syzbot

 sign-in | mailing list | source | docs
🐞 Open [717]
🐞 Fixed [181]
🐞 Invalid [640]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

possible deadlock in delete_one_xattr

Status: upstream: reported on 2023/02/08 17:45
Subsystems: reiserfs
[Documentation on labels]
Reported-by: syzbot+f638066b70cd49ab468e@syzkaller.appspotmail.com
First crash: 653d, last: 653d
▶ ▼ Similar bugs (5)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 possible deadlock in delete_one_xattr reiserfs 2 653d 714d 0/1 upstream: reported on 2022/12/10 02:38
linux-5.15 possible deadlock in delete_one_xattr origin:upstream C error 9 27d 207d 0/3 upstream: reported C repro on 2024/04/30 00:40
upstream possible deadlock in delete_one_xattr (2) reiserfs C done error 4 352d 631d 0/28 auto-obsoleted due to no activity on 2024/03/16 04:41
linux-6.1 possible deadlock in delete_one_xattr 15 64d 100d 0/3 upstream: reported on 2024/08/14 16:50
upstream possible deadlock in delete_one_xattr reiserfs C error 4 653d 654d 0/28 closed as invalid on 2023/02/08 16:28

Sample crash report:
REISERFS (device loop2): journal params: device loop2, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
REISERFS (device loop2): checking transaction log (loop2)
REISERFS (device loop2): Using r5 hash to sort names
REISERFS (device loop2): Created .reiserfs_priv - reserved for xattr storage.
======================================================
WARNING: possible circular locking dependency detected
4.14.305-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.2/11577 is trying to acquire lock:
 (&type->i_mutex_dir_key#12/2){+.+.}, at: [<ffffffff81b3b23a>] inode_lock_nested include/linux/fs.h:754 [inline]
 (&type->i_mutex_dir_key#12/2){+.+.}, at: [<ffffffff81b3b23a>] xattr_rmdir fs/reiserfs/xattr.c:106 [inline]
 (&type->i_mutex_dir_key#12/2){+.+.}, at: [<ffffffff81b3b23a>] delete_one_xattr+0x11a/0x2a0 fs/reiserfs/xattr.c:338

but task is already holding lock:
 (&type->i_mutex_dir_key#12/3){+.+.}, at: [<ffffffff81b3cae2>] inode_lock_nested include/linux/fs.h:754 [inline]
 (&type->i_mutex_dir_key#12/3){+.+.}, at: [<ffffffff81b3cae2>] reiserfs_for_each_xattr+0x5f2/0x830 fs/reiserfs/xattr.c:309

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (&type->i_mutex_dir_key#12/3){+.+.}:
       down_write_nested+0x36/0x90 kernel/locking/rwsem.c:172
       inode_lock_nested include/linux/fs.h:754 [inline]
       open_xa_root fs/reiserfs/xattr.c:127 [inline]
       open_xa_dir+0x115/0x600 fs/reiserfs/xattr.c:152
       reiserfs_for_each_xattr+0x159/0x830 fs/reiserfs/xattr.c:252
       reiserfs_delete_xattrs+0x1c/0x90 fs/reiserfs/xattr.c:364
       reiserfs_evict_inode+0x2b4/0x4a0 fs/reiserfs/inode.c:53
       evict+0x2c8/0x700 fs/inode.c:554
       iput_final fs/inode.c:1523 [inline]
       iput+0x458/0x7e0 fs/inode.c:1550
       dentry_unlink_inode+0x25c/0x310 fs/dcache.c:387
       __dentry_kill+0x320/0x550 fs/dcache.c:591
       dentry_kill fs/dcache.c:632 [inline]
       dput.part.0+0x4b5/0x710 fs/dcache.c:847
       dput+0x1b/0x30 fs/dcache.c:811
       SYSC_renameat2 fs/namei.c:4650 [inline]
       SyS_renameat2+0x96a/0xad0 fs/namei.c:4535
       do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
       entry_SYSCALL_64_after_hwframe+0x5e/0xd3

-> #0 (&type->i_mutex_dir_key#12/2){+.+.}:
       lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
       down_write_nested+0x36/0x90 kernel/locking/rwsem.c:172
       inode_lock_nested include/linux/fs.h:754 [inline]
       xattr_rmdir fs/reiserfs/xattr.c:106 [inline]
       delete_one_xattr+0x11a/0x2a0 fs/reiserfs/xattr.c:338
       reiserfs_for_each_xattr+0x603/0x830 fs/reiserfs/xattr.c:311
       reiserfs_delete_xattrs+0x1c/0x90 fs/reiserfs/xattr.c:364
       reiserfs_evict_inode+0x2b4/0x4a0 fs/reiserfs/inode.c:53
       evict+0x2c8/0x700 fs/inode.c:554
       iput_final fs/inode.c:1523 [inline]
       iput+0x458/0x7e0 fs/inode.c:1550
       dentry_unlink_inode+0x25c/0x310 fs/dcache.c:387
       d_delete+0x1c5/0x280 fs/dcache.c:2417
       vfs_rmdir.part.0+0x260/0x390 fs/namei.c:3922
       vfs_rmdir fs/namei.c:3895 [inline]
       do_rmdir+0x334/0x3c0 fs/namei.c:3970
       do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
       entry_SYSCALL_64_after_hwframe+0x5e/0xd3

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&type->i_mutex_dir_key#12/3);
                               lock(&type->i_mutex_dir_key#12/2);
                               lock(&type->i_mutex_dir_key#12/3);
  lock(&type->i_mutex_dir_key#12/2);

 *** DEADLOCK ***

3 locks held by syz-executor.2/11577:
 #0:  (sb_writers#19){.+.+}, at: [<ffffffff818e1f2a>] sb_start_write include/linux/fs.h:1551 [inline]
 #0:  (sb_writers#19){.+.+}, at: [<ffffffff818e1f2a>] mnt_want_write+0x3a/0xb0 fs/namespace.c:386
 #1:  (&type->i_mutex_dir_key#12/1){+.+.}, at: [<ffffffff818a9cde>] inode_lock_nested include/linux/fs.h:754 [inline]
 #1:  (&type->i_mutex_dir_key#12/1){+.+.}, at: [<ffffffff818a9cde>] do_rmdir+0x1de/0x3c0 fs/namei.c:3958
 #2:  (&type->i_mutex_dir_key#12/3){+.+.}, at: [<ffffffff81b3cae2>] inode_lock_nested include/linux/fs.h:754 [inline]
 #2:  (&type->i_mutex_dir_key#12/3){+.+.}, at: [<ffffffff81b3cae2>] reiserfs_for_each_xattr+0x5f2/0x830 fs/reiserfs/xattr.c:309

stack backtrace:
CPU: 1 PID: 11577 Comm: syz-executor.2 Not tainted 4.14.305-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x281 lib/dump_stack.c:58
 print_circular_bug.constprop.0.cold+0x2d7/0x41e kernel/locking/lockdep.c:1258
 check_prev_add kernel/locking/lockdep.c:1905 [inline]
 check_prevs_add kernel/locking/lockdep.c:2022 [inline]
 validate_chain kernel/locking/lockdep.c:2464 [inline]
 __lock_acquire+0x2e0e/0x3f20 kernel/locking/lockdep.c:3491
 lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
 down_write_nested+0x36/0x90 kernel/locking/rwsem.c:172
 inode_lock_nested include/linux/fs.h:754 [inline]
 xattr_rmdir fs/reiserfs/xattr.c:106 [inline]
 delete_one_xattr+0x11a/0x2a0 fs/reiserfs/xattr.c:338
 reiserfs_for_each_xattr+0x603/0x830 fs/reiserfs/xattr.c:311
 reiserfs_delete_xattrs+0x1c/0x90 fs/reiserfs/xattr.c:364
 reiserfs_evict_inode+0x2b4/0x4a0 fs/reiserfs/inode.c:53
 evict+0x2c8/0x700 fs/inode.c:554
 iput_final fs/inode.c:1523 [inline]
 iput+0x458/0x7e0 fs/inode.c:1550
 dentry_unlink_inode+0x25c/0x310 fs/dcache.c:387
 d_delete+0x1c5/0x280 fs/dcache.c:2417
 vfs_rmdir.part.0+0x260/0x390 fs/namei.c:3922
 vfs_rmdir fs/namei.c:3895 [inline]
 do_rmdir+0x334/0x3c0 fs/namei.c:3970
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x5e/0xd3
RIP: 0033:0x7f3b8a3510f9
RSP: 002b:00007f3b888c3168 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f3b8a470f80 RCX: 00007f3b8a3510f9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000100
RBP: 00007f3b8a3acae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffcca5e779f R14: 00007f3b888c3300 R15: 0000000000022000
REISERFS (device loop2): found reiserfs format "3.6" with non-standard journal
REISERFS (device loop2): using ordered data mode
reiserfs: using flush barriers
REISERFS (device loop2): journal params: device loop2, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
REISERFS (device loop3): found reiserfs format "3.6" with non-standard journal
REISERFS (device loop2): checking transaction log (loop2)
REISERFS (device loop3): using ordered data mode
reiserfs: using flush barriers
REISERFS (device loop3): journal params: device loop3, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
REISERFS (device loop2): Using r5 hash to sort names
REISERFS (device loop2): Created .reiserfs_priv - reserved for xattr storage.
REISERFS (device loop3): checking transaction log (loop3)
REISERFS (device loop3): Using r5 hash to sort names
REISERFS (device loop3): Created .reiserfs_priv - reserved for xattr storage.
REISERFS (device loop2): found reiserfs format "3.6" with non-standard journal
REISERFS (device loop2): using ordered data mode
reiserfs: using flush barriers
REISERFS (device loop2): journal params: device loop2, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
REISERFS (device loop2): checking transaction log (loop2)
REISERFS (device loop2): Using r5 hash to sort names
REISERFS (device loop2): Created .reiserfs_priv - reserved for xattr storage.
REISERFS (device loop3): found reiserfs format "3.6" with non-standard journal
REISERFS (device loop3): using ordered data mode
reiserfs: using flush barriers
REISERFS (device loop3): journal params: device loop3, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
REISERFS (device loop2): found reiserfs format "3.6" with non-standard journal
REISERFS (device loop2): using ordered data mode
reiserfs: using flush barriers
REISERFS (device loop2): journal params: device loop2, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
REISERFS (device loop3): checking transaction log (loop3)
REISERFS (device loop2): checking transaction log (loop2)
REISERFS (device loop3): Using r5 hash to sort names
REISERFS (device loop3): Created .reiserfs_priv - reserved for xattr storage.
REISERFS (device loop2): Using r5 hash to sort names
REISERFS (device loop2): Created .reiserfs_priv - reserved for xattr storage.
REISERFS (device loop3): found reiserfs format "3.6" with non-standard journal
REISERFS (device loop3): using ordered data mode
reiserfs: using flush barriers
REISERFS (device loop3): journal params: device loop3, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
REISERFS (device loop3): checking transaction log (loop3)
REISERFS (device loop3): Using r5 hash to sort names
REISERFS (device loop3): Created .reiserfs_priv - reserved for xattr storage.
ntfs: volume version 3.1.
ntfs: volume version 3.1.
ntfs: volume version 3.1.
ntfs: volume version 3.1.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'.
BTRFS info (device loop1): enabling inode map caching
BTRFS warning (device loop1): excessive commit interval 622039222
BTRFS info (device loop1): force zlib compression
BTRFS info (device loop1): using free space tree
BTRFS info (device loop1): has skinny extents
BTRFS info (device loop1): enabling inode map caching
BTRFS warning (device loop1): excessive commit interval 622039222
BTRFS info (device loop1): force zlib compression
BTRFS info (device loop1): using free space tree
BTRFS info (device loop1): has skinny extents

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/02/08 17:44 linux-4.14.y a8ad60f2af58 fc9c934e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-4-14 possible deadlock in delete_one_xattr
* Struck through repros no longer work on HEAD.