From: syzbot <syzbot+f55b043dacf43776b50c@syzkaller.appspotmail.com>
To: dhowells@redhat.com, jarkko@kernel.org, jmorris@namei.org,
keyrings@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-security-module@vger.kernel.org, paul@paul-moore.com,
serge@hallyn.com, syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [keyrings?] [lsm?] possible deadlock in keyring_clear (3)
Date: Sun, 21 Dec 2025 11:47:31 -0800 [thread overview]
Message-ID: <69484ed3.a70a0220.25eec0.0077.GAE@google.com> (raw)
In-Reply-To: <68e54915.a00a0220.298cc0.0480.GAE@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: 9094662f6707 Merge tag 'ata-6.19-rc2' of git://git.kernel...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1022f77c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=513255d80ab78f2b
dashboard link: https://syzkaller.appspot.com/bug?extid=f55b043dacf43776b50c
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=168a8b1a580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16c06b1a580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-9094662f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/baa55f8cf722/vmlinux-9094662f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/aaaa8a404a70/bzImage-9094662f.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/7a86e58a207c/mount_2.gz
fsck result: OK (log: https://syzkaller.appspot.com/x/fsck.log?x=12c06b1a580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f55b043dacf43776b50c@syzkaller.appspotmail.com
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
kswapd1/79 is trying to acquire lock:
ffff8880433bfcd8 (&type->lock_class){+.+.}-{4:4}, at: keyring_clear+0xaf/0x240 security/keys/keyring.c:1658
but task is already holding lock:
ffffffff8e051820 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat mm/vmscan.c:6975 [inline]
ffffffff8e051820 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x92a/0x2820 mm/vmscan.c:7354
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (fs_reclaim){+.+.}-{0:0}:
__fs_reclaim_acquire mm/page_alloc.c:4301 [inline]
fs_reclaim_acquire+0x72/0x100 mm/page_alloc.c:4315
might_alloc include/linux/sched/mm.h:317 [inline]
slab_pre_alloc_hook mm/slub.c:4904 [inline]
slab_alloc_node mm/slub.c:5239 [inline]
__kmalloc_cache_noprof+0x40/0x700 mm/slub.c:5771
kmalloc_noprof include/linux/slab.h:957 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]
assoc_array_insert+0x92/0x2f90 lib/assoc_array.c:980
__key_link_begin+0xd6/0x1f0 security/keys/keyring.c:1317
__key_create_or_update+0x41a/0xa30 security/keys/key.c:877
key_create_or_update+0x42/0x60 security/keys/key.c:1021
x509_load_certificate_list+0x145/0x280 crypto/asymmetric_keys/x509_loader.c:31
do_one_initcall+0x1f1/0x800 init/main.c:1378
do_initcall_level+0x104/0x190 init/main.c:1440
do_initcalls+0x59/0xa0 init/main.c:1456
kernel_init_freeable+0x2a7/0x3d0 init/main.c:1688
kernel_init+0x1d/0x1d0 init/main.c:1578
ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
-> #0 (&type->lock_class){+.+.}-{4:4}:
check_prev_add kernel/locking/lockdep.c:3165 [inline]
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain kernel/locking/lockdep.c:3908 [inline]
__lock_acquire+0x15a6/0x2cf0 kernel/locking/lockdep.c:5237
lock_acquire+0x107/0x340 kernel/locking/lockdep.c:5868
down_write+0x96/0x1f0 kernel/locking/rwsem.c:1590
keyring_clear+0xaf/0x240 security/keys/keyring.c:1658
fscrypt_put_master_key+0xca/0x190 fs/crypto/keyring.c:80
put_crypt_info+0x26d/0x310 fs/crypto/keysetup.c:573
fscrypt_put_encryption_info+0xf6/0x140 fs/crypto/keysetup.c:787
ext4_clear_inode+0x170/0x2f0 fs/ext4/super.c:1529
ext4_evict_inode+0x9f6/0xe60 fs/ext4/inode.c:320
evict+0x5f4/0xae0 fs/inode.c:837
__dentry_kill+0x209/0x660 fs/dcache.c:670
shrink_kill+0xa9/0x2c0 fs/dcache.c:1137
shrink_dentry_list+0x2e0/0x5e0 fs/dcache.c:1164
prune_dcache_sb+0x10e/0x180 fs/dcache.c:1246
super_cache_scan+0x369/0x4b0 fs/super.c:222
do_shrink_slab+0x6df/0x10d0 mm/shrinker.c:437
shrink_slab_memcg mm/shrinker.c:550 [inline]
shrink_slab+0x7ef/0x10d0 mm/shrinker.c:628
shrink_one+0x2d9/0x720 mm/vmscan.c:4921
shrink_many mm/vmscan.c:4982 [inline]
lru_gen_shrink_node mm/vmscan.c:5060 [inline]
shrink_node+0x2f7d/0x35b0 mm/vmscan.c:6047
kswapd_shrink_node mm/vmscan.c:6901 [inline]
balance_pgdat mm/vmscan.c:7084 [inline]
kswapd+0x145a/0x2820 mm/vmscan.c:7354
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(fs_reclaim);
lock(&type->lock_class);
lock(fs_reclaim);
lock(&type->lock_class);
*** DEADLOCK ***
2 locks held by kswapd1/79:
#0: ffffffff8e051820 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat mm/vmscan.c:6975 [inline]
#0: ffffffff8e051820 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x92a/0x2820 mm/vmscan.c:7354
#1: ffff88803fa5a0e0 (&type->s_umount_key#32){++++}-{4:4}, at: super_trylock_shared fs/super.c:563 [inline]
#1: ffff88803fa5a0e0 (&type->s_umount_key#32){++++}-{4:4}, at: super_cache_scan+0x91/0x4b0 fs/super.c:197
stack backtrace:
CPU: 0 UID: 0 PID: 79 Comm: kswapd1 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_circular_bug+0x2e2/0x300 kernel/locking/lockdep.c:2043
check_noncircular+0x12e/0x150 kernel/locking/lockdep.c:2175
check_prev_add kernel/locking/lockdep.c:3165 [inline]
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain kernel/locking/lockdep.c:3908 [inline]
__lock_acquire+0x15a6/0x2cf0 kernel/locking/lockdep.c:5237
lock_acquire+0x107/0x340 kernel/locking/lockdep.c:5868
down_write+0x96/0x1f0 kernel/locking/rwsem.c:1590
keyring_clear+0xaf/0x240 security/keys/keyring.c:1658
fscrypt_put_master_key+0xca/0x190 fs/crypto/keyring.c:80
put_crypt_info+0x26d/0x310 fs/crypto/keysetup.c:573
fscrypt_put_encryption_info+0xf6/0x140 fs/crypto/keysetup.c:787
ext4_clear_inode+0x170/0x2f0 fs/ext4/super.c:1529
ext4_evict_inode+0x9f6/0xe60 fs/ext4/inode.c:320
evict+0x5f4/0xae0 fs/inode.c:837
__dentry_kill+0x209/0x660 fs/dcache.c:670
shrink_kill+0xa9/0x2c0 fs/dcache.c:1137
shrink_dentry_list+0x2e0/0x5e0 fs/dcache.c:1164
prune_dcache_sb+0x10e/0x180 fs/dcache.c:1246
super_cache_scan+0x369/0x4b0 fs/super.c:222
do_shrink_slab+0x6df/0x10d0 mm/shrinker.c:437
shrink_slab_memcg mm/shrinker.c:550 [inline]
shrink_slab+0x7ef/0x10d0 mm/shrinker.c:628
shrink_one+0x2d9/0x720 mm/vmscan.c:4921
shrink_many mm/vmscan.c:4982 [inline]
lru_gen_shrink_node mm/vmscan.c:5060 [inline]
shrink_node+0x2f7d/0x35b0 mm/vmscan.c:6047
kswapd_shrink_node mm/vmscan.c:6901 [inline]
balance_pgdat mm/vmscan.c:7084 [inline]
kswapd+0x145a/0x2820 mm/vmscan.c:7354
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
prev parent reply other threads:[~2025-12-21 19:47 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-10-07 17:08 [syzbot] [keyrings?] [lsm?] possible deadlock in keyring_clear (3) syzbot
2025-12-21 19:47 ` syzbot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=69484ed3.a70a0220.25eec0.0077.GAE@google.com \
--to=syzbot+f55b043dacf43776b50c@syzkaller.appspotmail.com \
--cc=dhowells@redhat.com \
--cc=jarkko@kernel.org \
--cc=jmorris@namei.org \
--cc=keyrings@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=serge@hallyn.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.