* [syzbot] [ntfs3?] INFO: task hung in __start_renaming
@ 2025-11-23 22:44 syzbot
2025-11-23 23:29 ` Mateusz Guzik
` (5 more replies)
0 siblings, 6 replies; 17+ messages in thread
From: syzbot @ 2025-11-23 22:44 UTC (permalink / raw)
To: agruenba, almaz.alexandrovich, brauner, dhowells, gfs2, jack,
linux-afs, linux-fsdevel, linux-kernel, marc.dionne, mjguzik,
ntfs3, syzkaller-bugs, viro
Hello,
syzbot found the following issue on:
HEAD commit: fe4d0dea039f Add linux-next specific files for 20251119
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=142c0514580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f20a6db7594dcad7
dashboard link: https://syzkaller.appspot.com/bug?extid=2fefb910d2c20c0698d8
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11cd7692580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17615658580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ce4f26d91a01/disk-fe4d0dea.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6c9b53acf521/vmlinux-fe4d0dea.xz
kernel image: https://storage.googleapis.com/syzbot-assets/64d37d01cd64/bzImage-fe4d0dea.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/a91529a880b1/mount_0.gz
The issue was bisected to:
commit 1e3c3784221ac86401aea72e2bae36057062fc9c
Author: Mateusz Guzik <mjguzik@gmail.com>
Date: Fri Oct 10 22:17:36 2025 +0000
fs: rework I_NEW handling to operate without fences
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=17739742580000
final oops: https://syzkaller.appspot.com/x/report.txt?x=14f39742580000
console output: https://syzkaller.appspot.com/x/log.txt?x=10f39742580000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2fefb910d2c20c0698d8@syzkaller.appspotmail.com
Fixes: 1e3c3784221a ("fs: rework I_NEW handling to operate without fences")
INFO: task syz.0.17:6022 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17 state:D stack:28744 pid:6022 tgid:6020 ppid:5945 task_flags:0x400040 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5263 [inline]
__schedule+0x1836/0x4ed0 kernel/sched/core.c:6871
__schedule_loop kernel/sched/core.c:6953 [inline]
schedule+0x165/0x360 kernel/sched/core.c:6968
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7025
rwsem_down_write_slowpath+0x872/0xfe0 kernel/locking/rwsem.c:1185
__down_write_common kernel/locking/rwsem.c:1317 [inline]
__down_write kernel/locking/rwsem.c:1326 [inline]
down_write_nested+0x1b5/0x200 kernel/locking/rwsem.c:1707
inode_lock_nested include/linux/fs.h:1072 [inline]
lock_rename fs/namei.c:3681 [inline]
__start_renaming+0x148/0x410 fs/namei.c:3777
do_renameat2+0x399/0x8e0 fs/namei.c:5991
__do_sys_rename fs/namei.c:6059 [inline]
__se_sys_rename fs/namei.c:6057 [inline]
__x64_sys_rename+0x82/0x90 fs/namei.c:6057
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7ba9b8f749
RSP: 002b:00007f7ba91dd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000052
RAX: ffffffffffffffda RBX: 00007f7ba9de6090 RCX: 00007f7ba9b8f749
RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000200000000340
RBP: 00007f7ba9c13f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f7ba9de6128 R14: 00007f7ba9de6090 R15: 00007fff2ce8d188
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/31:
#0: ffffffff8df3d740 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8df3d740 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff8df3d740 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
2 locks held by getty/5589:
#0: ffff88814d56c0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 drivers/tty/n_tty.c:2222
3 locks held by syz.0.17/6021:
2 locks held by syz.0.17/6022:
#0: ffff888030718420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
#1: ffff8880631e3dd8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff8880631e3dd8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
#1: ffff8880631e3dd8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
3 locks held by syz.1.18/6048:
2 locks held by syz.1.18/6049:
#0: ffff888077cbe420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
#1: ffff8880632db690 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff8880632db690 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
#1: ffff8880632db690 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
3 locks held by syz.2.19/6082:
2 locks held by syz.2.19/6083:
#0: ffff88807945e420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
#1: ffff888073281970 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff888073281970 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
#1: ffff888073281970 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
3 locks held by syz.3.20/6107:
2 locks held by syz.3.20/6108:
#0: ffff88807b0a4420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
#1: ffff8880631e1228 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff8880631e1228 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
#1: ffff8880631e1228 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
3 locks held by syz.4.21/6138:
2 locks held by syz.4.21/6139:
#0: ffff8880587fe420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
#1: ffff8880632d8ae0 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff8880632d8ae0 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
#1: ffff8880632d8ae0 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
3 locks held by syz.5.22/6176:
2 locks held by syz.5.22/6177:
#0: ffff888026cec420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
#1: ffff8880631ce240 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff8880631ce240 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
#1: ffff8880631ce240 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
3 locks held by syz.6.23/6211:
2 locks held by syz.6.23/6212:
#0: ffff888027d88420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
#1: ffff8880631c9228 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff8880631c9228 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
#1: ffff8880631c9228 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
3 locks held by syz.7.24/6244:
2 locks held by syz.7.24/6245:
#0: ffff88807d516420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
#1: ffff8880631bdaf8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff8880631bdaf8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
#1: ffff8880631bdaf8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x135/0x170 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
watchdog+0xfb5/0x1000 kernel/hung_task.c:515
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 6107 Comm: syz.3.20 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:hlock_class kernel/locking/lockdep.c:234 [inline]
RIP: 0010:mark_lock+0x3c/0x190 kernel/locking/lockdep.c:4731
Code: 00 03 00 83 f9 01 bb 09 00 00 00 83 db 00 83 fa 08 0f 45 da bd 01 00 00 00 89 d9 d3 e5 25 ff 1f 00 00 48 0f a3 05 c4 46 df 11 <73> 10 48 69 c0 c8 00 00 00 48 8d 88 70 f3 1e 93 eb 48 83 3d 4b d6
RSP: 0018:ffffc90003747518 EFLAGS: 00000007
RAX: 0000000000000311 RBX: 0000000000000008 RCX: 0000000000000008
RDX: 0000000000000008 RSI: ffff8880275f48a8 RDI: ffff8880275f3d00
RBP: 0000000000000100 R08: 0000000000000000 R09: ffffffff8241cc56
R10: dffffc0000000000 R11: ffffed100e650518 R12: 0000000000000004
R13: 0000000000000003 R14: ffff8880275f48a8 R15: 0000000000000000
FS: 00007fc3607da6c0(0000) GS:ffff888125fbc000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000558e8c347168 CR3: 0000000077b26000 CR4: 00000000003526f0
Call Trace:
<TASK>
mark_usage kernel/locking/lockdep.c:4674 [inline]
__lock_acquire+0x6a8/0xd20 kernel/locking/lockdep.c:5191
lock_acquire+0x117/0x350 kernel/locking/lockdep.c:5868
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
insert_inode_locked+0x336/0x5d0 fs/inode.c:1837
ntfs_new_inode+0xc8/0x100 fs/ntfs3/fsntfs.c:1675
ntfs_create_inode+0x606/0x32a0 fs/ntfs3/inode.c:1309
ntfs_create+0x3d/0x50 fs/ntfs3/namei.c:110
lookup_open fs/namei.c:4409 [inline]
open_last_lookups fs/namei.c:4509 [inline]
path_openat+0x190f/0x3d90 fs/namei.c:4753
do_filp_open+0x1fa/0x410 fs/namei.c:4783
do_sys_openat2+0x121/0x1c0 fs/open.c:1432
do_sys_open fs/open.c:1447 [inline]
__do_sys_openat fs/open.c:1463 [inline]
__se_sys_openat fs/open.c:1458 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1458
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc35f98f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc3607da038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fc35fbe5fa0 RCX: 00007fc35f98f749
RDX: 000000000000275a RSI: 00002000000001c0 RDI: ffffffffffffff9c
RBP: 00007fc35fa13f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fc35fbe6038 R14: 00007fc35fbe5fa0 R15: 00007ffffeb34448
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [syzbot] [ntfs3?] INFO: task hung in __start_renaming
2025-11-23 22:44 [syzbot] [ntfs3?] INFO: task hung in __start_renaming syzbot
@ 2025-11-23 23:29 ` Mateusz Guzik
2025-11-23 23:30 ` Mateusz Guzik
2025-11-24 0:27 ` Mateusz Guzik
` (4 subsequent siblings)
5 siblings, 1 reply; 17+ messages in thread
From: Mateusz Guzik @ 2025-11-23 23:29 UTC (permalink / raw)
To: syzbot
Cc: agruenba, almaz.alexandrovich, brauner, dhowells, gfs2, jack,
linux-afs, linux-fsdevel, linux-kernel, marc.dionne, ntfs3,
syzkaller-bugs, viro
On Sun, Nov 23, 2025 at 11:44 PM syzbot
<syzbot+2fefb910d2c20c0698d8@syzkaller.appspotmail.com> wrote:
> NMI backtrace for cpu 1
> CPU: 1 UID: 0 PID: 6107 Comm: syz.3.20 Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
> RIP: 0010:hlock_class kernel/locking/lockdep.c:234 [inline]
> RIP: 0010:mark_lock+0x3c/0x190 kernel/locking/lockdep.c:4731
> Code: 00 03 00 83 f9 01 bb 09 00 00 00 83 db 00 83 fa 08 0f 45 da bd 01 00 00 00 89 d9 d3 e5 25 ff 1f 00 00 48 0f a3 05 c4 46 df 11 <73> 10 48 69 c0 c8 00 00 00 48 8d 88 70 f3 1e 93 eb 48 83 3d 4b d6
> RSP: 0018:ffffc90003747518 EFLAGS: 00000007
> RAX: 0000000000000311 RBX: 0000000000000008 RCX: 0000000000000008
> RDX: 0000000000000008 RSI: ffff8880275f48a8 RDI: ffff8880275f3d00
> RBP: 0000000000000100 R08: 0000000000000000 R09: ffffffff8241cc56
> R10: dffffc0000000000 R11: ffffed100e650518 R12: 0000000000000004
> R13: 0000000000000003 R14: ffff8880275f48a8 R15: 0000000000000000
> FS: 00007fc3607da6c0(0000) GS:ffff888125fbc000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000558e8c347168 CR3: 0000000077b26000 CR4: 00000000003526f0
> Call Trace:
> <TASK>
> mark_usage kernel/locking/lockdep.c:4674 [inline]
> __lock_acquire+0x6a8/0xd20 kernel/locking/lockdep.c:5191
> lock_acquire+0x117/0x350 kernel/locking/lockdep.c:5868
> __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
> _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
> spin_lock include/linux/spinlock.h:351 [inline]
> insert_inode_locked+0x336/0x5d0 fs/inode.c:1837
> ntfs_new_inode+0xc8/0x100 fs/ntfs3/fsntfs.c:1675
> ntfs_create_inode+0x606/0x32a0 fs/ntfs3/inode.c:1309
> ntfs_create+0x3d/0x50 fs/ntfs3/namei.c:110
> lookup_open fs/namei.c:4409 [inline]
> open_last_lookups fs/namei.c:4509 [inline]
> path_openat+0x190f/0x3d90 fs/namei.c:4753
> do_filp_open+0x1fa/0x410 fs/namei.c:4783
> do_sys_openat2+0x121/0x1c0 fs/open.c:1432
> do_sys_open fs/open.c:1447 [inline]
> __do_sys_openat fs/open.c:1463 [inline]
> __se_sys_openat fs/open.c:1458 [inline]
> __x64_sys_openat+0x138/0x170 fs/open.c:1458
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7fc35f98f749
> Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007fc3607da038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
> RAX: ffffffffffffffda RBX: 00007fc35fbe5fa0 RCX: 00007fc35f98f749
> RDX: 000000000000275a RSI: 00002000000001c0 RDI: ffffffffffffff9c
> RBP: 00007fc35fa13f91 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007fc35fbe6038 R14: 00007fc35fbe5fa0 R15: 00007ffffeb34448
> </TASK>
>
The bug is in ntfs. It calls d_instantiate instead of
d_instantiate_new and consequently there is no wakeup to begin with.
I'm going to chew on it a little bit, bare mininum d_instantiate
should warn about it and maybe some other fixups are warranted.
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [syzbot] [ntfs3?] INFO: task hung in __start_renaming
2025-11-23 23:29 ` Mateusz Guzik
@ 2025-11-23 23:30 ` Mateusz Guzik
0 siblings, 0 replies; 17+ messages in thread
From: Mateusz Guzik @ 2025-11-23 23:30 UTC (permalink / raw)
To: syzbot
Cc: agruenba, almaz.alexandrovich, brauner, dhowells, gfs2, jack,
linux-afs, linux-fsdevel, linux-kernel, marc.dionne, ntfs3,
syzkaller-bugs, viro
On Mon, Nov 24, 2025 at 12:29 AM Mateusz Guzik <mjguzik@gmail.com> wrote:
>
> On Sun, Nov 23, 2025 at 11:44 PM syzbot
> <syzbot+2fefb910d2c20c0698d8@syzkaller.appspotmail.com> wrote:
> > NMI backtrace for cpu 1
> > CPU: 1 UID: 0 PID: 6107 Comm: syz.3.20 Not tainted syzkaller #0 PREEMPT(full)
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
> > RIP: 0010:hlock_class kernel/locking/lockdep.c:234 [inline]
> > RIP: 0010:mark_lock+0x3c/0x190 kernel/locking/lockdep.c:4731
> > Code: 00 03 00 83 f9 01 bb 09 00 00 00 83 db 00 83 fa 08 0f 45 da bd 01 00 00 00 89 d9 d3 e5 25 ff 1f 00 00 48 0f a3 05 c4 46 df 11 <73> 10 48 69 c0 c8 00 00 00 48 8d 88 70 f3 1e 93 eb 48 83 3d 4b d6
> > RSP: 0018:ffffc90003747518 EFLAGS: 00000007
> > RAX: 0000000000000311 RBX: 0000000000000008 RCX: 0000000000000008
> > RDX: 0000000000000008 RSI: ffff8880275f48a8 RDI: ffff8880275f3d00
> > RBP: 0000000000000100 R08: 0000000000000000 R09: ffffffff8241cc56
> > R10: dffffc0000000000 R11: ffffed100e650518 R12: 0000000000000004
> > R13: 0000000000000003 R14: ffff8880275f48a8 R15: 0000000000000000
> > FS: 00007fc3607da6c0(0000) GS:ffff888125fbc000(0000) knlGS:0000000000000000
> > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > CR2: 0000558e8c347168 CR3: 0000000077b26000 CR4: 00000000003526f0
> > Call Trace:
> > <TASK>
> > mark_usage kernel/locking/lockdep.c:4674 [inline]
> > __lock_acquire+0x6a8/0xd20 kernel/locking/lockdep.c:5191
> > lock_acquire+0x117/0x350 kernel/locking/lockdep.c:5868
> > __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
> > _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
> > spin_lock include/linux/spinlock.h:351 [inline]
> > insert_inode_locked+0x336/0x5d0 fs/inode.c:1837
> > ntfs_new_inode+0xc8/0x100 fs/ntfs3/fsntfs.c:1675
> > ntfs_create_inode+0x606/0x32a0 fs/ntfs3/inode.c:1309
> > ntfs_create+0x3d/0x50 fs/ntfs3/namei.c:110
> > lookup_open fs/namei.c:4409 [inline]
> > open_last_lookups fs/namei.c:4509 [inline]
> > path_openat+0x190f/0x3d90 fs/namei.c:4753
> > do_filp_open+0x1fa/0x410 fs/namei.c:4783
> > do_sys_openat2+0x121/0x1c0 fs/open.c:1432
> > do_sys_open fs/open.c:1447 [inline]
> > __do_sys_openat fs/open.c:1463 [inline]
> > __se_sys_openat fs/open.c:1458 [inline]
> > __x64_sys_openat+0x138/0x170 fs/open.c:1458
> > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> > do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
> > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > RIP: 0033:0x7fc35f98f749
> > Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
> > RSP: 002b:00007fc3607da038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
> > RAX: ffffffffffffffda RBX: 00007fc35fbe5fa0 RCX: 00007fc35f98f749
> > RDX: 000000000000275a RSI: 00002000000001c0 RDI: ffffffffffffff9c
> > RBP: 00007fc35fa13f91 R08: 0000000000000000 R09: 0000000000000000
> > R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> > R13: 00007fc35fbe6038 R14: 00007fc35fbe5fa0 R15: 00007ffffeb34448
> > </TASK>
> >
>
> The bug is in ntfs. It calls d_instantiate instead of
> d_instantiate_new and consequently there is no wakeup to begin with.
>
> I'm going to chew on it a little bit, bare mininum d_instantiate
> should warn about it and maybe some other fixups are warranted.
As in I'm about to turn in, will post patches on Monday.
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [syzbot] [ntfs3?] INFO: task hung in __start_renaming
2025-11-23 22:44 [syzbot] [ntfs3?] INFO: task hung in __start_renaming syzbot
2025-11-23 23:29 ` Mateusz Guzik
@ 2025-11-24 0:27 ` Mateusz Guzik
2025-11-24 0:57 ` syzbot
2025-11-24 3:29 ` Mateusz Guzik
` (3 subsequent siblings)
5 siblings, 1 reply; 17+ messages in thread
From: Mateusz Guzik @ 2025-11-24 0:27 UTC (permalink / raw)
To: syzbot
Cc: agruenba, almaz.alexandrovich, brauner, dhowells, gfs2, jack,
linux-afs, linux-fsdevel, linux-kernel, marc.dionne, ntfs3,
syzkaller-bugs, viro
On Sun, Nov 23, 2025 at 02:44:29PM -0800, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: fe4d0dea039f Add linux-next specific files for 20251119
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=142c0514580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=f20a6db7594dcad7
> dashboard link: https://syzkaller.appspot.com/bug?extid=2fefb910d2c20c0698d8
> compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11cd7692580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17615658580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/ce4f26d91a01/disk-fe4d0dea.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/6c9b53acf521/vmlinux-fe4d0dea.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/64d37d01cd64/bzImage-fe4d0dea.xz
> mounted in repro: https://storage.googleapis.com/syzbot-assets/a91529a880b1/mount_0.gz
>
> The issue was bisected to:
>
> commit 1e3c3784221ac86401aea72e2bae36057062fc9c
> Author: Mateusz Guzik <mjguzik@gmail.com>
> Date: Fri Oct 10 22:17:36 2025 +0000
>
> fs: rework I_NEW handling to operate without fences
>
> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=17739742580000
> final oops: https://syzkaller.appspot.com/x/report.txt?x=14f39742580000
> console output: https://syzkaller.appspot.com/x/log.txt?x=10f39742580000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+2fefb910d2c20c0698d8@syzkaller.appspotmail.com
> Fixes: 1e3c3784221a ("fs: rework I_NEW handling to operate without fences")
>
> INFO: task syz.0.17:6022 blocked for more than 143 seconds.
> Not tainted syzkaller #0
> "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
> task:syz.0.17 state:D stack:28744 pid:6022 tgid:6020 ppid:5945 task_flags:0x400040 flags:0x00080002
> Call Trace:
> <TASK>
> context_switch kernel/sched/core.c:5263 [inline]
> __schedule+0x1836/0x4ed0 kernel/sched/core.c:6871
> __schedule_loop kernel/sched/core.c:6953 [inline]
> schedule+0x165/0x360 kernel/sched/core.c:6968
> schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7025
> rwsem_down_write_slowpath+0x872/0xfe0 kernel/locking/rwsem.c:1185
> __down_write_common kernel/locking/rwsem.c:1317 [inline]
> __down_write kernel/locking/rwsem.c:1326 [inline]
> down_write_nested+0x1b5/0x200 kernel/locking/rwsem.c:1707
> inode_lock_nested include/linux/fs.h:1072 [inline]
> lock_rename fs/namei.c:3681 [inline]
> __start_renaming+0x148/0x410 fs/namei.c:3777
> do_renameat2+0x399/0x8e0 fs/namei.c:5991
> __do_sys_rename fs/namei.c:6059 [inline]
> __se_sys_rename fs/namei.c:6057 [inline]
> __x64_sys_rename+0x82/0x90 fs/namei.c:6057
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f7ba9b8f749
> RSP: 002b:00007f7ba91dd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000052
> RAX: ffffffffffffffda RBX: 00007f7ba9de6090 RCX: 00007f7ba9b8f749
> RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000200000000340
> RBP: 00007f7ba9c13f91 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007f7ba9de6128 R14: 00007f7ba9de6090 R15: 00007fff2ce8d188
> </TASK>
>
> Showing all locks held in the system:
> 1 lock held by khungtaskd/31:
> #0: ffffffff8df3d740 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
> #0: ffffffff8df3d740 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
> #0: ffffffff8df3d740 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
> 2 locks held by getty/5589:
> #0: ffff88814d56c0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
> #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 drivers/tty/n_tty.c:2222
> 3 locks held by syz.0.17/6021:
> 2 locks held by syz.0.17/6022:
> #0: ffff888030718420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
> #1: ffff8880631e3dd8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
> #1: ffff8880631e3dd8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
> #1: ffff8880631e3dd8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
> 3 locks held by syz.1.18/6048:
> 2 locks held by syz.1.18/6049:
> #0: ffff888077cbe420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
> #1: ffff8880632db690 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
> #1: ffff8880632db690 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
> #1: ffff8880632db690 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
> 3 locks held by syz.2.19/6082:
> 2 locks held by syz.2.19/6083:
> #0: ffff88807945e420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
> #1: ffff888073281970 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
> #1: ffff888073281970 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
> #1: ffff888073281970 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
> 3 locks held by syz.3.20/6107:
> 2 locks held by syz.3.20/6108:
> #0: ffff88807b0a4420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
> #1: ffff8880631e1228 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
> #1: ffff8880631e1228 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
> #1: ffff8880631e1228 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
> 3 locks held by syz.4.21/6138:
> 2 locks held by syz.4.21/6139:
> #0: ffff8880587fe420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
> #1: ffff8880632d8ae0 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
> #1: ffff8880632d8ae0 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
> #1: ffff8880632d8ae0 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
> 3 locks held by syz.5.22/6176:
> 2 locks held by syz.5.22/6177:
> #0: ffff888026cec420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
> #1: ffff8880631ce240 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
> #1: ffff8880631ce240 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
> #1: ffff8880631ce240 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
> 3 locks held by syz.6.23/6211:
> 2 locks held by syz.6.23/6212:
> #0: ffff888027d88420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
> #1: ffff8880631c9228 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
> #1: ffff8880631c9228 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
> #1: ffff8880631c9228 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
> 3 locks held by syz.7.24/6244:
> 2 locks held by syz.7.24/6245:
> #0: ffff88807d516420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
> #1: ffff8880631bdaf8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
> #1: ffff8880631bdaf8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
> #1: ffff8880631bdaf8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
>
> =============================================
>
> NMI backtrace for cpu 0
> CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
> Call Trace:
> <TASK>
> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
> nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
> nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
> trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
> __sys_info lib/sys_info.c:157 [inline]
> sys_info+0x135/0x170 lib/sys_info.c:165
> check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
> watchdog+0xfb5/0x1000 kernel/hung_task.c:515
> kthread+0x711/0x8a0 kernel/kthread.c:463
> ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
> </TASK>
> Sending NMI from CPU 0 to CPUs 1:
> NMI backtrace for cpu 1
> CPU: 1 UID: 0 PID: 6107 Comm: syz.3.20 Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
> RIP: 0010:hlock_class kernel/locking/lockdep.c:234 [inline]
> RIP: 0010:mark_lock+0x3c/0x190 kernel/locking/lockdep.c:4731
> Code: 00 03 00 83 f9 01 bb 09 00 00 00 83 db 00 83 fa 08 0f 45 da bd 01 00 00 00 89 d9 d3 e5 25 ff 1f 00 00 48 0f a3 05 c4 46 df 11 <73> 10 48 69 c0 c8 00 00 00 48 8d 88 70 f3 1e 93 eb 48 83 3d 4b d6
> RSP: 0018:ffffc90003747518 EFLAGS: 00000007
> RAX: 0000000000000311 RBX: 0000000000000008 RCX: 0000000000000008
> RDX: 0000000000000008 RSI: ffff8880275f48a8 RDI: ffff8880275f3d00
> RBP: 0000000000000100 R08: 0000000000000000 R09: ffffffff8241cc56
> R10: dffffc0000000000 R11: ffffed100e650518 R12: 0000000000000004
> R13: 0000000000000003 R14: ffff8880275f48a8 R15: 0000000000000000
> FS: 00007fc3607da6c0(0000) GS:ffff888125fbc000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000558e8c347168 CR3: 0000000077b26000 CR4: 00000000003526f0
> Call Trace:
> <TASK>
> mark_usage kernel/locking/lockdep.c:4674 [inline]
> __lock_acquire+0x6a8/0xd20 kernel/locking/lockdep.c:5191
> lock_acquire+0x117/0x350 kernel/locking/lockdep.c:5868
> __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
> _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
> spin_lock include/linux/spinlock.h:351 [inline]
> insert_inode_locked+0x336/0x5d0 fs/inode.c:1837
> ntfs_new_inode+0xc8/0x100 fs/ntfs3/fsntfs.c:1675
> ntfs_create_inode+0x606/0x32a0 fs/ntfs3/inode.c:1309
> ntfs_create+0x3d/0x50 fs/ntfs3/namei.c:110
> lookup_open fs/namei.c:4409 [inline]
> open_last_lookups fs/namei.c:4509 [inline]
> path_openat+0x190f/0x3d90 fs/namei.c:4753
> do_filp_open+0x1fa/0x410 fs/namei.c:4783
> do_sys_openat2+0x121/0x1c0 fs/open.c:1432
> do_sys_open fs/open.c:1447 [inline]
> __do_sys_openat fs/open.c:1463 [inline]
> __se_sys_openat fs/open.c:1458 [inline]
> __x64_sys_openat+0x138/0x170 fs/open.c:1458
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7fc35f98f749
> Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007fc3607da038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
> RAX: ffffffffffffffda RBX: 00007fc35fbe5fa0 RCX: 00007fc35f98f749
> RDX: 000000000000275a RSI: 00002000000001c0 RDI: ffffffffffffff9c
> RBP: 00007fc35fa13f91 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007fc35fbe6038 R14: 00007fc35fbe5fa0 R15: 00007ffffeb34448
> </TASK>
>
>
> ---
#syz test
diff --git a/fs/inode.c b/fs/inode.c
index 0f3a56ea8f48..80298f048117 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -1311,12 +1311,11 @@ struct inode *inode_insert5(struct inode *inode, unsigned long hashval,
spin_unlock(&inode_hash_lock);
if (IS_ERR(old))
return NULL;
- if (unlikely(isnew)) {
+ if (unlikely(isnew))
wait_on_new_inode(old);
- if (unlikely(inode_unhashed(old))) {
- iput(old);
- goto again;
- }
+ if (unlikely(inode_unhashed(old))) {
+ iput(old);
+ goto again;
}
return old;
}
@@ -1413,12 +1412,11 @@ struct inode *iget5_locked_rcu(struct super_block *sb, unsigned long hashval,
if (inode) {
if (IS_ERR(inode))
return NULL;
- if (unlikely(isnew)) {
+ if (unlikely(isnew))
wait_on_new_inode(inode);
- if (unlikely(inode_unhashed(inode))) {
- iput(inode);
- goto again;
- }
+ if (unlikely(inode_unhashed(inode))) {
+ iput(inode);
+ goto again;
}
return inode;
}
@@ -1459,12 +1457,11 @@ struct inode *iget_locked(struct super_block *sb, unsigned long ino)
if (inode) {
if (IS_ERR(inode))
return NULL;
- if (unlikely(isnew)) {
+ if (unlikely(isnew))
wait_on_new_inode(inode);
- if (unlikely(inode_unhashed(inode))) {
- iput(inode);
- goto again;
- }
+ if (unlikely(inode_unhashed(inode))) {
+ iput(inode);
+ goto again;
}
return inode;
}
@@ -1501,12 +1498,11 @@ struct inode *iget_locked(struct super_block *sb, unsigned long ino)
if (IS_ERR(old))
return NULL;
inode = old;
- if (unlikely(isnew)) {
+ if (unlikely(isnew))
wait_on_new_inode(inode);
- if (unlikely(inode_unhashed(inode))) {
- iput(inode);
- goto again;
- }
+ if (unlikely(inode_unhashed(inode))) {
+ iput(inode);
+ goto again;
}
}
return inode;
@@ -1648,12 +1644,11 @@ struct inode *ilookup5(struct super_block *sb, unsigned long hashval,
again:
inode = ilookup5_nowait(sb, hashval, test, data, &isnew);
if (inode) {
- if (unlikely(isnew)) {
+ if (unlikely(isnew))
wait_on_new_inode(inode);
- if (unlikely(inode_unhashed(inode))) {
- iput(inode);
- goto again;
- }
+ if (unlikely(inode_unhashed(inode))) {
+ iput(inode);
+ goto again;
}
}
return inode;
@@ -1682,12 +1677,11 @@ struct inode *ilookup(struct super_block *sb, unsigned long ino)
if (inode) {
if (IS_ERR(inode))
return NULL;
- if (unlikely(isnew)) {
+ if (unlikely(isnew))
wait_on_new_inode(inode);
- if (unlikely(inode_unhashed(inode))) {
- iput(inode);
- goto again;
- }
+ if (unlikely(inode_unhashed(inode))) {
+ iput(inode);
+ goto again;
}
}
return inode;
@@ -1863,12 +1857,11 @@ int insert_inode_locked(struct inode *inode)
isnew = !!(inode_state_read(old) & I_NEW);
spin_unlock(&old->i_lock);
spin_unlock(&inode_hash_lock);
- if (isnew) {
+ if (isnew)
wait_on_new_inode(old);
- if (unlikely(!inode_unhashed(old))) {
- iput(old);
- return -EBUSY;
- }
+ if (unlikely(!inode_unhashed(old))) {
+ iput(old);
+ return -EBUSY;
}
iput(old);
}
^ permalink raw reply related [flat|nested] 17+ messages in thread
* Re: [syzbot] [ntfs3?] INFO: task hung in __start_renaming
2025-11-24 0:27 ` Mateusz Guzik
@ 2025-11-24 0:57 ` syzbot
0 siblings, 0 replies; 17+ messages in thread
From: syzbot @ 2025-11-24 0:57 UTC (permalink / raw)
To: agruenba, almaz.alexandrovich, brauner, dhowells, gfs2, jack,
linux-afs, linux-fsdevel, linux-kernel, marc.dionne, mjguzik,
ntfs3, syzkaller-bugs, viro
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+2fefb910d2c20c0698d8@syzkaller.appspotmail.com
Tested-by: syzbot+2fefb910d2c20c0698d8@syzkaller.appspotmail.com
Tested on:
commit: d724c6f8 Add linux-next specific files for 20251121
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=13f3d8b4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=68d11c703cf8e4a0
dashboard link: https://syzkaller.appspot.com/bug?extid=2fefb910d2c20c0698d8
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=1347d612580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [syzbot] [ntfs3?] INFO: task hung in __start_renaming
2025-11-23 22:44 [syzbot] [ntfs3?] INFO: task hung in __start_renaming syzbot
2025-11-23 23:29 ` Mateusz Guzik
2025-11-24 0:27 ` Mateusz Guzik
@ 2025-11-24 3:29 ` Mateusz Guzik
2025-11-24 4:47 ` syzbot
2025-11-24 6:28 ` Mateusz Guzik
` (2 subsequent siblings)
5 siblings, 1 reply; 17+ messages in thread
From: Mateusz Guzik @ 2025-11-24 3:29 UTC (permalink / raw)
To: syzbot
Cc: agruenba, almaz.alexandrovich, brauner, dhowells, gfs2, jack,
linux-afs, linux-fsdevel, linux-kernel, marc.dionne, ntfs3,
syzkaller-bugs, viro
On Sun, Nov 23, 2025 at 02:44:29PM -0800, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: fe4d0dea039f Add linux-next specific files for 20251119
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=142c0514580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=f20a6db7594dcad7
> dashboard link: https://syzkaller.appspot.com/bug?extid=2fefb910d2c20c0698d8
> compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11cd7692580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17615658580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/ce4f26d91a01/disk-fe4d0dea.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/6c9b53acf521/vmlinux-fe4d0dea.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/64d37d01cd64/bzImage-fe4d0dea.xz
> mounted in repro: https://storage.googleapis.com/syzbot-assets/a91529a880b1/mount_0.gz
>
> The issue was bisected to:
>
> commit 1e3c3784221ac86401aea72e2bae36057062fc9c
> Author: Mateusz Guzik <mjguzik@gmail.com>
> Date: Fri Oct 10 22:17:36 2025 +0000
>
> fs: rework I_NEW handling to operate without fences
>
> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=17739742580000
> final oops: https://syzkaller.appspot.com/x/report.txt?x=14f39742580000
> console output: https://syzkaller.appspot.com/x/log.txt?x=10f39742580000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+2fefb910d2c20c0698d8@syzkaller.appspotmail.com
> Fixes: 1e3c3784221a ("fs: rework I_NEW handling to operate without fences")
>
> INFO: task syz.0.17:6022 blocked for more than 143 seconds.
> Not tainted syzkaller #0
> "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
> task:syz.0.17 state:D stack:28744 pid:6022 tgid:6020 ppid:5945 task_flags:0x400040 flags:0x00080002
> Call Trace:
> <TASK>
> context_switch kernel/sched/core.c:5263 [inline]
> __schedule+0x1836/0x4ed0 kernel/sched/core.c:6871
> __schedule_loop kernel/sched/core.c:6953 [inline]
> schedule+0x165/0x360 kernel/sched/core.c:6968
> schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7025
> rwsem_down_write_slowpath+0x872/0xfe0 kernel/locking/rwsem.c:1185
> __down_write_common kernel/locking/rwsem.c:1317 [inline]
> __down_write kernel/locking/rwsem.c:1326 [inline]
> down_write_nested+0x1b5/0x200 kernel/locking/rwsem.c:1707
> inode_lock_nested include/linux/fs.h:1072 [inline]
> lock_rename fs/namei.c:3681 [inline]
> __start_renaming+0x148/0x410 fs/namei.c:3777
> do_renameat2+0x399/0x8e0 fs/namei.c:5991
> __do_sys_rename fs/namei.c:6059 [inline]
> __se_sys_rename fs/namei.c:6057 [inline]
> __x64_sys_rename+0x82/0x90 fs/namei.c:6057
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f7ba9b8f749
> RSP: 002b:00007f7ba91dd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000052
> RAX: ffffffffffffffda RBX: 00007f7ba9de6090 RCX: 00007f7ba9b8f749
> RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000200000000340
> RBP: 00007f7ba9c13f91 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007f7ba9de6128 R14: 00007f7ba9de6090 R15: 00007fff2ce8d188
> </TASK>
>
> Showing all locks held in the system:
> 1 lock held by khungtaskd/31:
> #0: ffffffff8df3d740 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
> #0: ffffffff8df3d740 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
> #0: ffffffff8df3d740 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
> 2 locks held by getty/5589:
> #0: ffff88814d56c0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
> #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 drivers/tty/n_tty.c:2222
> 3 locks held by syz.0.17/6021:
> 2 locks held by syz.0.17/6022:
> #0: ffff888030718420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
> #1: ffff8880631e3dd8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
> #1: ffff8880631e3dd8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
> #1: ffff8880631e3dd8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
> 3 locks held by syz.1.18/6048:
> 2 locks held by syz.1.18/6049:
> #0: ffff888077cbe420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
> #1: ffff8880632db690 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
> #1: ffff8880632db690 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
> #1: ffff8880632db690 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
> 3 locks held by syz.2.19/6082:
> 2 locks held by syz.2.19/6083:
> #0: ffff88807945e420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
> #1: ffff888073281970 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
> #1: ffff888073281970 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
> #1: ffff888073281970 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
> 3 locks held by syz.3.20/6107:
> 2 locks held by syz.3.20/6108:
> #0: ffff88807b0a4420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
> #1: ffff8880631e1228 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
> #1: ffff8880631e1228 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
> #1: ffff8880631e1228 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
> 3 locks held by syz.4.21/6138:
> 2 locks held by syz.4.21/6139:
> #0: ffff8880587fe420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
> #1: ffff8880632d8ae0 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
> #1: ffff8880632d8ae0 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
> #1: ffff8880632d8ae0 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
> 3 locks held by syz.5.22/6176:
> 2 locks held by syz.5.22/6177:
> #0: ffff888026cec420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
> #1: ffff8880631ce240 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
> #1: ffff8880631ce240 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
> #1: ffff8880631ce240 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
> 3 locks held by syz.6.23/6211:
> 2 locks held by syz.6.23/6212:
> #0: ffff888027d88420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
> #1: ffff8880631c9228 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
> #1: ffff8880631c9228 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
> #1: ffff8880631c9228 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
> 3 locks held by syz.7.24/6244:
> 2 locks held by syz.7.24/6245:
> #0: ffff88807d516420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
> #1: ffff8880631bdaf8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
> #1: ffff8880631bdaf8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
> #1: ffff8880631bdaf8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
>
> =============================================
>
> NMI backtrace for cpu 0
> CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
> Call Trace:
> <TASK>
> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
> nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
> nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
> trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
> __sys_info lib/sys_info.c:157 [inline]
> sys_info+0x135/0x170 lib/sys_info.c:165
> check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
> watchdog+0xfb5/0x1000 kernel/hung_task.c:515
> kthread+0x711/0x8a0 kernel/kthread.c:463
> ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
> </TASK>
> Sending NMI from CPU 0 to CPUs 1:
> NMI backtrace for cpu 1
> CPU: 1 UID: 0 PID: 6107 Comm: syz.3.20 Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
> RIP: 0010:hlock_class kernel/locking/lockdep.c:234 [inline]
> RIP: 0010:mark_lock+0x3c/0x190 kernel/locking/lockdep.c:4731
> Code: 00 03 00 83 f9 01 bb 09 00 00 00 83 db 00 83 fa 08 0f 45 da bd 01 00 00 00 89 d9 d3 e5 25 ff 1f 00 00 48 0f a3 05 c4 46 df 11 <73> 10 48 69 c0 c8 00 00 00 48 8d 88 70 f3 1e 93 eb 48 83 3d 4b d6
> RSP: 0018:ffffc90003747518 EFLAGS: 00000007
> RAX: 0000000000000311 RBX: 0000000000000008 RCX: 0000000000000008
> RDX: 0000000000000008 RSI: ffff8880275f48a8 RDI: ffff8880275f3d00
> RBP: 0000000000000100 R08: 0000000000000000 R09: ffffffff8241cc56
> R10: dffffc0000000000 R11: ffffed100e650518 R12: 0000000000000004
> R13: 0000000000000003 R14: ffff8880275f48a8 R15: 0000000000000000
> FS: 00007fc3607da6c0(0000) GS:ffff888125fbc000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000558e8c347168 CR3: 0000000077b26000 CR4: 00000000003526f0
> Call Trace:
> <TASK>
> mark_usage kernel/locking/lockdep.c:4674 [inline]
> __lock_acquire+0x6a8/0xd20 kernel/locking/lockdep.c:5191
> lock_acquire+0x117/0x350 kernel/locking/lockdep.c:5868
> __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
> _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
> spin_lock include/linux/spinlock.h:351 [inline]
> insert_inode_locked+0x336/0x5d0 fs/inode.c:1837
> ntfs_new_inode+0xc8/0x100 fs/ntfs3/fsntfs.c:1675
> ntfs_create_inode+0x606/0x32a0 fs/ntfs3/inode.c:1309
> ntfs_create+0x3d/0x50 fs/ntfs3/namei.c:110
> lookup_open fs/namei.c:4409 [inline]
> open_last_lookups fs/namei.c:4509 [inline]
> path_openat+0x190f/0x3d90 fs/namei.c:4753
> do_filp_open+0x1fa/0x410 fs/namei.c:4783
> do_sys_openat2+0x121/0x1c0 fs/open.c:1432
> do_sys_open fs/open.c:1447 [inline]
> __do_sys_openat fs/open.c:1463 [inline]
> __se_sys_openat fs/open.c:1458 [inline]
> __x64_sys_openat+0x138/0x170 fs/open.c:1458
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7fc35f98f749
> Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007fc3607da038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
> RAX: ffffffffffffffda RBX: 00007fc35fbe5fa0 RCX: 00007fc35f98f749
> RDX: 000000000000275a RSI: 00002000000001c0 RDI: ffffffffffffff9c
> RBP: 00007fc35fa13f91 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007fc35fbe6038 R14: 00007fc35fbe5fa0 R15: 00007ffffeb34448
> </TASK>
>
>
#syz test
diff --git a/fs/inode.c b/fs/inode.c
index a62032864ddf..e923f4303872 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -1057,6 +1057,7 @@ static struct inode *find_inode(struct super_block *sb,
__wait_on_freeing_inode(inode, is_inode_hash_locked);
goto repeat;
}
+ BUG_ON(inode_unhashed(inode));
if (unlikely(inode_state_read(inode) & I_CREATING)) {
spin_unlock(&inode->i_lock);
rcu_read_unlock();
@@ -1099,6 +1100,7 @@ static struct inode *find_inode_fast(struct super_block *sb,
__wait_on_freeing_inode(inode, is_inode_hash_locked);
goto repeat;
}
+ BUG_ON(inode_unhashed(inode));
if (unlikely(inode_state_read(inode) & I_CREATING)) {
spin_unlock(&inode->i_lock);
rcu_read_unlock();
@@ -1855,6 +1857,7 @@ int insert_inode_locked(struct inode *inode)
spin_unlock(&inode_hash_lock);
return 0;
}
+ BUG_ON(inode_unhashed(old));
if (unlikely(inode_state_read(old) & I_CREATING)) {
spin_unlock(&old->i_lock);
spin_unlock(&inode_hash_lock);
^ permalink raw reply related [flat|nested] 17+ messages in thread
* Re: [syzbot] [ntfs3?] INFO: task hung in __start_renaming
2025-11-24 3:29 ` Mateusz Guzik
@ 2025-11-24 4:47 ` syzbot
0 siblings, 0 replies; 17+ messages in thread
From: syzbot @ 2025-11-24 4:47 UTC (permalink / raw)
To: agruenba, almaz.alexandrovich, brauner, dhowells, gfs2, jack,
linux-afs, linux-fsdevel, linux-kernel, marc.dionne, mjguzik,
ntfs3, syzkaller-bugs, viro
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
SYZFAIL: failed to recv rpc
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
Warning: Permanently added '10.128.1.240' (ED25519) to the list of known hosts.
2025/11/24 04:46:07 parsed 1 programs
[ 90.555532][ T5834] cgroup: Unknown subsys name 'net'
[ 90.669357][ T5834] cgroup: Unknown subsys name 'cpuset'
[ 90.678428][ T5834] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 92.016508][ T10] cfg80211: failed to load regulatory.db
[ 92.473167][ T5834] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 95.487085][ T5846] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 96.148644][ T5858] chnl_net:caif_netlink_parms(): no params data found
[ 96.250234][ T5858] bridge0: port 1(bridge_slave_0) entered blocking state
[ 96.258110][ T5858] bridge0: port 1(bridge_slave_0) entered disabled state
[ 96.265979][ T5858] bridge_slave_0: entered allmulticast mode
[ 96.273344][ T5858] bridge_slave_0: entered promiscuous mode
[ 96.283227][ T5858] bridge0: port 2(bridge_slave_1) entered blocking state
[ 96.290745][ T5858] bridge0: port 2(bridge_slave_1) entered disabled state
[ 96.298585][ T5858] bridge_slave_1: entered allmulticast mode
[ 96.306164][ T5858] bridge_slave_1: entered promiscuous mode
[ 96.340272][ T5858] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 96.353486][ T5858] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 96.386615][ T5858] team0: Port device team_slave_0 added
[ 96.394597][ T5858] team0: Port device team_slave_1 added
[ 96.423182][ T5858] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 96.430950][ T5858] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 96.457421][ T5858] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 96.470037][ T5858] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 96.477137][ T5858] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 96.503196][ T5858] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 96.549258][ T5858] hsr_slave_0: entered promiscuous mode
[ 96.556089][ T5858] hsr_slave_1: entered promiscuous mode
[ 96.709149][ T5858] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 96.721617][ T5858] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 96.733093][ T5858] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 96.744474][ T5858] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 96.779618][ T5858] bridge0: port 2(bridge_slave_1) entered blocking state
[ 96.786970][ T5858] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 96.794851][ T5858] bridge0: port 1(bridge_slave_0) entered blocking state
[ 96.802116][ T5858] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 96.863750][ T5858] 8021q: adding VLAN 0 to HW filter on device bond0
[ 96.883749][ T12] bridge0: port 1(bridge_slave_0) entered disabled state
[ 96.893131][ T12] bridge0: port 2(bridge_slave_1) entered disabled state
[ 96.915600][ T5858] 8021q: adding VLAN 0 to HW filter on device team0
[ 96.931688][ T3534] bridge0: port 1(bridge_slave_0) entered blocking state
[ 96.938987][ T3534] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 96.952476][ T12] bridge0: port 2(bridge_slave_1) entered blocking state
[ 96.959687][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 97.144886][ T5858] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 97.200647][ T5858] veth0_vlan: entered promiscuous mode
[ 97.212659][ T5858] veth1_vlan: entered promiscuous mode
[ 97.247394][ T5858] veth0_macvtap: entered promiscuous mode
[ 97.257672][ T5858] veth1_macvtap: entered promiscuous mode
[ 97.279295][ T5858] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 97.293604][ T5858] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 97.311084][ T36] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 97.321470][ T36] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 97.333512][ T36] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 97.343962][ T36] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 97.489573][ T36] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 97.557912][ T36] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 97.656263][ T36] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 97.752469][ T36] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 98.236218][ T5896] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 98.244431][ T5896] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 98.253946][ T5896] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 98.264492][ T5896] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 98.272338][ T5896] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 99.530883][ T4188] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 99.539839][ T4188] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 99.571626][ T3534] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 99.579614][ T3534] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 100.426458][ T36] bridge_slave_1: left allmulticast mode
[ 100.447450][ T36] bridge_slave_1: left promiscuous mode
[ 100.454127][ T36] bridge0: port 2(bridge_slave_1) entered disabled state
[ 100.480752][ T36] bridge_slave_0: left allmulticast mode
[ 100.490779][ T36] bridge_slave_0: left promiscuous mode
[ 100.505305][ T36] bridge0: port 1(bridge_slave_0) entered disabled state
2025/11/24 04:46:20 executed programs: 0
[ 100.676852][ T5896] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 100.686417][ T5896] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 100.696621][ T5896] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 100.710027][ T5896] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 100.729116][ T5896] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 101.000183][ T36] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 101.015387][ T36] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 101.029740][ T36] bond0 (unregistering): Released all slaves
[ 101.191106][ T36] hsr_slave_0: left promiscuous mode
[ 101.198191][ T36] hsr_slave_1: left promiscuous mode
[ 101.204127][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 101.212520][ T36] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 101.221975][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 101.229631][ T36] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 101.245879][ T36] veth1_macvtap: left promiscuous mode
[ 101.251698][ T36] veth0_macvtap: left promiscuous mode
[ 101.258200][ T36] veth1_vlan: left promiscuous mode
[ 101.263553][ T36] veth0_vlan: left promiscuous mode
[ 101.580646][ T36] team0 (unregistering): Port device team_slave_1 removed
[ 101.610626][ T36] team0 (unregistering): Port device team_slave_0 removed
[ 102.143766][ T5949] chnl_net:caif_netlink_parms(): no params data found
[ 102.560717][ T5949] bridge0: port 1(bridge_slave_0) entered blocking state
[ 102.575166][ T5949] bridge0: port 1(bridge_slave_0) entered disabled state
[ 102.582540][ T5949] bridge_slave_0: entered allmulticast mode
[ 102.591585][ T5949] bridge_slave_0: entered promiscuous mode
[ 102.614286][ T5949] bridge0: port 2(bridge_slave_1) entered blocking state
[ 102.621909][ T5949] bridge0: port 2(bridge_slave_1) entered disabled state
[ 102.629681][ T5949] bridge_slave_1: entered allmulticast mode
[ 102.638831][ T5949] bridge_slave_1: entered promiscuous mode
[ 102.698198][ T5949] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 102.711869][ T5949] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 102.815644][ T5149] Bluetooth: hci0: command tx timeout
[ 103.123913][ T5949] team0: Port device team_slave_0 added
[ 103.139960][ T5949] team0: Port device team_slave_1 added
[ 103.229026][ T5949] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 103.239890][ T5949] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 103.266203][ T5949] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 103.297209][ T5949] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 103.304455][ T5949] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 103.331586][ T5949] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 103.553894][ T5949] hsr_slave_0: entered promiscuous mode
[ 103.584330][ T5949] hsr_slave_1: entered promiscuous mode
[ 104.403096][ T5949] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 104.420683][ T5949] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 104.435325][ T5949] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 104.449213][ T5949] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 104.617044][ T5949] 8021q: adding VLAN 0 to HW filter on device bond0
[ 104.649084][ T5949] 8021q: adding VLAN 0 to HW filter on device team0
[ 104.669296][ T3534] bridge0: port 1(bridge_slave_0) entered blocking state
[ 104.676566][ T3534] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 104.700338][ T3534] bridge0: port 2(bridge_slave_1) entered blocking state
[ 104.707610][ T3534] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 104.896202][ T5149] Bluetooth: hci0: command tx timeout
[ 105.029734][ T5949] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 105.112846][ T5949] veth0_vlan: entered promiscuous mode
[ 105.132429][ T5949] veth1_vlan: entered promiscuous mode
[ 105.181476][ T5949] veth0_macvtap: entered promiscuous mode
[ 105.200419][ T5949] veth1_macvtap: entered promiscuous mode
[ 105.228009][ T5949] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 105.248759][ T5949] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 105.270101][ T3534] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 105.283869][ T3534] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 105.294419][ T3534] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 105.317774][ T3534] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 105.417418][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 105.434266][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 105.481687][ T3534] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 105.490831][ T3534] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3558344338=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.4'
GOWORK=''
PKG_CONFIG='pkg-config'
git status (err=<nil>)
HEAD detached at 26ee52375
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=26ee5237507419c1fa5dea5b2a84a0b7dcce9307 -X github.com/google/syzkaller/prog.gitRevisionDate=20251119-085940" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=26ee5237507419c1fa5dea5b2a84a0b7dcce9307 -X github.com/google/syzkaller/prog.gitRevisionDate=20251119-085940" ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=26ee5237507419c1fa5dea5b2a84a0b7dcce9307 -X github.com/google/syzkaller/prog.gitRevisionDate=20251119-085940" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"26ee5237507419c1fa5dea5b2a84a0b7dcce9307\"
/usr/bin/ld: /tmp/cchUMbrN.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null
Tested on:
commit: d724c6f8 Add linux-next specific files for 20251121
git tree: linux-next
kernel config: https://syzkaller.appspot.com/x/.config?x=68d11c703cf8e4a0
dashboard link: https://syzkaller.appspot.com/bug?extid=2fefb910d2c20c0698d8
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=11883612580000
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [syzbot] [ntfs3?] INFO: task hung in __start_renaming
2025-11-23 22:44 [syzbot] [ntfs3?] INFO: task hung in __start_renaming syzbot
` (2 preceding siblings ...)
2025-11-24 3:29 ` Mateusz Guzik
@ 2025-11-24 6:28 ` Mateusz Guzik
2025-11-24 7:13 ` syzbot
2025-11-24 8:07 ` Mateusz Guzik
2025-11-24 8:08 ` Mateusz Guzik
5 siblings, 1 reply; 17+ messages in thread
From: Mateusz Guzik @ 2025-11-24 6:28 UTC (permalink / raw)
To: syzbot
Cc: agruenba, almaz.alexandrovich, brauner, dhowells, gfs2, jack,
linux-afs, linux-fsdevel, linux-kernel, marc.dionne, ntfs3,
syzkaller-bugs, viro
On Sun, Nov 23, 2025 at 02:44:29PM -0800, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: fe4d0dea039f Add linux-next specific files for 20251119
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=142c0514580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=f20a6db7594dcad7
> dashboard link: https://syzkaller.appspot.com/bug?extid=2fefb910d2c20c0698d8
> compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11cd7692580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17615658580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/ce4f26d91a01/disk-fe4d0dea.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/6c9b53acf521/vmlinux-fe4d0dea.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/64d37d01cd64/bzImage-fe4d0dea.xz
> mounted in repro: https://storage.googleapis.com/syzbot-assets/a91529a880b1/mount_0.gz
>
> The issue was bisected to:
>
> commit 1e3c3784221ac86401aea72e2bae36057062fc9c
> Author: Mateusz Guzik <mjguzik@gmail.com>
> Date: Fri Oct 10 22:17:36 2025 +0000
>
> fs: rework I_NEW handling to operate without fences
>
> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=17739742580000
> final oops: https://syzkaller.appspot.com/x/report.txt?x=14f39742580000
> console output: https://syzkaller.appspot.com/x/log.txt?x=10f39742580000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+2fefb910d2c20c0698d8@syzkaller.appspotmail.com
> Fixes: 1e3c3784221a ("fs: rework I_NEW handling to operate without fences")
>
> INFO: task syz.0.17:6022 blocked for more than 143 seconds.
> Not tainted syzkaller #0
> "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
> task:syz.0.17 state:D stack:28744 pid:6022 tgid:6020 ppid:5945 task_flags:0x400040 flags:0x00080002
> Call Trace:
> <TASK>
> context_switch kernel/sched/core.c:5263 [inline]
> __schedule+0x1836/0x4ed0 kernel/sched/core.c:6871
> __schedule_loop kernel/sched/core.c:6953 [inline]
> schedule+0x165/0x360 kernel/sched/core.c:6968
> schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7025
> rwsem_down_write_slowpath+0x872/0xfe0 kernel/locking/rwsem.c:1185
> __down_write_common kernel/locking/rwsem.c:1317 [inline]
> __down_write kernel/locking/rwsem.c:1326 [inline]
> down_write_nested+0x1b5/0x200 kernel/locking/rwsem.c:1707
> inode_lock_nested include/linux/fs.h:1072 [inline]
> lock_rename fs/namei.c:3681 [inline]
> __start_renaming+0x148/0x410 fs/namei.c:3777
> do_renameat2+0x399/0x8e0 fs/namei.c:5991
> __do_sys_rename fs/namei.c:6059 [inline]
> __se_sys_rename fs/namei.c:6057 [inline]
> __x64_sys_rename+0x82/0x90 fs/namei.c:6057
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f7ba9b8f749
> RSP: 002b:00007f7ba91dd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000052
> RAX: ffffffffffffffda RBX: 00007f7ba9de6090 RCX: 00007f7ba9b8f749
> RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000200000000340
> RBP: 00007f7ba9c13f91 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007f7ba9de6128 R14: 00007f7ba9de6090 R15: 00007fff2ce8d188
> </TASK>
>
> Showing all locks held in the system:
> 1 lock held by khungtaskd/31:
> #0: ffffffff8df3d740 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
> #0: ffffffff8df3d740 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
> #0: ffffffff8df3d740 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
> 2 locks held by getty/5589:
> #0: ffff88814d56c0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
> #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 drivers/tty/n_tty.c:2222
> 3 locks held by syz.0.17/6021:
> 2 locks held by syz.0.17/6022:
> #0: ffff888030718420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
> #1: ffff8880631e3dd8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
> #1: ffff8880631e3dd8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
> #1: ffff8880631e3dd8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
> 3 locks held by syz.1.18/6048:
> 2 locks held by syz.1.18/6049:
> #0: ffff888077cbe420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
> #1: ffff8880632db690 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
> #1: ffff8880632db690 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
> #1: ffff8880632db690 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
> 3 locks held by syz.2.19/6082:
> 2 locks held by syz.2.19/6083:
> #0: ffff88807945e420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
> #1: ffff888073281970 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
> #1: ffff888073281970 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
> #1: ffff888073281970 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
> 3 locks held by syz.3.20/6107:
> 2 locks held by syz.3.20/6108:
> #0: ffff88807b0a4420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
> #1: ffff8880631e1228 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
> #1: ffff8880631e1228 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
> #1: ffff8880631e1228 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
> 3 locks held by syz.4.21/6138:
> 2 locks held by syz.4.21/6139:
> #0: ffff8880587fe420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
> #1: ffff8880632d8ae0 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
> #1: ffff8880632d8ae0 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
> #1: ffff8880632d8ae0 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
> 3 locks held by syz.5.22/6176:
> 2 locks held by syz.5.22/6177:
> #0: ffff888026cec420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
> #1: ffff8880631ce240 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
> #1: ffff8880631ce240 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
> #1: ffff8880631ce240 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
> 3 locks held by syz.6.23/6211:
> 2 locks held by syz.6.23/6212:
> #0: ffff888027d88420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
> #1: ffff8880631c9228 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
> #1: ffff8880631c9228 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
> #1: ffff8880631c9228 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
> 3 locks held by syz.7.24/6244:
> 2 locks held by syz.7.24/6245:
> #0: ffff88807d516420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
> #1: ffff8880631bdaf8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
> #1: ffff8880631bdaf8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
> #1: ffff8880631bdaf8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
>
> =============================================
>
> NMI backtrace for cpu 0
> CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
> Call Trace:
> <TASK>
> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
> nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
> nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
> trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
> __sys_info lib/sys_info.c:157 [inline]
> sys_info+0x135/0x170 lib/sys_info.c:165
> check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
> watchdog+0xfb5/0x1000 kernel/hung_task.c:515
> kthread+0x711/0x8a0 kernel/kthread.c:463
> ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
> </TASK>
> Sending NMI from CPU 0 to CPUs 1:
> NMI backtrace for cpu 1
> CPU: 1 UID: 0 PID: 6107 Comm: syz.3.20 Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
> RIP: 0010:hlock_class kernel/locking/lockdep.c:234 [inline]
> RIP: 0010:mark_lock+0x3c/0x190 kernel/locking/lockdep.c:4731
> Code: 00 03 00 83 f9 01 bb 09 00 00 00 83 db 00 83 fa 08 0f 45 da bd 01 00 00 00 89 d9 d3 e5 25 ff 1f 00 00 48 0f a3 05 c4 46 df 11 <73> 10 48 69 c0 c8 00 00 00 48 8d 88 70 f3 1e 93 eb 48 83 3d 4b d6
> RSP: 0018:ffffc90003747518 EFLAGS: 00000007
> RAX: 0000000000000311 RBX: 0000000000000008 RCX: 0000000000000008
> RDX: 0000000000000008 RSI: ffff8880275f48a8 RDI: ffff8880275f3d00
> RBP: 0000000000000100 R08: 0000000000000000 R09: ffffffff8241cc56
> R10: dffffc0000000000 R11: ffffed100e650518 R12: 0000000000000004
> R13: 0000000000000003 R14: ffff8880275f48a8 R15: 0000000000000000
> FS: 00007fc3607da6c0(0000) GS:ffff888125fbc000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000558e8c347168 CR3: 0000000077b26000 CR4: 00000000003526f0
> Call Trace:
> <TASK>
> mark_usage kernel/locking/lockdep.c:4674 [inline]
> __lock_acquire+0x6a8/0xd20 kernel/locking/lockdep.c:5191
> lock_acquire+0x117/0x350 kernel/locking/lockdep.c:5868
> __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
> _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
> spin_lock include/linux/spinlock.h:351 [inline]
> insert_inode_locked+0x336/0x5d0 fs/inode.c:1837
> ntfs_new_inode+0xc8/0x100 fs/ntfs3/fsntfs.c:1675
> ntfs_create_inode+0x606/0x32a0 fs/ntfs3/inode.c:1309
> ntfs_create+0x3d/0x50 fs/ntfs3/namei.c:110
> lookup_open fs/namei.c:4409 [inline]
> open_last_lookups fs/namei.c:4509 [inline]
> path_openat+0x190f/0x3d90 fs/namei.c:4753
> do_filp_open+0x1fa/0x410 fs/namei.c:4783
> do_sys_openat2+0x121/0x1c0 fs/open.c:1432
> do_sys_open fs/open.c:1447 [inline]
> __do_sys_openat fs/open.c:1463 [inline]
> __se_sys_openat fs/open.c:1458 [inline]
> __x64_sys_openat+0x138/0x170 fs/open.c:1458
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7fc35f98f749
> Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007fc3607da038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
> RAX: ffffffffffffffda RBX: 00007fc35fbe5fa0 RCX: 00007fc35f98f749
> RDX: 000000000000275a RSI: 00002000000001c0 RDI: ffffffffffffff9c
> RBP: 00007fc35fa13f91 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007fc35fbe6038 R14: 00007fc35fbe5fa0 R15: 00007ffffeb34448
> </TASK>
>
>
#syz test
index a62032864ddf..7f4c74cc09b5 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -1057,6 +1057,7 @@ static struct inode *find_inode(struct super_block *sb,
__wait_on_freeing_inode(inode, is_inode_hash_locked);
goto repeat;
}
+ BUG_ON(inode_unhashed(inode));
if (unlikely(inode_state_read(inode) & I_CREATING)) {
spin_unlock(&inode->i_lock);
rcu_read_unlock();
@@ -1099,6 +1100,7 @@ static struct inode *find_inode_fast(struct super_block *sb,
__wait_on_freeing_inode(inode, is_inode_hash_locked);
goto repeat;
}
+ BUG_ON(inode_unhashed(inode));
if (unlikely(inode_state_read(inode) & I_CREATING)) {
spin_unlock(&inode->i_lock);
rcu_read_unlock();
@@ -1318,6 +1320,8 @@ struct inode *inode_insert5(struct inode *inode, unsigned long hashval,
iput(old);
goto again;
}
+ } else {
+ BUG_ON(inode_unhashed(old));
}
return old;
}
@@ -1420,6 +1424,8 @@ struct inode *iget5_locked_rcu(struct super_block *sb, unsigned long hashval,
iput(inode);
goto again;
}
+ } else {
+ BUG_ON(inode_unhashed(inode));
}
return inode;
}
@@ -1466,6 +1472,8 @@ struct inode *iget_locked(struct super_block *sb, unsigned long ino)
iput(inode);
goto again;
}
+ } else {
+ BUG_ON(inode_unhashed(inode));
}
return inode;
}
@@ -1508,6 +1516,8 @@ struct inode *iget_locked(struct super_block *sb, unsigned long ino)
iput(inode);
goto again;
}
+ } else {
+ BUG_ON(inode_unhashed(inode));
}
}
return inode;
@@ -1655,6 +1665,8 @@ struct inode *ilookup5(struct super_block *sb, unsigned long hashval,
iput(inode);
goto again;
}
+ } else {
+ BUG_ON(inode_unhashed(inode));
}
}
return inode;
@@ -1689,6 +1701,8 @@ struct inode *ilookup(struct super_block *sb, unsigned long ino)
iput(inode);
goto again;
}
+ } else {
+ BUG_ON(inode_unhashed(inode));
}
}
return inode;
@@ -1855,6 +1869,7 @@ int insert_inode_locked(struct inode *inode)
spin_unlock(&inode_hash_lock);
return 0;
}
+ BUG_ON(inode_unhashed(old));
if (unlikely(inode_state_read(old) & I_CREATING)) {
spin_unlock(&old->i_lock);
spin_unlock(&inode_hash_lock);
@@ -1870,6 +1885,8 @@ int insert_inode_locked(struct inode *inode)
iput(old);
return -EBUSY;
}
+ } else {
+ BUG_ON(inode_unhashed(old));
}
iput(old);
}
^ permalink raw reply related [flat|nested] 17+ messages in thread
* Re: [syzbot] [ntfs3?] INFO: task hung in __start_renaming
2025-11-24 6:28 ` Mateusz Guzik
@ 2025-11-24 7:13 ` syzbot
2025-11-24 7:54 ` Mateusz Guzik
0 siblings, 1 reply; 17+ messages in thread
From: syzbot @ 2025-11-24 7:13 UTC (permalink / raw)
To: agruenba, almaz.alexandrovich, brauner, dhowells, gfs2, jack,
linux-afs, linux-fsdevel, linux-kernel, marc.dionne, mjguzik,
ntfs3, syzkaller-bugs, viro
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: task hung in __start_renaming
INFO: task syz.0.17:6473 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17 state:D stack:27936 pid:6473 tgid:6471 ppid:6352 task_flags:0x400040 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5257 [inline]
__schedule+0x14bc/0x5030 kernel/sched/core.c:6864
__schedule_loop kernel/sched/core.c:6946 [inline]
schedule+0x165/0x360 kernel/sched/core.c:6961
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7018
rwsem_down_write_slowpath+0x872/0xfe0 kernel/locking/rwsem.c:1185
__down_write_common kernel/locking/rwsem.c:1317 [inline]
__down_write kernel/locking/rwsem.c:1326 [inline]
down_write_nested+0x1b5/0x200 kernel/locking/rwsem.c:1707
inode_lock_nested include/linux/fs.h:1072 [inline]
lock_rename fs/namei.c:3681 [inline]
__start_renaming+0x148/0x410 fs/namei.c:3777
do_renameat2+0x399/0x8e0 fs/namei.c:5991
__do_sys_rename fs/namei.c:6059 [inline]
__se_sys_rename fs/namei.c:6057 [inline]
__x64_sys_rename+0x82/0x90 fs/namei.c:6057
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2425d8f749
RSP: 002b:00007f2426c44038 EFLAGS: 00000246 ORIG_RAX: 0000000000000052
RAX: ffffffffffffffda RBX: 00007f2425fe6090 RCX: 00007f2425d8f749
RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000200000000340
RBP: 00007f2425e13f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f2425fe6128 R14: 00007f2425fe6090 R15: 00007ffcd5a91138
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/31:
#0: ffffffff8df3d980 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8df3d980 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff8df3d980 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
2 locks held by getty/5592:
#0: ffff8880342450a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 drivers/tty/n_tty.c:2222
3 locks held by syz.0.17/6472:
2 locks held by syz.0.17/6473:
#0: ffff88805c19c420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
#1: ffff88805e78e988 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff88805e78e988 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
#1: ffff88805e78e988 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
3 locks held by syz.1.18/6495:
2 locks held by syz.1.18/6496:
#0: ffff88807bbb8420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
#1: ffff888073ef5af8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff888073ef5af8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
#1: ffff888073ef5af8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
5 locks held by syz.2.19/6519:
2 locks held by syz.2.19/6520:
#0: ffff888031634420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
#1: ffff888073e770d0 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff888073e770d0 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
#1: ffff888073e770d0 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
3 locks held by syz.3.20/6552:
2 locks held by syz.3.20/6553:
#0: ffff8880241de420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
#1: ffff888073ee5af8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff888073ee5af8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
#1: ffff888073ee5af8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
3 locks held by syz.4.21/6582:
2 locks held by syz.4.21/6583:
#0: ffff88805dafe420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
#1: ffff88805e78b690 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff88805e78b690 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
#1: ffff88805e78b690 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
3 locks held by syz.5.22/6613:
2 locks held by syz.5.22/6614:
#0: ffff88806d820420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
#1: ffff88805e7dcc68 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff88805e7dcc68 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
#1: ffff88805e7dcc68 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
3 locks held by syz.6.23/6654:
2 locks held by syz.6.23/6655:
#0: ffff888032cd2420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
#1: ffff88805e78f818 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff88805e78f818 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
#1: ffff88805e78f818 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
3 locks held by syz.7.24/6689:
2 locks held by syz.7.24/6690:
#0: ffff88807eda2420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:509
#1: ffff888073e73dd8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff888073e73dd8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3681 [inline]
#1: ffff888073e73dd8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3777
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x135/0x170 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
watchdog+0xfb5/0x1000 kernel/hung_task.c:515
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 6582 Comm: syz.4.21 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:preempt_count arch/x86/include/asm/preempt.h:27 [inline]
RIP: 0010:check_kcov_mode kernel/kcov.c:183 [inline]
RIP: 0010:write_comp_data kernel/kcov.c:246 [inline]
RIP: 0010:__sanitizer_cov_trace_const_cmp4+0x11/0x90 kernel/kcov.c:314
Code: 09 cc 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 8b 04 24 65 48 8b 14 25 08 60 76 92 <65> 8b 0d 68 82 b4 10 81 e1 00 01 ff 00 74 11 81 f9 00 01 00 00 75
RSP: 0018:ffffc900040bf660 EFLAGS: 00000246
RAX: ffffffff82417239 RBX: ffff888073e75268 RCX: df51652e15ac6b00
RDX: ffff888024430000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000000000001 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000817ec0 R12: ffff888073e75268
R13: ffff888073e752e8 R14: dffffc0000000000 R15: 0000000000000003
FS: 00007f2cd1b696c0(0000) GS:ffff888125fba000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055b091e56a38 CR3: 000000003082e000 CR4: 00000000003526f0
Call Trace:
<TASK>
inode_state_read+0x59/0xd0 include/linux/fs.h:888
insert_inode_locked+0x2c8/0x650 fs/inode.c:1873
ntfs_new_inode+0xc8/0x100 fs/ntfs3/fsntfs.c:1675
ntfs_create_inode+0x606/0x32a0 fs/ntfs3/inode.c:1309
ntfs_create+0x3d/0x50 fs/ntfs3/namei.c:110
lookup_open fs/namei.c:4409 [inline]
open_last_lookups fs/namei.c:4509 [inline]
path_openat+0x190f/0x3d90 fs/namei.c:4753
do_filp_open+0x1fa/0x410 fs/namei.c:4783
do_sys_openat2+0x121/0x1c0 fs/open.c:1432
do_sys_open fs/open.c:1447 [inline]
__do_sys_openat fs/open.c:1463 [inline]
__se_sys_openat fs/open.c:1458 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1458
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2cd0d8f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f2cd1b69038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f2cd0fe5fa0 RCX: 00007f2cd0d8f749
RDX: 000000000000275a RSI: 00002000000001c0 RDI: ffffffffffffff9c
RBP: 00007f2cd0e13f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f2cd0fe6038 R14: 00007f2cd0fe5fa0 R15: 00007ffce05c0bc8
</TASK>
Tested on:
commit: d724c6f8 Add linux-next specific files for 20251121
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=17ce797c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=68d11c703cf8e4a0
dashboard link: https://syzkaller.appspot.com/bug?extid=2fefb910d2c20c0698d8
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=10fdf658580000
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [syzbot] [ntfs3?] INFO: task hung in __start_renaming
2025-11-24 7:13 ` syzbot
@ 2025-11-24 7:54 ` Mateusz Guzik
2025-11-24 9:01 ` Mateusz Guzik
0 siblings, 1 reply; 17+ messages in thread
From: Mateusz Guzik @ 2025-11-24 7:54 UTC (permalink / raw)
To: brauner, neil
Cc: agruenba, almaz.alexandrovich, dhowells, gfs2, jack, linux-afs,
linux-fsdevel, linux-kernel, marc.dionne, ntfs3, syzkaller-bugs,
viro, syzbot+2fefb910d2c20c0698d8
On Sun, Nov 23, 2025 at 11:13:03PM -0800, syzbot wrote:
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> INFO: task hung in __start_renaming
>
> INFO: task syz.0.17:6473 blocked for more than 143 seconds.
> Not tainted syzkaller #0
> "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
> task:syz.0.17 state:D stack:27936 pid:6473 tgid:6471 ppid:6352 task_flags:0x400040 flags:0x00080002
> Call Trace:
> <TASK>
> context_switch kernel/sched/core.c:5257 [inline]
> __schedule+0x14bc/0x5030 kernel/sched/core.c:6864
> __schedule_loop kernel/sched/core.c:6946 [inline]
> schedule+0x165/0x360 kernel/sched/core.c:6961
> schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7018
> rwsem_down_write_slowpath+0x872/0xfe0 kernel/locking/rwsem.c:1185
> __down_write_common kernel/locking/rwsem.c:1317 [inline]
> __down_write kernel/locking/rwsem.c:1326 [inline]
> down_write_nested+0x1b5/0x200 kernel/locking/rwsem.c:1707
> inode_lock_nested include/linux/fs.h:1072 [inline]
> lock_rename fs/namei.c:3681 [inline]
> __start_renaming+0x148/0x410 fs/namei.c:3777
> do_renameat2+0x399/0x8e0 fs/namei.c:5991
> __do_sys_rename fs/namei.c:6059 [inline]
> __se_sys_rename fs/namei.c:6057 [inline]
> __x64_sys_rename+0x82/0x90 fs/namei.c:6057
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f2425d8f749
> RSP: 002b:00007f2426c44038 EFLAGS: 00000246 ORIG_RAX: 0000000000000052
> RAX: ffffffffffffffda RBX: 00007f2425fe6090 RCX: 00007f2425d8f749
> RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000200000000340
> RBP: 00007f2425e13f91 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007f2425fe6128 R14: 00007f2425fe6090 R15: 00007ffcd5a91138
> </TASK>
>
So at the end of the day I think this erroneously bisected to my patch.
While it may sound like famous last words, hear me out.
The reproducer fails to trigger the problem on my test jig, thus I
resorted to asking syzbot.
First patch I sent for testing was merely a sanity check -- prior to my
patch inode_unhashed() checks were *always* executing, with my patch
they only happen if I_NEW was spotted. This patch "solved" the problem.
Second patch added some asserts on inode_unhashed() and syzbot had some
internal issues, ultimately it was not tested.
Third patch added even *more* asserts and t0his time around things
failed the previously reported way about half an hour of testing. But if
the first patch indeed solved something, the BUG_ONs would have
triggered instead.
So that's for testing.
In my first response I made a remark in my first reply that ntfs is at
fault. After a quick skim I spotted d_instantiate() instead of
d_instantiate_new() and jumped to conclusions. It calls unlock_new_inode()
later which does the right thing, so it is fine AFAICS.
So what about correctness of my patch?
My patch lifted the go-to-sleep code from inode_wait_for_lru_isolating().
In principle that can be buggy but is just used rarely enough that it
went unnoticed. I don't see anything wrong with it though, including
after comparing it with __wait_on_freeing_inode(). Notably both
synchronize with the ->i_lock. No games played.
I figure maybe there is something fucky going on with ordering on wakeup
side:
inode_state_clear(inode, I_NEW | I_CREATING);
inode_wake_up_bit(inode, __I_NEW);
Going through __wake_up_common_lock takes a spinlock, which on amd64
would have a side effect of publishing that I_NEW store, even ignoring
therest of the ordering.
On going to sleep side to the flag is only ever tested with ->i_lock
held anyway, so it can't be an ordering issue on that front. The thread
could not have been missed from the sleepers list as going to sleep is
again ->i_lock protected, with the lock only dropped around the call to
schedule().
So I don't see how this can be buggy.
At the same time the traces report the thing off cpu is playing around
with rwsems with the __start_renaming et al patchset, while the code for
inode hash manipulation is decidedly *ON* cpu -- reported by NMIs, not
hung test detector.
In principle this still can be a thread hung waiting on I_NEW somewhere,
but syzbot did not produce a collection of backtraces for other threads.
However, given that the __start_renaming et al patchset is complicated
*and* that syzbot could mistakenly report (or not) a bug I'm led to
conclude the reproducer is highly unreliable and my commit landed as a
random victim.
All that said, I think the folk working on that patchset should take
over.
My patch is a minor optimization and can be skipped in this merge window
at no real loss,
My take is that the big patchset *should* be skipped in this merge
window given the above, unless the problem is uickly identified.
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [syzbot] [ntfs3?] INFO: task hung in __start_renaming
2025-11-23 22:44 [syzbot] [ntfs3?] INFO: task hung in __start_renaming syzbot
` (3 preceding siblings ...)
2025-11-24 6:28 ` Mateusz Guzik
@ 2025-11-24 8:07 ` Mateusz Guzik
2025-11-24 8:38 ` syzbot
2025-11-24 8:08 ` Mateusz Guzik
5 siblings, 1 reply; 17+ messages in thread
From: Mateusz Guzik @ 2025-11-24 8:07 UTC (permalink / raw)
To: syzbot
Cc: agruenba, almaz.alexandrovich, brauner, dhowells, gfs2, jack,
linux-afs, linux-fsdevel, linux-kernel, marc.dionne, ntfs3,
syzkaller-bugs, viro
On Sun, Nov 23, 2025 at 02:44:29PM -0800, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: fe4d0dea039f Add linux-next specific files for 20251119
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=142c0514580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=f20a6db7594dcad7
> dashboard link: https://syzkaller.appspot.com/bug?extid=2fefb910d2c20c0698d8
> compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11cd7692580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17615658580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/ce4f26d91a01/disk-fe4d0dea.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/6c9b53acf521/vmlinux-fe4d0dea.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/64d37d01cd64/bzImage-fe4d0dea.xz
> mounted in repro: https://storage.googleapis.com/syzbot-assets/a91529a880b1/mount_0.gz
>
> The issue was bisected to:
>
> commit 1e3c3784221ac86401aea72e2bae36057062fc9c
> Author: Mateusz Guzik <mjguzik@gmail.com>
> Date: Fri Oct 10 22:17:36 2025 +0000
>
> fs: rework I_NEW handling to operate without fences
>
> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=17739742580000
> final oops: https://syzkaller.appspot.com/x/report.txt?x=14f39742580000
> console output: https://syzkaller.appspot.com/x/log.txt?x=10f39742580000
>
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git vfs-6.19.inode
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [syzbot] [ntfs3?] INFO: task hung in __start_renaming
2025-11-23 22:44 [syzbot] [ntfs3?] INFO: task hung in __start_renaming syzbot
` (4 preceding siblings ...)
2025-11-24 8:07 ` Mateusz Guzik
@ 2025-11-24 8:08 ` Mateusz Guzik
2025-11-24 8:57 ` syzbot
5 siblings, 1 reply; 17+ messages in thread
From: Mateusz Guzik @ 2025-11-24 8:08 UTC (permalink / raw)
To: syzbot
Cc: agruenba, almaz.alexandrovich, brauner, dhowells, gfs2, jack,
linux-afs, linux-fsdevel, linux-kernel, marc.dionne, ntfs3,
syzkaller-bugs, viro
On Sun, Nov 23, 2025 at 02:44:29PM -0800, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: fe4d0dea039f Add linux-next specific files for 20251119
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=142c0514580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=f20a6db7594dcad7
> dashboard link: https://syzkaller.appspot.com/bug?extid=2fefb910d2c20c0698d8
> compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11cd7692580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17615658580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/ce4f26d91a01/disk-fe4d0dea.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/6c9b53acf521/vmlinux-fe4d0dea.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/64d37d01cd64/bzImage-fe4d0dea.xz
> mounted in repro: https://storage.googleapis.com/syzbot-assets/a91529a880b1/mount_0.gz
>
> The issue was bisected to:
>
> commit 1e3c3784221ac86401aea72e2bae36057062fc9c
> Author: Mateusz Guzik <mjguzik@gmail.com>
> Date: Fri Oct 10 22:17:36 2025 +0000
>
> fs: rework I_NEW handling to operate without fences
>
> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=17739742580000
> final oops: https://syzkaller.appspot.com/x/report.txt?x=14f39742580000
> console output: https://syzkaller.appspot.com/x/log.txt?x=10f39742580000
>
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git vfs-6.19.directory.locking
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [syzbot] [ntfs3?] INFO: task hung in __start_renaming
2025-11-24 8:07 ` Mateusz Guzik
@ 2025-11-24 8:38 ` syzbot
0 siblings, 0 replies; 17+ messages in thread
From: syzbot @ 2025-11-24 8:38 UTC (permalink / raw)
To: agruenba, almaz.alexandrovich, brauner, dhowells, gfs2, jack,
linux-afs, linux-fsdevel, linux-kernel, marc.dionne, mjguzik,
ntfs3, syzkaller-bugs, viro
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: task hung in do_renameat2
INFO: task syz.0.17:6464 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17 state:D stack:28904 pid:6464 tgid:6455 ppid:6331 task_flags:0x400040 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5325 [inline]
__schedule+0x1798/0x4cc0 kernel/sched/core.c:6929
__schedule_loop kernel/sched/core.c:7011 [inline]
schedule+0x165/0x360 kernel/sched/core.c:7026
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7083
rwsem_down_write_slowpath+0x872/0xfe0 kernel/locking/rwsem.c:1185
__down_write_common kernel/locking/rwsem.c:1317 [inline]
__down_write kernel/locking/rwsem.c:1326 [inline]
down_write_nested+0x1b5/0x200 kernel/locking/rwsem.c:1707
inode_lock_nested include/linux/fs.h:1108 [inline]
lock_rename fs/namei.c:3360 [inline]
do_renameat2+0x3b9/0xa50 fs/namei.c:5311
__do_sys_rename fs/namei.c:5411 [inline]
__se_sys_rename fs/namei.c:5409 [inline]
__x64_sys_rename+0x82/0x90 fs/namei.c:5409
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa97338f749
RSP: 002b:00007fa97416a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000052
RAX: ffffffffffffffda RBX: 00007fa9735e6090 RCX: 00007fa97338f749
RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000200000000340
RBP: 00007fa973413f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa9735e6128 R14: 00007fa9735e6090 R15: 00007ffdbce82b48
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/31:
#0: ffffffff8df3d020 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8df3d020 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff8df3d020 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
3 locks held by kworker/u8:7/1145:
2 locks held by getty/5589:
#0: ffff888033d380a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 drivers/tty/n_tty.c:2222
3 locks held by syz.0.17/6456:
2 locks held by syz.0.17/6464:
#0: ffff88807b846420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:508
#1: ffff888058da6988 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1108 [inline]
#1: ffff888058da6988 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3360 [inline]
#1: ffff888058da6988 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_renameat2+0x3b9/0xa50 fs/namei.c:5311
3 locks held by syz.1.18/6490:
2 locks held by syz.1.18/6491:
#0: ffff88803257c420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:508
#1: ffff888058dae988 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1108 [inline]
#1: ffff888058dae988 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3360 [inline]
#1: ffff888058dae988 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_renameat2+0x3b9/0xa50 fs/namei.c:5311
3 locks held by syz.2.19/6514:
2 locks held by syz.2.19/6515:
#0: ffff88802ef3e420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:508
#1: ffff88807e9ee240 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1108 [inline]
#1: ffff88807e9ee240 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3360 [inline]
#1: ffff88807e9ee240 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_renameat2+0x3b9/0xa50 fs/namei.c:5311
3 locks held by syz.3.20/6543:
2 locks held by syz.3.20/6544:
#0: ffff88802765e420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:508
#1: ffff8880752ee240 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1108 [inline]
#1: ffff8880752ee240 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3360 [inline]
#1: ffff8880752ee240 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_renameat2+0x3b9/0xa50 fs/namei.c:5311
3 locks held by syz.4.21/6573:
2 locks held by syz.4.21/6574:
#0: ffff88805e6f0420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:508
#1: ffff888058dab690 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1108 [inline]
#1: ffff888058dab690 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3360 [inline]
#1: ffff888058dab690 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_renameat2+0x3b9/0xa50 fs/namei.c:5311
3 locks held by syz.5.22/6603:
2 locks held by syz.5.22/6604:
#0: ffff88807572c420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:508
#1: ffff8880752d9970 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1108 [inline]
#1: ffff8880752d9970 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3360 [inline]
#1: ffff8880752d9970 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_renameat2+0x3b9/0xa50 fs/namei.c:5311
3 locks held by syz.6.23/6640:
2 locks held by syz.6.23/6641:
#0: ffff888023ebe420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:508
#1: ffff888075340ae0 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1108 [inline]
#1: ffff888075340ae0 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3360 [inline]
#1: ffff888075340ae0 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_renameat2+0x3b9/0xa50 fs/namei.c:5311
3 locks held by syz.7.24/6671:
2 locks held by syz.7.24/6672:
#0: ffff8880795f0420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:508
#1: ffff88807e9ea0b8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1108 [inline]
#1: ffff88807e9ea0b8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3360 [inline]
#1: ffff88807e9ea0b8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_renameat2+0x3b9/0xa50 fs/namei.c:5311
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:332 [inline]
watchdog+0xf60/0xfa0 kernel/hung_task.c:495
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 6514 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:lockdep_recursion_finish kernel/locking/lockdep.c:470 [inline]
RIP: 0010:lock_is_held_type+0x10b/0x190 kernel/locking/lockdep.c:5941
Code: 0f 95 c0 31 db 39 c5 0f 94 c3 eb 05 bb 01 00 00 00 48 c7 c7 91 26 8f 8d e8 82 16 00 00 b8 ff ff ff ff 65 0f c1 05 85 1a 29 07 <83> f8 01 75 44 48 c7 04 24 00 00 00 00 9c 8f 04 24 f7 04 24 00 02
RSP: 0018:ffffc90003c1f498 EFLAGS: 00000057
RAX: 0000000000000001 RBX: 0000000000000000 RCX: bf125e8550141200
RDX: 0000000000000000 RSI: ffffffff8d8f2691 RDI: ffffffff8bbf0760
RBP: 00000000ffffffff R08: ffffffff8dc16843 R09: 1ffffffff1b82d08
R10: dffffc0000000000 R11: fffffbfff1b82d09 R12: 0000000000000246
R13: ffff88802d930000 R14: ffffffff8df3d080 R15: 0000000000000003
FS: 00007fdcbd6ba6c0(0000) GS:ffff888126240000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c0084c3000 CR3: 0000000077de8000 CR4: 00000000003526f0
Call Trace:
<TASK>
lock_is_held include/linux/lockdep.h:249 [inline]
__might_resched+0xa6/0x610 kernel/sched/core.c:8887
iput+0x2b/0x1050 fs/inode.c:1972
insert_inode_locked+0x32a/0x5d0 fs/inode.c:1874
ntfs_new_inode+0xc8/0x100 fs/ntfs3/fsntfs.c:1681
ntfs_create_inode+0x606/0x32a0 fs/ntfs3/inode.c:1306
ntfs_create+0x3d/0x50 fs/ntfs3/namei.c:110
lookup_open fs/namei.c:3796 [inline]
open_last_lookups fs/namei.c:3895 [inline]
path_openat+0x14f4/0x3830 fs/namei.c:4131
do_filp_open+0x1fa/0x410 fs/namei.c:4161
do_sys_openat2+0x121/0x1c0 fs/open.c:1437
do_sys_open fs/open.c:1452 [inline]
__do_sys_openat fs/open.c:1468 [inline]
__se_sys_openat fs/open.c:1463 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1463
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fdcbc78f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fdcbd6ba038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fdcbc9e5fa0 RCX: 00007fdcbc78f749
RDX: 000000000000275a RSI: 00002000000001c0 RDI: ffffffffffffff9c
RBP: 00007fdcbc813f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fdcbc9e6038 R14: 00007fdcbc9e5fa0 R15: 00007ffddfdb5568
</TASK>
Tested on:
commit: f6fe56e7 fs: push list presence check into inode_io_li..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git vfs-6.19.inode
console output: https://syzkaller.appspot.com/x/log.txt?x=1051797c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=e4d8bca00359e65f
dashboard link: https://syzkaller.appspot.com/bug?extid=2fefb910d2c20c0698d8
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
Note: no patches were applied.
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [syzbot] [ntfs3?] INFO: task hung in __start_renaming
2025-11-24 8:08 ` Mateusz Guzik
@ 2025-11-24 8:57 ` syzbot
0 siblings, 0 replies; 17+ messages in thread
From: syzbot @ 2025-11-24 8:57 UTC (permalink / raw)
To: agruenba, almaz.alexandrovich, brauner, dhowells, gfs2, jack,
linux-afs, linux-fsdevel, linux-kernel, marc.dionne, mjguzik,
ntfs3, syzkaller-bugs, viro
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+2fefb910d2c20c0698d8@syzkaller.appspotmail.com
Tested-by: syzbot+2fefb910d2c20c0698d8@syzkaller.appspotmail.com
Tested on:
commit: 523ac768 Merge patch series "Create and use APIs to ce..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git vfs-6.19.directory.locking
console output: https://syzkaller.appspot.com/x/log.txt?x=168a38b4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=e4d8bca00359e65f
dashboard link: https://syzkaller.appspot.com/bug?extid=2fefb910d2c20c0698d8
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [syzbot] [ntfs3?] INFO: task hung in __start_renaming
2025-11-24 7:54 ` Mateusz Guzik
@ 2025-11-24 9:01 ` Mateusz Guzik
2025-11-24 9:21 ` Mateusz Guzik
0 siblings, 1 reply; 17+ messages in thread
From: Mateusz Guzik @ 2025-11-24 9:01 UTC (permalink / raw)
To: brauner, neil
Cc: agruenba, almaz.alexandrovich, dhowells, gfs2, jack, linux-afs,
linux-fsdevel, linux-kernel, marc.dionne, ntfs3, syzkaller-bugs,
viro, syzbot+2fefb910d2c20c0698d8
sigh, so it *is* my patch, based on syzbot testing specifically on
directory locking vs inode branches, but I don't see why.
I take it the open() codepath took the rwsem, hence the rename is
sleeping. Given that all reproducers find it *on* cpu, it may be this
is busy looping for some reason.
I don't have time to dig more into it right now, so I think it would
be best to *drop* my patch for the time being. Once I figure it out
I'll send a v2.
On Mon, Nov 24, 2025 at 8:54 AM Mateusz Guzik <mjguzik@gmail.com> wrote:
>
> On Sun, Nov 23, 2025 at 11:13:03PM -0800, syzbot wrote:
> > syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> > INFO: task hung in __start_renaming
> >
> > INFO: task syz.0.17:6473 blocked for more than 143 seconds.
> > Not tainted syzkaller #0
> > "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
> > task:syz.0.17 state:D stack:27936 pid:6473 tgid:6471 ppid:6352 task_flags:0x400040 flags:0x00080002
> > Call Trace:
> > <TASK>
> > context_switch kernel/sched/core.c:5257 [inline]
> > __schedule+0x14bc/0x5030 kernel/sched/core.c:6864
> > __schedule_loop kernel/sched/core.c:6946 [inline]
> > schedule+0x165/0x360 kernel/sched/core.c:6961
> > schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7018
> > rwsem_down_write_slowpath+0x872/0xfe0 kernel/locking/rwsem.c:1185
> > __down_write_common kernel/locking/rwsem.c:1317 [inline]
> > __down_write kernel/locking/rwsem.c:1326 [inline]
> > down_write_nested+0x1b5/0x200 kernel/locking/rwsem.c:1707
> > inode_lock_nested include/linux/fs.h:1072 [inline]
> > lock_rename fs/namei.c:3681 [inline]
> > __start_renaming+0x148/0x410 fs/namei.c:3777
> > do_renameat2+0x399/0x8e0 fs/namei.c:5991
> > __do_sys_rename fs/namei.c:6059 [inline]
> > __se_sys_rename fs/namei.c:6057 [inline]
> > __x64_sys_rename+0x82/0x90 fs/namei.c:6057
> > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> > do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
> > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > RIP: 0033:0x7f2425d8f749
> > RSP: 002b:00007f2426c44038 EFLAGS: 00000246 ORIG_RAX: 0000000000000052
> > RAX: ffffffffffffffda RBX: 00007f2425fe6090 RCX: 00007f2425d8f749
> > RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000200000000340
> > RBP: 00007f2425e13f91 R08: 0000000000000000 R09: 0000000000000000
> > R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> > R13: 00007f2425fe6128 R14: 00007f2425fe6090 R15: 00007ffcd5a91138
> > </TASK>
> >
>
> So at the end of the day I think this erroneously bisected to my patch.
> While it may sound like famous last words, hear me out.
>
> The reproducer fails to trigger the problem on my test jig, thus I
> resorted to asking syzbot.
>
> First patch I sent for testing was merely a sanity check -- prior to my
> patch inode_unhashed() checks were *always* executing, with my patch
> they only happen if I_NEW was spotted. This patch "solved" the problem.
>
> Second patch added some asserts on inode_unhashed() and syzbot had some
> internal issues, ultimately it was not tested.
>
> Third patch added even *more* asserts and t0his time around things
> failed the previously reported way about half an hour of testing. But if
> the first patch indeed solved something, the BUG_ONs would have
> triggered instead.
>
> So that's for testing.
>
> In my first response I made a remark in my first reply that ntfs is at
> fault. After a quick skim I spotted d_instantiate() instead of
> d_instantiate_new() and jumped to conclusions. It calls unlock_new_inode()
> later which does the right thing, so it is fine AFAICS.
>
> So what about correctness of my patch?
>
> My patch lifted the go-to-sleep code from inode_wait_for_lru_isolating().
> In principle that can be buggy but is just used rarely enough that it
> went unnoticed. I don't see anything wrong with it though, including
> after comparing it with __wait_on_freeing_inode(). Notably both
> synchronize with the ->i_lock. No games played.
>
> I figure maybe there is something fucky going on with ordering on wakeup
> side:
>
> inode_state_clear(inode, I_NEW | I_CREATING);
> inode_wake_up_bit(inode, __I_NEW);
>
> Going through __wake_up_common_lock takes a spinlock, which on amd64
> would have a side effect of publishing that I_NEW store, even ignoring
> therest of the ordering.
>
> On going to sleep side to the flag is only ever tested with ->i_lock
> held anyway, so it can't be an ordering issue on that front. The thread
> could not have been missed from the sleepers list as going to sleep is
> again ->i_lock protected, with the lock only dropped around the call to
> schedule().
>
> So I don't see how this can be buggy.
>
> At the same time the traces report the thing off cpu is playing around
> with rwsems with the __start_renaming et al patchset, while the code for
> inode hash manipulation is decidedly *ON* cpu -- reported by NMIs, not
> hung test detector.
>
> In principle this still can be a thread hung waiting on I_NEW somewhere,
> but syzbot did not produce a collection of backtraces for other threads.
>
> However, given that the __start_renaming et al patchset is complicated
> *and* that syzbot could mistakenly report (or not) a bug I'm led to
> conclude the reproducer is highly unreliable and my commit landed as a
> random victim.
>
> All that said, I think the folk working on that patchset should take
> over.
>
> My patch is a minor optimization and can be skipped in this merge window
> at no real loss,
>
> My take is that the big patchset *should* be skipped in this merge
> window given the above, unless the problem is uickly identified.
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [syzbot] [ntfs3?] INFO: task hung in __start_renaming
2025-11-24 9:01 ` Mateusz Guzik
@ 2025-11-24 9:21 ` Mateusz Guzik
2025-11-25 9:35 ` Christian Brauner
0 siblings, 1 reply; 17+ messages in thread
From: Mateusz Guzik @ 2025-11-24 9:21 UTC (permalink / raw)
To: brauner, neil
Cc: agruenba, almaz.alexandrovich, dhowells, gfs2, jack, linux-afs,
linux-fsdevel, linux-kernel, marc.dionne, ntfs3, syzkaller-bugs,
viro, syzbot+2fefb910d2c20c0698d8
On Mon, Nov 24, 2025 at 10:01:53AM +0100, Mateusz Guzik wrote:
> sigh, so it *is* my patch, based on syzbot testing specifically on
> directory locking vs inode branches, but I don't see why.
>
> I take it the open() codepath took the rwsem, hence the rename is
> sleeping. Given that all reproducers find it *on* cpu, it may be this
> is busy looping for some reason.
>
> I don't have time to dig more into it right now, so I think it would
> be best to *drop* my patch for the time being. Once I figure it out
> I'll send a v2.
>
good news, now that I gave up I found it.
insert_inode_locked() is looping indefinitely an inode which is no
longer I_NEW or I_CREATING.
In stock kernel:
if (unlikely(!inode_unhashed(old))) {
iput(old);
return -EBUSY;
}
iput(old);
it returns an error
with my patch:
if (isnew) {
wait_on_new_inode(old);
if (unlikely(!inode_unhashed(old))) {
iput(old);
return -EBUSY;
}
}
iput(old);
unhashed status is only ever check if I_NEW was spotted,
which can be false. Afterwards the routine is stuck in endless cycle of
finding the inode and iputting it.
Christian, I think the easiest way out is to add the fix I initially
posted, inlined below. It *was* successfuly tested by syzbot. It retains
inode_unhashed checks even when they are not necessary to avoid any more
surprises.
There were some other changes in the area and turns out sending a v2 for
the patch would result in some merge conflicts, on the other hand the
patch below should be trivial to fold into the existing commit.
Sorry for the spam everyone. :-)
diff --git a/fs/inode.c b/fs/inode.c
index 0f3a56ea8f48..80298f048117 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -1311,12 +1311,11 @@ struct inode *inode_insert5(struct inode *inode, unsigned long hashval,
spin_unlock(&inode_hash_lock);
if (IS_ERR(old))
return NULL;
- if (unlikely(isnew)) {
+ if (unlikely(isnew))
wait_on_new_inode(old);
- if (unlikely(inode_unhashed(old))) {
- iput(old);
- goto again;
- }
+ if (unlikely(inode_unhashed(old))) {
+ iput(old);
+ goto again;
}
return old;
}
@@ -1413,12 +1412,11 @@ struct inode *iget5_locked_rcu(struct super_block *sb, unsigned long hashval,
if (inode) {
if (IS_ERR(inode))
return NULL;
- if (unlikely(isnew)) {
+ if (unlikely(isnew))
wait_on_new_inode(inode);
- if (unlikely(inode_unhashed(inode))) {
- iput(inode);
- goto again;
- }
+ if (unlikely(inode_unhashed(inode))) {
+ iput(inode);
+ goto again;
}
return inode;
}
@@ -1459,12 +1457,11 @@ struct inode *iget_locked(struct super_block *sb, unsigned long ino)
if (inode) {
if (IS_ERR(inode))
return NULL;
- if (unlikely(isnew)) {
+ if (unlikely(isnew))
wait_on_new_inode(inode);
- if (unlikely(inode_unhashed(inode))) {
- iput(inode);
- goto again;
- }
+ if (unlikely(inode_unhashed(inode))) {
+ iput(inode);
+ goto again;
}
return inode;
}
@@ -1501,12 +1498,11 @@ struct inode *iget_locked(struct super_block *sb, unsigned long ino)
if (IS_ERR(old))
return NULL;
inode = old;
- if (unlikely(isnew)) {
+ if (unlikely(isnew))
wait_on_new_inode(inode);
- if (unlikely(inode_unhashed(inode))) {
- iput(inode);
- goto again;
- }
+ if (unlikely(inode_unhashed(inode))) {
+ iput(inode);
+ goto again;
}
}
return inode;
@@ -1648,12 +1644,11 @@ struct inode *ilookup5(struct super_block *sb, unsigned long hashval,
again:
inode = ilookup5_nowait(sb, hashval, test, data, &isnew);
if (inode) {
- if (unlikely(isnew)) {
+ if (unlikely(isnew))
wait_on_new_inode(inode);
- if (unlikely(inode_unhashed(inode))) {
- iput(inode);
- goto again;
- }
+ if (unlikely(inode_unhashed(inode))) {
+ iput(inode);
+ goto again;
}
}
return inode;
@@ -1682,12 +1677,11 @@ struct inode *ilookup(struct super_block *sb, unsigned long ino)
if (inode) {
if (IS_ERR(inode))
return NULL;
- if (unlikely(isnew)) {
+ if (unlikely(isnew))
wait_on_new_inode(inode);
- if (unlikely(inode_unhashed(inode))) {
- iput(inode);
- goto again;
- }
+ if (unlikely(inode_unhashed(inode))) {
+ iput(inode);
+ goto again;
}
}
return inode;
@@ -1863,12 +1857,11 @@ int insert_inode_locked(struct inode *inode)
isnew = !!(inode_state_read(old) & I_NEW);
spin_unlock(&old->i_lock);
spin_unlock(&inode_hash_lock);
- if (isnew) {
+ if (isnew)
wait_on_new_inode(old);
- if (unlikely(!inode_unhashed(old))) {
- iput(old);
- return -EBUSY;
- }
+ if (unlikely(!inode_unhashed(old))) {
+ iput(old);
+ return -EBUSY;
}
iput(old);
}
^ permalink raw reply related [flat|nested] 17+ messages in thread
* Re: [syzbot] [ntfs3?] INFO: task hung in __start_renaming
2025-11-24 9:21 ` Mateusz Guzik
@ 2025-11-25 9:35 ` Christian Brauner
0 siblings, 0 replies; 17+ messages in thread
From: Christian Brauner @ 2025-11-25 9:35 UTC (permalink / raw)
To: Mateusz Guzik
Cc: neil, agruenba, almaz.alexandrovich, dhowells, gfs2, jack,
linux-afs, linux-fsdevel, linux-kernel, marc.dionne, ntfs3,
syzkaller-bugs, viro, syzbot+2fefb910d2c20c0698d8
On Mon, Nov 24, 2025 at 10:21:07AM +0100, Mateusz Guzik wrote:
> On Mon, Nov 24, 2025 at 10:01:53AM +0100, Mateusz Guzik wrote:
> > sigh, so it *is* my patch, based on syzbot testing specifically on
> > directory locking vs inode branches, but I don't see why.
> >
> > I take it the open() codepath took the rwsem, hence the rename is
> > sleeping. Given that all reproducers find it *on* cpu, it may be this
> > is busy looping for some reason.
> >
> > I don't have time to dig more into it right now, so I think it would
> > be best to *drop* my patch for the time being. Once I figure it out
> > I'll send a v2.
> >
>
> good news, now that I gave up I found it.
>
> insert_inode_locked() is looping indefinitely an inode which is no
> longer I_NEW or I_CREATING.
>
> In stock kernel:
> if (unlikely(!inode_unhashed(old))) {
> iput(old);
> return -EBUSY;
> }
> iput(old);
>
> it returns an error
>
> with my patch:
> if (isnew) {
> wait_on_new_inode(old);
> if (unlikely(!inode_unhashed(old))) {
> iput(old);
> return -EBUSY;
> }
> }
> iput(old);
>
> unhashed status is only ever check if I_NEW was spotted,
>
> which can be false. Afterwards the routine is stuck in endless cycle of
> finding the inode and iputting it.
>
> Christian, I think the easiest way out is to add the fix I initially
> posted, inlined below. It *was* successfuly tested by syzbot. It retains
> inode_unhashed checks even when they are not necessary to avoid any more
> surprises.
Thanks for tracking this down. Now folded.
^ permalink raw reply [flat|nested] 17+ messages in thread
end of thread, other threads:[~2025-11-25 9:35 UTC | newest]
Thread overview: 17+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-11-23 22:44 [syzbot] [ntfs3?] INFO: task hung in __start_renaming syzbot
2025-11-23 23:29 ` Mateusz Guzik
2025-11-23 23:30 ` Mateusz Guzik
2025-11-24 0:27 ` Mateusz Guzik
2025-11-24 0:57 ` syzbot
2025-11-24 3:29 ` Mateusz Guzik
2025-11-24 4:47 ` syzbot
2025-11-24 6:28 ` Mateusz Guzik
2025-11-24 7:13 ` syzbot
2025-11-24 7:54 ` Mateusz Guzik
2025-11-24 9:01 ` Mateusz Guzik
2025-11-24 9:21 ` Mateusz Guzik
2025-11-25 9:35 ` Christian Brauner
2025-11-24 8:07 ` Mateusz Guzik
2025-11-24 8:38 ` syzbot
2025-11-24 8:08 ` Mateusz Guzik
2025-11-24 8:57 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).