All of lore.kernel.org
 help / color / mirror / Atom feed
* [syzbot] [afs?] [ntfs3?] BUG: sleeping function called from invalid context in ovl_cache_entry_new
@ 2025-03-27 16:27 syzbot
  2025-03-28 17:46 ` David Howells
                   ` (2 more replies)
  0 siblings, 3 replies; 8+ messages in thread
From: syzbot @ 2025-03-27 16:27 UTC (permalink / raw)
  To: almaz.alexandrovich, dhowells, linux-afs, linux-kernel,
	marc.dionne, ntfs3, syzkaller-bugs

Hello,

syzbot found the following issue on:

HEAD commit:    2df0c02dab82 x86 boot build: make git ignore stale 'tools'..
git tree:       upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=138f0a4c580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=5f1762820c18874b
dashboard link: https://syzkaller.appspot.com/bug?extid=54e6c2176ba76c56217e
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=178f0a4c580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=14182bb0580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7fe089500003/disk-2df0c02d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d8df5abbd7c5/vmlinux-2df0c02d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/09d23e93d3a8/bzImage-2df0c02d.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/586c05b92249/mount_0.gz

The issue was bisected to:

commit 1d0b929fc070b4115403a0a6206a0c6a62dd61f5
Author: David Howells <dhowells@redhat.com>
Date:   Mon Feb 24 09:52:58 2025 +0000

    afs: Change dynroot to create contents on demand

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=1747aa4c580000
final oops:     https://syzkaller.appspot.com/x/report.txt?x=14c7aa4c580000
console output: https://syzkaller.appspot.com/x/log.txt?x=10c7aa4c580000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+54e6c2176ba76c56217e@syzkaller.appspotmail.com
Fixes: 1d0b929fc070 ("afs: Change dynroot to create contents on demand")

BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:321
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 5821, name: syz-executor365
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
4 locks held by syz-executor365/5821:
 #0: ffff888032b155f8 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x247/0x310 fs/file.c:1213
 #1: ffff888077c90cf8 (&ovl_i_mutex_dir_key[depth]){++++}-{4:4}, at: wrap_directory_iterator+0x5a/0xd0 fs/readdir.c:54
 #2: ffff88807d2c0148 (&type->i_mutex_dir_key#6){++++}-{4:4}, at: iterate_dir+0x4a6/0x760 fs/readdir.c:101
 #3: ffffffff8eb3a760 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 #3: ffffffff8eb3a760 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
 #3: ffffffff8eb3a760 (rcu_read_lock){....}-{1:3}, at: afs_dynroot_readdir+0x466/0xbe0 fs/afs/dynroot.c:351
CPU: 0 UID: 0 PID: 5821 Comm: syz-executor365 Not tainted 6.14.0-syzkaller-01103-g2df0c02dab82 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 __might_resched+0x558/0x6c0 kernel/sched/core.c:8798
 might_alloc include/linux/sched/mm.h:321 [inline]
 slab_pre_alloc_hook mm/slub.c:4089 [inline]
 slab_alloc_node mm/slub.c:4167 [inline]
 __do_kmalloc_node mm/slub.c:4317 [inline]
 __kmalloc_noprof+0xd0/0x4d0 mm/slub.c:4330
 kmalloc_noprof include/linux/slab.h:906 [inline]
 ovl_cache_entry_new+0x39/0x7b0 fs/overlayfs/readdir.c:152
 ovl_cache_entry_add_rb fs/overlayfs/readdir.c:188 [inline]
 ovl_fill_merge+0x416/0x830 fs/overlayfs/readdir.c:266
 dir_emit include/linux/fs.h:3853 [inline]
 afs_dynroot_readdir_cells fs/afs/dynroot.c:310 [inline]
 afs_dynroot_readdir+0x814/0xbe0 fs/afs/dynroot.c:352
 iterate_dir+0x5a9/0x760 fs/readdir.c:108
 ovl_dir_read+0xfe/0x570 fs/overlayfs/readdir.c:313
 ovl_dir_read_merged+0x315/0x5e0 fs/overlayfs/readdir.c:369
 ovl_cache_get fs/overlayfs/readdir.c:422 [inline]
 ovl_iterate+0x1196/0x21c0 fs/overlayfs/readdir.c:783
 wrap_directory_iterator+0x91/0xd0 fs/readdir.c:65
 iterate_dir+0x5a9/0x760 fs/readdir.c:108
 __do_sys_getdents fs/readdir.c:322 [inline]
 __se_sys_getdents+0x1ff/0x4e0 fs/readdir.c:308
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7c82f020f9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff5a9e9b58 EFLAGS: 00000246 ORIG_RAX: 000000000000004e
RAX: ffffffffffffffda RBX: 00007fff5a9e9c20 RCX: 00007f7c82f020f9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000000000


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

^ permalink raw reply	[flat|nested] 8+ messages in thread
end of thread, other threads:[~2025-03-31 11:07 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-03-27 16:27 [syzbot] [afs?] [ntfs3?] BUG: sleeping function called from invalid context in ovl_cache_entry_new syzbot
2025-03-28 17:46 ` David Howells
2025-03-28 18:28   ` syzbot
2025-03-29  2:53 ` [syzbot] [afs?] BUG: sleeping function called from invalid context in __alloc_frozen_pages_noprof Edward Adam Davis
2025-03-29  6:02   ` [syzbot] [afs?] [ntfs3?] BUG: sleeping function called from invalid context in ovl_cache_entry_new syzbot
2025-03-31  8:06 ` David Howells
2025-03-31  8:38   ` syzbot
2025-03-31 11:07     ` Is "unregister_netdevice: waiting for batadv0 to become free" fixed somewhere else? David Howells

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.