[syzbot] [ntfs3?] possible deadlock in indx_read

From: syzbot
Date: Sat Oct 28 2023 - 18:43:35 EST

Next message: Bart Van Assche: "Re: [PATCH RFC 1/2] RDMA/rxe: don't allow registering !PAGE_SIZE mr"
Previous message: kernel test robot: "[tip:irq/core] BUILD SUCCESS f99b926f6543faeadba1b4524d8dc9c102489135"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hello,

syzbot found the following issue on:

HEAD commit: f017d9a92a73 Add linux-next specific files for 20231024
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=114f9135680000
kernel config: https://syzkaller.appspot.com/x/.config?x=8fd5ab06ad389b6f
dashboard link: https://syzkaller.appspot.com/bug?extid=1e19c0a6b5e324635721
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/feca2ffa52fd/disk-f017d9a9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/c2643e9e7d02/vmlinux-f017d9a9.xz
kernel image: https://storage.googleapis.com/syzbot-assets/7492edb5b60c/bzImage-f017d9a9.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1e19c0a6b5e324635721@xxxxxxxxxxxxxxxxxxxxxxxxx

======================================================
WARNING: possible circular locking dependency detected
6.6.0-rc7-next-20231024-syzkaller #0 Not tainted
------------------------------------------------------
kworker/u4:0/24418 is trying to acquire lock:
ffff888039a1e1c0 (&indx->run_lock){.+.+}-{3:3}, at: indx_read+0x251/0xcd0 fs/ntfs3/index.c:1066

but task is already holding lock:
ffff888039a1e0e0 (&ni->ni_lock#2){+.+.}-{3:3}, at: ni_trylock fs/ntfs3/ntfs_fs.h:1144 [inline]
ffff888039a1e0e0 (&ni->ni_lock#2){+.+.}-{3:3}, at: ni_update_parent fs/ntfs3/frecord.c:3230 [inline]
ffff888039a1e0e0 (&ni->ni_lock#2){+.+.}-{3:3}, at: ni_write_inode+0x15a4/0x2850 fs/ntfs3/frecord.c:3321

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #4 (&ni->ni_lock#2){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:603 [inline]
__mutex_lock+0x181/0x1330 kernel/locking/mutex.c:747
ntfs_set_state+0x1d2/0x6a0 fs/ntfs3/fsntfs.c:946
ni_remove_name+0x2ff/0x670 fs/ntfs3/frecord.c:2926
ntfs_unlink_inode+0x37a/0x740 fs/ntfs3/inode.c:1772
ntfs_rename+0x387/0xec0 fs/ntfs3/namei.c:288
vfs_rename+0xe20/0x1c30 fs/namei.c:4843
do_renameat2+0xc3c/0xdc0 fs/namei.c:4995
__do_sys_rename fs/namei.c:5041 [inline]
__se_sys_rename fs/namei.c:5039 [inline]
__x64_sys_rename+0x81/0xa0 fs/namei.c:5039
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x62/0x6a

-> #3 (&ni->ni_lock#2/4){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:603 [inline]
__mutex_lock+0x181/0x1330 kernel/locking/mutex.c:747
ni_lock fs/ntfs3/ntfs_fs.h:1124 [inline]
ntfs_fallocate+0x73d/0x1260 fs/ntfs3/file.c:499
vfs_fallocate+0x46c/0xe50 fs/open.c:324
ksys_fallocate fs/open.c:347 [inline]
__do_sys_fallocate fs/open.c:355 [inline]
__se_sys_fallocate fs/open.c:353 [inline]
__x64_sys_fallocate+0xd5/0x140 fs/open.c:353
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x62/0x6a

-> #2 (mapping.invalidate_lock#5){++++}-{3:3}:
down_read+0x9c/0x470 kernel/locking/rwsem.c:1526
filemap_invalidate_lock_shared include/linux/fs.h:857 [inline]
filemap_fault+0x28c/0x3570 mm/filemap.c:3225
__do_fault+0x107/0x5f0 mm/memory.c:4268
do_read_fault mm/memory.c:4631 [inline]
do_fault mm/memory.c:4765 [inline]
do_pte_missing mm/memory.c:3733 [inline]
handle_pte_fault mm/memory.c:5041 [inline]
__handle_mm_fault+0x2682/0x3d60 mm/memory.c:5182
handle_mm_fault+0x474/0x9f0 mm/memory.c:5347
faultin_page mm/gup.c:956 [inline]
__get_user_pages+0x4b1/0x1480 mm/gup.c:1239
populate_vma_page_range+0x2d4/0x410 mm/gup.c:1677
__mm_populate+0x1d6/0x380 mm/gup.c:1786
mm_populate include/linux/mm.h:3379 [inline]
vm_mmap_pgoff+0x2cc/0x3b0 mm/util.c:551
ksys_mmap_pgoff+0x421/0x5a0 mm/mmap.c:1428
__do_sys_mmap arch/x86/kernel/sys_x86_64.c:93 [inline]
__se_sys_mmap arch/x86/kernel/sys_x86_64.c:86 [inline]
__x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:86
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x62/0x6a

-> #1 (&mm->mmap_lock){++++}-{3:3}:
__might_fault mm/memory.c:5958 [inline]
__might_fault+0x11b/0x190 mm/memory.c:5951
_copy_to_user+0x2b/0xb0 lib/usercopy.c:36
copy_to_user include/linux/uaccess.h:191 [inline]
fiemap_fill_next_extent+0x232/0x380 fs/ioctl.c:145
ni_fiemap+0x440/0xc00 fs/ntfs3/frecord.c:2065
ntfs_fiemap+0xc9/0x110 fs/ntfs3/file.c:1164
ioctl_fiemap fs/ioctl.c:220 [inline]
do_vfs_ioctl+0x339/0x1920 fs/ioctl.c:811
__do_sys_ioctl fs/ioctl.c:869 [inline]
__se_sys_ioctl fs/ioctl.c:857 [inline]
__x64_sys_ioctl+0x112/0x210 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x62/0x6a

-> #0 (&indx->run_lock){.+.+}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x2e22/0x5dc0 kernel/locking/lockdep.c:5136
lock_acquire kernel/locking/lockdep.c:5753 [inline]
lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718
down_read+0x9c/0x470 kernel/locking/rwsem.c:1526
indx_read+0x251/0xcd0 fs/ntfs3/index.c:1066
indx_find+0x4a9/0x980 fs/ntfs3/index.c:1181
indx_update_dup+0x166/0x440 fs/ntfs3/index.c:2659
ni_update_parent fs/ntfs3/frecord.c:3233 [inline]
ni_write_inode+0x1650/0x2850 fs/ntfs3/frecord.c:3321
write_inode fs/fs-writeback.c:1473 [inline]
__writeback_single_inode+0xa84/0xe60 fs/fs-writeback.c:1690
writeback_sb_inodes+0x5a2/0x1090 fs/fs-writeback.c:1916
__writeback_inodes_wb+0xff/0x2d0 fs/fs-writeback.c:1987
wb_writeback+0x7fe/0xaa0 fs/fs-writeback.c:2094
wb_check_old_data_flush fs/fs-writeback.c:2198 [inline]
wb_do_writeback fs/fs-writeback.c:2251 [inline]
wb_workfn+0x9f8/0xfd0 fs/fs-writeback.c:2279
process_one_work+0x8a2/0x15e0 kernel/workqueue.c:2630
process_scheduled_works kernel/workqueue.c:2703 [inline]
worker_thread+0x8b6/0x1280 kernel/workqueue.c:2784
kthread+0x337/0x440 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242

other info that might help us debug this:

Chain exists of:
&indx->run_lock --> &ni->ni_lock#2/4 --> &ni->ni_lock#2

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(&ni->ni_lock#2);
lock(&ni->ni_lock#2/4);
lock(&ni->ni_lock#2);
rlock(&indx->run_lock);

*** DEADLOCK ***

5 locks held by kworker/u4:0/24418:
#0: ffff88814226d938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work+0x78a/0x15e0 kernel/workqueue.c:2605
#1: ffffc9000326fd80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work+0x7f4/0x15e0 kernel/workqueue.c:2606
#2: ffff888030fde0e0 (&type->s_umount_key#65){++++}-{3:3}, at: super_trylock_shared+0x1e/0xf0 fs/super.c:610
#3: ffff888039a1e840 (&ni->ni_lock#2){+.+.}-{3:3}, at: ni_trylock fs/ntfs3/ntfs_fs.h:1144 [inline]
#3: ffff888039a1e840 (&ni->ni_lock#2){+.+.}-{3:3}, at: ni_write_inode+0x1c6/0x2850 fs/ntfs3/frecord.c:3262
#4: ffff888039a1e0e0 (&ni->ni_lock#2){+.+.}-{3:3}, at: ni_trylock fs/ntfs3/ntfs_fs.h:1144 [inline]
#4: ffff888039a1e0e0 (&ni->ni_lock#2){+.+.}-{3:3}, at: ni_update_parent fs/ntfs3/frecord.c:3230 [inline]
#4: ffff888039a1e0e0 (&ni->ni_lock#2){+.+.}-{3:3}, at: ni_write_inode+0x15a4/0x2850 fs/ntfs3/frecord.c:3321

stack backtrace:
CPU: 1 PID: 24418 Comm: kworker/u4:0 Not tainted 6.6.0-rc7-next-20231024-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023
Workqueue: writeback wb_workfn (flush-7:4)
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
check_noncircular+0x310/0x3f0 kernel/locking/lockdep.c:2187
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain kernel/locking/lockdep.c:3868 [inline]
__lock_acquire+0x2e22/0x5dc0 kernel/locking/lockdep.c:5136
lock_acquire kernel/locking/lockdep.c:5753 [inline]
lock_acquire+0x1b1/0x530 kernel/locking/lockdep.c:5718
down_read+0x9c/0x470 kernel/locking/rwsem.c:1526
indx_read+0x251/0xcd0 fs/ntfs3/index.c:1066
indx_find+0x4a9/0x980 fs/ntfs3/index.c:1181
indx_update_dup+0x166/0x440 fs/ntfs3/index.c:2659
ni_update_parent fs/ntfs3/frecord.c:3233 [inline]
ni_write_inode+0x1650/0x2850 fs/ntfs3/frecord.c:3321
write_inode fs/fs-writeback.c:1473 [inline]
__writeback_single_inode+0xa84/0xe60 fs/fs-writeback.c:1690
writeback_sb_inodes+0x5a2/0x1090 fs/fs-writeback.c:1916
__writeback_inodes_wb+0xff/0x2d0 fs/fs-writeback.c:1987
wb_writeback+0x7fe/0xaa0 fs/fs-writeback.c:2094
wb_check_old_data_flush fs/fs-writeback.c:2198 [inline]
wb_do_writeback fs/fs-writeback.c:2251 [inline]
wb_workfn+0x9f8/0xfd0 fs/fs-writeback.c:2279
process_one_work+0x8a2/0x15e0 kernel/workqueue.c:2630
process_scheduled_works kernel/workqueue.c:2703 [inline]
worker_thread+0x8b6/0x1280 kernel/workqueue.c:2784
kthread+0x337/0x440 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
</TASK>

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@xxxxxxxxxxxxxxxx.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Next message: Bart Van Assche: "Re: [PATCH RFC 1/2] RDMA/rxe: don't allow registering !PAGE_SIZE mr"
Previous message: kernel test robot: "[tip:irq/core] BUILD SUCCESS f99b926f6543faeadba1b4524d8dc9c102489135"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]