linux-kernel - Re: [syzbot] possible deadlock in dquot

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20211007084449.GA12712@quack2.suse.cz>
Date:   Thu, 7 Oct 2021 10:44:49 +0200
From:   Jan Kara <jack@...e.cz>
To:     syzbot <syzbot+3b6f9218b1301ddda3e2@...kaller.appspotmail.com>
Cc:     dvyukov@...gle.com, jack@...e.cz, linux-kernel@...r.kernel.org,
        syzkaller-bugs@...glegroups.com, syzkaller@...glegroups.com,
        tytso@....edu
Subject: Re: [syzbot] possible deadlock in dquot_commit

On Mon 09-08-21 05:54:27, syzbot wrote:
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    66745863ecde Merge tag 'char-misc-5.14-rc5' of git://git.k..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=13edca6e300000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=702bfdfbf389c324
> dashboard link: https://syzkaller.appspot.com/bug?extid=3b6f9218b1301ddda3e2
> compiler:       Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.1
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15aeba6e300000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=17a609e6300000
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+3b6f9218b1301ddda3e2@...kaller.appspotmail.com
> 
> loop0: detected capacity change from 0 to 4096
> EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
> ======================================================
> WARNING: possible circular locking dependency detected
> 5.14.0-rc4-syzkaller #0 Not tainted
> ------------------------------------------------------
> syz-executor211/9242 is trying to acquire lock:
> ffff88803a37ece8 (&dquot->dq_lock){+.+.}-{3:3}, at: dquot_commit+0x57/0x360 fs/quota/dquot.c:474
> 
> but task is already holding lock:
> ffff88803a303e48 (&ei->i_data_sem/2){++++}-{3:3}, at: ext4_map_blocks+0x9e5/0x1cb0 fs/ext4/inode.c:631
> 
> which lock already depends on the new lock.

I've got back to this and I have one more idea what could be causing this
and why I'm not able to reproduce. I think we free some inode with
i_data_sem locking class set to 2 and when the inode gets reused (which
doesn't happen in my VM for some reason) for a normal file, problems trigger.
Let's try attached patch.

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 60a9483534ed0d99090a2ee1d4bb0b8179195f51

									Honza
-- 
Jan Kara <jack@...e.com>
SUSE Labs, CR

View attachment "0001-ext4-Make-sure-to-reset-inode-lockdep-class-when-quo.patch" of type "text/x-patch" (1442 bytes)