From: syzbot <syzbot+63ba90b81c16b86379bd@syzkaller.appspotmail.com>
To: akpm@linux-foundation.org, linux-kernel@vger.kernel.org,
linux-mm@kvack.org, syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [mm?] possible deadlock in gup_fast_fallback
Date: Wed, 24 Jul 2024 07:10:33 -0700 [thread overview]
Message-ID: <000000000000733373061dfed75d@google.com> (raw)
In-Reply-To: <0000000000006bca48061692b790@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: 786c8248dbd3 Merge tag 'perf-tools-fixes-for-v6.11-2024-07..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=15009665980000
kernel config: https://syzkaller.appspot.com/x/.config?x=d732ba79a3d0331b
dashboard link: https://syzkaller.appspot.com/bug?extid=63ba90b81c16b86379bd
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=162862e3980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10d14ce3980000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/a022c722f874/disk-786c8248.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/860e2faa9749/vmlinux-786c8248.xz
kernel image: https://storage.googleapis.com/syzbot-assets/518e4afe4ede/bzImage-786c8248.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/09d1622c5e09/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+63ba90b81c16b86379bd@syzkaller.appspotmail.com
ntfs3: loop0: Mark volume as dirty due to NTFS errors
ntfs3: loop0: Failed to load $Extend (-116).
ntfs3: loop0: Failed to initialize $Extend.
======================================================
WARNING: possible circular locking dependency detected
6.10.0-syzkaller-12246-g786c8248dbd3 #0 Not tainted
------------------------------------------------------
syz-executor288/5099 is trying to acquire lock:
ffff888063210b18 (&mm->mmap_lock){++++}-{3:3}, at: gup_fast_fallback+0x233/0x2b50 mm/gup.c:3367
but task is already holding lock:
ffff88807a2be310 (&sb->s_type->i_mutex_key#14){+.+.}-{3:3}, at: inode_trylock include/linux/fs.h:819 [inline]
ffff88807a2be310 (&sb->s_type->i_mutex_key#14){+.+.}-{3:3}, at: ntfs_file_write_iter+0x24a/0x740 fs/ntfs3/file.c:1166
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&sb->s_type->i_mutex_key#14){+.+.}-{3:3}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5759
down_write+0x99/0x220 kernel/locking/rwsem.c:1579
inode_lock include/linux/fs.h:799 [inline]
ntfs_file_mmap+0x5bf/0x850 fs/ntfs3/file.c:368
call_mmap include/linux/fs.h:2129 [inline]
mmap_region+0xe8f/0x2090 mm/mmap.c:2927
do_mmap+0x8ad/0xfa0 mm/mmap.c:1438
vm_mmap_pgoff+0x1dd/0x3d0 mm/util.c:588
ksys_mmap_pgoff+0x4f1/0x720 mm/mmap.c:1484
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (&mm->mmap_lock){++++}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain+0x18e0/0x5900 kernel/locking/lockdep.c:3868
__lock_acquire+0x137a/0x2040 kernel/locking/lockdep.c:5142
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5759
gup_fast_fallback+0x24c/0x2b50 mm/gup.c:3367
pin_user_pages_fast+0xcc/0x160 mm/gup.c:3491
iov_iter_extract_user_pages lib/iov_iter.c:1583 [inline]
iov_iter_extract_pages+0x3db/0x720 lib/iov_iter.c:1646
dio_refill_pages fs/direct-io.c:173 [inline]
dio_get_page fs/direct-io.c:214 [inline]
do_direct_IO fs/direct-io.c:916 [inline]
__blockdev_direct_IO+0x144c/0x4890 fs/direct-io.c:1249
blockdev_direct_IO include/linux/fs.h:3212 [inline]
ntfs_direct_IO+0x195/0x370 fs/ntfs3/inode.c:801
generic_file_direct_write+0x130/0x350 mm/filemap.c:3941
__generic_file_write_iter+0x129/0x230 mm/filemap.c:4107
ntfs_file_write_iter+0x663/0x740 fs/ntfs3/file.c:1193
do_iter_readv_writev+0x60a/0x890
vfs_writev+0x37c/0xbb0 fs/read_write.c:971
do_pwritev fs/read_write.c:1072 [inline]
__do_sys_pwritev2 fs/read_write.c:1131 [inline]
__se_sys_pwritev2+0x1ca/0x2d0 fs/read_write.c:1122
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&sb->s_type->i_mutex_key#14);
lock(&mm->mmap_lock);
lock(&sb->s_type->i_mutex_key#14);
rlock(&mm->mmap_lock);
*** DEADLOCK ***
2 locks held by syz-executor288/5099:
#0: ffff888023990420 (sb_writers#9){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2876 [inline]
#0: ffff888023990420 (sb_writers#9){.+.+}-{0:0}, at: vfs_writev+0x2d4/0xbb0 fs/read_write.c:969
#1: ffff88807a2be310 (&sb->s_type->i_mutex_key#14){+.+.}-{3:3}, at: inode_trylock include/linux/fs.h:819 [inline]
#1: ffff88807a2be310 (&sb->s_type->i_mutex_key#14){+.+.}-{3:3}, at: ntfs_file_write_iter+0x24a/0x740 fs/ntfs3/file.c:1166
stack backtrace:
CPU: 0 UID: 0 PID: 5099 Comm: syz-executor288 Not tainted 6.10.0-syzkaller-12246-g786c8248dbd3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119
check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2186
check_prev_add kernel/locking/lockdep.c:3133 [inline]
check_prevs_add kernel/locking/lockdep.c:3252 [inline]
validate_chain+0x18e0/0x5900 kernel/locking/lockdep.c:3868
__lock_acquire+0x137a/0x2040 kernel/locking/lockdep.c:5142
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5759
gup_fast_fallback+0x24c/0x2b50 mm/gup.c:3367
pin_user_pages_fast+0xcc/0x160 mm/gup.c:3491
iov_iter_extract_user_pages lib/iov_iter.c:1583 [inline]
iov_iter_extract_pages+0x3db/0x720 lib/iov_iter.c:1646
dio_refill_pages fs/direct-io.c:173 [inline]
dio_get_page fs/direct-io.c:214 [inline]
do_direct_IO fs/direct-io.c:916 [inline]
__blockdev_direct_IO+0x144c/0x4890 fs/direct-io.c:1249
blockdev_direct_IO include/linux/fs.h:3212 [inline]
ntfs_direct_IO+0x195/0x370 fs/ntfs3/inode.c:801
generic_file_direct_write+0x130/0x350 mm/filemap.c:3941
__generic_file_write_iter+0x129/0x230 mm/filemap.c:4107
ntfs_file_write_iter+0x663/0x740 fs/ntfs3/file.c:1193
do_iter_readv_writev+0x60a/0x890
vfs_writev+0x37c/0xbb0 fs/read_write.c:971
do_pwritev fs/read_write.c:1072 [inline]
__do_sys_pwritev2 fs/read_write.c:1131 [inline]
__se_sys_pwritev2+0x1ca/0x2d0 fs/read_write.c:1122
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb9777dcb59
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe15926128 EFLAGS: 00000246 ORIG_RAX: 0000000000000148
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb9777dcb59
RDX: 0000000000000001 RSI: 0000000020000240 RDI: 0000000000000005
RBP: 00007fb97786f5f0 R08: 0000000000000000 R09: 0000000000000003
R10: 0000000000007000 R11: 0000000000000246 R12: 00007ffe15926160
R13: 00007ffe15926388 R14: 431bde82d7b634db R15: 00007fb97782503b
</TASK>
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
next prev parent reply other threads:[~2024-07-24 14:10 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-21 3:14 [syzbot] [mm?] possible deadlock in gup_fast_fallback syzbot
2024-07-24 14:10 ` syzbot [this message]
2024-07-25 1:01 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000733373061dfed75d@google.com \
--to=syzbot+63ba90b81c16b86379bd@syzkaller.appspotmail.com \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.