Re: [syzbot] [ext4?] possible deadlock in ext4_truncate
From: Dave Chinner
Date: Thu Dec 12 2024 - 18:40:56 EST
On Fri, Dec 06, 2024 at 09:42:23PM -0800, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: cdd30ebb1b9f module: Convert symbol namespace to string li..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=15898330580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=50c7a61469ce77e7
> dashboard link: https://syzkaller.appspot.com/bug?extid=449c80b8f4946f26184b
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
>
> Unfortunately, I don't have any reproducer for this issue yet.
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/658bd206f462/disk-cdd30ebb.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/12cb86080d87/vmlinux-cdd30ebb.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/5181aac6587a/bzImage-cdd30ebb.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+449c80b8f4946f26184b@xxxxxxxxxxxxxxxxxxxxxxxxx
>
> ======================================================
> WARNING: possible circular locking dependency detected
> 6.13.0-rc1-syzkaller-00002-gcdd30ebb1b9f #0 Not tainted
> ------------------------------------------------------
> syz-executor/11503 is trying to acquire lock:
> ffff88807abcdbb0 (&ei->i_data_sem){++++}-{4:4}, at: ext4_truncate+0x994/0x11c0 fs/ext4/inode.c:4212
>
> but task is already holding lock:
> ffff888034d3a610 (sb_internal){++++}-{0:0}, at: __sb_start_write include/linux/fs.h:1725 [inline]
> ffff888034d3a610 (sb_internal){++++}-{0:0}, at: sb_start_intwrite include/linux/fs.h:1908 [inline]
> ffff888034d3a610 (sb_internal){++++}-{0:0}, at: ext4_evict_inode+0x2f4/0xf50 fs/ext4/inode.c:217
>
> which lock already depends on the new lock.
>
>
> the existing dependency chain (in reverse order) is:
>
> -> #7 (sb_internal){++++}-{0:0}:
> lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
> percpu_down_write+0x54/0x310 kernel/locking/percpu-rwsem.c:229
> sb_wait_write fs/super.c:1910 [inline]
> freeze_super+0x7cc/0xee0 fs/super.c:2118
> fs_bdev_freeze+0x1ac/0x320 fs/super.c:1484
> bdev_freeze+0xd8/0x220 block/bdev.c:257
> ext4_force_shutdown+0x319/0x550 fs/ext4/ioctl.c:822
> ext4_ioctl_shutdown fs/ext4/ioctl.c:857 [inline]
> __ext4_ioctl fs/ext4/ioctl.c:1580 [inline]
> ext4_ioctl+0x2145/0x58d0 fs/ext4/ioctl.c:1619
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:906 [inline]
> __se_sys_ioctl+0xf7/0x170 fs/ioctl.c:892
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> -> #6 (sb_pagefaults){++++}-{0:0}:
> lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
> percpu_down_read+0x44/0x1b0 include/linux/percpu-rwsem.h:51
> __sb_start_write include/linux/fs.h:1725 [inline]
> sb_start_pagefault include/linux/fs.h:1890 [inline]
> ext4_page_mkwrite+0x1ef/0xdf0 fs/ext4/inode.c:6158
> do_page_mkwrite+0x19a/0x480 mm/memory.c:3176
> do_shared_fault mm/memory.c:5398 [inline]
> do_fault mm/memory.c:5460 [inline]
> do_pte_missing mm/memory.c:3979 [inline]
> handle_pte_fault+0x1235/0x68a0 mm/memory.c:5801
> __handle_mm_fault mm/memory.c:5944 [inline]
> handle_mm_fault+0x1106/0x1bb0 mm/memory.c:6112
> do_user_addr_fault arch/x86/mm/fault.c:1389 [inline]
> handle_page_fault arch/x86/mm/fault.c:1481 [inline]
> exc_page_fault+0x2b9/0x8b0 arch/x86/mm/fault.c:1539
> asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
>
> -> #5 (&mm->mmap_lock){++++}-{4:4}:
> lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
> __might_fault+0xc6/0x120 mm/memory.c:6751
> _inline_copy_from_user include/linux/uaccess.h:162 [inline]
> _copy_from_user+0x2a/0xc0 lib/usercopy.c:18
> copy_from_user include/linux/uaccess.h:212 [inline]
> __blk_trace_setup kernel/trace/blktrace.c:626 [inline]
> blk_trace_ioctl+0x1ad/0x9a0 kernel/trace/blktrace.c:740
> blkdev_ioctl+0x40c/0x6a0 block/ioctl.c:682
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:906 [inline]
> __se_sys_ioctl+0xf7/0x170 fs/ioctl.c:892
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
#syz dup: possible deadlock in xfs_vn_update_time
--
Dave Chinner
david@xxxxxxxxxxxxx