All of lore.kernel.org
 help / color / mirror / Atom feed
From: syzbot <syzbot+c2ada45c23d98d646118@syzkaller.appspotmail.com>
To: eadavis@qq.com, linux-kernel@vger.kernel.org,
	 syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [ntfs3?] possible deadlock in ntfs_set_state (2)
Date: Tue, 13 Feb 2024 03:10:01 -0800	[thread overview]
Message-ID: <0000000000008325b70611416f20@google.com> (raw)
In-Reply-To: <tencent_E2FE25978DA612195DF45DCD191D4FAF8D07@qq.com>

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in ntfs_set_state

loop0: detected capacity change from 0 to 4096
ntfs3: loop0: Different NTFS sector size (4096) and media sector size (512).
ntfs3: loop0: ino=5, "/" ntfs_iget5
============================================
WARNING: possible recursive locking detected
6.8.0-rc4-syzkaller-00005-gc664e16bb1ba-dirty #0 Not tainted
--------------------------------------------
syz-executor.0/5514 is trying to acquire lock:
ffff888068bf8100 (&ni->ni_lock#3){+.+.}-{3:3}, at: ntfs_set_state+0x1ff/0x6c0 fs/ntfs3/fsntfs.c:947

but task is already holding lock:
ffff888068bf9e80 (&ni->ni_lock#3){+.+.}-{3:3}, at: ni_trylock fs/ntfs3/ntfs_fs.h:1141 [inline]
ffff888068bf9e80 (&ni->ni_lock#3){+.+.}-{3:3}, at: ni_write_inode+0x1bc/0x1010 fs/ntfs3/frecord.c:3264

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&ni->ni_lock#3);
  lock(&ni->ni_lock#3);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

3 locks held by syz-executor.0/5514:
 #0: ffff88802ec00420 (sb_writers#13){.+.+}-{0:0}, at: do_sys_ftruncate+0x25c/0x390 fs/open.c:191
 #1: ffff888068bfa120 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:802 [inline]
 #1: ffff888068bfa120 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: do_truncate+0x20c/0x310 fs/open.c:64
 #2: ffff888068bf9e80 (&ni->ni_lock#3){+.+.}-{3:3}, at: ni_trylock fs/ntfs3/ntfs_fs.h:1141 [inline]
 #2: ffff888068bf9e80 (&ni->ni_lock#3){+.+.}-{3:3}, at: ni_write_inode+0x1bc/0x1010 fs/ntfs3/frecord.c:3264

stack backtrace:
CPU: 0 PID: 5514 Comm: syz-executor.0 Not tainted 6.8.0-rc4-syzkaller-00005-gc664e16bb1ba-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106
 check_deadlock kernel/locking/lockdep.c:3062 [inline]
 validate_chain+0x15c0/0x58e0 kernel/locking/lockdep.c:3856
 __lock_acquire+0x1345/0x1fd0 kernel/locking/lockdep.c:5137
 lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754
 __mutex_lock_common kernel/locking/mutex.c:608 [inline]
 __mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752
 ntfs_set_state+0x1ff/0x6c0 fs/ntfs3/fsntfs.c:947
 ntfs_iget5+0x3f0/0x3b70 fs/ntfs3/inode.c:535
 ni_update_parent+0x934/0xdc0 fs/ntfs3/frecord.c:3217
 ni_write_inode+0xde9/0x1010 fs/ntfs3/frecord.c:3323
 ntfs_truncate fs/ntfs3/file.c:410 [inline]
 ntfs3_setattr+0x950/0xb40 fs/ntfs3/file.c:703
 notify_change+0xb9f/0xe70 fs/attr.c:499
 do_truncate+0x220/0x310 fs/open.c:66
 do_sys_ftruncate+0x2f7/0x390 fs/open.c:194
 do_syscall_64+0xfb/0x240
 entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7f8b46a7dda9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8b478530c8 EFLAGS: 00000246 ORIG_RAX: 000000000000004d
RAX: ffffffffffffffda RBX: 00007f8b46babf80 RCX: 00007f8b46a7dda9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007f8b46aca47a R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f8b46babf80 R15: 00007ffcddaf9d18
 </TASK>
ntfs3: loop0: Mark volume as dirty due to NTFS errors


Tested on:

commit:         c664e16b Merge tag 'docs-6.8-fixes2' of git://git.lwn...
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=152c5114180000
kernel config:  https://syzkaller.appspot.com/x/.config?x=1d7c92dd8d5c7a1e
dashboard link: https://syzkaller.appspot.com/bug?extid=c2ada45c23d98d646118
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=15ff6de0180000


  reply	other threads:[~2024-02-13 11:10 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-02-13  7:12 [syzbot] [ntfs3?] possible deadlock in ntfs_set_state (2) syzbot
2024-02-13 10:37 ` Edward Adam Davis
2024-02-13 11:10   ` syzbot [this message]
2024-02-13 11:41 ` Hillf Danton
2024-02-26  4:23   ` Boqun Feng
2024-02-26 10:55     ` Hillf Danton
2024-02-26 11:46       ` syzbot
2024-02-26 12:06         ` Hillf Danton
2024-02-26 15:00           ` syzbot
2024-07-17  6:31 ` [syzbot] ntfs3.git syzbot
2024-08-23  8:56 ` [syzbot] possible deadlock in ntfs_set_state (linux-ntfs3.git/master) syzbot
     [not found] <6fb088e7-3385-4c06-945f-0a58da0bf138@paragon-software.com>
2024-07-17  7:27 ` [syzbot] [ntfs3?] possible deadlock in ntfs_set_state (2) syzbot
     [not found] <e80cfc67-ff1c-484f-bf42-8c9d72408c36@paragon-software.com>
2024-08-23  9:26 ` syzbot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=0000000000008325b70611416f20@google.com \
    --to=syzbot+c2ada45c23d98d646118@syzkaller.appspotmail.com \
    --cc=eadavis@qq.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.