[syzbot] [afs?] BUG: sleeping function called from invalid context in __alloc_frozen_pages_noprof

[syzbot] [afs?] BUG: sleeping function called from invalid context in __alloc_frozen_pages_noprof

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    2df0c02dab82 x86 boot build: make git ignore stale 'tools'..
git tree:       upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=15bcc198580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=5f1762820c18874b
dashboard link: https://syzkaller.appspot.com/bug?extid=3b6c5c6a1d0119b687a1
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=114ffc4c580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1580a804580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7fe089500003/disk-2df0c02d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d8df5abbd7c5/vmlinux-2df0c02d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/09d23e93d3a8/bzImage-2df0c02d.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/70d29040b480/mount_0.gz
  fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=1180a804580000)

The issue was bisected to:

commit 1d0b929fc070b4115403a0a6206a0c6a62dd61f5
Author: David Howells <dhowells@redhat.com>
Date:   Mon Feb 24 09:52:58 2025 +0000

    afs: Change dynroot to create contents on demand

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=1207ade4580000
final oops:     https://syzkaller.appspot.com/x/report.txt?x=1107ade4580000
console output: https://syzkaller.appspot.com/x/log.txt?x=1607ade4580000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3b6c5c6a1d0119b687a1@syzkaller.appspotmail.com
Fixes: 1d0b929fc070 ("afs: Change dynroot to create contents on demand")

BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:321
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 5828, name: syz-executor995
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
4 locks held by syz-executor995/5828:
 #0: ffff8880332ef0b8 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x247/0x310 fs/file.c:1213
 #1: ffff888053d08148 (&type->i_mutex_dir_key#7){.+.+}-{4:4}, at: iterate_dir+0x4a6/0x760 fs/readdir.c:101
 #2: ffffffff8eb3a760 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 #2: ffffffff8eb3a760 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
 #2: ffffffff8eb3a760 (rcu_read_lock){....}-{1:3}, at: afs_dynroot_readdir+0x466/0xbe0 fs/afs/dynroot.c:351
 #3: ffff88806d7fed20 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_trylock include/linux/mmap_lock.h:209 [inline]
 #3: ffff88806d7fed20 (&mm->mmap_lock){++++}-{4:4}, at: get_mmap_lock_carefully mm/memory.c:6237 [inline]
 #3: ffff88806d7fed20 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x32/0x2f0 mm/memory.c:6297
CPU: 1 UID: 0 PID: 5828 Comm: syz-executor995 Not tainted 6.14.0-syzkaller-01103-g2df0c02dab82 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 __might_resched+0x558/0x6c0 kernel/sched/core.c:8798
 might_alloc include/linux/sched/mm.h:321 [inline]
 prepare_alloc_pages+0x1cc/0x5c0 mm/page_alloc.c:4513
 __alloc_frozen_pages_noprof+0x181/0x7b0 mm/page_alloc.c:4729
 alloc_pages_mpol+0x339/0x690 mm/mempolicy.c:2301
 folio_alloc_mpol_noprof mm/mempolicy.c:2320 [inline]
 vma_alloc_folio_noprof+0x12d/0x260 mm/mempolicy.c:2355
 folio_prealloc+0x2e/0x170
 alloc_anon_folio mm/memory.c:4834 [inline]
 do_anonymous_page mm/memory.c:4891 [inline]
 do_pte_missing mm/memory.c:4057 [inline]
 handle_pte_fault mm/memory.c:5888 [inline]
 __handle_mm_fault+0x32e8/0x6ef0 mm/memory.c:6031
 handle_mm_fault+0x2c1/0x7e0 mm/memory.c:6200
 do_user_addr_fault arch/x86/mm/fault.c:1388 [inline]
 handle_page_fault arch/x86/mm/fault.c:1480 [inline]
 exc_page_fault+0x2bb/0x8b0 arch/x86/mm/fault.c:1538
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0010:filldir+0x2c4/0x6a0 fs/readdir.c:292
Code: 87 55 02 00 00 0f 01 cb 0f ae e8 48 8b 44 24 30 49 89 46 08 48 8b 4c 24 10 48 8b 44 24 60 48 89 01 48 8b 44 24 18 8b 6c 24 3c <66> 89 41 10 48 98 40 88 6c 01 ff 48 89 44 24 30 4d 63 f5 42 c6 44
RSP: 0018:ffffc90003a37be0 EFLAGS: 00050283
RAX: 0000000000000020 RBX: 0000200000002010 RCX: 0000200000001ff0
RDX: 0000000000000000 RSI: 0000200000001fd8 RDI: 0000200000002010
RBP: 0000000000000004 R08: ffffffff8240768d R09: 1ffff1100a7fa780
R10: dffffc0000000000 R11: ffffed100a7fa781 R12: ffff888029500e41
R13: 0000000000000005 R14: 0000200000001fd8 R15: 00007ffffffff000
 dir_emit include/linux/fs.h:3853 [inline]
 afs_dynroot_readdir_cells fs/afs/dynroot.c:310 [inline]
 afs_dynroot_readdir+0x814/0xbe0 fs/afs/dynroot.c:352
 iterate_dir+0x5a9/0x760 fs/readdir.c:108
 __do_sys_getdents fs/readdir.c:322 [inline]
 __se_sys_getdents+0x1ff/0x4e0 fs/readdir.c:308
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3db8a3a419
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff5882c0e8 EFLAGS: 00000246 ORIG_RAX: 000000000000004e
RAX: ffffffffffffffda RBX: 65726f6e67693d72 RCX: 00007f3db8a3a419
RDX: 00000000000000b8 RSI: 0000200000001fc0 RDI: 0000000000000004
RBP: 00007fff5882c0f8 R08: 6c616b7a79732f2e R09: 6c616b7a79732f2e
R10: 6c616b7a79732f2e R11: 0000000000000246 R12: 0000000000000000
R13: 00007fff5882c358 R14: 000000
----------------
Code disassembly (best guess):
   0:	87 55 02             	xchg   %edx,0x2(%rbp)
   3:	00 00                	add    %al,(%rax)
   5:	0f 01 cb             	stac
   8:	0f ae e8             	lfence
   b:	48 8b 44 24 30       	mov    0x30(%rsp),%rax
  10:	49 89 46 08          	mov    %rax,0x8(%r14)
  14:	48 8b 4c 24 10       	mov    0x10(%rsp),%rcx
  19:	48 8b 44 24 60       	mov    0x60(%rsp),%rax
  1e:	48 89 01             	mov    %rax,(%rcx)
  21:	48 8b 44 24 18       	mov    0x18(%rsp),%rax
  26:	8b 6c 24 3c          	mov    0x3c(%rsp),%ebp
* 2a:	66 89 41 10          	mov    %ax,0x10(%rcx) <-- trapping instruction
  2e:	48 98                	cltq
  30:	40 88 6c 01 ff       	mov    %bpl,-0x1(%rcx,%rax,1)
  35:	48 89 44 24 30       	mov    %rax,0x30(%rsp)
  3a:	4d 63 f5             	movslq %r13d,%r14
  3d:	42                   	rex.X
  3e:	c6                   	.byte 0xc6
  3f:	44                   	rex.R


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [afs?] BUG: sleeping function called from invalid context in __alloc_frozen_pages_noprof

[David Howells]

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

commit f34068283e8650ecd7a2f57b0b55aa91e498a470
Author: David Howells <dhowells@redhat.com>
Date:   Fri Mar 28 16:46:58 2025 +0000

    afs: Fix afs_dynroot_readdir() to not use the RCU read lock
    
    afs_dynroot_readdir() uses the RCU read lock to walk the cell list whilst
    emitting cell automount entries - but dir_emit() may write to a userspace
    buffer, thereby causing a fault to occur and waits to happen.
    
    Fix afs_dynroot_readdir() to get a shared lock on i_rwsem instead.
    
    Fixes: 1d0b929fc070 ("afs: Change dynroot to create contents on demand")
    Reported-by: syzbot+3b6c5c6a1d0119b687a1@syzkaller.appspotmail.com
    Signed-off-by: David Howells <dhowells@redhat.com>
    cc: Marc Dionne <marc.dionne@auristor.com>
    cc: linux-afs@lists.infradead.org
    cc: linux-fsdevel@vger.kernel.org

diff --git a/fs/afs/dynroot.c b/fs/afs/dynroot.c
index 691e0ae607a1..61bc8c81c5ca 100644
--- a/fs/afs/dynroot.c
+++ b/fs/afs/dynroot.c
@@ -348,9 +348,9 @@ static int afs_dynroot_readdir(struct file *file, struct dir_context *ctx)
 	}
 
 	if ((unsigned long long)ctx->pos <= AFS_MAX_DYNROOT_CELL_INO) {
-		rcu_read_lock();
+		down_read(&file_inode(file)->i_rwsem);
 		ret = afs_dynroot_readdir_cells(net, ctx);
-		rcu_read_unlock();
+		up_read(&file_inode(file)->i_rwsem);
 	}
 	return ret;
 }

Re: [syzbot] [afs?] BUG: sleeping function called from invalid context in __alloc_frozen_pages_noprof

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
possible deadlock in afs_dynroot_readdir

loop0: detected capacity change from 0 to 512
EXT4-fs: Ignoring removed bh option
EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem
EXT4-fs (loop0): 1 truncate cleaned up
EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
============================================
WARNING: possible recursive locking detected
6.14.0-syzkaller-07422-gacb4f33713b9-dirty #0 Not tainted
--------------------------------------------
syz.0.16/6130 is trying to acquire lock:
ffff888011d70148 (&type->i_mutex_dir_key#9){.+.+}-{4:4}, at: afs_dynroot_readdir+0x49e/0xb10 fs/afs/dynroot.c:351

but task is already holding lock:
ffff888011d70148 (&type->i_mutex_dir_key#9){.+.+}-{4:4}, at: iterate_dir+0x4a6/0x760 fs/readdir.c:101

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&type->i_mutex_dir_key#9);
  lock(&type->i_mutex_dir_key#9);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

2 locks held by syz.0.16/6130:
 #0: ffff88807e06bcf8 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x247/0x310 fs/file.c:1213
 #1: ffff888011d70148 (&type->i_mutex_dir_key#9){.+.+}-{4:4}, at: iterate_dir+0x4a6/0x760 fs/readdir.c:101

stack backtrace:
CPU: 1 UID: 0 PID: 6130 Comm: syz.0.16 Not tainted 6.14.0-syzkaller-07422-gacb4f33713b9-dirty #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_deadlock_bug+0x2be/0x2d0 kernel/locking/lockdep.c:3042
 check_deadlock kernel/locking/lockdep.c:3094 [inline]
 validate_chain+0x928/0x24e0 kernel/locking/lockdep.c:3896
 __lock_acquire+0xad5/0xd80 kernel/locking/lockdep.c:5235
 lock_acquire+0x116/0x2f0 kernel/locking/lockdep.c:5866
 down_read+0xb3/0xa50 kernel/locking/rwsem.c:1524
 afs_dynroot_readdir+0x49e/0xb10 fs/afs/dynroot.c:351
 iterate_dir+0x5a9/0x760 fs/readdir.c:108
 __do_sys_getdents fs/readdir.c:322 [inline]
 __se_sys_getdents+0x1ff/0x4e0 fs/readdir.c:308
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fdd5b98d169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fdd5c816038 EFLAGS: 00000246 ORIG_RAX: 000000000000004e
RAX: ffffffffffffffda RBX: 00007fdd5bba5fa0 RCX: 00007fdd5b98d169
RDX: 00000000000000b8 RSI: 0000200000001fc0 RDI: 0000000000000004
RBP: 00007fdd5ba0e2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fdd5bba5fa0 R15: 00007ffe6a4f5bb8
 </TASK>


Tested on:

commit:         acb4f337 Merge tag 'm68knommu-for-v6.15' of git://git...
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10922a4c580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=982413b40f90fdf8
dashboard link: https://syzkaller.appspot.com/bug?extid=3b6c5c6a1d0119b687a1
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=17f51198580000

Re: [syzbot] [afs?] BUG: sleeping function called from invalid context in __alloc_frozen_pages_noprof

[Edward Adam Davis]

#syz test

diff --git a/fs/afs/dynroot.c b/fs/afs/dynroot.c
index 691e0ae607a1..829188ef5435 100644
--- a/fs/afs/dynroot.c
+++ b/fs/afs/dynroot.c
@@ -287,12 +287,16 @@ static int afs_dynroot_readdir_cells(struct afs_net *net, struct dir_context *ct
 
 	_enter("%llu", ctx->pos);
 
+	rcu_read_lock();
 	for (;;) {
 		unsigned int ix = ctx->pos >> 1;
+		u8 name_len;
+		char *name;
+		unsigned int dynroot_ino;
 
 		cell = idr_get_next(&net->cells_dyn_ino, &ix);
 		if (!cell)
-			return 0;
+			goto unlock;
 		if (READ_ONCE(cell->state) == AFS_CELL_REMOVING ||
 		    READ_ONCE(cell->state) == AFS_CELL_DEAD) {
 			ctx->pos += 2;
@@ -306,19 +310,28 @@ static int afs_dynroot_readdir_cells(struct afs_net *net, struct dir_context *ct
 
 		_debug("pos %llu -> cell %u", ctx->pos, cell->dynroot_ino);
 
+		name_len = cell->name_len;
+		name = cell->name;
+		dynroot_ino = cell->dynroot_ino;
 		if ((ctx->pos & 1) == 0) {
-			if (!dir_emit(ctx, cell->name, cell->name_len,
-				      cell->dynroot_ino, DT_DIR))
-				return 0;
+			rcu_read_unlock();
+			if (!dir_emit(ctx, name, name_len, dynroot_ino, DT_DIR))
+				goto out;
+			rcu_read_lock();
 			ctx->pos++;
 		}
 		if ((ctx->pos & 1) == 1) {
-			if (!dir_emit(ctx, cell->name - 1, cell->name_len + 1,
-				      cell->dynroot_ino + 1, DT_DIR))
-				return 0;
+			rcu_read_unlock();
+			if (!dir_emit(ctx, name - 1, name_len + 1,
+				      dynroot_ino + 1, DT_DIR))
+				goto out;
+			rcu_read_lock();
 			ctx->pos++;
 		}
 	}
+unlock:
+	rcu_read_unlock();
+out:
 	return 0;
 }
 
@@ -348,9 +361,7 @@ static int afs_dynroot_readdir(struct file *file, struct dir_context *ctx)
 	}
 
 	if ((unsigned long long)ctx->pos <= AFS_MAX_DYNROOT_CELL_INO) {
-		rcu_read_lock();
 		ret = afs_dynroot_readdir_cells(net, ctx);
-		rcu_read_unlock();
 	}
 	return ret;
 }

Re: [syzbot] [afs?] BUG: sleeping function called from invalid context in __alloc_frozen_pages_noprof

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

mode
[   69.518774][ T5887] batman_adv: batadv0: Interface activated: batadv_slave_0
[   69.531611][ T5887] batman_adv: batadv0: Interface activated: batadv_slave_1
[   69.542159][ T5887] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   69.551960][ T5887] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   69.560878][ T5887] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   69.570005][ T5887] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   69.691353][ T5887] syz-executor (5887) used greatest stack depth: 19616 bytes left
[   69.711047][   T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   69.775907][   T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   69.840598][   T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   69.898295][   T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   70.157572][ T5919] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   70.166420][ T5919] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   70.174104][ T5919] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   70.183110][ T5919] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   70.192891][ T5919] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
2025/03/29 05:50:44 executed programs: 0
[   70.660061][ T5919] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   70.669464][ T5919] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   70.678754][ T5919] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   70.687373][ T5919] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   70.695598][ T5919] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   70.785794][ T5933] chnl_net:caif_netlink_parms(): no params data found
[   70.828056][ T5933] bridge0: port 1(bridge_slave_0) entered blocking state
[   70.835717][ T5933] bridge0: port 1(bridge_slave_0) entered disabled state
[   70.842920][ T5933] bridge_slave_0: entered allmulticast mode
[   70.850250][ T5933] bridge_slave_0: entered promiscuous mode
[   70.858138][ T5933] bridge0: port 2(bridge_slave_1) entered blocking state
[   70.866441][ T5933] bridge0: port 2(bridge_slave_1) entered disabled state
[   70.873655][ T5933] bridge_slave_1: entered allmulticast mode
[   70.880415][ T5933] bridge_slave_1: entered promiscuous mode
[   70.910123][ T5933] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   70.921677][ T5933] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   70.946174][ T5933] team0: Port device team_slave_0 added
[   70.955650][ T5933] team0: Port device team_slave_1 added
[   70.972195][ T5933] batman_adv: batadv0: Adding interface: batadv_slave_0
[   70.979290][ T5933] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   71.005779][ T5933] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   71.018566][ T5933] batman_adv: batadv0: Adding interface: batadv_slave_1
[   71.025719][ T5933] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   71.052143][ T5933] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   71.084918][ T5933] hsr_slave_0: entered promiscuous mode
[   71.091172][ T5933] hsr_slave_1: entered promiscuous mode
[   71.097607][ T5933] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   71.105530][ T5933] Cannot create hsr debugfs directory
[   71.467764][ T1299] ieee802154 phy0 wpan0: encryption failed: -22
[   71.474219][ T1299] ieee802154 phy1 wpan1: encryption failed: -22
[   72.755330][ T5137] Bluetooth: hci0: command tx timeout
[   73.078740][   T13] bridge_slave_1: left allmulticast mode
[   73.087005][   T13] bridge_slave_1: left promiscuous mode
[   73.094074][   T13] bridge0: port 2(bridge_slave_1) entered disabled state
[   73.105207][   T13] bridge_slave_0: left allmulticast mode
[   73.110923][   T13] bridge_slave_0: left promiscuous mode
[   73.117589][   T13] bridge0: port 1(bridge_slave_0) entered disabled state
[   73.292536][   T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   73.303595][   T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   73.316478][   T13] bond0 (unregistering): Released all slaves
[   73.414239][   T13] hsr_slave_0: left promiscuous mode
[   73.424392][   T13] hsr_slave_1: left promiscuous mode
[   73.430886][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   73.442780][   T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[   73.451616][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   73.460757][   T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[   73.477508][   T13] veth1_macvtap: left promiscuous mode
[   73.483334][   T13] veth0_macvtap: left promiscuous mode
[   73.489387][   T13] veth1_vlan: left promiscuous mode
[   73.496421][   T13] veth0_vlan: left promiscuous mode
[   73.767218][   T13] team0 (unregistering): Port device team_slave_1 removed
[   73.792742][   T13] team0 (unregistering): Port device team_slave_0 removed
[   74.013067][ T5491] 
[   74.015514][ T5491] ============================================
[   74.021675][ T5491] WARNING: possible recursive locking detected
[   74.027830][ T5491] 6.14.0-syzkaller-09584-g7d06015d936c-dirty #0 Not tainted
[   74.035096][ T5491] --------------------------------------------
[   74.041229][ T5491] dhcpcd/5491 is trying to acquire lock:
[   74.046854][ T5491] ffff88807edb8d28 (&dev->lock){+.+.}-{4:4}, at: lapbeth_device_event+0x766/0xa20
[   74.056138][ T5491] 
[   74.056138][ T5491] but task is already holding lock:
[   74.064028][ T5491] ffff888069be8d28 (&dev->lock){+.+.}-{4:4}, at: dev_change_flags+0x120/0x270
[   74.072906][ T5491] 
[   74.072906][ T5491] other info that might help us debug this:
[   74.080951][ T5491]  Possible unsafe locking scenario:
[   74.080951][ T5491] 
[   74.088384][ T5491]        CPU0
[   74.091676][ T5491]        ----
[   74.094943][ T5491]   lock(&dev->lock);
[   74.098914][ T5491]   lock(&dev->lock);
[   74.102886][ T5491] 
[   74.102886][ T5491]  *** DEADLOCK ***
[   74.102886][ T5491] 
[   74.111023][ T5491]  May be due to missing lock nesting notation
[   74.111023][ T5491] 
[   74.119346][ T5491] 2 locks held by dhcpcd/5491:
[   74.124095][ T5491]  #0: ffffffff900d3988 (rtnl_mutex){+.+.}-{4:4}, at: devinet_ioctl+0x34e/0x1d80
[   74.133367][ T5491]  #1: ffff888069be8d28 (&dev->lock){+.+.}-{4:4}, at: dev_change_flags+0x120/0x270
[   74.142678][ T5491] 
[   74.142678][ T5491] stack backtrace:
[   74.148570][ T5491] CPU: 1 UID: 0 PID: 5491 Comm: dhcpcd Not tainted 6.14.0-syzkaller-09584-g7d06015d936c-dirty #0 PREEMPT(full) 
[   74.148586][ T5491] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[   74.148597][ T5491] Call Trace:
[   74.148603][ T5491]  <TASK>
[   74.148609][ T5491]  dump_stack_lvl+0x241/0x360
[   74.148627][ T5491]  ? __pfx_dump_stack_lvl+0x10/0x10
[   74.148641][ T5491]  ? __pfx__printk+0x10/0x10
[   74.148656][ T5491]  ? print_lock+0x171/0x1a0
[   74.148668][ T5491]  print_deadlock_bug+0x2be/0x2d0
[   74.148681][ T5491]  validate_chain+0x928/0x24e0
[   74.148693][ T5491]  ? stack_depot_save_flags+0x3a/0x970
[   74.148711][ T5491]  ? look_up_lock_class+0x7b/0x170
[   74.148723][ T5491]  ? register_lock_class+0x54/0x330
[   74.148740][ T5491]  __lock_acquire+0xad5/0xd80
[   74.148757][ T5491]  lock_acquire+0x116/0x2f0
[   74.148772][ T5491]  ? lapbeth_device_event+0x766/0xa20
[   74.148788][ T5491]  __mutex_lock+0x1a5/0x10c0
[   74.148799][ T5491]  ? lapbeth_device_event+0x766/0xa20
[   74.148812][ T5491]  ? ref_tracker_alloc+0x316/0x4c0
[   74.148829][ T5491]  ? lapbeth_device_event+0x766/0xa20
[   74.148840][ T5491]  ? rcu_is_watching+0x15/0xb0
[   74.148852][ T5491]  ? __pfx___mutex_lock+0x10/0x10
[   74.148866][ T5491]  ? __raw_spin_lock_init+0x45/0x100
[   74.148880][ T5491]  lapbeth_device_event+0x766/0xa20
[   74.148893][ T5491]  notifier_call_chain+0x1a5/0x3f0
[   74.148907][ T5491]  __dev_notify_flags+0x209/0x410
[   74.148923][ T5491]  ? __pfx___dev_notify_flags+0x10/0x10
[   74.148935][ T5491]  ? __dev_change_flags+0x517/0x700
[   74.148949][ T5491]  ? __pfx___mutex_lock+0x10/0x10
[   74.148960][ T5491]  ? __pfx___dev_change_flags+0x10/0x10
[   74.148975][ T5491]  ? __pfx___mutex_lock+0x10/0x10
[   74.148986][ T5491]  netif_change_flags+0xf0/0x1a0
[   74.149000][ T5491]  dev_change_flags+0x146/0x270
[   74.149015][ T5491]  devinet_ioctl+0xea4/0x1d80
[   74.149030][ T5491]  ? __pfx_devinet_ioctl+0x10/0x10
[   74.149042][ T5491]  ? get_user_ifreq+0x1bb/0x200
[   74.149058][ T5491]  inet_ioctl+0x3d9/0x4f0
[   74.149073][ T5491]  ? __pfx_inet_ioctl+0x10/0x10
[   74.149087][ T5491]  ? lockdep_hardirqs_on+0x9d/0x150
[   74.149109][ T5491]  ? tomoyo_path_number_perm+0x215/0x790
[   74.149122][ T5491]  sock_do_ioctl+0x15a/0x490
[   74.149134][ T5491]  ? __pfx_sock_do_ioctl+0x10/0x10
[   74.149146][ T5491]  ? fd_install+0x9c/0x4c0
[   74.149159][ T5491]  ? __asan_memset+0x23/0x50
[   74.149173][ T5491]  ? smack_file_ioctl+0x2a7/0x3b0
[   74.149186][ T5491]  sock_ioctl+0x644/0x900
[   74.149202][ T5491]  ? __pfx_sock_ioctl+0x10/0x10
[   74.149218][ T5491]  ? __sys_socket+0x209/0x3c0
[   74.149231][ T5491]  ? __pfx_sock_ioctl+0x10/0x10
[   74.149248][ T5491]  __se_sys_ioctl+0xf1/0x160
[   74.149265][ T5491]  do_syscall_64+0xf3/0x230
[   74.149276][ T5491]  ? clear_bhb_loop+0x45/0xa0
[   74.149289][ T5491]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   74.149303][ T5491] RIP: 0033:0x7ffb21c81d49
[   74.149318][ T5491] Code: 5c c3 48 8d 44 24 08 48 89 54 24 e0 48 89 44 24 c0 48 8d 44 24 d0 48 89 44 24 c8 b8 10 00 00 00 c7 44 24 b8 10 00 00 00 0f 05 <41> 89 c0 3d 00 f0 ff ff 76 10 48 8b 15 ae 60 0d 00 f7 d8 41 83 c8
[   74.149328][ T5491] RSP: 002b:00007ffe55611008 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[   74.149341][ T5491] RAX: ffffffffffffffda RBX: 00007ffb21bb36c0 RCX: 00007ffb21c81d49
[   74.149350][ T5491] RDX: 00007ffe556211f8 RSI: 0000000000008914 RDI: 000000000000000e
[   74.149358][ T5491] RBP: 00007ffe556313b8 R08: 00007ffe556211b8 R09: 00007ffe55621168
[   74.149366][ T5491] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   74.149374][ T5491] R13: 00007ffe556211f8 R14: 0000000000000028 R15: 0000000000008914
[   74.149385][ T5491]  </TASK>
[   74.714069][ T5933] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   74.724023][ T5933] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   74.733084][ T5933] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   74.748582][ T5933] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   74.796465][ T5933] 8021q: adding VLAN 0 to HW filter on device bond0
[   74.810222][ T5933] 8021q: adding VLAN 0 to HW filter on device team0
[   74.821065][   T78] bridge0: port 1(bridge_slave_0) entered blocking state
[   74.828458][   T78] bridge0: port 1(bridge_slave_0) entered forwarding state
[   74.838471][ T5137] Bluetooth: hci0: command tx timeout
[   74.847260][ T1079] bridge0: port 2(bridge_slave_1) entered blocking state
[   74.854495][ T1079] bridge0: port 2(bridge_slave_1) entered forwarding state
[   74.983183][ T5933] 8021q: adding VLAN 0 to HW filter on device batadv0
[   75.017511][ T5933] veth0_vlan: entered promiscuous mode
[   75.027982][ T5933] veth1_vlan: entered promiscuous mode
[   75.051472][ T5933] veth0_macvtap: entered promiscuous mode
[   75.060843][ T5933] veth1_macvtap: entered promiscuous mode
[   75.078135][ T5933] batman_adv: batadv0: Interface activated: batadv_slave_0
[   75.091091][ T5933] batman_adv: batadv0: Interface activated: batadv_slave_1
[   75.102457][ T5933] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   75.111555][ T5933] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   75.122011][ T5933] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   75.131879][ T5933] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   75.163469][ T5933] ieee80211 phy5: Selected rate control algorithm 'minstrel_ht'
[   75.183636][   T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   75.193456][ T5933] ieee80211 phy6: Selected rate control algorithm 'minstrel_ht'
[   75.202887][   T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   75.224644][ T1079] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   75.232795][ T1079] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50


syzkaller build log:
go env (err=<nil>)
GO111MODULE='auto'
GOARCH='amd64'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/syzkaller/jobs-2/linux/gopath/pkg/mod/golang.org/toolchain@v0.0.1-go1.23.6.linux-amd64'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/syzkaller/jobs-2/linux/gopath/pkg/mod/golang.org/toolchain@v0.0.1-go1.23.6.linux-amd64/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.23.6'
GODEBUG=''
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1160221299=/tmp/go-build -gno-record-gcc-switches'

git status (err=<nil>)
HEAD detached at 875573af37b
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=875573af37b09758ab48042f2b8a368097204888 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20250323-222138'" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"875573af37b09758ab48042f2b8a368097204888\"
/usr/bin/ld: /tmp/cc8wE2TU.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=1357064c580000


Tested on:

commit:         7d06015d Merge tag 'pci-v6.15-changes' of git://git.ke..
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=6f5a67fe881fabe4
dashboard link: https://syzkaller.appspot.com/bug?extid=3b6c5c6a1d0119b687a1
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=12c6bbb0580000

Re: [syzbot] [afs?] BUG: sleeping function called from invalid context in __alloc_frozen_pages_noprof

[Edward Adam Davis]

#syz test: upstream 1d0b929fc070b4115403a0a6206a0c6a62dd61f5

diff --git a/fs/afs/dynroot.c b/fs/afs/dynroot.c
index 691e0ae607a1..829188ef5435 100644
--- a/fs/afs/dynroot.c
+++ b/fs/afs/dynroot.c
@@ -287,12 +287,16 @@ static int afs_dynroot_readdir_cells(struct afs_net *net, struct dir_context *ct
 
 	_enter("%llu", ctx->pos);
 
+	rcu_read_lock();
 	for (;;) {
 		unsigned int ix = ctx->pos >> 1;
+		u8 name_len;
+		char *name;
+		unsigned int dynroot_ino;
 
 		cell = idr_get_next(&net->cells_dyn_ino, &ix);
 		if (!cell)
-			return 0;
+			goto unlock;
 		if (READ_ONCE(cell->state) == AFS_CELL_REMOVING ||
 		    READ_ONCE(cell->state) == AFS_CELL_DEAD) {
 			ctx->pos += 2;
@@ -306,19 +310,28 @@ static int afs_dynroot_readdir_cells(struct afs_net *net, struct dir_context *ct
 
 		_debug("pos %llu -> cell %u", ctx->pos, cell->dynroot_ino);
 
+		name_len = cell->name_len;
+		name = cell->name;
+		dynroot_ino = cell->dynroot_ino;
 		if ((ctx->pos & 1) == 0) {
-			if (!dir_emit(ctx, cell->name, cell->name_len,
-				      cell->dynroot_ino, DT_DIR))
-				return 0;
+			rcu_read_unlock();
+			if (!dir_emit(ctx, name, name_len, dynroot_ino, DT_DIR))
+				goto out;
+			rcu_read_lock();
 			ctx->pos++;
 		}
 		if ((ctx->pos & 1) == 1) {
-			if (!dir_emit(ctx, cell->name - 1, cell->name_len + 1,
-				      cell->dynroot_ino + 1, DT_DIR))
-				return 0;
+			rcu_read_unlock();
+			if (!dir_emit(ctx, name - 1, name_len + 1,
+				      dynroot_ino + 1, DT_DIR))
+				goto out;
+			rcu_read_lock();
 			ctx->pos++;
 		}
 	}
+unlock:
+	rcu_read_unlock();
+out:
 	return 0;
 }
 
@@ -348,9 +361,7 @@ static int afs_dynroot_readdir(struct file *file, struct dir_context *ctx)
 	}
 
 	if ((unsigned long long)ctx->pos <= AFS_MAX_DYNROOT_CELL_INO) {
-		rcu_read_lock();
 		ret = afs_dynroot_readdir_cells(net, ctx);
-		rcu_read_unlock();
 	}
 	return ret;
 }

Re: [syzbot] [afs?] BUG: sleeping function called from invalid context in __alloc_frozen_pages_noprof

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to apply patch:
checking file fs/afs/dynroot.c
Hunk #1 FAILED at 287.
Hunk #2 succeeded at 305 (offset -1 lines).
Hunk #3 succeeded at 356 (offset -1 lines).
1 out of 3 hunks FAILED



Tested on:

commit:         1d0b929f afs: Change dynroot to create contents on dem..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel config:  https://syzkaller.appspot.com/x/.config?x=5f1762820c18874b
dashboard link: https://syzkaller.appspot.com/bug?extid=3b6c5c6a1d0119b687a1
compiler:       
patch:          https://syzkaller.appspot.com/x/patch.diff?x=17917804580000

Re: [syzbot] [afs?] BUG: sleeping function called from invalid context in __alloc_frozen_pages_noprof

[Edward Adam Davis]

#syz test: upstream 1d0b929fc070b4115403a0a6206a0c6a62dd61f5

diff --git a/fs/afs/dynroot.c b/fs/afs/dynroot.c
index eb20e231d7ac..8d640f6537fc 100644
--- a/fs/afs/dynroot.c
+++ b/fs/afs/dynroot.c
@@ -286,12 +286,16 @@ static int afs_dynroot_readdir_cells(struct afs_net *net, struct dir_context *ct
 
 	_enter("%llu", ctx->pos);
 
+	rcu_read_lock();
 	for (;;) {
 		unsigned int ix = ctx->pos >> 1;
+		u8 name_len;
+		char *name;
+		unsigned int dynroot_ino;
 
 		cell = idr_get_next(&net->cells_dyn_ino, &ix);
 		if (!cell)
-			return 0;
+			goto unlock;
 		if (READ_ONCE(cell->state) == AFS_CELL_FAILED ||
 		    READ_ONCE(cell->state) == AFS_CELL_REMOVED) {
 			ctx->pos += 2;
@@ -305,19 +309,29 @@ static int afs_dynroot_readdir_cells(struct afs_net *net, struct dir_context *ct
 
 		_debug("pos %llu -> cell %u", ctx->pos, cell->dynroot_ino);
 
+		name_len = cell->name_len;
+		name = cell->name;
+		dynroot_ino = cell->dynroot_ino;
 		if ((ctx->pos & 1) == 0) {
-			if (!dir_emit(ctx, cell->name, cell->name_len,
-				      cell->dynroot_ino, DT_DIR))
-				return 0;
+			rcu_read_unlock();
+			if (!dir_emit(ctx, name, name_len,
+				      dynroot_ino, DT_DIR))
+				goto out;
+			rcu_read_lock();
 			ctx->pos++;
 		}
 		if ((ctx->pos & 1) == 1) {
-			if (!dir_emit(ctx, cell->name - 1, cell->name_len + 1,
-				      cell->dynroot_ino + 1, DT_DIR))
-				return 0;
+			rcu_read_unlock();
+			if (!dir_emit(ctx, name - 1, name_len + 1,
+				      dynroot_ino + 1, DT_DIR))
+				goto out;
+			rcu_read_lock();
 			ctx->pos++;
 		}
 	}
+unlock:
+	rcu_read_unlock();
+out:
 	return 0;
 }
 
@@ -347,9 +361,7 @@ static int afs_dynroot_readdir(struct file *file, struct dir_context *ctx)
 	}
 
 	if ((unsigned long long)ctx->pos <= AFS_MAX_DYNROOT_CELL_INO) {
-		rcu_read_lock();
 		ret = afs_dynroot_readdir_cells(net, ctx);
-		rcu_read_unlock();
 	}
 	return ret;
 }

Re: [syzbot] [afs?] BUG: sleeping function called from invalid context in __alloc_frozen_pages_noprof

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in inode_set_cached_link

------------[ cut here ]------------
bad length passed for symlink [/tmp/syz-imagegen2884317625/\b] (got 39, expected 29)
WARNING: CPU: 0 PID: 6579 at ./include/linux/fs.h:803 inode_set_cached_link+0xd0/0x110 include/linux/fs.h:802
Modules linked in:
CPU: 0 UID: 0 PID: 6579 Comm: syz-executor Not tainted 6.14.0-rc4-syzkaller-00172-g1d0b929fc070-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:inode_set_cached_link+0xd0/0x110 include/linux/fs.h:802
Code: 41 5f 5d c3 cc cc cc cc e8 3d ef 44 ff c6 05 e0 41 a8 0d 01 90 48 c7 c7 e0 23 3e 8c 4c 89 f6 44 89 fa 89 e9 e8 21 79 03 ff 90 <0f> 0b 90 90 e9 6a ff ff ff 89 f9 80 e1 07 80 c1 03 38 c1 7c a1 e8
RSP: 0018:ffffc90003667698 EFLAGS: 00010246
RAX: 720c93d201fc4800 RBX: ffff888063c302b0 RCX: ffff88807b148000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 000000000000001d R08: ffffffff81819472 R09: 1ffff110170c519a
R10: dffffc0000000000 R11: ffffed10170c519b R12: ffff888063c302b0
R13: dffffc0000000000 R14: ffff888063c30000 R15: 0000000000000027
FS:  000055558945a500(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe2a3a0da8 CR3: 0000000033d6c000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __ext4_iget+0x2ea4/0x3f30 fs/ext4/inode.c:5012
 ext4_lookup+0x3e3/0x750 fs/ext4/namei.c:1813
 __lookup_slow+0x296/0x400 fs/namei.c:1793
 lookup_slow+0x53/0x70 fs/namei.c:1810
 walk_component+0x2ea/0x410 fs/namei.c:2114
 lookup_last fs/namei.c:2612 [inline]
 path_lookupat+0x16f/0x450 fs/namei.c:2636
 filename_lookup+0x2a3/0x670 fs/namei.c:2665
 user_path_at+0x3a/0x60 fs/namei.c:3072
 ksys_umount fs/namespace.c:2071 [inline]
 __do_sys_umount fs/namespace.c:2079 [inline]
 __se_sys_umount fs/namespace.c:2077 [inline]
 __x64_sys_umount+0xf1/0x170 fs/namespace.c:2077
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fdcbc38e497
Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffe2a3a1558 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: ffffffffffffffda RBX: 00007fdcbc40e08c RCX: 00007fdcbc38e497
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe2a3a1610
RBP: 00007ffe2a3a1610 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffe2a3a2700
R13: 00007fdcbc40e08c R14: 000000000001bcfe R15: 00007ffe2a3a48c0
 </TASK>


Tested on:

commit:         1d0b929f afs: Change dynroot to create contents on dem..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=17fb7804580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=b1debf8c2c3d28b1
dashboard link: https://syzkaller.appspot.com/bug?extid=3b6c5c6a1d0119b687a1
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1514864c580000

Re: [syzbot] [afs?] BUG: sleeping function called from invalid context in __alloc_frozen_pages_noprof

[David Howells]

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

commit db7a516159869b19f237c73bd75599bbe0bfcc4d
Author: David Howells <dhowells@redhat.com>
Date:   Fri Mar 28 16:46:58 2025 +0000

    afs: Fix afs_dynroot_readdir() to not use the RCU read lock
    
    afs_dynroot_readdir() uses the RCU read lock to walk the cell list whilst
    emitting cell automount entries - but dir_emit() may write to a userspace
    buffer, thereby causing a fault to occur and waits to happen.
    
    Fix afs_dynroot_readdir() to get a shared lock on net->cells_lock instead.
    
    Fixes: 1d0b929fc070 ("afs: Change dynroot to create contents on demand")
    Reported-by: syzbot+3b6c5c6a1d0119b687a1@syzkaller.appspotmail.com
    Signed-off-by: David Howells <dhowells@redhat.com>
    cc: Marc Dionne <marc.dionne@auristor.com>
    cc: linux-afs@lists.infradead.org
    cc: linux-fsdevel@vger.kernel.org

diff --git a/fs/afs/dynroot.c b/fs/afs/dynroot.c
index 691e0ae607a1..8c6130789fde 100644
--- a/fs/afs/dynroot.c
+++ b/fs/afs/dynroot.c
@@ -348,9 +348,9 @@ static int afs_dynroot_readdir(struct file *file, struct dir_context *ctx)
 	}
 
 	if ((unsigned long long)ctx->pos <= AFS_MAX_DYNROOT_CELL_INO) {
-		rcu_read_lock();
+		down_read(&net->cells_lock);
 		ret = afs_dynroot_readdir_cells(net, ctx);
-		rcu_read_unlock();
+		up_read(&net->cells_lock);
 	}
 	return ret;
 }

Re: [syzbot] [afs?] BUG: sleeping function called from invalid context in __alloc_frozen_pages_noprof

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
unregister_netdevice: waiting for DEV to become free

unregister_netdevice: waiting for batadv0 to become free. Usage count = 3


Tested on:

commit:         7d06015d Merge tag 'pci-v6.15-changes' of git://git.ke..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14c77804580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=6f5a67fe881fabe4
dashboard link: https://syzkaller.appspot.com/bug?extid=3b6c5c6a1d0119b687a1
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1259f43f980000

Re: [syzbot] [afs?] BUG: sleeping function called from invalid context in __alloc_frozen_pages_noprof

[David Howells]

Note to syzbot maintainers: the C test program contains a compressed ext3
image and decompression code that I think is entirely unnecessary.  All it
does is provide a directory that the afs dynroot can be mounted upon.

This is the only bit of the test that is actually necessary:

  NONFAILING(memcpy((void*)0x2000000001c0, "./file0\000", 8));
  NONFAILING(memcpy((void*)0x2000000002c0, "afs\000", 4));
  NONFAILING(memcpy((void*)0x200000000400, "dyn", 3));
  NONFAILING(*(uint8_t*)0x200000000403 = 0x2c);
  NONFAILING(*(uint8_t*)0x200000000404 = 0);
  syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x2000000001c0ul,
          /*type=*/0x2000000002c0ul, /*flags=*/0ul, /*opts=*/0x200000000400ul);
  NONFAILING(memcpy((void*)0x2000000000c0, "./file0\000", 8));
  syscall(__NR_chdir, /*dir=*/0x2000000000c0ul);
  NONFAILING(memcpy((void*)0x200000000240, "./file1\000", 8));
  syscall(__NR_lstat, /*file=*/0x200000000240ul, /*statbuf=*/0ul);
  NONFAILING(memcpy((void*)0x2000000000c0, ".\000", 2));
  res = syscall(__NR_open, /*file=*/0x2000000000c0ul, /*flags=*/0ul,
                /*mode=*/0ul);
  if (res != -1)
    r[0] = res;
  syscall(__NR_getdents, /*fd=*/r[0], /*ent=*/0x200000001fc0ul,
          /*count=*/0xb8ul);

Basically:

  mount(NULL, "./file0", "afs", 0, "dyn,") = 0
  chdir("./file0")                  = 0
  lstat("./file1", NULL)            = -1 EFAULT (Bad address)
  open(".", O_RDONLY)               = 4
  getdents(4, 0x200000001fc0 /* 5 entries */, 184) = 168

David

Re: [syzbot] [afs?] BUG: sleeping function called from invalid context in __alloc_frozen_pages_noprof

[Aleksandr Nogikh]

Hi David,

Thanks for letting us know!

I've left a note in our issue tracker:
https://github.com/google/syzkaller/issues/1020#issuecomment-2766118626

On Mon, Mar 31, 2025 at 12:58 PM 'David Howells' via syzkaller-bugs
<syzkaller-bugs@googlegroups.com> wrote:
>
> Note to syzbot maintainers: the C test program contains a compressed ext3
> image and decompression code that I think is entirely unnecessary.  All it
> does is provide a directory that the afs dynroot can be mounted upon.
>
> This is the only bit of the test that is actually necessary:
>
>   NONFAILING(memcpy((void*)0x2000000001c0, "./file0\000", 8));
>   NONFAILING(memcpy((void*)0x2000000002c0, "afs\000", 4));
>   NONFAILING(memcpy((void*)0x200000000400, "dyn", 3));
>   NONFAILING(*(uint8_t*)0x200000000403 = 0x2c);
>   NONFAILING(*(uint8_t*)0x200000000404 = 0);
>   syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x2000000001c0ul,
>           /*type=*/0x2000000002c0ul, /*flags=*/0ul, /*opts=*/0x200000000400ul);
>   NONFAILING(memcpy((void*)0x2000000000c0, "./file0\000", 8));
>   syscall(__NR_chdir, /*dir=*/0x2000000000c0ul);
>   NONFAILING(memcpy((void*)0x200000000240, "./file1\000", 8));
>   syscall(__NR_lstat, /*file=*/0x200000000240ul, /*statbuf=*/0ul);
>   NONFAILING(memcpy((void*)0x2000000000c0, ".\000", 2));
>   res = syscall(__NR_open, /*file=*/0x2000000000c0ul, /*flags=*/0ul,
>                 /*mode=*/0ul);
>   if (res != -1)
>     r[0] = res;
>   syscall(__NR_getdents, /*fd=*/r[0], /*ent=*/0x200000001fc0ul,
>           /*count=*/0xb8ul);
>
> Basically:
>
>   mount(NULL, "./file0", "afs", 0, "dyn,") = 0
>   chdir("./file0")                  = 0
>   lstat("./file1", NULL)            = -1 EFAULT (Bad address)
>   open(".", O_RDONLY)               = 4
>   getdents(4, 0x200000001fc0 /* 5 entries */, 184) = 168
>
> David
>

-- 
Aleksandr

[syzbot] [afs?] [ntfs3?] BUG: sleeping function called from invalid context in ovl_cache_entry_new

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    2df0c02dab82 x86 boot build: make git ignore stale 'tools'..
git tree:       upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=138f0a4c580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=5f1762820c18874b
dashboard link: https://syzkaller.appspot.com/bug?extid=54e6c2176ba76c56217e
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=178f0a4c580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=14182bb0580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7fe089500003/disk-2df0c02d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d8df5abbd7c5/vmlinux-2df0c02d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/09d23e93d3a8/bzImage-2df0c02d.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/586c05b92249/mount_0.gz

The issue was bisected to:

commit 1d0b929fc070b4115403a0a6206a0c6a62dd61f5
Author: David Howells <dhowells@redhat.com>
Date:   Mon Feb 24 09:52:58 2025 +0000

    afs: Change dynroot to create contents on demand

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=1747aa4c580000
final oops:     https://syzkaller.appspot.com/x/report.txt?x=14c7aa4c580000
console output: https://syzkaller.appspot.com/x/log.txt?x=10c7aa4c580000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+54e6c2176ba76c56217e@syzkaller.appspotmail.com
Fixes: 1d0b929fc070 ("afs: Change dynroot to create contents on demand")

BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:321
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 5821, name: syz-executor365
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
4 locks held by syz-executor365/5821:
 #0: ffff888032b155f8 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x247/0x310 fs/file.c:1213
 #1: ffff888077c90cf8 (&ovl_i_mutex_dir_key[depth]){++++}-{4:4}, at: wrap_directory_iterator+0x5a/0xd0 fs/readdir.c:54
 #2: ffff88807d2c0148 (&type->i_mutex_dir_key#6){++++}-{4:4}, at: iterate_dir+0x4a6/0x760 fs/readdir.c:101
 #3: ffffffff8eb3a760 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 #3: ffffffff8eb3a760 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
 #3: ffffffff8eb3a760 (rcu_read_lock){....}-{1:3}, at: afs_dynroot_readdir+0x466/0xbe0 fs/afs/dynroot.c:351
CPU: 0 UID: 0 PID: 5821 Comm: syz-executor365 Not tainted 6.14.0-syzkaller-01103-g2df0c02dab82 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 __might_resched+0x558/0x6c0 kernel/sched/core.c:8798
 might_alloc include/linux/sched/mm.h:321 [inline]
 slab_pre_alloc_hook mm/slub.c:4089 [inline]
 slab_alloc_node mm/slub.c:4167 [inline]
 __do_kmalloc_node mm/slub.c:4317 [inline]
 __kmalloc_noprof+0xd0/0x4d0 mm/slub.c:4330
 kmalloc_noprof include/linux/slab.h:906 [inline]
 ovl_cache_entry_new+0x39/0x7b0 fs/overlayfs/readdir.c:152
 ovl_cache_entry_add_rb fs/overlayfs/readdir.c:188 [inline]
 ovl_fill_merge+0x416/0x830 fs/overlayfs/readdir.c:266
 dir_emit include/linux/fs.h:3853 [inline]
 afs_dynroot_readdir_cells fs/afs/dynroot.c:310 [inline]
 afs_dynroot_readdir+0x814/0xbe0 fs/afs/dynroot.c:352
 iterate_dir+0x5a9/0x760 fs/readdir.c:108
 ovl_dir_read+0xfe/0x570 fs/overlayfs/readdir.c:313
 ovl_dir_read_merged+0x315/0x5e0 fs/overlayfs/readdir.c:369
 ovl_cache_get fs/overlayfs/readdir.c:422 [inline]
 ovl_iterate+0x1196/0x21c0 fs/overlayfs/readdir.c:783
 wrap_directory_iterator+0x91/0xd0 fs/readdir.c:65
 iterate_dir+0x5a9/0x760 fs/readdir.c:108
 __do_sys_getdents fs/readdir.c:322 [inline]
 __se_sys_getdents+0x1ff/0x4e0 fs/readdir.c:308
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7c82f020f9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff5a9e9b58 EFLAGS: 00000246 ORIG_RAX: 000000000000004e
RAX: ffffffffffffffda RBX: 00007fff5a9e9c20 RCX: 00007f7c82f020f9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000000000


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [afs?] BUG: sleeping function called from invalid context in __alloc_frozen_pages_noprof

[Edward Adam Davis]

#syz test

diff --git a/fs/afs/dynroot.c b/fs/afs/dynroot.c
index 691e0ae607a1..829188ef5435 100644
--- a/fs/afs/dynroot.c
+++ b/fs/afs/dynroot.c
@@ -287,12 +287,16 @@ static int afs_dynroot_readdir_cells(struct afs_net *net, struct dir_context *ct
 
 	_enter("%llu", ctx->pos);
 
+	rcu_read_lock();
 	for (;;) {
 		unsigned int ix = ctx->pos >> 1;
+		u8 name_len;
+		char *name;
+		unsigned int dynroot_ino;
 
 		cell = idr_get_next(&net->cells_dyn_ino, &ix);
 		if (!cell)
-			return 0;
+			goto unlock;
 		if (READ_ONCE(cell->state) == AFS_CELL_REMOVING ||
 		    READ_ONCE(cell->state) == AFS_CELL_DEAD) {
 			ctx->pos += 2;
@@ -306,19 +310,28 @@ static int afs_dynroot_readdir_cells(struct afs_net *net, struct dir_context *ct
 
 		_debug("pos %llu -> cell %u", ctx->pos, cell->dynroot_ino);
 
+		name_len = cell->name_len;
+		name = cell->name;
+		dynroot_ino = cell->dynroot_ino;
 		if ((ctx->pos & 1) == 0) {
-			if (!dir_emit(ctx, cell->name, cell->name_len,
-				      cell->dynroot_ino, DT_DIR))
-				return 0;
+			rcu_read_unlock();
+			if (!dir_emit(ctx, name, name_len, dynroot_ino, DT_DIR))
+				goto out;
+			rcu_read_lock();
 			ctx->pos++;
 		}
 		if ((ctx->pos & 1) == 1) {
-			if (!dir_emit(ctx, cell->name - 1, cell->name_len + 1,
-				      cell->dynroot_ino + 1, DT_DIR))
-				return 0;
+			rcu_read_unlock();
+			if (!dir_emit(ctx, name - 1, name_len + 1,
+				      dynroot_ino + 1, DT_DIR))
+				goto out;
+			rcu_read_lock();
 			ctx->pos++;
 		}
 	}
+unlock:
+	rcu_read_unlock();
+out:
 	return 0;
 }
 
@@ -348,9 +361,7 @@ static int afs_dynroot_readdir(struct file *file, struct dir_context *ctx)
 	}
 
 	if ((unsigned long long)ctx->pos <= AFS_MAX_DYNROOT_CELL_INO) {
-		rcu_read_lock();
 		ret = afs_dynroot_readdir_cells(net, ctx);
-		rcu_read_unlock();
 	}
 	return ret;
 }