syzbot


possible deadlock in acct_pin_kill

Status: fixed on 2019/06/14 18:22
Reported-by: syzbot+2a73a6ea9507b7112141@syzkaller.appspotmail.com
Fix commit: 9419a3191dcb acct_on(): don't mess with freeze protection
First crash: 2037d, last: 1816d
Cause bisection: introduced by (bisect log) :
commit e950564b97fd0f541b02eb207685d0746f5ecf29
Author: Miklos Szeredi <mszeredi@redhat.com>
Date: Tue Jul 24 13:01:55 2018 +0000

  vfs: don't evict uninitialized inode

Crash: BUG: corrupted list in inode_insert5 (log)
Repro: C syz .config
  
Discussions (5)
Title Replies (including bot) Last reply
[PATCH 4.19 000/276] 4.19.47-stable review 304 (304) 2019/06/06 19:22
[PATCH 5.0 000/346] 5.0.20-stable review 355 (355) 2019/05/31 14:18
[PATCH 5.1 000/405] 5.1.6-stable review 414 (414) 2019/05/31 14:16
possible deadlock in acct_pin_kill 3 (8) 2019/04/19 07:52
[PATCH v2] acct: fix possible deadlock in acct_pin_kill 7 (7) 2019/04/11 19:10
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 possible deadlock in acct_pin_kill C done 125 1796d 1831d 1/1 fixed on 2019/11/30 21:02
Last patch testing requests (1)
Created Duration User Patch Repo Result
2019/03/27 07:16 18m amir73il@gmail.com https://github.com/amir73il/linux.git acct_pin_kill_deadlock OK

Sample crash report:
======================================================
WARNING: possible circular locking dependency detected
5.1.0-rc6+ #88 Not tainted
------------------------------------------------------
syz-executor968/8248 is trying to acquire lock:
00000000c67275e3 (&acct->lock#2){+.+.}, at: acct_pin_kill+0x27/0x100 kernel/acct.c:173

but task is already holding lock:
0000000004ad978d (sb_writers#4){.+.+}, at: sb_start_write include/linux/fs.h:1621 [inline]
0000000004ad978d (sb_writers#4){.+.+}, at: mnt_want_write+0x3f/0xc0 fs/namespace.c:358

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #2 (sb_writers#4){.+.+}:
       lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:4211
       percpu_down_read include/linux/percpu-rwsem.h:36 [inline]
       __sb_start_write+0x20b/0x360 fs/super.c:1613
       file_start_write include/linux/fs.h:2825 [inline]
       ovl_write_iter+0x91b/0xc20 fs/overlayfs/file.c:243
       call_write_iter include/linux/fs.h:1866 [inline]
       new_sync_write+0x4c7/0x760 fs/read_write.c:474
       __vfs_write+0xe4/0x110 fs/read_write.c:487
       __kernel_write+0x110/0x3b0 fs/read_write.c:506
       do_acct_process+0xd37/0x1150 kernel/acct.c:520
       slow_acct_process kernel/acct.c:579 [inline]
       acct_process+0x568/0x61e kernel/acct.c:605
       do_exit+0x17bd/0x2fa0 kernel/exit.c:866
       do_group_exit+0x135/0x370 kernel/exit.c:980
       get_signal+0x399/0x1d50 kernel/signal.c:2577
       do_signal+0x87/0x1940 arch/x86/kernel/signal.c:816
       exit_to_usermode_loop+0x244/0x2c0 arch/x86/entry/common.c:162
       prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
       syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
       do_syscall_64+0x52d/0x610 arch/x86/entry/common.c:293
       entry_SYSCALL_64_after_hwframe+0x49/0xbe

-> #1 (&ovl_i_mutex_key[depth]){+.+.}:
       lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:4211
       down_write+0x38/0x90 kernel/locking/rwsem.c:70
       inode_lock include/linux/fs.h:772 [inline]
       ovl_write_iter+0x148/0xc20 fs/overlayfs/file.c:231
       call_write_iter include/linux/fs.h:1866 [inline]
       new_sync_write+0x4c7/0x760 fs/read_write.c:474
       __vfs_write+0xe4/0x110 fs/read_write.c:487
       __kernel_write+0x110/0x3b0 fs/read_write.c:506
       do_acct_process+0xd37/0x1150 kernel/acct.c:520
       slow_acct_process kernel/acct.c:579 [inline]
       acct_process+0x568/0x61e kernel/acct.c:605
       do_exit+0x17bd/0x2fa0 kernel/exit.c:866
       do_group_exit+0x135/0x370 kernel/exit.c:980
       get_signal+0x399/0x1d50 kernel/signal.c:2577
       do_signal+0x87/0x1940 arch/x86/kernel/signal.c:816
       exit_to_usermode_loop+0x244/0x2c0 arch/x86/entry/common.c:162
       prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
       syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
       do_syscall_64+0x52d/0x610 arch/x86/entry/common.c:293
       entry_SYSCALL_64_after_hwframe+0x49/0xbe

-> #0 (&acct->lock#2){+.+.}:
       check_prevs_add kernel/locking/lockdep.c:2333 [inline]
       validate_chain kernel/locking/lockdep.c:2714 [inline]
       __lock_acquire+0x239c/0x3fb0 kernel/locking/lockdep.c:3701
       lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:4211
       __mutex_lock_common kernel/locking/mutex.c:925 [inline]
       __mutex_lock+0xf7/0x1310 kernel/locking/mutex.c:1072
       mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
       acct_pin_kill+0x27/0x100 kernel/acct.c:173
       pin_kill+0x18f/0x860 fs/fs_pin.c:50
       acct_on+0x574/0x790 kernel/acct.c:254
       __do_sys_acct kernel/acct.c:286 [inline]
       __se_sys_acct kernel/acct.c:273 [inline]
       __x64_sys_acct+0xae/0x200 kernel/acct.c:273
       do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
       entry_SYSCALL_64_after_hwframe+0x49/0xbe

other info that might help us debug this:

Chain exists of:
  &acct->lock#2 --> &ovl_i_mutex_key[depth] --> sb_writers#4

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(sb_writers#4);
                               lock(&ovl_i_mutex_key[depth]);
                               lock(sb_writers#4);
  lock(&acct->lock#2);

 *** DEADLOCK ***

2 locks held by syz-executor968/8248:
 #0: 000000001559d3a8 (acct_on_mutex){+.+.}, at: __do_sys_acct kernel/acct.c:285 [inline]
 #0: 000000001559d3a8 (acct_on_mutex){+.+.}, at: __se_sys_acct kernel/acct.c:273 [inline]
 #0: 000000001559d3a8 (acct_on_mutex){+.+.}, at: __x64_sys_acct+0xa6/0x200 kernel/acct.c:273
 #1: 0000000004ad978d (sb_writers#4){.+.+}, at: sb_start_write include/linux/fs.h:1621 [inline]
 #1: 0000000004ad978d (sb_writers#4){.+.+}, at: mnt_want_write+0x3f/0xc0 fs/namespace.c:358

stack backtrace:
CPU: 0 PID: 8248 Comm: syz-executor968 Not tainted 5.1.0-rc6+ #88
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 print_circular_bug.isra.0.cold+0x1cc/0x28f kernel/locking/lockdep.c:1571
 check_prev_add.constprop.0+0xf11/0x23c0 kernel/locking/lockdep.c:2220
 check_prevs_add kernel/locking/lockdep.c:2333 [inline]
 validate_chain kernel/locking/lockdep.c:2714 [inline]
 __lock_acquire+0x239c/0x3fb0 kernel/locking/lockdep.c:3701
 lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:4211
 __mutex_lock_common kernel/locking/mutex.c:925 [inline]
 __mutex_lock+0xf7/0x1310 kernel/locking/mutex.c:1072
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
 acct_pin_kill+0x27/0x100 kernel/acct.c:173
 pin_kill+0x18f/0x860 fs/fs_pin.c:50
 acct_on+0x574/0x790 kernel/acct.c:254
 __do_sys_acct kernel/acct.c:286 [inline]
 __se_sys_acct kernel/acct.c:273 [inline]
 __x64_sys_acct+0xae/0x200 kernel/acct.c:273
 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x446819
Code: e8 5c b3 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 0b 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f536ce50db8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a3
RAX: ffffffffffffffda RBX: 00000000006dbc28 RCX: 0000000000446819
RDX: 0000000000446819 RSI: 0000000000000000 RDI: 0000000020000000
RBP: 00000000006dbc20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dbc2c
R13: 00007ffe54efe82f R14: 00007f536ce519c0 R15: 20c49ba5e353f7cf

Crashes (273):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/04/28 03:49 upstream 037904a22bf8 b617407b .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/04/28 03:45 upstream 037904a22bf8 b617407b .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/04/28 01:57 upstream 037904a22bf8 b617407b .config console log report syz C ci-upstream-kasan-gce-root
2019/04/19 23:41 upstream 55e3a6ba5cce b0e8efcb .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/04/19 22:12 upstream 3ecafda911f4 b0e8efcb .config console log report syz C ci-upstream-kasan-gce-root
2019/04/18 22:12 upstream e53f31bffe1d b0e8efcb .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/04/18 21:52 upstream e53f31bffe1d b0e8efcb .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/04/18 21:42 upstream e53f31bffe1d b0e8efcb .config console log report syz C ci-upstream-kasan-gce-root
2019/04/18 14:57 upstream e53f31bffe1d b0e8efcb .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/04/18 13:40 upstream e53f31bffe1d b0e8efcb .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/04/18 13:36 upstream e53f31bffe1d b0e8efcb .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/04/18 12:51 upstream e53f31bffe1d b0e8efcb .config console log report syz C ci-upstream-kasan-gce-root
2019/04/18 04:16 upstream fe5cdef29e41 b0e8efcb .config console log report syz C ci-upstream-kasan-gce-selinux-root
2018/11/20 07:59 upstream f2ce1065e767 9bc2a903 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2018/11/20 03:40 upstream f2ce1065e767 adf636a8 .config console log report syz C ci-upstream-kasan-gce-root
2018/11/20 02:51 upstream f2ce1065e767 adf636a8 .config console log report syz C ci-upstream-kasan-gce-smack-root
2018/11/16 10:50 upstream da5322e65940 f5e275d1 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2018/11/16 09:17 upstream da5322e65940 f5e275d1 .config console log report syz C ci-upstream-kasan-gce-smack-root
2018/11/20 03:22 linux-next 442b8cea2477 adf636a8 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/04/18 04:11 upstream fe5cdef29e41 b0e8efcb .config console log report syz ci-upstream-kasan-gce-smack-root
2019/04/18 04:09 upstream fe5cdef29e41 b0e8efcb .config console log report syz ci-upstream-kasan-gce-root
2018/11/16 04:46 upstream da5322e65940 3a41052e .config console log report syz ci-upstream-kasan-gce-root
2018/11/16 09:01 linux-next 442b8cea2477 f5e275d1 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/05/02 19:26 upstream b7a5b22b0547 e9039493 .config console log report ci-upstream-kasan-gce-root
2019/05/02 06:27 upstream 459e3a21535a 7516d9fa .config console log report ci-upstream-kasan-gce-root
2019/05/01 20:09 upstream 459e3a21535a 7516d9fa .config console log report ci-upstream-kasan-gce-selinux-root
2019/05/01 09:13 upstream f2bc9c908dfe 618456b4 .config console log report ci-upstream-kasan-gce-root
2019/04/30 22:59 upstream bf3bd966dfd7 618456b4 .config console log report ci-upstream-kasan-gce-root
2019/04/30 20:15 upstream bf3bd966dfd7 618456b4 .config console log report ci-upstream-kasan-gce-root
2019/04/30 18:32 upstream 83a50840e72a 618456b4 .config console log report ci-upstream-kasan-gce-root
2019/04/30 18:06 upstream 83a50840e72a 618456b4 .config console log report ci-upstream-kasan-gce-selinux-root
2019/04/30 12:27 upstream 83a50840e72a 20f16bef .config console log report ci-upstream-kasan-gce-root
2019/04/30 11:04 upstream 83a50840e72a 20f16bef .config console log report ci-upstream-kasan-gce-smack-root
2019/04/30 07:00 upstream 83a50840e72a 20f16bef .config console log report ci-upstream-kasan-gce-root
2019/04/30 03:26 upstream 80871482fd5c b617407b .config console log report ci-upstream-kasan-gce-root
2019/04/29 23:33 upstream 80871482fd5c b617407b .config console log report ci-upstream-kasan-gce-root
2019/04/29 21:25 upstream 80871482fd5c b617407b .config console log report ci-upstream-kasan-gce-root
2019/04/29 19:37 upstream 37624b58542f b617407b .config console log report ci-upstream-kasan-gce-root
2019/04/29 18:06 upstream 37624b58542f b617407b .config console log report ci-upstream-kasan-gce-root
2019/04/29 14:05 upstream 37624b58542f b617407b .config console log report ci-upstream-kasan-gce-root
2019/04/29 10:15 upstream 37624b58542f b617407b .config console log report ci-upstream-kasan-gce-selinux-root
2019/04/29 08:07 upstream 37624b58542f b617407b .config console log report ci-upstream-kasan-gce-selinux-root
2019/04/29 06:37 upstream 9520b5324b0e b617407b .config console log report ci-upstream-kasan-gce-root
2019/04/29 04:31 upstream 9520b5324b0e b617407b .config console log report ci-upstream-kasan-gce-selinux-root
2019/04/28 22:08 upstream 9520b5324b0e b617407b .config console log report ci-upstream-kasan-gce-root
2019/04/28 20:36 upstream 9520b5324b0e b617407b .config console log report ci-upstream-kasan-gce-root
2019/04/28 18:56 upstream 9520b5324b0e b617407b .config console log report ci-upstream-kasan-gce-root
2019/04/28 18:35 upstream 9520b5324b0e b617407b .config console log report ci-upstream-kasan-gce-smack-root
2019/04/28 16:02 upstream 037904a22bf8 b617407b .config console log report ci-upstream-kasan-gce-root
2019/04/28 11:30 upstream 037904a22bf8 b617407b .config console log report ci-upstream-kasan-gce-smack-root
2019/04/28 05:00 upstream 037904a22bf8 b617407b .config console log report ci-upstream-kasan-gce-selinux-root
2019/04/27 23:50 upstream 037904a22bf8 b617407b .config console log report ci-upstream-kasan-gce-selinux-root
2019/04/27 22:36 upstream baf76f0c58ae b617407b .config console log report ci-upstream-kasan-gce-selinux-root
2019/04/27 18:32 upstream baf76f0c58ae b617407b .config console log report ci-upstream-kasan-gce-selinux-root
2019/04/27 17:43 upstream baf76f0c58ae b617407b .config console log report ci-upstream-kasan-gce-selinux-root
2019/04/27 16:22 upstream baf76f0c58ae b617407b .config console log report ci-upstream-kasan-gce-selinux-root
2019/04/27 14:05 upstream baf76f0c58ae b617407b .config console log report ci-upstream-kasan-gce-selinux-root
2019/04/27 12:48 upstream baf76f0c58ae b617407b .config console log report ci-upstream-kasan-gce-smack-root
2019/04/27 07:04 upstream baf76f0c58ae b617407b .config console log report ci-upstream-kasan-gce-selinux-root
2019/04/27 05:14 upstream d0473f978e61 b617407b .config console log report ci-upstream-kasan-gce-selinux-root
2019/04/27 01:50 upstream d0473f978e61 b617407b .config console log report ci-upstream-kasan-gce-selinux-root
2019/04/26 23:28 upstream d0473f978e61 b617407b .config console log report ci-upstream-kasan-gce-smack-root
2019/04/26 18:27 upstream d0473f978e61 b617407b .config console log report ci-upstream-kasan-gce-selinux-root
2019/04/26 18:24 upstream d0473f978e61 b617407b .config console log report ci-upstream-kasan-gce-selinux-root
2019/04/26 17:24 upstream 8113a85f8720 b617407b .config console log report ci-upstream-kasan-gce-selinux-root
2019/04/26 09:49 upstream 8113a85f8720 b617407b .config console log report ci-upstream-kasan-gce-selinux-root
2019/04/26 04:14 upstream 8113a85f8720 b617407b .config console log report ci-upstream-kasan-gce-root
2019/04/26 01:13 upstream f6f3e747454f f46aabc8 .config console log report ci-upstream-kasan-gce-root
2019/04/25 17:08 upstream f6f3e747454f f46aabc8 .config console log report ci-upstream-kasan-gce-selinux-root
2019/04/25 16:00 upstream cd8dead0c394 f46aabc8 .config console log report ci-upstream-kasan-gce-selinux-root
2019/04/25 15:17 upstream cd8dead0c394 f46aabc8 .config console log report ci-upstream-kasan-gce-root
2019/04/25 09:24 upstream cd8dead0c394 8e3c52b1 .config console log report ci-upstream-kasan-gce-smack-root
2019/03/17 07:48 linux-next cf08baa29613 bab43553 .config console log report ci-upstream-linux-next-kasan-gce-root
2018/09/23 16:02 linux-next 46c163a036b4 37079712 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.