Re: [syzbot] [overlayfs?] WARNING in shmem_unlink (2)

[Hillf Danton <hdanton@sina.com>]

On Fri, 28 Nov 2025 08:42:08 +1100 NeilBrown wrote:
> On Fri, 28 Nov 2025, syzbot wrote:
> > Hello,
> > 
> > syzbot found the following issue on:
> > 
> > HEAD commit:    30f09200cc4a Merge tag 'arm64-fixes' of git://git.kernel.o..
> > git tree:       upstream
> > console output: https://syzkaller.appspot.com/x/log.txt?x=1047ee92580000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=38a0c4cddc846161
> > dashboard link: https://syzkaller.appspot.com/bug?extid=bfc9a0ccf0de47d04e8c
> > compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1626ae12580000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1126ae12580000
> > 
> > Downloadable assets:
> > disk image: https://storage.googleapis.com/syzbot-assets/a5630d1ab1eb/disk-30f09200.raw.xz
> > vmlinux: https://storage.googleapis.com/syzbot-assets/584408ed3fcf/vmlinux-30f09200.xz
> > kernel image: https://storage.googleapis.com/syzbot-assets/69749e493b1e/bzImage-30f09200.xz
> > 
> > The issue was bisected to:
> > 
> > commit d2c995581c7c5d0ff623b2700e76bf22499c66df
> > Author: NeilBrown <neil@brown.name>
> > Date:   Wed Jul 16 00:44:14 2025 +0000
> > 
> >     ovl: Call ovl_create_temp() without lock held.
> > 
> > bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=13db1e92580000
> > final oops:     https://syzkaller.appspot.com/x/report.txt?x=103b1e92580000
> > console output: https://syzkaller.appspot.com/x/log.txt?x=17db1e92580000
> > 
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+bfc9a0ccf0de47d04e8c@syzkaller.appspotmail.com
> > Fixes: d2c995581c7c ("ovl: Call ovl_create_temp() without lock held.")
> 
> I think this was probably fixed by 
> Commit 1f480a181137 ("Add start_renaming_two_dentries()")
> 
> That patch replaced the call to ovl_lock_rename_workdir()
> with start_renaming_two_dentries()
> The new function checks that the two dentries are still hashed.
> 
> ovl_lock_rename_workdir() should have been changed to check
> that the dentries were still hashed before that patch that
> the bisect found which changed the locking in ovl_cleanup_and_whiteout.
> 
> Can you please confirm the bug no longer exists after that patch?
>
#syz test upstream master