linux-kernel - Re: [syzbot] [ext4?] possible deadlock in start_this

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Y/6aDmrx8Q9ob+Zi@sol.localdomain>
Date:   Tue, 28 Feb 2023 16:19:26 -0800
From:   Eric Biggers <ebiggers@...nel.org>
To:     syzbot <syzbot+cf0b4280f19be4031cf2@...kaller.appspotmail.com>
Cc:     jack@...e.com, linux-ext4@...r.kernel.org,
        linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
        syzkaller-bugs@...glegroups.com, tytso@....edu,
        linux-fscrypt@...r.kernel.org
Subject: Re: [syzbot] [ext4?] possible deadlock in start_this_handle (4)

On Tue, Feb 28, 2023 at 04:02:36PM -0800, syzbot wrote:
> -> #1 (fscrypt_init_mutex){+.+.}-{3:3}:
>        __mutex_lock_common kernel/locking/mutex.c:603 [inline]
>        __mutex_lock+0x12f/0x1350 kernel/locking/mutex.c:747
>        fscrypt_initialize+0x40/0xa0 fs/crypto/crypto.c:326
>        fscrypt_setup_encryption_info+0xef/0xeb0 fs/crypto/keysetup.c:563
>        fscrypt_get_encryption_info+0x375/0x450 fs/crypto/keysetup.c:668
>        fscrypt_setup_filename+0x23c/0xec0 fs/crypto/fname.c:458
>        ext4_fname_setup_filename+0x8c/0x110 fs/ext4/crypto.c:28
>        ext4_add_entry+0x3aa/0xe30 fs/ext4/namei.c:2380
>        ext4_rename+0x1979/0x2620 fs/ext4/namei.c:3904
>        ext4_rename2+0x1c7/0x270 fs/ext4/namei.c:4184
>        vfs_rename+0xef6/0x17a0 fs/namei.c:4772
>        do_renameat2+0xb62/0xc90 fs/namei.c:4923
>        __do_sys_renameat2 fs/namei.c:4956 [inline]
>        __se_sys_renameat2 fs/namei.c:4953 [inline]
>        __ia32_sys_renameat2+0xe8/0x120 fs/namei.c:4953
>        do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
>        __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178
>        do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203
>        entry_SYSENTER_compat_after_hwframe+0x70/0x82

Interesting.  The above call stack is not supposed to be possible.  It says that
the target directory's encryption key is being set up in the middle of
ext4_rename().  But, fscrypt_prepare_rename() is supposed to return an error if
either the source or target directory's key isn't set up already.

> Unfortunately, I don't have any reproducer for this issue yet.

That's quite unfortunate :-(

- Eric