From: syzbot <syzbot+731b27ee9413ba859499@syzkaller.appspotmail.com>
To: almaz.alexandrovich@paragon-software.com,
linux-kernel@vger.kernel.org, ntfs3@lists.linux.dev,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [ntfs3?] possible deadlock in run_unpack_ex
Date: Thu, 19 Dec 2024 18:51:26 -0800 [thread overview]
Message-ID: <6764dbae.050a0220.1bfc9e.0003.GAE@google.com> (raw)
In-Reply-To: <672dbfef.050a0220.69327.0000.GAE@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: baaa2567a712 Merge tag 'mmc-v6.13-rc2' of git://git.kernel..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=155d9f44580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1234f097ee657d8b
dashboard link: https://syzkaller.appspot.com/bug?extid=731b27ee9413ba859499
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11660fe8580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12ce62df980000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/816d068f9171/disk-baaa2567.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9b40d3a7d8cc/vmlinux-baaa2567.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e9af7e09d18f/bzImage-baaa2567.xz
mounted in repro #1: https://storage.googleapis.com/syzbot-assets/9fd4a2bb86ce/mount_0.gz
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/87a127155fbe/mount_2.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+731b27ee9413ba859499@syzkaller.appspotmail.com
======================================================
WARNING: possible circular locking dependency detected
6.13.0-rc3-syzkaller-00082-gbaaa2567a712 #0 Not tainted
------------------------------------------------------
syz-executor336/5955 is trying to acquire lock:
ffff8880772ed9d0 (&ni->file.run_lock#2){++++}-{4:4}, at: run_unpack_ex+0x55e/0x9e0 fs/ntfs3/run.c:1119
but task is already holding lock:
ffff88807ffd4270 (&wnd->rw_lock){++++}-{4:4}, at: run_unpack_ex+0x47a/0x9e0 fs/ntfs3/run.c:1100
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&wnd->rw_lock){++++}-{4:4}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
down_write_nested+0xa2/0x220 kernel/locking/rwsem.c:1693
mark_as_free_ex+0x3e/0x390 fs/ntfs3/fsntfs.c:2484
run_deallocate_ex+0x244/0x5f0 fs/ntfs3/attrib.c:122
attr_set_size+0x168d/0x4300 fs/ntfs3/attrib.c:753
ntfs_truncate fs/ntfs3/file.c:506 [inline]
ntfs_setattr+0x7a4/0xb80 fs/ntfs3/file.c:824
notify_change+0xbca/0xe90 fs/attr.c:552
do_truncate+0x220/0x310 fs/open.c:65
vfs_truncate+0x2e1/0x3b0 fs/open.c:111
do_sys_truncate+0xdb/0x190 fs/open.c:134
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (&ni->file.run_lock#2){++++}-{4:4}:
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904
__lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
down_read+0xb1/0xa40 kernel/locking/rwsem.c:1524
run_unpack_ex+0x55e/0x9e0 fs/ntfs3/run.c:1119
ntfs_read_mft fs/ntfs3/inode.c:401 [inline]
ntfs_iget5+0x1f9a/0x37b0 fs/ntfs3/inode.c:537
dir_search_u+0x2fe/0x3a0 fs/ntfs3/dir.c:264
ntfs_lookup+0x106/0x1f0 fs/ntfs3/namei.c:85
__lookup_slow+0x28c/0x3f0 fs/namei.c:1791
lookup_slow+0x53/0x70 fs/namei.c:1808
walk_component+0x2e1/0x410 fs/namei.c:2112
lookup_last fs/namei.c:2610 [inline]
path_lookupat+0x16f/0x450 fs/namei.c:2634
filename_lookup+0x2a3/0x670 fs/namei.c:2663
user_path_at+0x3a/0x60 fs/namei.c:3070
do_mount fs/namespace.c:3844 [inline]
__do_sys_mount fs/namespace.c:4057 [inline]
__se_sys_mount+0x297/0x3c0 fs/namespace.c:4034
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&wnd->rw_lock);
lock(&ni->file.run_lock#2);
lock(&wnd->rw_lock);
rlock(&ni->file.run_lock#2);
*** DEADLOCK ***
3 locks held by syz-executor336/5955:
#0: ffff8880703e5bb8 (&type->i_mutex_dir_key#8){++++}-{4:4}, at: inode_lock_shared include/linux/fs.h:828 [inline]
#0: ffff8880703e5bb8 (&type->i_mutex_dir_key#8){++++}-{4:4}, at: lookup_slow+0x45/0x70 fs/namei.c:1807
#1: ffff8880703e5920 (&ni->ni_lock#3/6){+.+.}-{4:4}, at: ni_lock_dir fs/ntfs3/ntfs_fs.h:1115 [inline]
#1: ffff8880703e5920 (&ni->ni_lock#3/6){+.+.}-{4:4}, at: ntfs_lookup+0xf9/0x1f0 fs/ntfs3/namei.c:84
#2: ffff88807ffd4270 (&wnd->rw_lock){++++}-{4:4}, at: run_unpack_ex+0x47a/0x9e0 fs/ntfs3/run.c:1100
stack backtrace:
CPU: 1 UID: 0 PID: 5955 Comm: syz-executor336 Not tainted 6.13.0-rc3-syzkaller-00082-gbaaa2567a712 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2074
check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2206
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904
__lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
down_read+0xb1/0xa40 kernel/locking/rwsem.c:1524
run_unpack_ex+0x55e/0x9e0 fs/ntfs3/run.c:1119
ntfs_read_mft fs/ntfs3/inode.c:401 [inline]
ntfs_iget5+0x1f9a/0x37b0 fs/ntfs3/inode.c:537
dir_search_u+0x2fe/0x3a0 fs/ntfs3/dir.c:264
ntfs_lookup+0x106/0x1f0 fs/ntfs3/namei.c:85
__lookup_slow+0x28c/0x3f0 fs/namei.c:1791
lookup_slow+0x53/0x70 fs/namei.c:1808
walk_component+0x2e1/0x410 fs/namei.c:2112
lookup_last fs/namei.c:2610 [inline]
path_lookupat+0x16f/0x450 fs/namei.c:2634
filename_lookup+0x2a3/0x670 fs/namei.c:2663
user_path_at+0x3a/0x60 fs/namei.c:3070
do_mount fs/namespace.c:3844 [inline]
__do_sys_mount fs/namespace.c:4057 [inline]
__se_sys_mount+0x297/0x3c0 fs/namespace.c:4034
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7febe4f8bed9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd61a52908 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007febe4f8bed9
RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000000
RBP: 00007ffd61a5292c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000021 R11: 0000000000000246 R12: 00007ffd61a52980
R13: 00007ffd61a52940 R14: 0000000000014b5d R15: 0000000000000014
</TASK>
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
next prev parent reply other threads:[~2024-12-20 2:51 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-11-08 7:38 [syzbot] [ntfs3?] possible deadlock in run_unpack_ex syzbot
2024-12-20 2:51 ` syzbot [this message]
2024-12-20 22:26 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6764dbae.050a0220.1bfc9e.0003.GAE@google.com \
--to=syzbot+731b27ee9413ba859499@syzkaller.appspotmail.com \
--cc=almaz.alexandrovich@paragon-software.com \
--cc=linux-kernel@vger.kernel.org \
--cc=ntfs3@lists.linux.dev \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.