syzbot


possible deadlock in mark_as_free_ex (2)

Status: upstream: reported C repro on 2024/11/08 07:38
Subsystems: ntfs3
[Documentation on labels]
Reported-by: syzbot+8df514c431bd240c5644@syzkaller.appspotmail.com
First crash: 350d, last: 2h27m
Cause bisection: introduced by (bisect log) :
commit 5fc982fe7eca9d0cf7b25832450ebd4f7c8e1c36
Author: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Date: Thu Oct 10 17:09:24 2024 +0000

  fs/ntfs3: Fix case when unmarked clusters intersect with zone

Crash: possible deadlock in mark_as_free_ex (log)
Repro: C syz .config
  
Discussions (11)
Title Replies (including bot) Last reply
[syzbot] Monthly ntfs3 report (Sep 2025) 0 (1) 2025/09/25 16:00
[syzbot] Monthly ntfs3 report (Aug 2025) 0 (1) 2025/08/25 13:19
[syzbot] Monthly ntfs3 report (Jul 2025) 0 (1) 2025/07/25 12:39
[syzbot] Monthly ntfs3 report (Jun 2025) 0 (1) 2025/06/24 07:38
[syzbot] Monthly ntfs3 report (May 2025) 0 (1) 2025/05/24 10:04
[syzbot] Monthly ntfs3 report (Apr 2025) 0 (1) 2025/04/22 12:41
[syzbot] Monthly ntfs3 report (Mar 2025) 0 (1) 2025/03/18 14:49
[syzbot] Monthly ntfs3 report (Feb 2025) 0 (1) 2025/02/16 21:53
[syzbot] Monthly ntfs3 report (Jan 2025) 0 (1) 2025/01/15 08:54
[PATCH] ntfs3: fix deadlock in mark_as_free_ex 1 (1) 2024/12/13 09:05
[syzbot] [ntfs3?] possible deadlock in mark_as_free_ex (2) 0 (5) 2024/12/13 08:24
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.6 possible deadlock in mark_as_free_ex origin:upstream 4 syz 35 3d18h 110d 0/2 upstream: reported syz repro on 2025/07/03 04:12
upstream possible deadlock in mark_as_free_ex ntfs3 4 3 868d 873d 0/29 auto-obsoleted due to no activity on 2023/09/13 11:34
Last patch testing requests (1)
Created Duration User Patch Repo Result
2024/12/13 08:24 26m lizhi.xu@windriver.com patch upstream OK log

Sample crash report:
loop0: detected capacity change from 0 to 4096
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.0.19/6051 is trying to acquire lock:
ffff8880351b2250 (&wnd->rw_lock){++++}-{4:4}, at: mark_as_free_ex+0x3e/0x390 fs/ntfs3/fsntfs.c:2464

but task is already holding lock:
ffff8880487fbf90 (&ni->file.run_lock#2){++++}-{4:4}, at: ntfs_truncate fs/ntfs3/file.c:455 [inline]
ffff8880487fbf90 (&ni->file.run_lock#2){++++}-{4:4}, at: ntfs_setattr+0x70e/0xbe0 fs/ntfs3/file.c:778

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (&ni->file.run_lock#2){++++}-{4:4}:
       lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868
       down_read+0x97/0x1f0 kernel/locking/rwsem.c:1537
       run_unpack_ex+0x7e5/0xba0 fs/ntfs3/run.c:1119
       ntfs_read_mft fs/ntfs3/inode.c:401 [inline]
       ntfs_iget5+0x232b/0x37c0 fs/ntfs3/inode.c:540
       dir_search_u+0x1df/0x2c0 fs/ntfs3/dir.c:264
       ntfs_lookup+0xfb/0x1f0 fs/ntfs3/namei.c:85
       lookup_open fs/namei.c:3686 [inline]
       open_last_lookups fs/namei.c:3807 [inline]
       path_openat+0x110d/0x3840 fs/namei.c:4043
       do_filp_open+0x1fa/0x410 fs/namei.c:4073
       do_sys_openat2+0x121/0x1c0 fs/open.c:1435
       do_sys_open fs/open.c:1450 [inline]
       __do_sys_creat fs/open.c:1528 [inline]
       __se_sys_creat fs/open.c:1522 [inline]
       __x64_sys_creat+0x8f/0xc0 fs/open.c:1522
       do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
       do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #0 (&wnd->rw_lock){++++}-{4:4}:
       check_prev_add kernel/locking/lockdep.c:3165 [inline]
       check_prevs_add kernel/locking/lockdep.c:3284 [inline]
       validate_chain+0xb9b/0x2140 kernel/locking/lockdep.c:3908
       __lock_acquire+0xab9/0xd20 kernel/locking/lockdep.c:5237
       lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868
       down_write_nested+0x3e/0x60 kernel/locking/rwsem.c:1706
       mark_as_free_ex+0x3e/0x390 fs/ntfs3/fsntfs.c:2464
       run_deallocate_ex+0x187/0x2f0 fs/ntfs3/attrib.c:122
       attr_set_size+0xeb9/0x2c70 fs/ntfs3/attrib.c:753
       ntfs_truncate fs/ntfs3/file.c:456 [inline]
       ntfs_setattr+0x7d0/0xbe0 fs/ntfs3/file.c:778
       notify_change+0xb31/0xe60 fs/attr.c:552
       do_truncate+0x1a4/0x220 fs/open.c:68
       handle_truncate fs/namei.c:3508 [inline]
       do_open fs/namei.c:3891 [inline]
       path_openat+0x3078/0x3840 fs/namei.c:4046
       do_filp_open+0x1fa/0x410 fs/namei.c:4073
       do_sys_openat2+0x121/0x1c0 fs/open.c:1435
       do_sys_open fs/open.c:1450 [inline]
       __do_sys_creat fs/open.c:1528 [inline]
       __se_sys_creat fs/open.c:1522 [inline]
       __x64_sys_creat+0x8f/0xc0 fs/open.c:1522
       do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
       do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&ni->file.run_lock#2);
                               lock(&wnd->rw_lock);
                               lock(&ni->file.run_lock#2);
  lock(&wnd->rw_lock);

 *** DEADLOCK ***

4 locks held by syz.0.19/6051:
 #0: ffff8880351b4488 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:557
 #1: ffff8880487fc1a8 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: inode_lock_killable include/linux/fs.h:874 [inline]
 #1: ffff8880487fc1a8 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: do_truncate+0x171/0x220 fs/open.c:63
 #2: ffff8880487fbef0 (&ni->ni_lock/5){+.+.}-{4:4}, at: ni_lock fs/ntfs3/ntfs_fs.h:1113 [inline]
 #2: ffff8880487fbef0 (&ni->ni_lock/5){+.+.}-{4:4}, at: ntfs_truncate fs/ntfs3/file.c:453 [inline]
 #2: ffff8880487fbef0 (&ni->ni_lock/5){+.+.}-{4:4}, at: ntfs_setattr+0x6fd/0xbe0 fs/ntfs3/file.c:778
 #3: ffff8880487fbf90 (&ni->file.run_lock#2){++++}-{4:4}, at: ntfs_truncate fs/ntfs3/file.c:455 [inline]
 #3: ffff8880487fbf90 (&ni->file.run_lock#2){++++}-{4:4}, at: ntfs_setattr+0x70e/0xbe0 fs/ntfs3/file.c:778

stack backtrace:
CPU: 1 UID: 0 PID: 6051 Comm: syz.0.19 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 print_circular_bug+0x2ee/0x310 kernel/locking/lockdep.c:2043
 check_noncircular+0x134/0x160 kernel/locking/lockdep.c:2175
 check_prev_add kernel/locking/lockdep.c:3165 [inline]
 check_prevs_add kernel/locking/lockdep.c:3284 [inline]
 validate_chain+0xb9b/0x2140 kernel/locking/lockdep.c:3908
 __lock_acquire+0xab9/0xd20 kernel/locking/lockdep.c:5237
 lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868
 down_write_nested+0x3e/0x60 kernel/locking/rwsem.c:1706
 mark_as_free_ex+0x3e/0x390 fs/ntfs3/fsntfs.c:2464
 run_deallocate_ex+0x187/0x2f0 fs/ntfs3/attrib.c:122
 attr_set_size+0xeb9/0x2c70 fs/ntfs3/attrib.c:753
 ntfs_truncate fs/ntfs3/file.c:456 [inline]
 ntfs_setattr+0x7d0/0xbe0 fs/ntfs3/file.c:778
 notify_change+0xb31/0xe60 fs/attr.c:552
 do_truncate+0x1a4/0x220 fs/open.c:68
 handle_truncate fs/namei.c:3508 [inline]
 do_open fs/namei.c:3891 [inline]
 path_openat+0x3078/0x3840 fs/namei.c:4046
 do_filp_open+0x1fa/0x410 fs/namei.c:4073
 do_sys_openat2+0x121/0x1c0 fs/open.c:1435
 do_sys_open fs/open.c:1450 [inline]
 __do_sys_creat fs/open.c:1528 [inline]
 __se_sys_creat fs/open.c:1522 [inline]
 __x64_sys_creat+0x8f/0xc0 fs/open.c:1522
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff4d8bdebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffef3e4a208 EFLAGS: 00000246 ORIG_RAX: 0000000000000055
RAX: ffffffffffffffda RBX: 00007ff4d8e05fa0 RCX: 00007ff4d8bdebe9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00002000000002c0
RBP: 00007ff4d8c61e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ff4d8e05fa0 R14: 00007ff4d8e05fa0 R15: 0000000000000002
 </TASK>

Crashes (3540):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/08/24 22:00 upstream c330cb607721 bf27483f .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro #1] [mounted in repro #2] ci2-upstream-fs possible deadlock in mark_as_free_ex
2024/12/12 08:34 upstream 231825b2e1ff 6f1b0fa8 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro #1] [mounted in repro #2] ci2-upstream-fs possible deadlock in mark_as_free_ex
2024/11/29 01:42 upstream 7af08b57bcb9 5df23865 .config console log report syz / log [disk image] [vmlinux] [kernel image] [mounted in repro #1] [mounted in repro #2] ci2-upstream-fs possible deadlock in mark_as_free_ex
2025/10/20 13:56 upstream 211ddde0823f 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root possible deadlock in mark_as_free_ex
2025/10/20 11:27 upstream 211ddde0823f 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root possible deadlock in mark_as_free_ex
2025/10/20 09:13 upstream d9043c79ba68 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root possible deadlock in mark_as_free_ex
2025/10/20 05:00 upstream d9043c79ba68 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root possible deadlock in mark_as_free_ex
2025/10/20 00:36 upstream d9043c79ba68 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root possible deadlock in mark_as_free_ex
2025/10/19 22:10 upstream d9043c79ba68 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs possible deadlock in mark_as_free_ex
2025/10/19 20:27 upstream d9043c79ba68 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs possible deadlock in mark_as_free_ex
2025/10/19 11:18 upstream 1c64efcb083c 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root possible deadlock in mark_as_free_ex
2025/10/19 00:12 upstream 847f242f7a44 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root possible deadlock in mark_as_free_ex
2025/10/18 21:17 upstream 847f242f7a44 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root possible deadlock in mark_as_free_ex
2025/10/18 07:01 upstream cf1ea8854e4f 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs possible deadlock in mark_as_free_ex
2025/10/18 00:32 upstream cf1ea8854e4f 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs possible deadlock in mark_as_free_ex
2025/10/17 13:57 upstream 98ac9cc4b445 7adf5298 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs possible deadlock in mark_as_free_ex
2025/10/17 10:46 upstream 98ac9cc4b445 19568248 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root possible deadlock in mark_as_free_ex
2025/10/17 06:04 upstream 98ac9cc4b445 19568248 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs possible deadlock in mark_as_free_ex
2025/10/17 03:23 upstream 98ac9cc4b445 19568248 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs possible deadlock in mark_as_free_ex
2025/10/17 01:13 upstream 98ac9cc4b445 19568248 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs possible deadlock in mark_as_free_ex
2025/10/16 21:40 upstream 98ac9cc4b445 19568248 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs possible deadlock in mark_as_free_ex
2025/10/16 21:37 upstream 98ac9cc4b445 19568248 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs possible deadlock in mark_as_free_ex
2025/10/16 05:59 upstream 7ea30958b305 19568248 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root possible deadlock in mark_as_free_ex
2025/10/15 16:56 upstream 1f4a222b0e33 19568248 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root possible deadlock in mark_as_free_ex
2025/10/15 14:19 upstream 9b332cece987 19568248 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root possible deadlock in mark_as_free_ex
2025/10/15 07:26 upstream 9b332cece987 b6605ba8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root possible deadlock in mark_as_free_ex
2025/10/15 06:18 upstream 9b332cece987 b6605ba8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root possible deadlock in mark_as_free_ex
2025/10/14 17:21 upstream 9b332cece987 b6605ba8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs possible deadlock in mark_as_free_ex
2025/10/14 15:52 upstream 3a8660878839 b6605ba8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs possible deadlock in mark_as_free_ex
2025/10/14 12:39 upstream 3a8660878839 b6605ba8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs possible deadlock in mark_as_free_ex
2025/10/13 23:21 upstream 3a8660878839 b6605ba8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs possible deadlock in mark_as_free_ex
2025/10/13 18:14 upstream 3a8660878839 b6605ba8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root possible deadlock in mark_as_free_ex
2025/10/13 15:47 upstream 3a8660878839 b6605ba8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs possible deadlock in mark_as_free_ex
2025/10/13 10:34 upstream 3a8660878839 ff1712fe .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs possible deadlock in mark_as_free_ex
2025/10/13 08:07 upstream 3a8660878839 ff1712fe .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs possible deadlock in mark_as_free_ex
2025/10/13 06:21 upstream 3a8660878839 ff1712fe .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root possible deadlock in mark_as_free_ex
2025/10/13 05:16 upstream 3a8660878839 ff1712fe .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs possible deadlock in mark_as_free_ex
2025/10/13 02:50 upstream 3a8660878839 ff1712fe .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs possible deadlock in mark_as_free_ex
2025/10/19 16:15 linux-next 93f3bab4310d 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in mark_as_free_ex
2025/10/19 10:18 linux-next 93f3bab4310d 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in mark_as_free_ex
2025/10/18 16:12 linux-next 93f3bab4310d 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in mark_as_free_ex
2025/10/18 12:01 linux-next 93f3bab4310d 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in mark_as_free_ex
2025/10/13 12:51 linux-next 52ba76324a9d ff1712fe .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in mark_as_free_ex
2024/11/08 06:46 linux-next 74741a050b79 179b040e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in mark_as_free_ex
2024/11/04 07:27 linux-next 1ffec08567f4 f00eed24 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in mark_as_free_ex
2025/10/21 03:16 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bf45a62baffc 9832ed61 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 possible deadlock in mark_as_free_ex
2025/10/20 02:52 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bf45a62baffc 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 possible deadlock in mark_as_free_ex
2025/10/18 23:10 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bf45a62baffc 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 possible deadlock in mark_as_free_ex
2025/10/18 19:05 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bf45a62baffc 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 possible deadlock in mark_as_free_ex
2025/10/18 10:41 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bf45a62baffc 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 possible deadlock in mark_as_free_ex
2025/10/16 10:35 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bf45a62baffc 19568248 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 possible deadlock in mark_as_free_ex
2025/10/16 01:05 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bf45a62baffc 19568248 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 possible deadlock in mark_as_free_ex
2025/10/15 19:44 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bf45a62baffc 19568248 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 possible deadlock in mark_as_free_ex
2025/10/15 11:22 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bf45a62baffc b6605ba8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 possible deadlock in mark_as_free_ex
2025/10/15 10:10 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bf45a62baffc b6605ba8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 possible deadlock in mark_as_free_ex
2025/10/13 03:14 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bf45a62baffc ff1712fe .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 possible deadlock in mark_as_free_ex
* Struck through repros no longer work on HEAD.