linux-kernel - Re: [syzbot] inconsistent lock state in _atomic_dec_and

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Y1X6CY0ZoM9/HuNf@casper.infradead.org>
Date:   Mon, 24 Oct 2022 03:35:53 +0100
From:   Matthew Wilcox <willy@...radead.org>
To:     syzbot <syzbot+9c8140e9162432b9eb20@...kaller.appspotmail.com>
Cc:     akpm@...ux-foundation.org, linux-fsdevel@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-mm@...ck.org,
        syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] inconsistent lock state in _atomic_dec_and_lock

On Sun, Oct 23, 2022 at 11:32:30AM -0700, syzbot wrote:
> ================================
> WARNING: inconsistent lock state
> 6.0.0-rc7-syzkaller-18095-gbbed346d5a96 #0 Not tainted
> --------------------------------
> inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage.
> syz-executor.3/9712 [HC0[0]:SC0[0]:HE1:SE1] takes:
> ffff0000d10c2577 (&folio_wait_table[i]){?.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:349 [inline]
> ffff0000d10c2577 (&folio_wait_table[i]){?.-.}-{2:2}, at: _atomic_dec_and_lock+0xc8/0x130 lib/dec_and_lock.c:28
> {IN-HARDIRQ-W} state was registered at:
>   lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5666
>   __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
>   _raw_spin_lock_irqsave+0x6c/0xb4 kernel/locking/spinlock.c:162
>   folio_wake_bit+0x88/0x254 mm/filemap.c:1143

This is clearly complete garbage.  If we're using spin_lock_irqsave(),
then we can't have a {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} problem.

> stack backtrace:
> CPU: 1 PID: 9712 Comm: syz-executor.3 Not tainted 6.0.0-rc7-syzkaller-18095-gbbed346d5a96 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022
> Call trace:
>  dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:156
>  show_stack+0x2c/0x54 arch/arm64/kernel/stacktrace.c:163
>  __dump_stack lib/dump_stack.c:88 [inline]
>  dump_stack_lvl+0x104/0x16c lib/dump_stack.c:106
>  dump_stack+0x1c/0x58 lib/dump_stack.c:113
>  print_usage_bug+0x39c/0x3cc kernel/locking/lockdep.c:3961
>  mark_lock_irq+0x4a8/0x4b4
>  mark_lock+0x154/0x1b4 kernel/locking/lockdep.c:4632
>  mark_usage kernel/locking/lockdep.c:4541 [inline]
>  __lock_acquire+0x5f8/0x30a4 kernel/locking/lockdep.c:5007
>  lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5666
>  __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
>  _raw_spin_lock+0x54/0x6c kernel/locking/spinlock.c:154
>  spin_lock include/linux/spinlock.h:349 [inline]
>  _atomic_dec_and_lock+0xc8/0x130 lib/dec_and_lock.c:28
>  iput+0x50/0x324 fs/inode.c:1766
>  ntfs_fill_super+0x1254/0x14a4 fs/ntfs3/super.c:1190

Oh.  ntfs probably corrupted the lockdep state.  Also, this is
a completely different lock from the first one.  So I'm going to
ignore this report.