4_expand_extra_isize+0x2f7/0x3d0 fs/ext4/inode.c:5792
ext4_try_to_expand_extra_isize fs/ext4/inode.c:5835 [inline]
__ext4_mark_inode_dirty+0x53e/0x870 fs/ext4/inode.c:5913
Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3eb7db0f88 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 000000000000043a RCX: 00007f3eb708d69a
RDX: 0000000020000180 RSI: 00000000200000c0 RDI: 00007f3eb7db0fe0
RBP: 00007f3eb7db1020 R08: 00007f3eb7db1020 R09: 0000000000800700
R10: 0000000000800700 R11: 0000000000000246 R12: 0000000020000180
R13: 00000000200000c0 R14: 00007f3eb7db0fe0 R15: 0000000020000100
</TASK>
Tested on:
commit: 5f0839ac ext4: set lockdep subclass for the ea_inode i..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git test
console output: https://syzkaller.appspot.com/x/log.txt?x=16eaa01e280000
kernel config: https://syzkaller.appspot.com/x/.config?x=94af80bb8ddd23c4
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING: locking bug in ext4_xattr_inode_iget
EXT4-fs error (device loop0): ext4_xattr_inode_iget:436: inode #12: comm syz-executor.0: casefold flag without casefold feature
------------[ cut here ]------------
Looking for class "&ea_inode->i_rwsem" with key ext4_fs_type, but found a different class "&type->i_mutex_dir_key" with the same key
WARNING: CPU: 1 PID: 5415 at kernel/locking/lockdep.c:941 look_up_lock_class+0xc2/0x140 kernel/locking/lockdep.c:938
Looking for class "&ea_inode->i_rwsem" with key ext4_fs_type, but found a different class "&type->i_mutex_dir_key" with the same key
Modules linked in:
CPU: 1 PID: 5415 Comm: syz-executor.0 Not tainted 6.4.0-rc2-syzkaller-00002-g5f0839acb99f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
RIP: 0010:look_up_lock_class+0xc2/0x140 kernel/locking/lockdep.c:938
Code: 8b 16 48 c7 c0 60 81 1e 90 48 39 c2 74 46 f6 05 0f 77 92 03 01 75 3d c6 05 06 77 92 03 01 48 c7 c7 c0 ad ea 8a e8 0e 0a a4 f6 <0f> 0b eb 26 e8 d5 2d 81 f9 48 c7 c7 00 ad ea 8a 89 de e8 37 ca fd
RSP: 0018:ffffc90004f1f090 EFLAGS: 00010046
RAX: ec813201e1b69c00 RBX: ffffffff9005b420 RCX: ffff888027905940
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90004f1f190 R08: ffffffff815301a2 R09: ffffed1017325163
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000001
R13: 1ffff920009e3e20 R14: ffff888077245e00 R15: ffffffff8d0df6f9
FS: 00007f3eb7db1700(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe9e4fac3b0 CR3: 00000000783f3000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
register_lock_class+0x104/0x990 kernel/locking/lockdep.c:1290
lockdep_init_map_type+0x37a/0x8e0 kernel/locking/lockdep.c:4875
ext4_xattr_inode_set_class fs/ext4/xattr.c:124 [inline]
ext4_xattr_inode_iget+0x1f1/0x490 fs/ext4/xattr.c:444
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
register_lock_class+0x104/0x990 kernel/locking/lockdep.c:1290
lockdep_init_map_type+0x37a/0x8e0 kernel/locking/lockdep.c:4875
ext4_xattr_inode_set_class fs/ext4/xattr.c:124 [inline]
ext4_xattr_inode_get+0x164/0x430 fs/ext4/xattr.c:531
ext4_xattr_move_to_block fs/ext4/xattr.c:2620 [inline]
ext4_xattr_make_inode_space fs/ext4/xattr.c:2722 [inline]
ext4_expand_extra_isize_ea+0xf21/0x1ce0 fs/ext4/xattr.c:2814
__ext4_expand_extra_isize+0x2f7/0x3d0 fs/ext4/inode.c:5792
ext4_try_to_expand_extra_isize fs/ext4/inode.c:5835 [inline]
__ext4_mark_inode_dirty+0x53e/0x870 fs/ext4/inode.c:5913
ext4_evict_inode+0x839/0xf20 fs/ext4/inode.c:251
evict+0x2a4/0x620 fs/inode.c:665
ext4_orphan_cleanup+0xb1e/0x13c0 fs/ext4/orphan.c:474
__ext4_fill_super fs/ext4/super.c:5556 [inline]
ext4_fill_super+0x6392/0x6c60 fs/ext4/super.c:5672
evict+0x2a4/0x620 fs/inode.c:665
ext4_orphan_cleanup+0xb1e/0x13c0 fs/ext4/orphan.c:474
__ext4_fill_super fs/ext4/super.c:5556 [inline]
get_tree_bdev+0x405/0x620 fs/super.c:1303
vfs_get_tree+0x8c/0x270 fs/super.c:1510
do_new_mount+0x28f/0xae0 fs/namespace.c:3039
do_mount fs/namespace.c:3382 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3568
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f3eb708d69a
vfs_get_tree+0x8c/0x270 fs/super.c:1510
do_new_mount+0x28f/0xae0 fs/namespace.c:3039
do_mount fs/namespace.c:3382 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3568
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3eb7db0f88 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 000000000000043a RCX: 00007f3eb708d69a
RDX: 0000000020000180 RSI: 00000000200000c0 RDI: 00007f3eb7db0fe0
RBP: 00007f3eb7db1020 R08: 00007f3eb7db1020 R09: 0000000000800700
R10: 0000000000800700 R11: 0000000000000246 R12: 0000000020000180
R13: 00000000200000c0 R14: 00007f3eb7db0fe0 R15: 0000000020000100
</TASK>
Tested on:
commit: 5f0839ac ext4: set lockdep subclass for the ea_inode i..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git test
console output: https://syzkaller.appspot.com/x/log.txt?x=16eaa01e280000
kernel config: https://syzkaller.appspot.com/x/.config?x=94af80bb8ddd23c4
dashboard link: https://syzkaller.appspot.com/bug?extid=e44749b6ba4d0434cd47
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
Note: no patches were applied.
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
Theodore Ts'o
May 23, 2023, 12:21:34 PM5/23/23
to syzbot, syzkall...@googlegroups.com
commit 6a5695213ee67fc52e60fd1a6078266b026828d9
ext4: disallow ea_inodes with extended attributes
An ea_inode stores the value of an extended attribute; it can not have
extended attributes itself, or this will cause recursive nightmares.
Add a check in ext4_iget() to make sure this is the case.
Cc: sta...@kernel.org
Author: Theodore Ts'o <ty...@mit.edu>
Date: Tue May 23 12:14:45 2023 -0400
ext4: disallow ea_inodes with extended attributes
An ea_inode stores the value of an extended attribute; it can not have
extended attributes itself, or this will cause recursive nightmares.
Add a check in ext4_iget() to make sure this is the case.
Cc: sta...@kernel.org
syzbot
May 23, 2023, 12:52:29 PM5/23/23
to syzkall...@googlegroups.com, ty...@mit.edu
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+e44749...@syzkaller.appspotmail.com
Tested on:
commit: 6a569521 ext4: disallow ea_inodes with extended attrib..
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+e44749...@syzkaller.appspotmail.com
Tested on:
commit: 6a569521 ext4: disallow ea_inodes with extended attrib..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git test
console output: https://syzkaller.appspot.com/x/log.txt?x=13f24ef9280000
kernel config: https://syzkaller.appspot.com/x/.config?x=94af80bb8ddd23c4
dashboard link: https://syzkaller.appspot.com/bug?extid=e44749b6ba4d0434cd47
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.
dashboard link: https://syzkaller.appspot.com/bug?extid=e44749b6ba4d0434cd47
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
Note: no patches were applied.
Reply all
Reply to author
Forward
0 new messages