From: syzbot <syzbot+4cba2fd444e9a16ae758@syzkaller.appspotmail.com>
To: eadavis@qq.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [hfs?] possible deadlock in hfsplus_file_extend (2)
Date: Mon, 11 Nov 2024 05:26:03 -0800 [thread overview]
Message-ID: <673205eb.050a0220.a83d0.0014.GAE@google.com> (raw)
In-Reply-To: <tencent_29BA7ABBA933079E391B774B921B61255908@qq.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in hfsplus_file_extend
loop0: detected capacity change from 0 to 1024
hfsplus: inconsistency in B*Tree (128,1,255,1,0)
======================================================
WARNING: possible circular locking dependency detected
6.12.0-rc7-syzkaller-g2d5404caa8c7-dirty #0 Not tainted
------------------------------------------------------
syz.0.15/5813 is trying to acquire lock:
ffff8880569a0108 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}, at: hfsplus_file_extend+0x21b/0x1b70 fs/hfsplus/extents.c:460
but task is already holding lock:
ffff88803625c0b0 (&tree->tree_lock/1){+.+.}-{3:3}, at: hfsplus_find_init+0x14a/0x1c0 fs/hfsplus/bfind.c:28
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&tree->tree_lock/1){+.+.}-{3:3}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752
hfsplus_find_init+0x14a/0x1c0 fs/hfsplus/bfind.c:28
hfsplus_ext_read_extent fs/hfsplus/extents.c:218 [inline]
hfsplus_file_extend+0x454/0x1b70 fs/hfsplus/extents.c:464
hfsplus_bmap_reserve+0x105/0x4e0 fs/hfsplus/btree.c:358
hfsplus_create_attr+0x1c8/0x640 fs/hfsplus/attributes.c:221
__hfsplus_setxattr+0x6fe/0x22d0 fs/hfsplus/xattr.c:354
hfsplus_setxattr+0xb0/0xe0 fs/hfsplus/xattr.c:432
hfsplus_trusted_setxattr+0x40/0x60 fs/hfsplus/xattr_trusted.c:30
__vfs_setxattr+0x468/0x4a0 fs/xattr.c:200
__vfs_setxattr_noperm+0x12e/0x660 fs/xattr.c:234
vfs_setxattr+0x221/0x430 fs/xattr.c:321
do_setxattr fs/xattr.c:629 [inline]
path_setxattr+0x37e/0x4d0 fs/xattr.c:658
__do_sys_lsetxattr fs/xattr.c:683 [inline]
__se_sys_lsetxattr fs/xattr.c:679 [inline]
__x64_sys_lsetxattr+0xb8/0xd0 fs/xattr.c:679
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904
__lock_acquire+0x1384/0x2050 kernel/locking/lockdep.c:5202
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752
hfsplus_file_extend+0x21b/0x1b70 fs/hfsplus/extents.c:460
hfsplus_bmap_reserve+0x105/0x4e0 fs/hfsplus/btree.c:358
__hfsplus_ext_write_extent+0x2af/0x5d0 fs/hfsplus/extents.c:105
__hfsplus_ext_cache_extent+0x84/0xe10 fs/hfsplus/extents.c:188
hfsplus_ext_read_extent fs/hfsplus/extents.c:220 [inline]
hfsplus_file_extend+0x48c/0x1b70 fs/hfsplus/extents.c:464
hfsplus_bmap_reserve+0x105/0x4e0 fs/hfsplus/btree.c:358
hfsplus_create_attr+0x1c8/0x640 fs/hfsplus/attributes.c:221
__hfsplus_setxattr+0x6fe/0x22d0 fs/hfsplus/xattr.c:354
hfsplus_setxattr+0xb0/0xe0 fs/hfsplus/xattr.c:432
hfsplus_trusted_setxattr+0x40/0x60 fs/hfsplus/xattr_trusted.c:30
__vfs_setxattr+0x468/0x4a0 fs/xattr.c:200
__vfs_setxattr_noperm+0x12e/0x660 fs/xattr.c:234
vfs_setxattr+0x221/0x430 fs/xattr.c:321
do_setxattr fs/xattr.c:629 [inline]
path_setxattr+0x37e/0x4d0 fs/xattr.c:658
__do_sys_lsetxattr fs/xattr.c:683 [inline]
__se_sys_lsetxattr fs/xattr.c:679 [inline]
__x64_sys_lsetxattr+0xb8/0xd0 fs/xattr.c:679
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&tree->tree_lock/1);
lock(&HFSPLUS_I(inode)->extents_lock);
lock(&tree->tree_lock/1);
lock(&HFSPLUS_I(inode)->extents_lock);
*** DEADLOCK ***
5 locks held by syz.0.15/5813:
#0: ffff888011c4c420 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x3f/0x90 fs/namespace.c:515
#1: ffff8880569a24b8 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline]
#1: ffff8880569a24b8 (&sb->s_type->i_mutex_key#21){+.+.}-{3:3}, at: vfs_setxattr+0x1e1/0x430 fs/xattr.c:320
#2: ffff888040a3a0b0 (&tree->tree_lock){+.+.}-{3:3}, at: hfsplus_find_init+0x14a/0x1c0 fs/hfsplus/bfind.c:28
#3: ffff888040a3e0b0 (&tree->tree_lock/2){+.+.}-{3:3}, at: hfsplus_find_init+0x14a/0x1c0 fs/hfsplus/bfind.c:28
#4: ffff88803625c0b0 (&tree->tree_lock/1){+.+.}-{3:3}, at: hfsplus_find_init+0x14a/0x1c0 fs/hfsplus/bfind.c:28
stack backtrace:
CPU: 0 UID: 0 PID: 5813 Comm: syz.0.15 Not tainted 6.12.0-rc7-syzkaller-g2d5404caa8c7-dirty #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2074
check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2206
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904
__lock_acquire+0x1384/0x2050 kernel/locking/lockdep.c:5202
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752
hfsplus_file_extend+0x21b/0x1b70 fs/hfsplus/extents.c:460
hfsplus_bmap_reserve+0x105/0x4e0 fs/hfsplus/btree.c:358
__hfsplus_ext_write_extent+0x2af/0x5d0 fs/hfsplus/extents.c:105
__hfsplus_ext_cache_extent+0x84/0xe10 fs/hfsplus/extents.c:188
hfsplus_ext_read_extent fs/hfsplus/extents.c:220 [inline]
hfsplus_file_extend+0x48c/0x1b70 fs/hfsplus/extents.c:464
hfsplus_bmap_reserve+0x105/0x4e0 fs/hfsplus/btree.c:358
hfsplus_create_attr+0x1c8/0x640 fs/hfsplus/attributes.c:221
__hfsplus_setxattr+0x6fe/0x22d0 fs/hfsplus/xattr.c:354
hfsplus_setxattr+0xb0/0xe0 fs/hfsplus/xattr.c:432
hfsplus_trusted_setxattr+0x40/0x60 fs/hfsplus/xattr_trusted.c:30
__vfs_setxattr+0x468/0x4a0 fs/xattr.c:200
__vfs_setxattr_noperm+0x12e/0x660 fs/xattr.c:234
vfs_setxattr+0x221/0x430 fs/xattr.c:321
do_setxattr fs/xattr.c:629 [inline]
path_setxattr+0x37e/0x4d0 fs/xattr.c:658
__do_sys_lsetxattr fs/xattr.c:683 [inline]
__se_sys_lsetxattr fs/xattr.c:679 [inline]
__x64_sys_lsetxattr+0xb8/0xd0 fs/xattr.c:679
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb2e7b7e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb2e88e4038 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd
RAX: ffffffffffffffda RBX: 00007fb2e7d35f80 RCX: 00007fb2e7b7e719
RDX: 0000000000000000 RSI: 0000000020000200 RDI: 0000000020000040
RBP: 00007fb2e7bf139e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fb2e7d35f80 R15: 00007ffc148ca008
</TASK>
Tested on:
commit: 2d5404ca Linux 6.12-rc7
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17a53ea7980000
kernel config: https://syzkaller.appspot.com/x/.config?x=d2aeec8c0b2e420c
dashboard link: https://syzkaller.appspot.com/bug?extid=4cba2fd444e9a16ae758
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=11f93ea7980000
next prev parent reply other threads:[~2024-11-11 13:26 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-11-11 11:50 [syzbot] [hfs?] possible deadlock in hfsplus_file_extend (2) syzbot
2024-11-11 12:35 ` Edward Adam Davis
2024-11-11 12:51 ` syzbot
2024-11-11 13:11 ` Edward Adam Davis
2024-11-11 13:26 ` syzbot [this message]
2024-11-12 5:38 ` Edward Adam Davis
2024-11-12 5:59 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=673205eb.050a0220.a83d0.0014.GAE@google.com \
--to=syzbot+4cba2fd444e9a16ae758@syzkaller.appspotmail.com \
--cc=eadavis@qq.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.