syzbot


possible deadlock in diFree (2)

Status: upstream: reported C repro on 2024/11/21 12:18
Subsystems: jfs
[Documentation on labels]
Reported-by: syzbot+355da3b3a74881008e8f@syzkaller.appspotmail.com
Fix commit: b61e69bb1c04 jfs: Prevent copying of nlink with value 0 from disk inode
Patched on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-riscv64]
First crash: 175d, last: 46d
Discussions (11)
Title Replies (including bot) Last reply
[PATCH AUTOSEL 5.4 04/14] jfs: Prevent copying of nlink with value 0 from disk inode 1 (1) 2025/04/03 19:10
[PATCH AUTOSEL 5.10 04/15] jfs: Prevent copying of nlink with value 0 from disk inode 1 (1) 2025/04/03 19:09
[PATCH AUTOSEL 5.15 05/16] jfs: Prevent copying of nlink with value 0 from disk inode 1 (1) 2025/04/03 19:09
[PATCH AUTOSEL 6.1 06/18] jfs: Prevent copying of nlink with value 0 from disk inode 1 (1) 2025/04/03 19:08
[PATCH AUTOSEL 6.6 10/26] jfs: Prevent copying of nlink with value 0 from disk inode 1 (1) 2025/04/03 19:07
[PATCH AUTOSEL 6.12 21/47] jfs: Prevent copying of nlink with value 0 from disk inode 1 (1) 2025/04/03 19:05
[PATCH AUTOSEL 6.13 21/49] jfs: Prevent copying of nlink with value 0 from disk inode 1 (1) 2025/04/03 19:03
[PATCH AUTOSEL 6.14 23/54] jfs: Prevent copying of nlink with value 0 from disk inode 1 (1) 2025/04/03 19:01
Re: [PATCH V3] jfs: Prevent copying of nlink with value 0 from disk inode 3 (3) 2025/02/24 14:56
[PATCH] jfs: Prevent setting of nlink with value 0 from disk inode 6 (6) 2025/02/20 23:22
[syzbot] [jfs?] possible deadlock in diFree (2) 0 (4) 2024/12/19 08:52
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream possible deadlock in diFree jfs 91 278d 384d 0/28 auto-obsoleted due to no activity on 2024/10/15 15:16
linux-6.1 possible deadlock in diFree 1 47d 47d 0/3 upstream: reported on 2025/03/25 19:22
Last patch testing requests (3)
Created Duration User Patch Repo Result
2024/12/19 08:52 19m lizhi.xu@windriver.com patch upstream OK log
2024/12/19 08:24 18m lizhi.xu@windriver.com patch upstream report log
2024/12/19 02:56 9m lizhi.xu@windriver.com patch upstream report log

Sample crash report:
ERROR: (device loop0): remounting filesystem as read-only
ERROR: (device loop0): duplicateIXtree: 
============================================
WARNING: possible recursive locking detected
6.12.0-rc7-syzkaller-00212-g4a5df3796467 #0 Not tainted
--------------------------------------------
syz-executor301/5309 is trying to acquire lock:
ffff888044548920 (&(imap->im_aglock[index])){+.+.}-{3:3}, at: diFree+0x37c/0x2fb0 fs/jfs/jfs_imap.c:889

but task is already holding lock:
ffff888044548920 (&(imap->im_aglock[index])){+.+.}-{3:3}, at: diAlloc+0x1b6/0x1630

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&(imap->im_aglock[index]));
  lock(&(imap->im_aglock[index]));

 *** DEADLOCK ***

 May be due to missing lock nesting notation

5 locks held by syz-executor301/5309:
 #0: ffff8880422a4420 (sb_writers#9){.+.+}-{0:0}, at: mnt_want_write+0x3f/0x90 fs/namespace.c:515
 #1: ffff88804755b390 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:850 [inline]
 #1: ffff88804755b390 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: filename_create+0x260/0x540 fs/namei.c:4026
 #2: ffff888044548920 (&(imap->im_aglock[index])){+.+.}-{3:3}, at: diAlloc+0x1b6/0x1630
 #3: ffff888044548890 (&imap->im_freelock){+.+.}-{3:3}, at: diNewIAG fs/jfs/jfs_imap.c:2460 [inline]
 #3: ffff888044548890 (&imap->im_freelock){+.+.}-{3:3}, at: diAllocExt fs/jfs/jfs_imap.c:1905 [inline]
 #3: ffff888044548890 (&imap->im_freelock){+.+.}-{3:3}, at: diAllocAG+0x4b7/0x1e50 fs/jfs/jfs_imap.c:1669
 #4: ffff88804755a618 (&jfs_ip->rdwrlock/1){++++}-{3:3}, at: diNewIAG fs/jfs/jfs_imap.c:2477 [inline]
 #4: ffff88804755a618 (&jfs_ip->rdwrlock/1){++++}-{3:3}, at: diAllocExt fs/jfs/jfs_imap.c:1905 [inline]
 #4: ffff88804755a618 (&jfs_ip->rdwrlock/1){++++}-{3:3}, at: diAllocAG+0x869/0x1e50 fs/jfs/jfs_imap.c:1669

stack backtrace:
CPU: 0 UID: 0 PID: 5309 Comm: syz-executor301 Not tainted 6.12.0-rc7-syzkaller-00212-g4a5df3796467 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_deadlock_bug+0x483/0x620 kernel/locking/lockdep.c:3037
 check_deadlock kernel/locking/lockdep.c:3089 [inline]
 validate_chain+0x15e2/0x5920 kernel/locking/lockdep.c:3891
 __lock_acquire+0x1384/0x2050 kernel/locking/lockdep.c:5202
 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
 __mutex_lock_common kernel/locking/mutex.c:608 [inline]
 __mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752
 diFree+0x37c/0x2fb0 fs/jfs/jfs_imap.c:889
 jfs_evict_inode+0x32d/0x440 fs/jfs/inode.c:156
 evict+0x4e8/0x9b0 fs/inode.c:725
 diFreeSpecial fs/jfs/jfs_imap.c:552 [inline]
 duplicateIXtree+0x3c6/0x550 fs/jfs/jfs_imap.c:3022
 diNewIAG fs/jfs/jfs_imap.c:2597 [inline]
 diAllocExt fs/jfs/jfs_imap.c:1905 [inline]
 diAllocAG+0x17dc/0x1e50 fs/jfs/jfs_imap.c:1669
 diAlloc+0x1d2/0x1630 fs/jfs/jfs_imap.c:1590
 ialloc+0x8f/0x900 fs/jfs/jfs_inode.c:56
 jfs_mkdir+0x1c5/0xba0 fs/jfs/namei.c:225
 vfs_mkdir+0x2f9/0x4f0 fs/namei.c:4257
 do_mkdirat+0x264/0x3a0 fs/namei.c:4280
 __do_sys_mkdirat fs/namei.c:4295 [inline]
 __se_sys_mkdirat fs/namei.c:4293 [inline]
 __x64_sys_mkdirat+0x87/0xa0 fs/namei.c:4293
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc96b45f879
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffca87793b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007ffca8779588 RCX: 00007fc96b45f879
RDX: 0000000000000000 RSI: 00000000200005c0 RDI: 00000000ffffff9c
RBP: 00007fc96b4d9610 R08: 00007ffca8779588 R09: 00007ffca8779588
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffca8779578 R14: 0000000000000001 R15: 0000000000000001
 </TASK>

Crashes (40):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/11/17 13:32 upstream 4a5df3796467 cfe3a04a .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro] ci-snapshot-upstream-root possible deadlock in diFree
2024/11/17 13:07 upstream 4a5df3796467 cfe3a04a .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro] ci-snapshot-upstream-root possible deadlock in diFree
2024/11/17 12:40 upstream 4a5df3796467 cfe3a04a .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro] ci-snapshot-upstream-root possible deadlock in diFree
2025/03/27 00:34 upstream 1e26c5e28ca5 19e40f48 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2025/03/26 03:35 upstream 2df0c02dab82 89d30d73 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2025/03/20 03:50 upstream a7f2e10ecd8f 8d0a2921 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2025/03/17 14:55 upstream 4701f33a1070 948c34e4 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2025/03/17 03:39 upstream cb82ca153949 e2826670 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2025/03/02 23:12 upstream 1973160c90d7 c3901742 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2025/02/24 16:05 upstream d082ecbc71e9 d34966d1 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2025/02/22 15:45 upstream ff202c5028a1 d34966d1 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2025/02/16 11:43 upstream ad1b832bf1cf 40a34ec9 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2025/02/10 03:49 upstream 69b54314c975 ef44b750 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2025/02/07 03:23 upstream bb066fe812d6 53657d1b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2025/02/04 14:56 upstream 0de63bb7d919 8f267cef .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2025/02/04 14:04 upstream 0de63bb7d919 8f267cef .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2025/02/02 10:57 upstream 69e858e0b8b2 568559e4 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2025/02/01 08:45 upstream 69e858e0b8b2 aa47157c .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2025/01/27 06:55 upstream c2da8b3f914f 9fbd772e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2025/01/26 07:33 upstream 405057718a1f 9fbd772e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2025/01/26 06:54 upstream 405057718a1f 9fbd772e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2025/01/23 05:24 upstream df60eac9efe8 9d4f14f8 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2025/01/22 17:17 upstream c4b9570cfb63 25e17fd3 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2025/01/22 02:35 upstream 95ec54a420b8 da72ac06 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2025/01/20 18:21 upstream ffd294d346d1 6e87cfa2 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2025/01/16 16:59 upstream 619f0b6fad52 f9e07a6e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2025/01/16 12:39 upstream 619f0b6fad52 968edaf4 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2025/01/11 10:05 upstream 77a903cd8e5a 6dbc6a9b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2025/01/03 06:00 upstream 0bc21e701a6f d3ccff63 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2025/01/01 04:47 upstream ccb98ccef0e5 d3ccff63 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2024/12/20 20:37 upstream 8faabc041a00 49cfeac8 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2024/12/20 05:03 upstream baaa2567a712 c87fa8a3 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2024/12/11 02:05 upstream 7cb1b4663150 cfc402b4 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2024/12/06 15:13 upstream b8f52214c61a 9ac0fdc6 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2024/12/04 09:51 upstream ceb8bf2ceaa7 b50eb251 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2024/12/01 05:34 upstream d8b78066f4c9 68914665 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2024/11/24 18:26 upstream 9f16d5e6f220 68da6d95 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2024/11/23 03:29 upstream 06afb0f36106 68da6d95 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2024/11/18 00:24 upstream f66d6acccbc0 cfe3a04a .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
2024/11/17 12:16 upstream 4a5df3796467 cfe3a04a .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root possible deadlock in diFree
* Struck through repros no longer work on HEAD.