[syzbot] [ext4?] possible deadlock in ext4_setattr

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 358a161a6a9e Merge branch 'for-next/fixes' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=166001ba480000
kernel config: https://syzkaller.appspot.com/x/.config?x=2573056c6a11f00d
dashboard link: https://syzkaller.appspot.com/bug?extid=cbb68193bdb95af4340a
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1287585a480000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=167d644a480000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/99d14e0f4c19/disk-358a161a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/23275b612976/vmlinux-358a161a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ed79195fac61/Image-358a161a.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/6e1f0d31d9b5/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+cbb681...@syzkaller.appspotmail.com

EXT4-fs error (device loop0): ext4_mb_mark_diskspace_used:3789: comm syz-executor184: Allocating blocks 44-48 which overlap fs metadata
EXT4-fs error (device loop0): ext4_xattr_block_set:2175: inode #12: comm syz-executor184: bad block 0
======================================================
WARNING: possible circular locking dependency detected
6.2.0-rc3-syzkaller-16369-g358a161a6a9e #0 Not tainted
------------------------------------------------------
syz-executor184/4449 is trying to acquire lock:
ffff0000cb1ae540 (mapping.invalidate_lock){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:801 [inline]
ffff0000cb1ae540 (mapping.invalidate_lock){++++}-{3:3}, at: ext4_setattr+0x804/0xb38 fs/ext4/inode.c:5545

but task is already holding lock:
ffff0000cb1ae3a0 (&ea_inode->i_rwsem#8/1){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:756 [inline]
ffff0000cb1ae3a0 (&ea_inode->i_rwsem#8/1){+.+.}-{3:3}, at: do_truncate+0xf8/0x154 fs/open.c:63

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #3 (&ea_inode->i_rwsem#8/1){+.+.}-{3:3}:
down_write+0x5c/0x88 kernel/locking/rwsem.c:1562
inode_lock include/linux/fs.h:756 [inline]
ext4_xattr_inode_create fs/ext4/xattr.c:1457 [inline]
ext4_xattr_inode_lookup_create fs/ext4/xattr.c:1540 [inline]
ext4_xattr_set_entry+0xdf4/0xe40 fs/ext4/xattr.c:1669
ext4_xattr_block_set+0x3d0/0x1404 fs/ext4/xattr.c:1975
ext4_xattr_set_handle+0x724/0x9a0 fs/ext4/xattr.c:2390
ext4_xattr_set+0x104/0x1d4 fs/ext4/xattr.c:2492
ext4_xattr_trusted_set+0x4c/0x64 fs/ext4/xattr_trusted.c:38
__vfs_setxattr+0x290/0x29c fs/xattr.c:202
__vfs_setxattr_noperm+0xcc/0x320 fs/xattr.c:236
__vfs_setxattr_locked+0x16c/0x194 fs/xattr.c:297
vfs_setxattr+0xf4/0x1f4 fs/xattr.c:323
do_setxattr fs/xattr.c:608 [inline]
setxattr fs/xattr.c:631 [inline]
path_setxattr+0x32c/0x424 fs/xattr.c:650
__do_sys_setxattr fs/xattr.c:666 [inline]
__se_sys_setxattr fs/xattr.c:662 [inline]
__arm64_sys_setxattr+0x2c/0x40 fs/xattr.c:662
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x48/0x140 arch/arm64/kernel/syscall.c:197
el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584

-> #2 (&ei->xattr_sem){++++}-{3:3}:
down_write+0x5c/0x88 kernel/locking/rwsem.c:1562
ext4_write_lock_xattr fs/ext4/xattr.h:155 [inline]
ext4_xattr_set_handle+0xd0/0x9a0 fs/ext4/xattr.c:2305
ext4_initxattrs+0x50/0xac fs/ext4/xattr_security.c:44
security_inode_init_security+0x208/0x278 security/security.c:1147
ext4_init_security+0x44/0x58 fs/ext4/xattr_security.c:58
__ext4_new_inode+0x1a88/0x1c78 fs/ext4/ialloc.c:1324
ext4_create+0x124/0x26c fs/ext4/namei.c:2809
lookup_open fs/namei.c:3413 [inline]
open_last_lookups fs/namei.c:3481 [inline]
path_openat+0x804/0x11f0 fs/namei.c:3711
do_filp_open+0xdc/0x1b8 fs/namei.c:3741
do_sys_openat2+0xb8/0x22c fs/open.c:1310
do_sys_open fs/open.c:1326 [inline]
__do_sys_openat fs/open.c:1342 [inline]
__se_sys_openat fs/open.c:1337 [inline]
__arm64_sys_openat+0xb0/0xe0 fs/open.c:1337
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x48/0x140 arch/arm64/kernel/syscall.c:197
el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584

-> #1 (jbd2_handle){.+.+}-{0:0}:
start_this_handle+0x6e0/0x7fc fs/jbd2/transaction.c:463
jbd2__journal_start+0x148/0x1f0 fs/jbd2/transaction.c:520
__ext4_journal_start_sb+0x158/0x210 fs/ext4/ext4_jbd2.c:111
__ext4_journal_start fs/ext4/ext4_jbd2.h:326 [inline]
ext4_truncate+0x3b4/0x72c fs/ext4/inode.c:4315
ext4_setattr+0x900/0xb38 fs/ext4/inode.c:5622
notify_change+0x738/0x7d0 fs/attr.c:482
do_truncate+0x10c/0x154 fs/open.c:65
do_sys_ftruncate+0x1b4/0x1c4 fs/open.c:193
__do_sys_ftruncate fs/open.c:204 [inline]
__se_sys_ftruncate fs/open.c:202 [inline]
__arm64_sys_ftruncate+0x28/0x38 fs/open.c:202
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x48/0x140 arch/arm64/kernel/syscall.c:197
el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584

-> #0 (mapping.invalidate_lock){++++}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3097 [inline]
check_prevs_add kernel/locking/lockdep.c:3216 [inline]
validate_chain kernel/locking/lockdep.c:3831 [inline]
__lock_acquire+0x1530/0x3084 kernel/locking/lockdep.c:5055
lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5668
down_write+0x5c/0x88 kernel/locking/rwsem.c:1562
filemap_invalidate_lock include/linux/fs.h:801 [inline]
ext4_setattr+0x804/0xb38 fs/ext4/inode.c:5545
notify_change+0x738/0x7d0 fs/attr.c:482
do_truncate+0x10c/0x154 fs/open.c:65
handle_truncate+0xf4/0x154 fs/namei.c:3216
do_open fs/namei.c:3561 [inline]
path_openat+0xee0/0x11f0 fs/namei.c:3714
do_filp_open+0xdc/0x1b8 fs/namei.c:3741
do_sys_openat2+0xb8/0x22c fs/open.c:1310
do_sys_open fs/open.c:1326 [inline]
__do_sys_openat fs/open.c:1342 [inline]
__se_sys_openat fs/open.c:1337 [inline]
__arm64_sys_openat+0xb0/0xe0 fs/open.c:1337
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x48/0x140 arch/arm64/kernel/syscall.c:197
el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584

other info that might help us debug this:

Chain exists of:
mapping.invalidate_lock --> &ei->xattr_sem --> &ea_inode->i_rwsem#8/1

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&ea_inode->i_rwsem#8/1);
lock(&ei->xattr_sem);
lock(&ea_inode->i_rwsem#8/1);
lock(mapping.invalidate_lock);

*** DEADLOCK ***

2 locks held by syz-executor184/4449:
#0: ffff0000c6723460 (sb_writers#3){.+.+}-{0:0}, at: mnt_want_write+0x20/0x64 fs/namespace.c:508
#1: ffff0000cb1ae3a0 (&ea_inode->i_rwsem#8/1){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:756 [inline]
#1: ffff0000cb1ae3a0 (&ea_inode->i_rwsem#8/1){+.+.}-{3:3}, at: do_truncate+0xf8/0x154 fs/open.c:63

stack backtrace:
CPU: 1 PID: 4449 Comm: syz-executor184 Not tainted 6.2.0-rc3-syzkaller-16369-g358a161a6a9e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call trace:
dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:156
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:163
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x104/0x16c lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
print_circular_bug+0x2c4/0x2c8 kernel/locking/lockdep.c:2055
check_noncircular+0x14c/0x154 kernel/locking/lockdep.c:2177
check_prev_add kernel/locking/lockdep.c:3097 [inline]
check_prevs_add kernel/locking/lockdep.c:3216 [inline]
validate_chain kernel/locking/lockdep.c:3831 [inline]
__lock_acquire+0x1530/0x3084 kernel/locking/lockdep.c:5055
lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5668
down_write+0x5c/0x88 kernel/locking/rwsem.c:1562
filemap_invalidate_lock include/linux/fs.h:801 [inline]
ext4_setattr+0x804/0xb38 fs/ext4/inode.c:5545
notify_change+0x738/0x7d0 fs/attr.c:482
do_truncate+0x10c/0x154 fs/open.c:65
handle_truncate+0xf4/0x154 fs/namei.c:3216
do_open fs/namei.c:3561 [inline]
path_openat+0xee0/0x11f0 fs/namei.c:3714
do_filp_open+0xdc/0x1b8 fs/namei.c:3741
do_sys_openat2+0xb8/0x22c fs/open.c:1310
do_sys_open fs/open.c:1326 [inline]
__do_sys_openat fs/open.c:1342 [inline]
__se_sys_openat fs/open.c:1337 [inline]
__arm64_sys_openat+0xb0/0xe0 fs/open.c:1337
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x48/0x140 arch/arm64/kernel/syscall.c:197
el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

[syzbot]

syzbot has bisected this issue to:

commit a3c06ae158dd6fa8336157c31d9234689d068d02
Author: Parav Pandit <pa...@nvidia.com>
Date: Tue Jan 5 10:32:03 2021 +0000

vdpa_sim_net: Add support for user supported devices

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=16e372c6280000
start commit: e922ba281a8d Add linux-next specific files for 20230512
git tree: linux-next
final oops: https://syzkaller.appspot.com/x/report.txt?x=15e372c6280000
console output: https://syzkaller.appspot.com/x/log.txt?x=11e372c6280000
kernel config: https://syzkaller.appspot.com/x/.config?x=17a4c2d44484b62f
dashboard link: https://syzkaller.appspot.com/bug?extid=cbb68193bdb95af4340a
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=172a21c6280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16b67fc6280000

Reported-by: syzbot+cbb681...@syzkaller.appspotmail.com
Fixes: a3c06ae158dd ("vdpa_sim_net: Add support for user supported devices")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

[Michael S. Tsirkin]

I don't see how this can be related, I don't think the test setup uses
vdpa sim at all.

--
MST

[Theodore Ts'o]

On Sun, May 14, 2023 at 04:39:36PM -0400, Michael S. Tsirkin wrote:
> On Sun, May 14, 2023 at 12:24:32PM -0700, syzbot wrote:
> > syzbot has bisected this issue to:
> >
> > commit a3c06ae158dd6fa8336157c31d9234689d068d02
> > Author: Parav Pandit <pa...@nvidia.com>
> > Date: Tue Jan 5 10:32:03 2021 +0000
> >
> > vdpa_sim_net: Add support for user supported devices
> >

> > For information about bisection process see: https://goo.gl/tpsmEJ#bisection
>
> I don't see how this can be related, I don't think the test setup uses
> vdpa sim at all.

Yeah, it's totally bogus. You can see it by looking at the bisection
log[1].

[1] https://syzkaller.appspot.com/text?tag=Log&x=16e372c6280000

The initial bisection logs make it clear that it is *trivially* easy
to reproduce, and that the failure signature is:

crashed: possible deadlock in {ext4_xattr_set_handle,ext4_setattr,ext4_xattr_set_handle}

However, somewhere in the bisection, we start seeing this:

run #0: boot failed: WARNING in kvm_wait
run #1: boot failed: WARNING in kvm_wait
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK

This is a completely different failure signature, and the "WARNING in
kvm_wait" should be ignored, and this should be considered a "git
bisect good". However, the syzkaller bisection doesn't understand
this, and so it gets sent down the primrose path. :-(

Unfortunately, there isn't a good way to tell the syzkaller bisection,
"go home, your drunk", and to tell it to try again, perhaps with a
human-supplied discriminator of what should be considered a valid
failure signature.

In the ideal world, a human should be able to give it a setup set of
bisection "good" and "bad" commits, along with a regexp for what a
failure should look like, and perhaps with a hint of how many tries it
should use before assuming that a bisection result is "good", and to
teach it to assume that the bisection has "bad" after seeing a single
failure signature.

If the above is too much to ask, in the slightly-less-ideal world,
there would be a way to give "#syz test" a count argument, so we could
have syzkaller try N times, for when we need to do a manual bisection
using "#syz test"....

- Ted

[Theodore Ts'o]

On Sun, May 14, 2023 at 08:53:21PM -0400, Theodore Ts'o wrote:
> However, somewhere in the bisection, we start seeing this:
>
> run #0: boot failed: WARNING in kvm_wait

...

>
> This is a completely different failure signature, and the "WARNING in
> kvm_wait" should be ignored, and this should be considered a "git
> bisect good". However, the syzkaller bisection doesn't understand
> this, and so it gets sent down the primrose path. :-(

Sorry, I spoke too soon. It did get this right; it looks like it
ignores "boot failed: " messages, although it treats is as one of the
10 tries for a particular commit.

I don't see anything obviously wrong with the bisect log, although
obviously I'd want to retry some of the "All OK" results to see if
somehow things got confused. In any case, there have been a large
number of timees where the bisection results have been less than
correct, and unfortunately, there's not much that can be done other
than just to ignore them. It would be nice to have a human being be
able to mark the bisection as Obviously Wrong(tm), and maybe ask it do
do a slightly different bisection.

Also unfortunate is that I've had more than one case where the problem
doesn't reproduce at all using KVM, but only reproduces using #syz
test. Which means that manual bisection may be the only way for now
to work some of these.

- Ted

[Theodore Ts'o]

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v6.4-rc1

[Theodore Ts'o]

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v6.4-rc2

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in ext4_xattr_set_handle

======================================================
WARNING: possible circular locking dependency detected

6.4.0-rc1-syzkaller-gac9a78681b92 #0 Not tainted
------------------------------------------------------
syz-executor.0/5526 is trying to acquire lock:
ffff88806e1b5ac8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_write_lock_xattr fs/ext4/xattr.h:155 [inline]
ffff88806e1b5ac8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_xattr_set_handle+0x160/0x1510 fs/ext4/xattr.c:2372

but task is already holding lock:

ffff88802aabe990 (jbd2_handle){.+.+}-{0:0}, at: start_this_handle+0xfb4/0x14e0 fs/jbd2/transaction.c:461

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #3 (jbd2_handle){.+.+}-{0:0}:
start_this_handle+0xfe7/0x14e0 fs/jbd2/transaction.c:463
jbd2__journal_start+0x390/0x850 fs/jbd2/transaction.c:520
__ext4_journal_start_sb+0x411/0x5d0 fs/ext4/ext4_jbd2.c:111
__ext4_journal_start fs/ext4/ext4_jbd2.h:326 [inline]
ext4_truncate+0x54f/0x1340 fs/ext4/inode.c:4124
ext4_setattr+0x1b24/0x2880 fs/ext4/inode.c:5434
notify_change+0xb2c/0x1180 fs/attr.c:483
do_truncate+0x143/0x200 fs/open.c:66
do_sys_ftruncate+0x53a/0x770 fs/open.c:194
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

-> #2 (mapping.invalidate_lock){++++}-{3:3}:
down_write+0x92/0x200 kernel/locking/rwsem.c:1573
filemap_invalidate_lock include/linux/fs.h:820 [inline]
ext4_setattr+0x6f2/0x2880 fs/ext4/inode.c:5357
notify_change+0xb2c/0x1180 fs/attr.c:483
do_truncate+0x143/0x200 fs/open.c:66
handle_truncate fs/namei.c:3295 [inline]
do_open fs/namei.c:3640 [inline]
path_openat+0x2083/0x2750 fs/namei.c:3791
do_filp_open+0x1ba/0x410 fs/namei.c:3818
do_sys_openat2+0x16d/0x4c0 fs/open.c:1356
do_sys_open fs/open.c:1372 [inline]
__do_sys_openat fs/open.c:1388 [inline]
__se_sys_openat fs/open.c:1383 [inline]
__x64_sys_openat+0x143/0x1f0 fs/open.c:1383
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

-> #1 (&ea_inode->i_rwsem#8/1){+.+.}-{3:3}:
down_write+0x92/0x200 kernel/locking/rwsem.c:1573
inode_lock include/linux/fs.h:775 [inline]
ext4_xattr_inode_create fs/ext4/xattr.c:1524 [inline]
ext4_xattr_inode_lookup_create fs/ext4/xattr.c:1607 [inline]
ext4_xattr_set_entry+0x2b19/0x39e0 fs/ext4/xattr.c:1736
ext4_xattr_block_set+0xcb7/0x3030 fs/ext4/xattr.c:2042
ext4_xattr_set_handle+0xd8a/0x1510 fs/ext4/xattr.c:2457
ext4_xattr_set+0x144/0x360 fs/ext4/xattr.c:2559
__vfs_setxattr+0x173/0x1e0 fs/xattr.c:201
__vfs_setxattr_noperm+0x129/0x5f0 fs/xattr.c:235
__vfs_setxattr_locked+0x1d3/0x260 fs/xattr.c:296
vfs_setxattr+0x143/0x340 fs/xattr.c:322
do_setxattr+0x147/0x190 fs/xattr.c:630
setxattr+0x146/0x160 fs/xattr.c:653
path_setxattr+0x197/0x1c0 fs/xattr.c:672
__do_sys_setxattr fs/xattr.c:688 [inline]
__se_sys_setxattr fs/xattr.c:684 [inline]
__x64_sys_setxattr+0xc4/0x160 fs/xattr.c:684
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

-> #0 (&ei->xattr_sem){++++}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3108 [inline]
check_prevs_add kernel/locking/lockdep.c:3227 [inline]
validate_chain kernel/locking/lockdep.c:3842 [inline]
__lock_acquire+0x2f21/0x5df0 kernel/locking/lockdep.c:5074
lock_acquire kernel/locking/lockdep.c:5691 [inline]
lock_acquire+0x1b1/0x520 kernel/locking/lockdep.c:5656
down_write+0x92/0x200 kernel/locking/rwsem.c:1573
ext4_write_lock_xattr fs/ext4/xattr.h:155 [inline]
ext4_xattr_set_handle+0x160/0x1510 fs/ext4/xattr.c:2372
ext4_xattr_set+0x144/0x360 fs/ext4/xattr.c:2559
__vfs_setxattr+0x173/0x1e0 fs/xattr.c:201
__vfs_setxattr_noperm+0x129/0x5f0 fs/xattr.c:235
__vfs_setxattr_locked+0x1d3/0x260 fs/xattr.c:296
vfs_setxattr+0x143/0x340 fs/xattr.c:322
do_setxattr+0x147/0x190 fs/xattr.c:630
setxattr+0x146/0x160 fs/xattr.c:653
path_setxattr+0x197/0x1c0 fs/xattr.c:672
__do_sys_setxattr fs/xattr.c:688 [inline]
__se_sys_setxattr fs/xattr.c:684 [inline]
__x64_sys_setxattr+0xc4/0x160 fs/xattr.c:684
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

other info that might help us debug this:

Chain exists of:

&ei->xattr_sem --> mapping.invalidate_lock --> jbd2_handle

Possible unsafe locking scenario:

CPU0 CPU1
---- ----

rlock(jbd2_handle);
lock(mapping.invalidate_lock);
lock(jbd2_handle);
lock(&ei->xattr_sem);

*** DEADLOCK ***

3 locks held by syz-executor.0/5526:
#0: ffff88802aaba460 (sb_writers#4){.+.+}-{0:0}, at: path_setxattr+0xb2/0x1c0 fs/xattr.c:670
#1: ffff88806e1b5e00 (&type->i_mutex_dir_key#3){++++}-{3:3}, at: inode_lock include/linux/fs.h:775 [inline]
#1: ffff88806e1b5e00 (&type->i_mutex_dir_key#3){++++}-{3:3}, at: vfs_setxattr+0x120/0x340 fs/xattr.c:321
#2: ffff88802aabe990 (jbd2_handle){.+.+}-{0:0}, at: start_this_handle+0xfb4/0x14e0 fs/jbd2/transaction.c:461

stack backtrace:
CPU: 1 PID: 5526 Comm: syz-executor.0 Not tainted 6.4.0-rc1-syzkaller-gac9a78681b92 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
check_noncircular+0x25f/0x2e0 kernel/locking/lockdep.c:2188
check_prev_add kernel/locking/lockdep.c:3108 [inline]
check_prevs_add kernel/locking/lockdep.c:3227 [inline]
validate_chain kernel/locking/lockdep.c:3842 [inline]
__lock_acquire+0x2f21/0x5df0 kernel/locking/lockdep.c:5074
lock_acquire kernel/locking/lockdep.c:5691 [inline]
lock_acquire+0x1b1/0x520 kernel/locking/lockdep.c:5656
down_write+0x92/0x200 kernel/locking/rwsem.c:1573
ext4_write_lock_xattr fs/ext4/xattr.h:155 [inline]
ext4_xattr_set_handle+0x160/0x1510 fs/ext4/xattr.c:2372
ext4_xattr_set+0x144/0x360 fs/ext4/xattr.c:2559
__vfs_setxattr+0x173/0x1e0 fs/xattr.c:201
__vfs_setxattr_noperm+0x129/0x5f0 fs/xattr.c:235
__vfs_setxattr_locked+0x1d3/0x260 fs/xattr.c:296
vfs_setxattr+0x143/0x340 fs/xattr.c:322
do_setxattr+0x147/0x190 fs/xattr.c:630
setxattr+0x146/0x160 fs/xattr.c:653
path_setxattr+0x197/0x1c0 fs/xattr.c:672
__do_sys_setxattr fs/xattr.c:688 [inline]
__se_sys_setxattr fs/xattr.c:684 [inline]
__x64_sys_setxattr+0xc4/0x160 fs/xattr.c:684
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f06bfa8c169
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f06c078b168 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc
RAX: ffffffffffffffda RBX: 00007f06bfbac050 RCX: 00007f06bfa8c169
RDX: 00000000200005c0 RSI: 0000000020000180 RDI: 0000000020000080
RBP: 00007f06bfae7ca1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000002000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fff7db6458f R14: 00007f06c078b300 R15: 0000000000022000
</TASK>


Tested on:

commit: ac9a7868 Linux 6.4-rc1
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v6.4-rc1
console output: https://syzkaller.appspot.com/x/log.txt?x=113420fa280000
kernel config: https://syzkaller.appspot.com/x/.config?x=8bc832f563d8bf38
dashboard link: https://syzkaller.appspot.com/bug?extid=cbb68193bdb95af4340a
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

Note: no patches were applied.

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in ext4_xattr_set_handle

======================================================
WARNING: possible circular locking dependency detected

6.4.0-rc2-syzkaller-gf1fcbaa18b28 #0 Not tainted
------------------------------------------------------
syz-executor.0/5686 is trying to acquire lock:
ffff8880782c14c8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_write_lock_xattr fs/ext4/xattr.h:155 [inline]
ffff8880782c14c8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_xattr_set_handle+0x160/0x1510 fs/ext4/xattr.c:2372

but task is already holding lock:

ffff88802a380990 (jbd2_handle){.+.+}-{0:0}, at: start_this_handle+0xfb4/0x14e0 fs/jbd2/transaction.c:461

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #3 (jbd2_handle){.+.+}-{0:0}:
start_this_handle+0xfe7/0x14e0 fs/jbd2/transaction.c:463
jbd2__journal_start+0x390/0x850 fs/jbd2/transaction.c:520
__ext4_journal_start_sb+0x411/0x5d0 fs/ext4/ext4_jbd2.c:111
__ext4_journal_start fs/ext4/ext4_jbd2.h:326 [inline]

ext4_truncate+0x54f/0x1340 fs/ext4/inode.c:4126
ext4_setattr+0x1b24/0x2880 fs/ext4/inode.c:5436

notify_change+0xb2c/0x1180 fs/attr.c:483
do_truncate+0x143/0x200 fs/open.c:66
do_sys_ftruncate+0x53a/0x770 fs/open.c:194
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

-> #2 (mapping.invalidate_lock){++++}-{3:3}:
down_write+0x92/0x200 kernel/locking/rwsem.c:1573
filemap_invalidate_lock include/linux/fs.h:820 [inline]

ext4_setattr+0x6f2/0x2880 fs/ext4/inode.c:5359

3 locks held by syz-executor.0/5686:
#0: ffff88802c3ba460 (sb_writers#4){.+.+}-{0:0}, at: path_setxattr+0xb2/0x1c0 fs/xattr.c:670
#1: ffff8880782c1800 (&type->i_mutex_dir_key#3){++++}-{3:3}, at: inode_lock include/linux/fs.h:775 [inline]
#1: ffff8880782c1800 (&type->i_mutex_dir_key#3){++++}-{3:3}, at: vfs_setxattr+0x120/0x340 fs/xattr.c:321
#2: ffff88802a380990 (jbd2_handle){.+.+}-{0:0}, at: start_this_handle+0xfb4/0x14e0 fs/jbd2/transaction.c:461

stack backtrace:
CPU: 0 PID: 5686 Comm: syz-executor.0 Not tainted 6.4.0-rc2-syzkaller-gf1fcbaa18b28 #0

RIP: 0033:0x7fefe3e8c169

Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007fefe4b08168 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc
RAX: ffffffffffffffda RBX: 00007fefe3fac050 RCX: 00007fefe3e8c169

RDX: 00000000200005c0 RSI: 0000000020000180 RDI: 0000000020000080

RBP: 00007fefe3ee7ca1 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000002000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007fff917f81bf R14: 00007fefe4b08300 R15: 0000000000022000
</TASK>


Tested on:

commit: f1fcbaa1 Linux 6.4-rc2
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v6.4-rc2
console output: https://syzkaller.appspot.com/x/log.txt?x=164ffcaa280000
kernel config: https://syzkaller.appspot.com/x/.config?x=ac0db1213414a978

[Theodore Ts'o]

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v6.4-rc2

diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index dfc2e223bd10..0018f76d7312 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -118,12 +118,13 @@ static int
ext4_expand_inode_array(struct ext4_xattr_inode_array **ea_inode_array,
struct inode *inode);

-#ifdef CONFIG_LOCKDEP
-void ext4_xattr_inode_set_class(struct inode *ea_inode)
+static inline void ext4_xattr_inode_set_class(struct inode *ea_inode,
+ int subclass)
{
- lockdep_set_subclass(&ea_inode->i_rwsem, 1);
-}
+#ifdef CONFIG_LOCKDEP
+ lockdep_set_subclass(&ea_inode->i_rwsem, subclass);
#endif
+}

static __le32 ext4_xattr_block_csum(struct inode *inode,
sector_t block_nr,
@@ -458,7 +459,7 @@ static int ext4_xattr_inode_iget(struct inode *parent, unsigned long ea_ino,
goto error;
}

- ext4_xattr_inode_set_class(inode);
+ ext4_xattr_inode_set_class(inode, 1);

/*
* Check whether this is an old Lustre-style xattr inode. Lustre
@@ -1084,7 +1085,7 @@ static int ext4_xattr_inode_update_ref(handle_t *handle, struct inode *ea_inode,
WARN_ONCE(ea_inode->i_nlink != 1,
"EA inode %lu i_nlink=%u",
ea_inode->i_ino, ea_inode->i_nlink);
-
+ ext4_xattr_inode_set_class(ea_inode, 0);
clear_nlink(ea_inode);
ext4_orphan_add(handle, ea_inode);
}
@@ -1500,7 +1501,7 @@ static struct inode *ext4_xattr_inode_create(handle_t *handle,
ea_inode->i_op = &ext4_file_inode_operations;
ea_inode->i_fop = &ext4_file_operations;
ext4_set_aops(ea_inode);
- ext4_xattr_inode_set_class(ea_inode);
+ ext4_xattr_inode_set_class(ea_inode, 1);
unlock_new_inode(ea_inode);
ext4_xattr_inode_set_ref(ea_inode, 1);
ext4_xattr_inode_set_hash(ea_inode, hash);
@@ -1511,6 +1512,7 @@ static struct inode *ext4_xattr_inode_create(handle_t *handle,
if (ext4_xattr_inode_dec_ref(handle, ea_inode))
ext4_warning_inode(ea_inode,
"cleanup dec ref error %d", err);
+ ext4_xattr_inode_set_class(ea_inode, 0);
iput(ea_inode);
return ERR_PTR(err);
}
diff --git a/fs/ext4/xattr.h b/fs/ext4/xattr.h
index 824faf0b15a8..32d6222ec9ec 100644
--- a/fs/ext4/xattr.h
+++ b/fs/ext4/xattr.h
@@ -218,10 +218,4 @@ static inline int ext4_init_security(handle_t *handle, struct inode *inode,
}
#endif

-#ifdef CONFIG_LOCKDEP
-extern void ext4_xattr_inode_set_class(struct inode *ea_inode);
-#else
-static inline void ext4_xattr_inode_set_class(struct inode *ea_inode) { }
-#endif
-
extern int ext4_get_inode_usage(struct inode *inode, qsize_t *usage);

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in ext4_xattr_set_handle

======================================================
WARNING: possible circular locking dependency detected

6.4.0-rc2-syzkaller-dirty #0 Not tainted
------------------------------------------------------
syz-executor.0/5501 is trying to acquire lock:
ffff8880746780c8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_write_lock_xattr fs/ext4/xattr.h:155 [inline]
ffff8880746780c8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_xattr_set_handle+0x160/0x1510 fs/ext4/xattr.c:2374

but task is already holding lock:

ffff88802c4b0990 (jbd2_handle){.+.+}-{0:0}, at: start_this_handle+0xfb4/0x14e0 fs/jbd2/transaction.c:461

ext4_xattr_inode_create fs/ext4/xattr.c:1526 [inline]
ext4_xattr_inode_lookup_create fs/ext4/xattr.c:1609 [inline]
ext4_xattr_set_entry+0x2c06/0x3b20 fs/ext4/xattr.c:1738
ext4_xattr_block_set+0xcb7/0x3030 fs/ext4/xattr.c:2044
ext4_xattr_set_handle+0xd8a/0x1510 fs/ext4/xattr.c:2459
ext4_xattr_set+0x144/0x360 fs/ext4/xattr.c:2561

__vfs_setxattr+0x173/0x1e0 fs/xattr.c:201
__vfs_setxattr_noperm+0x129/0x5f0 fs/xattr.c:235
__vfs_setxattr_locked+0x1d3/0x260 fs/xattr.c:296
vfs_setxattr+0x143/0x340 fs/xattr.c:322
do_setxattr+0x147/0x190 fs/xattr.c:630
setxattr+0x146/0x160 fs/xattr.c:653
path_setxattr+0x197/0x1c0 fs/xattr.c:672
__do_sys_setxattr fs/xattr.c:688 [inline]
__se_sys_setxattr fs/xattr.c:684 [inline]
__x64_sys_setxattr+0xc4/0x160 fs/xattr.c:684
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

-> #0 (&ei->xattr_sem){++++}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3108 [inline]
check_prevs_add kernel/locking/lockdep.c:3227 [inline]
validate_chain kernel/locking/lockdep.c:3842 [inline]
__lock_acquire+0x2f21/0x5df0 kernel/locking/lockdep.c:5074
lock_acquire kernel/locking/lockdep.c:5691 [inline]
lock_acquire+0x1b1/0x520 kernel/locking/lockdep.c:5656
down_write+0x92/0x200 kernel/locking/rwsem.c:1573
ext4_write_lock_xattr fs/ext4/xattr.h:155 [inline]

ext4_xattr_set_handle+0x160/0x1510 fs/ext4/xattr.c:2374
ext4_xattr_set+0x144/0x360 fs/ext4/xattr.c:2561

__vfs_setxattr+0x173/0x1e0 fs/xattr.c:201
__vfs_setxattr_noperm+0x129/0x5f0 fs/xattr.c:235
__vfs_setxattr_locked+0x1d3/0x260 fs/xattr.c:296
vfs_setxattr+0x143/0x340 fs/xattr.c:322
do_setxattr+0x147/0x190 fs/xattr.c:630
setxattr+0x146/0x160 fs/xattr.c:653
path_setxattr+0x197/0x1c0 fs/xattr.c:672
__do_sys_setxattr fs/xattr.c:688 [inline]
__se_sys_setxattr fs/xattr.c:684 [inline]
__x64_sys_setxattr+0xc4/0x160 fs/xattr.c:684
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

other info that might help us debug this:

Chain exists of:
&ei->xattr_sem --> mapping.invalidate_lock --> jbd2_handle

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
rlock(jbd2_handle);
lock(mapping.invalidate_lock);
lock(jbd2_handle);
lock(&ei->xattr_sem);

*** DEADLOCK ***

3 locks held by syz-executor.0/5501:
#0: ffff88802c3f8460 (sb_writers#4){.+.+}-{0:0}, at: path_setxattr+0xb2/0x1c0 fs/xattr.c:670
#1: ffff888074678400 (&type->i_mutex_dir_key#3){++++}-{3:3}, at: inode_lock include/linux/fs.h:775 [inline]
#1: ffff888074678400 (&type->i_mutex_dir_key#3){++++}-{3:3}, at: vfs_setxattr+0x120/0x340 fs/xattr.c:321
#2: ffff88802c4b0990 (jbd2_handle){.+.+}-{0:0}, at: start_this_handle+0xfb4/0x14e0 fs/jbd2/transaction.c:461

stack backtrace:
CPU: 0 PID: 5501 Comm: syz-executor.0 Not tainted 6.4.0-rc2-syzkaller-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
check_noncircular+0x25f/0x2e0 kernel/locking/lockdep.c:2188
check_prev_add kernel/locking/lockdep.c:3108 [inline]
check_prevs_add kernel/locking/lockdep.c:3227 [inline]
validate_chain kernel/locking/lockdep.c:3842 [inline]
__lock_acquire+0x2f21/0x5df0 kernel/locking/lockdep.c:5074
lock_acquire kernel/locking/lockdep.c:5691 [inline]
lock_acquire+0x1b1/0x520 kernel/locking/lockdep.c:5656
down_write+0x92/0x200 kernel/locking/rwsem.c:1573
ext4_write_lock_xattr fs/ext4/xattr.h:155 [inline]

ext4_xattr_set_handle+0x160/0x1510 fs/ext4/xattr.c:2374
ext4_xattr_set+0x144/0x360 fs/ext4/xattr.c:2561

__vfs_setxattr+0x173/0x1e0 fs/xattr.c:201
__vfs_setxattr_noperm+0x129/0x5f0 fs/xattr.c:235
__vfs_setxattr_locked+0x1d3/0x260 fs/xattr.c:296
vfs_setxattr+0x143/0x340 fs/xattr.c:322
do_setxattr+0x147/0x190 fs/xattr.c:630
setxattr+0x146/0x160 fs/xattr.c:653
path_setxattr+0x197/0x1c0 fs/xattr.c:672
__do_sys_setxattr fs/xattr.c:688 [inline]
__se_sys_setxattr fs/xattr.c:684 [inline]
__x64_sys_setxattr+0xc4/0x160 fs/xattr.c:684
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

RIP: 0033:0x7f3060a8c169

Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007f30617c8168 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc
RAX: ffffffffffffffda RBX: 00007f3060bac050 RCX: 00007f3060a8c169

RDX: 00000000200005c0 RSI: 0000000020000180 RDI: 0000000020000080

RBP: 00007f3060ae7ca1 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000002000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007ffcf5737d4f R14: 00007f30617c8300 R15: 0000000000022000

</TASK>


Tested on:

commit: f1fcbaa1 Linux 6.4-rc2
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v6.4-rc2

console output: https://syzkaller.appspot.com/x/log.txt?x=1603764e280000

kernel config: https://syzkaller.appspot.com/x/.config?x=ac0db1213414a978
dashboard link: https://syzkaller.appspot.com/bug?extid=cbb68193bdb95af4340a
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=1125d09a280000

[Theodore Ts'o]

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v6.4-rc2

commit 22fe710dc4afc1103ca43f4362eed668459490f7
Author: Theodore Ts'o <ty...@mit.edu>
Date: Mon May 15 00:31:43 2023 -0400

ext4: reset lockdep class on ea_inodes before releasing them

We set the lockdep subclass on ea_inodes to 1, since they aren't
"real" files, but before they are released (meaning nothing should be
referring them as ea_inodes, or there was an error creating the
ea_inode), reset the lockdep subclass to 0 to avoid lockdep false
positives when the ea_inode is released/truncated.

Reported-by: syzbot+62120f...@syzkaller.appspotmail.com
Reported-by: syzbot+cbb681...@syzkaller.appspotmail.com
Reported-by: syzbot+298c5d...@syzkaller.appspotmail.com
Reported-by: syzbot+edce54...@syzkaller.appspotmail.com
Signed-off-by: Theodore Ts'o <ty...@mit.edu>

diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index dfc2e223bd10..aa8f26087116 100644

--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -118,12 +118,13 @@ static int
ext4_expand_inode_array(struct ext4_xattr_inode_array **ea_inode_array,
struct inode *inode);

-#ifdef CONFIG_LOCKDEP
-void ext4_xattr_inode_set_class(struct inode *ea_inode)
+static inline void ext4_xattr_inode_set_class(struct inode *ea_inode,
+ int subclass)
{
- lockdep_set_subclass(&ea_inode->i_rwsem, 1);
-}
+#ifdef CONFIG_LOCKDEP
+ lockdep_set_subclass(&ea_inode->i_rwsem, subclass);
#endif
+}

static __le32 ext4_xattr_block_csum(struct inode *inode,
sector_t block_nr,
@@ -458,7 +459,7 @@ static int ext4_xattr_inode_iget(struct inode *parent, unsigned long ea_ino,
goto error;
}

- ext4_xattr_inode_set_class(inode);
+ ext4_xattr_inode_set_class(inode, 1);

/*
* Check whether this is an old Lustre-style xattr inode. Lustre

@@ -1058,8 +1059,10 @@ static int ext4_xattr_inode_update_ref(handle_t *handle, struct inode *ea_inode,
inode_lock(ea_inode);

ret = ext4_reserve_inode_write(handle, ea_inode, &iloc);
- if (ret)
- goto out;
+ if (ret) {
+ inode_unlock(ea_inode);
+ return ret;
+ }

ref_count = ext4_xattr_inode_get_ref(ea_inode);
ref_count += ref_change;
@@ -1074,7 +1077,9 @@ static int ext4_xattr_inode_update_ref(handle_t *handle, struct inode *ea_inode,
ea_inode->i_ino, ea_inode->i_nlink);

set_nlink(ea_inode, 1);
+ inode_unlock(ea_inode);
ext4_orphan_del(handle, ea_inode);
+ ext4_xattr_inode_set_class(ea_inode, 1);
}
} else {
WARN_ONCE(ref_count < 0, "EA inode %lu ref_count=%lld",
@@ -1084,7 +1089,8 @@ static int ext4_xattr_inode_update_ref(handle_t *handle, struct inode *ea_inode,

WARN_ONCE(ea_inode->i_nlink != 1,
"EA inode %lu i_nlink=%u",
ea_inode->i_ino, ea_inode->i_nlink);
-

+ inode_unlock(ea_inode);

+ ext4_xattr_inode_set_class(ea_inode, 0);
clear_nlink(ea_inode);
ext4_orphan_add(handle, ea_inode);
}

@@ -1094,8 +1100,6 @@ static int ext4_xattr_inode_update_ref(handle_t *handle, struct inode *ea_inode,
if (ret)
ext4_warning_inode(ea_inode,
"ext4_mark_iloc_dirty() failed ret=%d", ret);
-out:
- inode_unlock(ea_inode);
return ret;
}

@@ -1500,7 +1504,7 @@ static struct inode *ext4_xattr_inode_create(handle_t *handle,

ea_inode->i_op = &ext4_file_inode_operations;
ea_inode->i_fop = &ext4_file_operations;
ext4_set_aops(ea_inode);
- ext4_xattr_inode_set_class(ea_inode);
+ ext4_xattr_inode_set_class(ea_inode, 1);
unlock_new_inode(ea_inode);
ext4_xattr_inode_set_ref(ea_inode, 1);
ext4_xattr_inode_set_hash(ea_inode, hash);

@@ -1511,6 +1515,7 @@ static struct inode *ext4_xattr_inode_create(handle_t *handle,

if (ext4_xattr_inode_dec_ref(handle, ea_inode))
ext4_warning_inode(ea_inode,
"cleanup dec ref error %d", err);
+ ext4_xattr_inode_set_class(ea_inode, 0);
iput(ea_inode);
return ERR_PTR(err);
}

@@ -1560,6 +1565,7 @@ ext4_xattr_inode_cache_find(struct inode *inode, const void *value,
if (!IS_ERR(ea_inode) &&
!is_bad_inode(ea_inode) &&
(EXT4_I(ea_inode)->i_flags & EXT4_EA_INODE_FL) &&
+ inode->i_nlink &&
i_size_read(ea_inode) == value_len &&
!ext4_xattr_inode_read(ea_inode, ea_data, value_len) &&
!ext4_xattr_inode_verify_hashes(ea_inode, NULL, ea_data,

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

possible deadlock in ext4_xattr_inode_update_ref

EXT4-fs error (device loop0): ext4_mb_mark_diskspace_used:3806: comm syz-executor.0: Allocating blocks 44-48 which overlap fs metadata
EXT4-fs error (device loop0): ext4_xattr_block_set:2247: inode #12: comm syz-executor.0: bad block 0
============================================
WARNING: possible recursive locking detected
6.4.0-rc2-syzkaller-gf1fcbaa18b28-dirty #0 Not tainted
--------------------------------------------
syz-executor.0/5467 is trying to acquire lock:
ffff8880747f0400 (&ea_inode->i_rwsem#8/1){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:775 [inline]
ffff8880747f0400 (&ea_inode->i_rwsem#8/1){+.+.}-{3:3}, at: ext4_xattr_inode_update_ref+0x87/0x7f0 fs/ext4/xattr.c:1059

but task is already holding lock:

ffff8880747f0400 (&ea_inode->i_rwsem#8/1){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:775 [inline]
ffff8880747f0400 (&ea_inode->i_rwsem#8/1){+.+.}-{3:3}, at: ext4_xattr_inode_update_ref+0x87/0x7f0 fs/ext4/xattr.c:1059

other info that might help us debug this:

Possible unsafe locking scenario:

CPU0

----
lock(&ea_inode->i_rwsem#8/1);
lock(&ea_inode->i_rwsem#8/1);

*** DEADLOCK ***

May be due to missing lock nesting notation

4 locks held by syz-executor.0/5467:
#0: ffff88807a186460 (sb_writers#4){.+.+}-{0:0}, at: path_setxattr+0xb2/0x1c0 fs/xattr.c:670
#1: ffff8880747ee800 (&type->i_mutex_dir_key#3){++++}-{3:3}, at: inode_lock include/linux/fs.h:775 [inline]
#1: ffff8880747ee800 (&type->i_mutex_dir_key#3){++++}-{3:3}, at: vfs_setxattr+0x120/0x340 fs/xattr.c:321
#2: ffff8880747ee4c8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_write_lock_xattr fs/ext4/xattr.h:155 [inline]
#2: ffff8880747ee4c8 (&ei->xattr_sem){++++}-{3:3}, at: ext4_xattr_set_handle+0x160/0x1510 fs/ext4/xattr.c:2378
#3: ffff8880747f0400 (&ea_inode->i_rwsem#8/1){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:775 [inline]
#3: ffff8880747f0400 (&ea_inode->i_rwsem#8/1){+.+.}-{3:3}, at: ext4_xattr_inode_update_ref+0x87/0x7f0 fs/ext4/xattr.c:1059

stack backtrace:
CPU: 0 PID: 5467 Comm: syz-executor.0 Not tainted 6.4.0-rc2-syzkaller-gf1fcbaa18b28-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106

print_deadlock_bug kernel/locking/lockdep.c:3001 [inline]
check_deadlock kernel/locking/lockdep.c:3044 [inline]
validate_chain kernel/locking/lockdep.c:3829 [inline]
__lock_acquire+0x13b3/0x5df0 kernel/locking/lockdep.c:5074

lock_acquire kernel/locking/lockdep.c:5691 [inline]
lock_acquire+0x1b1/0x520 kernel/locking/lockdep.c:5656
down_write+0x92/0x200 kernel/locking/rwsem.c:1573

inode_lock include/linux/fs.h:775 [inline]
ext4_xattr_inode_update_ref+0x87/0x7f0 fs/ext4/xattr.c:1059
ext4_xattr_inode_dec_ref fs/ext4/xattr.c:1113 [inline]
ext4_xattr_block_set+0x24ba/0x3030 fs/ext4/xattr.c:2172
ext4_xattr_set_handle+0xd8a/0x1510 fs/ext4/xattr.c:2463
ext4_xattr_set+0x144/0x360 fs/ext4/xattr.c:2565

__vfs_setxattr+0x173/0x1e0 fs/xattr.c:201
__vfs_setxattr_noperm+0x129/0x5f0 fs/xattr.c:235
__vfs_setxattr_locked+0x1d3/0x260 fs/xattr.c:296
vfs_setxattr+0x143/0x340 fs/xattr.c:322
do_setxattr+0x147/0x190 fs/xattr.c:630
setxattr+0x146/0x160 fs/xattr.c:653
path_setxattr+0x197/0x1c0 fs/xattr.c:672
__do_sys_setxattr fs/xattr.c:688 [inline]
__se_sys_setxattr fs/xattr.c:684 [inline]
__x64_sys_setxattr+0xc4/0x160 fs/xattr.c:684
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

RIP: 0033:0x7f00fb88c169

Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007f00fc5b2168 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc
RAX: ffffffffffffffda RBX: 00007f00fb9abf80 RCX: 00007f00fb88c169

RDX: 00000000200005c0 RSI: 0000000020000180 RDI: 0000000020000080

RBP: 00007f00fb8e7ca1 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000002000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007ffd43d210cf R14: 00007f00fc5b2300 R15: 0000000000022000

</TASK>


Tested on:

commit: f1fcbaa1 Linux 6.4-rc2
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v6.4-rc2

console output: https://syzkaller.appspot.com/x/log.txt?x=17ef8cce280000

kernel config: https://syzkaller.appspot.com/x/.config?x=ac0db1213414a978
dashboard link: https://syzkaller.appspot.com/bug?extid=cbb68193bdb95af4340a
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=111967f1280000

[Theodore Ts'o]

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git test

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to checkout kernel repo https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/test: failed to run ["git" "fetch" "--force" "4d52a57a3858a6eee0d0b25cc3a0c9533f747d8f" "test"]: exit status 128
fatal: couldn't find remote ref test



Tested on:

commit: [unknown
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git test

dashboard link: https://syzkaller.appspot.com/bug?extid=cbb68193bdb95af4340a
compiler:

[Theodore Ts'o]

[syzbot]

[Theodore Ts'o]

#syz test git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git test

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

possible deadlock in ext4_setattr

EXT4-fs error (device loop0): ext4_mb_mark_diskspace_used:3806: comm syz-executor.0: Allocating blocks 44-48 which overlap fs metadata

EXT4-fs error (device loop0): ext4_xattr_block_set:2242: inode #12: comm syz-executor.0: bad block 0

======================================================
WARNING: possible circular locking dependency detected

6.4.0-rc2-syzkaller-00002-g57c32940818a #0 Not tainted
------------------------------------------------------
syz-executor.0/5504 is trying to acquire lock:
ffff888074a8ada0 (mapping.invalidate_lock){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:820 [inline]
ffff888074a8ada0 (mapping.invalidate_lock){++++}-{3:3}, at: ext4_setattr+0x6f2/0x2880 fs/ext4/inode.c:5374

but task is already holding lock:

ffff888074a8ac00 (&ea_inode->i_rwsem#8/1){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:775 [inline]
ffff888074a8ac00 (&ea_inode->i_rwsem#8/1){+.+.}-{3:3}, at: do_truncate+0x131/0x200 fs/open.c:64

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #3 (&ea_inode->i_rwsem#8/1){+.+.}-{3:3}:

down_write+0x92/0x200 kernel/locking/rwsem.c:1573
inode_lock include/linux/fs.h:775 [inline]

ext4_xattr_inode_create fs/ext4/xattr.c:1524 [inline]
ext4_xattr_inode_lookup_create fs/ext4/xattr.c:1608 [inline]
ext4_xattr_set_entry+0x2c2c/0x3b80 fs/ext4/xattr.c:1737
ext4_xattr_block_set+0xcb7/0x3030 fs/ext4/xattr.c:2043
ext4_xattr_set_handle+0xd8a/0x1510 fs/ext4/xattr.c:2458
ext4_xattr_set+0x144/0x360 fs/ext4/xattr.c:2560

__vfs_setxattr+0x173/0x1e0 fs/xattr.c:201
__vfs_setxattr_noperm+0x129/0x5f0 fs/xattr.c:235
__vfs_setxattr_locked+0x1d3/0x260 fs/xattr.c:296
vfs_setxattr+0x143/0x340 fs/xattr.c:322
do_setxattr+0x147/0x190 fs/xattr.c:630
setxattr+0x146/0x160 fs/xattr.c:653
path_setxattr+0x197/0x1c0 fs/xattr.c:672
__do_sys_setxattr fs/xattr.c:688 [inline]
__se_sys_setxattr fs/xattr.c:684 [inline]
__x64_sys_setxattr+0xc4/0x160 fs/xattr.c:684
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

-> #2 (&ei->xattr_sem){++++}-{3:3}:

down_write+0x92/0x200 kernel/locking/rwsem.c:1573
ext4_write_lock_xattr fs/ext4/xattr.h:155 [inline]

ext4_xattr_set_handle+0x160/0x1510 fs/ext4/xattr.c:2373
ext4_xattr_set+0x144/0x360 fs/ext4/xattr.c:2560

__vfs_setxattr+0x173/0x1e0 fs/xattr.c:201
__vfs_setxattr_noperm+0x129/0x5f0 fs/xattr.c:235
__vfs_setxattr_locked+0x1d3/0x260 fs/xattr.c:296
vfs_setxattr+0x143/0x340 fs/xattr.c:322
do_setxattr+0x147/0x190 fs/xattr.c:630
setxattr+0x146/0x160 fs/xattr.c:653
path_setxattr+0x197/0x1c0 fs/xattr.c:672
__do_sys_setxattr fs/xattr.c:688 [inline]
__se_sys_setxattr fs/xattr.c:684 [inline]
__x64_sys_setxattr+0xc4/0x160 fs/xattr.c:684
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

-> #1 (jbd2_handle){.+.+}-{0:0}:

start_this_handle+0xfe7/0x14e0 fs/jbd2/transaction.c:463
jbd2__journal_start+0x390/0x850 fs/jbd2/transaction.c:520
__ext4_journal_start_sb+0x411/0x5d0 fs/ext4/ext4_jbd2.c:111
__ext4_journal_start fs/ext4/ext4_jbd2.h:326 [inline]
ext4_truncate+0x54f/0x1340 fs/ext4/inode.c:4126

ext4_setattr+0x1b24/0x2880 fs/ext4/inode.c:5451

notify_change+0xb2c/0x1180 fs/attr.c:483
do_truncate+0x143/0x200 fs/open.c:66
do_sys_ftruncate+0x53a/0x770 fs/open.c:194

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

-> #0 (mapping.invalidate_lock){++++}-{3:3}:

check_prev_add kernel/locking/lockdep.c:3108 [inline]
check_prevs_add kernel/locking/lockdep.c:3227 [inline]
validate_chain kernel/locking/lockdep.c:3842 [inline]

__lock_acquire+0x2f21/0x5df0 kernel/locking/lockdep.c:5074

lock_acquire kernel/locking/lockdep.c:5691 [inline]
lock_acquire+0x1b1/0x520 kernel/locking/lockdep.c:5656
down_write+0x92/0x200 kernel/locking/rwsem.c:1573

filemap_invalidate_lock include/linux/fs.h:820 [inline]
ext4_setattr+0x6f2/0x2880 fs/ext4/inode.c:5374

notify_change+0xb2c/0x1180 fs/attr.c:483
do_truncate+0x143/0x200 fs/open.c:66
handle_truncate fs/namei.c:3295 [inline]
do_open fs/namei.c:3640 [inline]
path_openat+0x2083/0x2750 fs/namei.c:3791
do_filp_open+0x1ba/0x410 fs/namei.c:3818
do_sys_openat2+0x16d/0x4c0 fs/open.c:1356
do_sys_open fs/open.c:1372 [inline]
__do_sys_openat fs/open.c:1388 [inline]
__se_sys_openat fs/open.c:1383 [inline]
__x64_sys_openat+0x143/0x1f0 fs/open.c:1383

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

other info that might help us debug this:

Chain exists of:
mapping.invalidate_lock --> &ei->xattr_sem --> &ea_inode->i_rwsem#8/1

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&ea_inode->i_rwsem#8/1);
lock(&ei->xattr_sem);
lock(&ea_inode->i_rwsem#8/1);
lock(mapping.invalidate_lock);

*** DEADLOCK ***

2 locks held by syz-executor.0/5504:
#0: ffff88807ad78460 (sb_writers#4){.+.+}-{0:0}, at: do_open fs/namei.c:3629 [inline]
#0: ffff88807ad78460 (sb_writers#4){.+.+}-{0:0}, at: path_openat+0x19a4/0x2750 fs/namei.c:3791
#1: ffff888074a8ac00 (&ea_inode->i_rwsem#8/1){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:775 [inline]
#1: ffff888074a8ac00 (&ea_inode->i_rwsem#8/1){+.+.}-{3:3}, at: do_truncate+0x131/0x200 fs/open.c:64

stack backtrace:
CPU: 0 PID: 5504 Comm: syz-executor.0 Not tainted 6.4.0-rc2-syzkaller-00002-g57c32940818a #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106

check_noncircular+0x25f/0x2e0 kernel/locking/lockdep.c:2188
check_prev_add kernel/locking/lockdep.c:3108 [inline]
check_prevs_add kernel/locking/lockdep.c:3227 [inline]
validate_chain kernel/locking/lockdep.c:3842 [inline]

__lock_acquire+0x2f21/0x5df0 kernel/locking/lockdep.c:5074

lock_acquire kernel/locking/lockdep.c:5691 [inline]
lock_acquire+0x1b1/0x520 kernel/locking/lockdep.c:5656
down_write+0x92/0x200 kernel/locking/rwsem.c:1573

filemap_invalidate_lock include/linux/fs.h:820 [inline]
ext4_setattr+0x6f2/0x2880 fs/ext4/inode.c:5374

notify_change+0xb2c/0x1180 fs/attr.c:483
do_truncate+0x143/0x200 fs/open.c:66
handle_truncate fs/namei.c:3295 [inline]
do_open fs/namei.c:3640 [inline]
path_openat+0x2083/0x2750 fs/namei.c:3791
do_filp_open+0x1ba/0x410 fs/namei.c:3818
do_sys_openat2+0x16d/0x4c0 fs/open.c:1356
do_sys_open fs/open.c:1372 [inline]
__do_sys_openat fs/open.c:1388 [inline]
__se_sys_openat fs/open.c:1383 [inline]
__x64_sys_openat+0x143/0x1f0 fs/open.c:1383

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

RIP: 0033:0x7ff272e8c169

Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007ff273c34168 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007ff272fabf80 RCX: 00007ff272e8c169
RDX: 0000000000028200 RSI: 00000000200000c0 RDI: ffffffffffffff9c
RBP: 00007ff272ee7ca1 R08: 0000000000000000 R09: 0000000000000000
R10: 000000000000002d R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc91d5066f R14: 00007ff273c34300 R15: 0000000000022000
</TASK>


Tested on:

commit: 57c32940 ext4: add EA_INODE checking to ext4_iget()
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git test
console output: https://syzkaller.appspot.com/x/log.txt?x=174ed5d9280000
kernel config: https://syzkaller.appspot.com/x/.config?x=ac0db1213414a978
dashboard link: https://syzkaller.appspot.com/bug?extid=cbb68193bdb95af4340a

compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

[Theodore Ts'o]

#syz test git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git test

One more attempt at reworking the patch.

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

VFS: Busy inodes after unmount (use-after-free)

EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
VFS: Busy inodes after unmount of loop0 (ext4)
------------[ cut here ]------------
kernel BUG at fs/super.c:502!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 5356 Comm: syz-executor.0 Not tainted 6.4.0-rc2-syzkaller-00002-g6dc4aa72ed47 #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023

RIP: 0010:generic_shutdown_super+0x3bb/0x480 fs/super.c:502
Code: 6b 28 48 89 ea 48 c1 ea 03 80 3c 02 00 0f 85 c4 00 00 00 48 8b 55 00 48 8d b3 a8 06 00 00 48 c7 c7 20 ca 5b 8a e8 d5 99 81 ff <0f> 0b e8 3e 7d f0 ff e9 6a fc ff ff e8 34 7d f0 ff e9 f1 fd ff ff
RSP: 0018:ffffc90005167d90 EFLAGS: 00010282
RAX: 000000000000002e RBX: ffff88802c0ca000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8168b8fc RDI: 0000000000000005
RBP: ffffffff8ca214a0 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000000 R11: 0000000000000001 R12: ffff88802c0ca7d8
R13: 0000000000000000 R14: 0000000000000000 R15: ffff888029c719c0
FS: 000055555557b400(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6ece980440 CR3: 0000000021a7f000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
kill_block_super+0xa1/0x100 fs/super.c:1407
deactivate_locked_super+0x98/0x160 fs/super.c:331
deactivate_super+0xb1/0xd0 fs/super.c:362
cleanup_mnt+0x2ae/0x3d0 fs/namespace.c:1177
task_work_run+0x16f/0x270 kernel/task_work.c:179
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
exit_to_user_mode_prepare+0x210/0x240 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f566348d5d7
Code: ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd8a348f88 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f566348d5d7
RDX: 00007ffd8a349059 RSI: 000000000000000a RDI: 00007ffd8a349050
RBP: 00007ffd8a349050 R08: 00000000ffffffff R09: 00007ffd8a348e20
R10: 000055555557c893 R11: 0000000000000246 R12: 00007f56634e6cdc
R13: 00007ffd8a34a110 R14: 000055555557c810 R15: 00007ffd8a34a150
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:generic_shutdown_super+0x3bb/0x480 fs/super.c:502
Code: 6b 28 48 89 ea 48 c1 ea 03 80 3c 02 00 0f 85 c4 00 00 00 48 8b 55 00 48 8d b3 a8 06 00 00 48 c7 c7 20 ca 5b 8a e8 d5 99 81 ff <0f> 0b e8 3e 7d f0 ff e9 6a fc ff ff e8 34 7d f0 ff e9 f1 fd ff ff
RSP: 0018:ffffc90005167d90 EFLAGS: 00010282
RAX: 000000000000002e RBX: ffff88802c0ca000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8168b8fc RDI: 0000000000000005
RBP: ffffffff8ca214a0 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000000 R11: 0000000000000001 R12: ffff88802c0ca7d8
R13: 0000000000000000 R14: 0000000000000000 R15: ffff888029c719c0
FS: 000055555557b400(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6ece980440 CR3: 0000000021a7f000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


Tested on:

commit: 6dc4aa72 ext4: add EA_INODE checking to ext4_iget()

git tree: git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git test

console output: https://syzkaller.appspot.com/x/log.txt?x=110c3391280000

[Theodore Ts'o]

#syz test git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git test

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 07dda6745435..a84b6e1037e0 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4645,11 +4645,15 @@ static const char *check_igot_inode(struct inode *inode, ext4_iget_flags flags)

{
if (flags & EXT4_IGET_EA_INODE) {
- if (!(EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL))
+ if (!(EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL)) {
+ dump_stack();
return "EA inode does not have EA_INODE flag";
+ }
} else {
- if ((EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL))
+ if ((EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL)) {
+ dump_stack();
return "inode unexpectedly has EA_INODE flag";
+ }
}
if (is_bad_inode(inode) && !(flags & EXT4_IGET_BAD))
return "bad inode without EXT4_IGET_BAD flag";

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
VFS: Busy inodes after unmount (use-after-free)

EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
VFS: Busy inodes after unmount of loop0 (ext4)
------------[ cut here ]------------
kernel BUG at fs/super.c:502!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN

CPU: 1 PID: 5362 Comm: syz-executor.0 Not tainted 6.4.0-rc2-syzkaller-00002-g6dc4aa72ed47-dirty #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
RIP: 0010:generic_shutdown_super+0x3bb/0x480 fs/super.c:502
Code: 6b 28 48 89 ea 48 c1 ea 03 80 3c 02 00 0f 85 c4 00 00 00 48 8b 55 00 48 8d b3 a8 06 00 00 48 c7 c7 20 ca 5b 8a e8 d5 99 81 ff <0f> 0b e8 3e 7d f0 ff e9 6a fc ff ff e8 34 7d f0 ff e9 f1 fd ff ff

RSP: 0018:ffffc90004d5fd90 EFLAGS: 00010282
RAX: 000000000000002e RBX: ffff888029722000 RCX: 0000000000000000

RDX: 0000000000000000 RSI: ffffffff8168b8fc RDI: 0000000000000005
RBP: ffffffff8ca214a0 R08: 0000000000000005 R09: 0000000000000000

R10: 0000000080000000 R11: 0000000000000001 R12: ffff8880297227d8
R13: 0000000000000000 R14: 0000000000000000 R15: ffff888076cb6640
FS: 0000555555d50400(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007f780da64008 CR3: 0000000075be6000 CR4: 00000000003506e0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
kill_block_super+0xa1/0x100 fs/super.c:1407
deactivate_locked_super+0x98/0x160 fs/super.c:331
deactivate_super+0xb1/0xd0 fs/super.c:362
cleanup_mnt+0x2ae/0x3d0 fs/namespace.c:1177
task_work_run+0x16f/0x270 kernel/task_work.c:179
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
exit_to_user_mode_prepare+0x210/0x240 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd

RIP: 0033:0x7eff2ec8d5d7

Code: ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007fff8ee873f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007eff2ec8d5d7
RDX: 00007fff8ee874c9 RSI: 000000000000000a RDI: 00007fff8ee874c0
RBP: 00007fff8ee874c0 R08: 00000000ffffffff R09: 00007fff8ee87290
R10: 0000555555d51893 R11: 0000000000000246 R12: 00007eff2ece6cdc
R13: 00007fff8ee88580 R14: 0000555555d51810 R15: 00007fff8ee885c0

</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:generic_shutdown_super+0x3bb/0x480 fs/super.c:502
Code: 6b 28 48 89 ea 48 c1 ea 03 80 3c 02 00 0f 85 c4 00 00 00 48 8b 55 00 48 8d b3 a8 06 00 00 48 c7 c7 20 ca 5b 8a e8 d5 99 81 ff <0f> 0b e8 3e 7d f0 ff e9 6a fc ff ff e8 34 7d f0 ff e9 f1 fd ff ff

RSP: 0018:ffffc90004d5fd90 EFLAGS: 00010282
RAX: 000000000000002e RBX: ffff888029722000 RCX: 0000000000000000

RDX: 0000000000000000 RSI: ffffffff8168b8fc RDI: 0000000000000005
RBP: ffffffff8ca214a0 R08: 0000000000000005 R09: 0000000000000000

R10: 0000000080000000 R11: 0000000000000001 R12: ffff8880297227d8
R13: 0000000000000000 R14: 0000000000000000 R15: ffff888076cb6640
FS: 0000555555d50400(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007f780da64008 CR3: 0000000075be6000 CR4: 00000000003506e0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


Tested on:

commit: 6dc4aa72 ext4: add EA_INODE checking to ext4_iget()
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git test

console output: https://syzkaller.appspot.com/x/log.txt?x=143dc361280000

kernel config: https://syzkaller.appspot.com/x/.config?x=ac0db1213414a978
dashboard link: https://syzkaller.appspot.com/bug?extid=cbb68193bdb95af4340a
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=13662e41280000

[Theodore Ts'o]

#syz test git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git test

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c

index 07dda6745435..0168e219fa82 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4696,6 +4696,7 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
if (!(inode->i_state & I_NEW)) {
if ((err_str = check_igot_inode(inode, flags)) != NULL) {
ext4_error_inode(inode, function, line, 0, err_str);
+ iput(inode);
return ERR_PTR(-EFSCORRUPTED);
}
return inode;
diff --git a/fs/super.c b/fs/super.c
index 34afe411cf2b..f7bbdaec1e52 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -511,6 +511,7 @@ void generic_shutdown_super(struct super_block *sb)

spin_lock(&sb->s_inode_list_lock);
list_for_each_entry(inode, &sb->s_inodes, i_sb_list) {
+ pr_err("busy inode: %lu\n", inode->i_ino);
inode->i_op = VFS_PTR_POISON;
inode->i_sb = VFS_PTR_POISON;
inode->i_mapping = VFS_PTR_POISON;

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+cbb681...@syzkaller.appspotmail.com

Tested on:

commit: 6dc4aa72 ext4: add EA_INODE checking to ext4_iget()
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git test

console output: https://syzkaller.appspot.com/x/log.txt?x=17cfe972280000

kernel config: https://syzkaller.appspot.com/x/.config?x=ac0db1213414a978
dashboard link: https://syzkaller.appspot.com/bug?extid=cbb68193bdb95af4340a
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=136aa851280000

Note: testing is done by a robot and is best-effort only.

[Theodore Ts'o]

#syz test git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git test

Testing solo patch

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+cbb681...@syzkaller.appspotmail.com

Tested on:

commit: c139d578 ext4: add EA_INODE checking to ext4_iget()

git tree: git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git test

console output: https://syzkaller.appspot.com/x/log.txt?x=11791361280000

kernel config: https://syzkaller.appspot.com/x/.config?x=ac0db1213414a978
dashboard link: https://syzkaller.appspot.com/bug?extid=cbb68193bdb95af4340a
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

Note: no patches were applied.

[Theodore Ts'o]

#syz test git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git test

Let's see if this also fixes these other bugs.... (and see if I can
trigger tests for multiple syzbot issues at once :-)

[Theodore Ts'o]

#syz test git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git test

... and the answer is no, I can't trigger multiple tests by specifying
multiple syzbo...@syzkaller.appspotmail.com address on the to: line. Oh, well....

[Theodore Ts'o]

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+62120f...@syzkaller.appspotmail.com

Tested on:

commit: c139d578 ext4: add EA_INODE checking to ext4_iget()
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git test

console output: https://syzkaller.appspot.com/x/log.txt?x=1317966a280000
kernel config: https://syzkaller.appspot.com/x/.config?x=fce86b9e6330e0b5
dashboard link: https://syzkaller.appspot.com/bug?extid=62120febbd1ee3c3c860

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

possible deadlock in ext4_xattr_inode_iget

EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.

======================================================
WARNING: possible circular locking dependency detected

6.4.0-rc2-syzkaller-00001-gc139d578ee6b #0 Not tainted
------------------------------------------------------
syz-executor.0/5417 is trying to acquire lock:
ffff888071756700 (&ea_inode->i_rwsem#7/1){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:775 [inline]
ffff888071756700 (&ea_inode->i_rwsem#7/1){+.+.}-{3:3}, at: ext4_xattr_inode_iget+0x267/0x5b0 fs/ext4/xattr.c:465

but task is already holding lock:

ffff888071755548 (&ei->i_data_sem){++++}-{3:3}, at: ext4_setattr+0x1988/0x2880 fs/ext4/inode.c:5420

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (&ei->i_data_sem){++++}-{3:3}:
down_write+0x92/0x200 kernel/locking/rwsem.c:1573
ext4_update_i_disksize fs/ext4/ext4.h:3307 [inline]
ext4_xattr_inode_write fs/ext4/xattr.c:1453 [inline]
ext4_xattr_inode_lookup_create fs/ext4/xattr.c:1602 [inline]
ext4_xattr_set_entry+0x30c8/0x39e0 fs/ext4/xattr.c:1727
ext4_xattr_ibody_set+0x131/0x3a0 fs/ext4/xattr.c:2279
ext4_xattr_set_handle+0x968/0x1510 fs/ext4/xattr.c:2436
ext4_xattr_set+0x144/0x360 fs/ext4/xattr.c:2550

__vfs_setxattr+0x173/0x1e0 fs/xattr.c:201
__vfs_setxattr_noperm+0x129/0x5f0 fs/xattr.c:235
__vfs_setxattr_locked+0x1d3/0x260 fs/xattr.c:296
vfs_setxattr+0x143/0x340 fs/xattr.c:322
do_setxattr+0x147/0x190 fs/xattr.c:630
setxattr+0x146/0x160 fs/xattr.c:653
path_setxattr+0x197/0x1c0 fs/xattr.c:672
__do_sys_setxattr fs/xattr.c:688 [inline]
__se_sys_setxattr fs/xattr.c:684 [inline]
__x64_sys_setxattr+0xc4/0x160 fs/xattr.c:684
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

-> #0 (&ea_inode->i_rwsem#7/1){+.+.}-{3:3}:

check_prev_add kernel/locking/lockdep.c:3108 [inline]
check_prevs_add kernel/locking/lockdep.c:3227 [inline]
validate_chain kernel/locking/lockdep.c:3842 [inline]
__lock_acquire+0x2f21/0x5df0 kernel/locking/lockdep.c:5074
lock_acquire kernel/locking/lockdep.c:5691 [inline]
lock_acquire+0x1b1/0x520 kernel/locking/lockdep.c:5656
down_write+0x92/0x200 kernel/locking/rwsem.c:1573

inode_lock include/linux/fs.h:775 [inline]
ext4_xattr_inode_iget+0x267/0x5b0 fs/ext4/xattr.c:465
ext4_xattr_inode_get+0x162/0x830 fs/ext4/xattr.c:542
ext4_xattr_move_to_block fs/ext4/xattr.c:2632 [inline]
ext4_xattr_make_inode_space fs/ext4/xattr.c:2734 [inline]
ext4_expand_extra_isize_ea+0xf51/0x1810 fs/ext4/xattr.c:2826
__ext4_expand_extra_isize+0x33e/0x470 fs/ext4/inode.c:5792
ext4_try_to_expand_extra_isize fs/ext4/inode.c:5835 [inline]
__ext4_mark_inode_dirty+0x51b/0x800 fs/ext4/inode.c:5913
ext4_setattr+0x1a02/0x2880 fs/ext4/inode.c:5423

notify_change+0xb2c/0x1180 fs/attr.c:483
do_truncate+0x143/0x200 fs/open.c:66
handle_truncate fs/namei.c:3295 [inline]
do_open fs/namei.c:3640 [inline]
path_openat+0x2083/0x2750 fs/namei.c:3791
do_filp_open+0x1ba/0x410 fs/namei.c:3818
do_sys_openat2+0x16d/0x4c0 fs/open.c:1356
do_sys_open fs/open.c:1372 [inline]

__do_sys_creat fs/open.c:1448 [inline]
__se_sys_creat fs/open.c:1442 [inline]
__x64_sys_creat+0xcd/0x120 fs/open.c:1442

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

other info that might help us debug this:

Possible unsafe locking scenario:

CPU0 CPU1
---- ----

lock(&ei->i_data_sem);
lock(&ea_inode->i_rwsem#7/1);
lock(&ei->i_data_sem);
lock(&ea_inode->i_rwsem#7/1);

*** DEADLOCK ***

5 locks held by syz-executor.0/5417:
#0: ffff88802c6aa460 (sb_writers#5){.+.+}-{0:0}, at: do_open fs/namei.c:3629 [inline]
#0: ffff88802c6aa460 (sb_writers#5){.+.+}-{0:0}, at: path_openat+0x19a4/0x2750 fs/namei.c:3791
#1: ffff8880717556c0 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: inode_lock include/linux/fs.h:775 [inline]
#1: ffff8880717556c0 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: do_truncate+0x131/0x200 fs/open.c:64
#2: ffff888071755860 (mapping.invalidate_lock){++++}-{3:3}, at: filemap_invalidate_lock include/linux/fs.h:820 [inline]
#2: ffff888071755860 (mapping.invalidate_lock){++++}-{3:3}, at: ext4_setattr+0x6f2/0x2880 fs/ext4/inode.c:5380
#3: ffff888071755548 (&ei->i_data_sem){++++}-{3:3}, at: ext4_setattr+0x1988/0x2880 fs/ext4/inode.c:5420
#4: ffff888071755388 (&ei->xattr_sem){++++}-{3:3}, at: ext4_write_trylock_xattr fs/ext4/xattr.h:162 [inline]
#4: ffff888071755388 (&ei->xattr_sem){++++}-{3:3}, at: ext4_try_to_expand_extra_isize fs/ext4/inode.c:5832 [inline]
#4: ffff888071755388 (&ei->xattr_sem){++++}-{3:3}, at: __ext4_mark_inode_dirty+0x48f/0x800 fs/ext4/inode.c:5913

stack backtrace:
CPU: 0 PID: 5417 Comm: syz-executor.0 Not tainted 6.4.0-rc2-syzkaller-00001-gc139d578ee6b #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023

Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
check_noncircular+0x25f/0x2e0 kernel/locking/lockdep.c:2188
check_prev_add kernel/locking/lockdep.c:3108 [inline]
check_prevs_add kernel/locking/lockdep.c:3227 [inline]
validate_chain kernel/locking/lockdep.c:3842 [inline]
__lock_acquire+0x2f21/0x5df0 kernel/locking/lockdep.c:5074
lock_acquire kernel/locking/lockdep.c:5691 [inline]
lock_acquire+0x1b1/0x520 kernel/locking/lockdep.c:5656
down_write+0x92/0x200 kernel/locking/rwsem.c:1573

inode_lock include/linux/fs.h:775 [inline]
ext4_xattr_inode_iget+0x267/0x5b0 fs/ext4/xattr.c:465
ext4_xattr_inode_get+0x162/0x830 fs/ext4/xattr.c:542
ext4_xattr_move_to_block fs/ext4/xattr.c:2632 [inline]
ext4_xattr_make_inode_space fs/ext4/xattr.c:2734 [inline]
ext4_expand_extra_isize_ea+0xf51/0x1810 fs/ext4/xattr.c:2826
__ext4_expand_extra_isize+0x33e/0x470 fs/ext4/inode.c:5792
ext4_try_to_expand_extra_isize fs/ext4/inode.c:5835 [inline]
__ext4_mark_inode_dirty+0x51b/0x800 fs/ext4/inode.c:5913
ext4_setattr+0x1a02/0x2880 fs/ext4/inode.c:5423

notify_change+0xb2c/0x1180 fs/attr.c:483
do_truncate+0x143/0x200 fs/open.c:66
handle_truncate fs/namei.c:3295 [inline]
do_open fs/namei.c:3640 [inline]
path_openat+0x2083/0x2750 fs/namei.c:3791
do_filp_open+0x1ba/0x410 fs/namei.c:3818
do_sys_openat2+0x16d/0x4c0 fs/open.c:1356
do_sys_open fs/open.c:1372 [inline]

__do_sys_creat fs/open.c:1448 [inline]
__se_sys_creat fs/open.c:1442 [inline]
__x64_sys_creat+0xcd/0x120 fs/open.c:1442

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

RIP: 0033:0x7f5b3f88c169
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5b3ebfe168 EFLAGS: 00000246 ORIG_RAX: 0000000000000055
RAX: ffffffffffffffda RBX: 00007f5b3f9abf80 RCX: 00007f5b3f88c169
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000400
RBP: 00007f5b3f8e7ca1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffdc0c1b45f R14: 00007f5b3ebfe300 R15: 0000000000022000
</TASK>

Tested on:

commit: c139d578 ext4: add EA_INODE checking to ext4_iget()
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git test

console output: https://syzkaller.appspot.com/x/log.txt?x=10ded5d9280000
kernel config: https://syzkaller.appspot.com/x/.config?x=6beb6ffe4f59ef2a
dashboard link: https://syzkaller.appspot.com/bug?extid=298c5d8fb4a128bc27b0

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+edce54...@syzkaller.appspotmail.com

Tested on:

commit: c139d578 ext4: add EA_INODE checking to ext4_iget()
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git test

console output: https://syzkaller.appspot.com/x/log.txt?x=15ff99ee280000
kernel config: https://syzkaller.appspot.com/x/.config?x=f255d5b76a346cad
dashboard link: https://syzkaller.appspot.com/bug?extid=edce54daffee36421b4c
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

Note: no patches were applied.

[Theodore Ts'o]

#syz test git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git test

Testing "WARNING: locking bug in ext4_xattr_inode_iget"

[Theodore Ts'o]

#syz test git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git test

Testing "WARNING: locking bug in ext4_xattr_inode_update_ref"

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

WARNING: locking bug in ext4_xattr_inode_iget

loop0: detected capacity change from 0 to 512
EXT4-fs: Ignoring removed mblk_io_submit option
EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
EXT4-fs error (device loop0): ext4_xattr_inode_iget:436: inode #12: comm syz-executor.0: casefold flag without casefold feature
------------[ cut here ]------------
Looking for class "&ea_inode->i_rwsem" with key ext4_fs_type, but found a different class "&type->i_mutex_dir_key" with the same key
WARNING: CPU: 0 PID: 5414 at kernel/locking/lockdep.c:941 look_up_lock_class+0xc2/0x140 kernel/locking/lockdep.c:938
Modules linked in:
CPU: 0 PID: 5414 Comm: syz-executor.0 Not tainted 6.4.0-rc2-syzkaller-00001-gc139d578ee6b #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023

RIP: 0010:look_up_lock_class+0xc2/0x140 kernel/locking/lockdep.c:938
Code: 8b 16 48 c7 c0 60 81 1e 90 48 39 c2 74 46 f6 05 4f 77 92 03 01 75 3d c6 05 46 77 92 03 01 48 c7 c7 c0 ad ea 8a e8 0e 0a a4 f6 <0f> 0b eb 26 e8 d5 2d 81 f9 48 c7 c7 00 ad ea 8a 89 de e8 37 ca fd
RSP: 0018:ffffc900050c7090 EFLAGS: 00010046
RAX: 11637452825a6500 RBX: ffffffff9005b360 RCX: ffff88801edd0000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900050c7190 R08: ffffffff815301a2 R09: ffffed1017305163
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000001
R13: 1ffff92000a18e20 R14: ffff888074ffc000 R15: ffffffff8d0df6f9
FS: 00007f9b71f64700(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 000055825a44d950 CR3: 0000000027b46000 CR4: 00000000003506f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>

register_lock_class+0x104/0x990 kernel/locking/lockdep.c:1290
lockdep_init_map_type+0x37a/0x8e0 kernel/locking/lockdep.c:4875
ext4_xattr_inode_set_class fs/ext4/xattr.c:124 [inline]
ext4_xattr_inode_iget+0x25a/0x520 fs/ext4/xattr.c:452
ext4_xattr_inode_get+0x164/0x430 fs/ext4/xattr.c:542

ext4_xattr_move_to_block fs/ext4/xattr.c:2632 [inline]
ext4_xattr_make_inode_space fs/ext4/xattr.c:2734 [inline]

ext4_expand_extra_isize_ea+0xf21/0x1ce0 fs/ext4/xattr.c:2826
__ext4_expand_extra_isize+0x2f7/0x3d0 fs/ext4/inode.c:5792
ext4_try_to_expand_extra_isize fs/ext4/inode.c:5835 [inline]
__ext4_mark_inode_dirty+0x53e/0x870 fs/ext4/inode.c:5913
ext4_evict_inode+0x839/0xf20 fs/ext4/inode.c:251
evict+0x2a4/0x620 fs/inode.c:665
ext4_orphan_cleanup+0xb1e/0x13c0 fs/ext4/orphan.c:474
__ext4_fill_super fs/ext4/super.c:5556 [inline]
ext4_fill_super+0x6392/0x6c60 fs/ext4/super.c:5672
get_tree_bdev+0x405/0x620 fs/super.c:1303
vfs_get_tree+0x8c/0x270 fs/super.c:1510
do_new_mount+0x28f/0xae0 fs/namespace.c:3039
do_mount fs/namespace.c:3382 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3568
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f9b7128d69a
Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9b71f63f88 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 000000000000043a RCX: 00007f9b7128d69a
RDX: 0000000020000180 RSI: 00000000200000c0 RDI: 00007f9b71f63fe0
RBP: 00007f9b71f64020 R08: 00007f9b71f64020 R09: 0000000000800700
R10: 0000000000800700 R11: 0000000000000246 R12: 0000000020000180
R13: 00000000200000c0 R14: 00007f9b71f63fe0 R15: 0000000020000100
</TASK>

Tested on:

commit: c139d578 ext4: add EA_INODE checking to ext4_iget()
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git test

console output: https://syzkaller.appspot.com/x/log.txt?x=12351d09280000
kernel config: https://syzkaller.appspot.com/x/.config?x=94af80bb8ddd23c4
dashboard link: https://syzkaller.appspot.com/bug?extid=e44749b6ba4d0434cd47

compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

WARNING: locking bug in ext4_xattr_inode_update_ref

------------[ cut here ]------------
Looking for class "&ea_inode->i_rwsem" with key ext4_fs_type, but found a different class "&sb->s_type->i_mutex_key" with the same key
WARNING: CPU: 1 PID: 9816 at kernel/locking/lockdep.c:941 look_up_lock_class+0xec/0x158 kernel/locking/lockdep.c:938
Modules linked in:
CPU: 1 PID: 9816 Comm: syz-executor.3 Not tainted 6.4.0-rc2-syzkaller-00001-gc139d578ee6b #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023

pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : look_up_lock_class+0xec/0x158 kernel/locking/lockdep.c:938
lr : look_up_lock_class+0xec/0x158 kernel/locking/lockdep.c:938
sp : ffff8000218d6900
x29: ffff8000218d6900 x28: dfff800000000000 x27: ffff800008f8127c
x26: ffff80001a21a6e0 x25: ffff80001a21a000 x24: 0000000000000000
x23: 0000000000000000 x22: 0000000000000000 x21: ffff800016222d58
x20: ffff0000e6c5f200 x19: ffff800018e56c80 x18: 1ffff0000431ad7c
x17: 0000000000000000 x16: ffff8000123804b0 x15: 0000000000000002
x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000001
x11: 0000000000000000 x10: 0000000000000000 x9 : f7400f5d78b49100
x8 : f7400f5d78b49100 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff8000218d61f8 x4 : ffff800015f8e880 x3 : ffff80000835b2ac
x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000000
Call trace:
look_up_lock_class+0xec/0x158 kernel/locking/lockdep.c:938
register_lock_class+0x8c/0x6a4 kernel/locking/lockdep.c:1290
__lock_acquire+0x184/0x75f0 kernel/locking/lockdep.c:4951
lock_acquire+0x23c/0x71c kernel/locking/lockdep.c:5691
down_write+0x50/0xc0 kernel/locking/rwsem.c:1573
inode_lock include/linux/fs.h:775 [inline]
ext4_xattr_inode_update_ref+0xac/0x4e0 fs/ext4/xattr.c:1049
ext4_xattr_inode_dec_ref fs/ext4/xattr.c:1100 [inline]
ext4_xattr_set_entry+0x9c0/0x2c3c fs/ext4/xattr.c:1739
ext4_xattr_block_set+0x558/0x2cc4 fs/ext4/xattr.c:1964
ext4_xattr_set_handle+0xb2c/0x12d8 fs/ext4/xattr.c:2448
ext4_xattr_set+0x1e0/0x354 fs/ext4/xattr.c:2550
ext4_xattr_trusted_set+0x4c/0x64 fs/ext4/xattr_trusted.c:38
__vfs_setxattr+0x3d8/0x400 fs/xattr.c:201
__vfs_setxattr_noperm+0x110/0x528 fs/xattr.c:235
__vfs_setxattr_locked+0x1ec/0x218 fs/xattr.c:296
vfs_setxattr+0x1a8/0x344 fs/xattr.c:322
do_setxattr fs/xattr.c:630 [inline]
setxattr+0x208/0x29c fs/xattr.c:653
path_setxattr+0x17c/0x258 fs/xattr.c:672

__do_sys_setxattr fs/xattr.c:688 [inline]
__se_sys_setxattr fs/xattr.c:684 [inline]

__arm64_sys_setxattr+0xbc/0xd8 fs/xattr.c:684
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:193
el0_svc+0x4c/0x15c arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
irq event stamp: 10295
hardirqs last enabled at (10295): [<ffff800008b569d4>] lookup_bh_lru fs/buffer.c:1340 [inline]
hardirqs last enabled at (10295): [<ffff800008b569d4>] __find_get_block+0x1a0/0xe8c fs/buffer.c:1352
hardirqs last disabled at (10294): [<ffff800008b5689c>] lookup_bh_lru fs/buffer.c:1321 [inline]
hardirqs last disabled at (10294): [<ffff800008b5689c>] __find_get_block+0x68/0xe8c fs/buffer.c:1352
softirqs last enabled at (9066): [<ffff800008033378>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (9064): [<ffff800008033344>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19

---[ end trace 0000000000000000 ]---

======================================================

Tested on:

commit: c139d578 ext4: add EA_INODE checking to ext4_iget()
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git test

console output: https://syzkaller.appspot.com/x/log.txt?x=1193c50e280000
kernel config: https://syzkaller.appspot.com/x/.config?x=f255d5b76a346cad
dashboard link: https://syzkaller.appspot.com/bug?extid=d4b971e744b1f5439336

compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2

userspace arch: arm64