Re: [syzbot] [ext4?] possible deadlock in ext4_truncate

[Dave Chinner <david@fromorbit.com>]

On Fri, Dec 06, 2024 at 09:42:23PM -0800, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    cdd30ebb1b9f module: Convert symbol namespace to string li..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=15898330580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=50c7a61469ce77e7
> dashboard link: https://syzkaller.appspot.com/bug?extid=449c80b8f4946f26184b
> compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> 
> Unfortunately, I don't have any reproducer for this issue yet.
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/658bd206f462/disk-cdd30ebb.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/12cb86080d87/vmlinux-cdd30ebb.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/5181aac6587a/bzImage-cdd30ebb.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+449c80b8f4946f26184b@syzkaller.appspotmail.com
> 
> ======================================================
> WARNING: possible circular locking dependency detected
> 6.13.0-rc1-syzkaller-00002-gcdd30ebb1b9f #0 Not tainted
> ------------------------------------------------------
> syz-executor/11503 is trying to acquire lock:
> ffff88807abcdbb0 (&ei->i_data_sem){++++}-{4:4}, at: ext4_truncate+0x994/0x11c0 fs/ext4/inode.c:4212
> 
> but task is already holding lock:
> ffff888034d3a610 (sb_internal){++++}-{0:0}, at: __sb_start_write include/linux/fs.h:1725 [inline]
> ffff888034d3a610 (sb_internal){++++}-{0:0}, at: sb_start_intwrite include/linux/fs.h:1908 [inline]
> ffff888034d3a610 (sb_internal){++++}-{0:0}, at: ext4_evict_inode+0x2f4/0xf50 fs/ext4/inode.c:217
> 
> which lock already depends on the new lock.
> 
> 
> the existing dependency chain (in reverse order) is:
> 
> -> #7 (sb_internal){++++}-{0:0}:
>        lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
>        percpu_down_write+0x54/0x310 kernel/locking/percpu-rwsem.c:229
>        sb_wait_write fs/super.c:1910 [inline]
>        freeze_super+0x7cc/0xee0 fs/super.c:2118
>        fs_bdev_freeze+0x1ac/0x320 fs/super.c:1484
>        bdev_freeze+0xd8/0x220 block/bdev.c:257
>        ext4_force_shutdown+0x319/0x550 fs/ext4/ioctl.c:822
>        ext4_ioctl_shutdown fs/ext4/ioctl.c:857 [inline]
>        __ext4_ioctl fs/ext4/ioctl.c:1580 [inline]
>        ext4_ioctl+0x2145/0x58d0 fs/ext4/ioctl.c:1619
>        vfs_ioctl fs/ioctl.c:51 [inline]
>        __do_sys_ioctl fs/ioctl.c:906 [inline]
>        __se_sys_ioctl+0xf7/0x170 fs/ioctl.c:892
>        do_syscall_x64 arch/x86/entry/common.c:52 [inline]
>        do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
>        entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> -> #6 (sb_pagefaults){++++}-{0:0}:
>        lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
>        percpu_down_read+0x44/0x1b0 include/linux/percpu-rwsem.h:51
>        __sb_start_write include/linux/fs.h:1725 [inline]
>        sb_start_pagefault include/linux/fs.h:1890 [inline]
>        ext4_page_mkwrite+0x1ef/0xdf0 fs/ext4/inode.c:6158
>        do_page_mkwrite+0x19a/0x480 mm/memory.c:3176
>        do_shared_fault mm/memory.c:5398 [inline]
>        do_fault mm/memory.c:5460 [inline]
>        do_pte_missing mm/memory.c:3979 [inline]
>        handle_pte_fault+0x1235/0x68a0 mm/memory.c:5801
>        __handle_mm_fault mm/memory.c:5944 [inline]
>        handle_mm_fault+0x1106/0x1bb0 mm/memory.c:6112
>        do_user_addr_fault arch/x86/mm/fault.c:1389 [inline]
>        handle_page_fault arch/x86/mm/fault.c:1481 [inline]
>        exc_page_fault+0x2b9/0x8b0 arch/x86/mm/fault.c:1539
>        asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
> 
> -> #5 (&mm->mmap_lock){++++}-{4:4}:
>        lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
>        __might_fault+0xc6/0x120 mm/memory.c:6751
>        _inline_copy_from_user include/linux/uaccess.h:162 [inline]
>        _copy_from_user+0x2a/0xc0 lib/usercopy.c:18
>        copy_from_user include/linux/uaccess.h:212 [inline]
>        __blk_trace_setup kernel/trace/blktrace.c:626 [inline]
>        blk_trace_ioctl+0x1ad/0x9a0 kernel/trace/blktrace.c:740
>        blkdev_ioctl+0x40c/0x6a0 block/ioctl.c:682
>        vfs_ioctl fs/ioctl.c:51 [inline]
>        __do_sys_ioctl fs/ioctl.c:906 [inline]
>        __se_sys_ioctl+0xf7/0x170 fs/ioctl.c:892
>        do_syscall_x64 arch/x86/entry/common.c:52 [inline]
>        do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
>        entry_SYSCALL_64_after_hwframe+0x77/0x7f

#syz dup: possible deadlock in xfs_vn_update_time

-- 
Dave Chinner
david@fromorbit.com