task hung in xlog_grant_head_check - still reproducible on 7.2-rc7 (2018 report went dormant)

[杨贵琨]

Hello,

syzbot reported "INFO: task hung in xlog_grant_head_check" back in May

2018 [1][2]; the tracker entry has been dormant (no-reminders) for years

and the cause bisection was inconclusive.

While fuzzing current mainline (7.2.0-rc7-00232-gdcb68831eac7) with

syzkaller I hit the same hang again, and syzkaller minimized it to just

two syscalls: mount a crafted XFS image (v5, small log) and issue one

setxattr("security.ima", ..., size=0xfffe):

syz_mount_image$xfs(..., './file0', ..., image)

setxattr$security_ima('./file0', 'security.ima',

      {sha1, ...}, 0xfffe, 0)

INFO: task syz.0.17:10462 blocked for more than 143 seconds.

Call Trace:

__schedule+0x12e4/0x64e0

schedule+0xe7/0x2d0

xlog_grant_head_wait+0x13f/0xd00 fs/xfs/xfs_log.c:217

xlog_grant_head_check+0x48f/0x4e0 fs/xfs/xfs_log.c:279

xfs_log_reserve+0x2d2/0x850 fs/xfs/xfs_log.c:387

xfs_trans_reserve fs/xfs/trans.c:174 [inline]

xfs_trans_alloc+0x3c5/0xd40 fs/xfs/xfs_trans.c:256

xfs_trans_alloc_inode+0x198/0x3b0 fs/xfs/xfs_trans.c:1080

xfs_attr_set+0x40b/0x10f0 fs/xfs/libxfs/xfs_attr.c:1184

xfs_attr_change+0x379/0x500 fs/xfs/xfs_xattr.c:128

...

__x64_sys_setxattr+0xc6/0x140 fs/xattr.c:764

The 64 KB xattr value forces a transaction larger than the log of the

crafted image can ever satisfy, and xlog_grant_head_wait() then waits

forever - the task is not killable and eventually trips the hung-task

detector.

So this looks like an unbounded/unkillable wait rather than something

that resolves with log tail pushing: with a transaction reservation

larger than the total log size, no amount of tail progress can ever

grant it.  If that analysis holds, a reservation-size sanity check

(xlog_grant_head_check refusing reservations > usable log size, or the

attr code splitting such transactions further) would turn the hang into

a clean -ENOSPC.

Full syzkaller reproducer (image + program) and logs available on

request.

Kernel: stock mainline 7.2.0-rc7-00232-gdcb68831eac7, syzkaller's

upstream KASAN config.

[1] https://lwn.net/Articles/755633/

[2] https://lkml.org/lkml/2018/5/22/1056 (Dave Chinner's analysis of the

    grant head wait logic, 2018)

Found-by: syzkaller on linux-7.2.0-rc7-00232-gdcb68831eac7

Attachment: 3_xlog.zip
Description: Zip compressed data