| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CADCV8sphDww3CUj5hv2+jUiqg7YeCkk7xhVDbnAieQw9+gaaAQ@mail.gmail.com>
Date: Tue, 14 Jan 2025 19:16:22 +0800
From: Liebes Wang <wanghaichi0403@...il.com>
To: mark@...heh.com, jlbec@...lplan.org, joseph.qi@...ux.alibaba.com,
ocfs2-devel@...ts.linux.dev, linux-kernel@...r.kernel.org
Cc: syzkaller@...glegroups.com
Subject: possible deadlock in ocfs2_write_begin_nolock
Dear Linux maintainers and reviewers:
We are reporting a Linux kernel bug titled **possible deadlock in
ocfs2_write_begin_nolock**, discovered using a modified version of
Syzkaller.
Linux version: 2144da25584eb10b84252230319b5783f6a83041
The bisection log shows the first introduced commit is
5fc8cbe4cf0fd34ded8045c385790c3bf04f6785:
5fc8cbe4cf0f rcu-tasks: Avoid pr_info() with spin lock in
cblist_init_generic()
The test case, kernel config and full bisection log are in attach.
The report is (The full report is attached):
WARNING: possible circular locking dependency detected
6.12.0-rc6 #1 Not tainted
------------------------------------------------------
syz.7.168/6155 is trying to acquire lock:
ff110001596745e8 (sb_internal#4){.+.+}-{0:0}, at: ocfs2_write_begin_inline
fs/ocfs2/aops.c:1479 [inline]
ff110001596745e8 (sb_internal#4){.+.+}-{0:0}, at:
ocfs2_try_to_write_inline_data fs/ocfs2/aops.c:1582 [inline]
ff110001596745e8 (sb_internal#4){.+.+}-{0:0}, at:
ocfs2_write_begin_nolock+0x18d5/0x66e0 fs/ocfs2/aops.c:1668
but task is already holding lock:
ff110001585922e0 (&oi->ip_alloc_sem){++++}-{3:3}, at:
ocfs2_write_begin+0x1ba/0x350 fs/ocfs2/aops.c:1900
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #4 (&oi->ip_alloc_sem){++++}-{3:3}:
down_write+0x92/0x1f0 kernel/locking/rwsem.c:1577
ocfs2_try_remove_refcount_tree+0xa6/0x310 fs/ocfs2/refcounttree.c:932
ocfs2_xattr_set+0x1432/0x27b0 fs/ocfs2/xattr.c:3670
ocfs2_set_acl+0x46f/0x530 fs/ocfs2/acl.c:254
ocfs2_iop_set_acl+0x1d2/0x270 fs/ocfs2/acl.c:286
set_posix_acl+0x25e/0x330 fs/posix_acl.c:955
vfs_remove_acl+0x338/0x610 fs/posix_acl.c:1242
removexattr fs/xattr.c:906 [inline]
path_removexattr+0x1ef/0x2b0 fs/xattr.c:928
__do_sys_lremovexattr fs/xattr.c:948 [inline]
__se_sys_lremovexattr fs/xattr.c:945 [inline]
__x64_sys_lremovexattr+0x56/0x80 fs/xattr.c:945
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xc1/0x1d0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #3 (&oi->ip_xattr_sem){++++}-{3:3}:
down_read+0x9a/0x320 kernel/locking/rwsem.c:1524
ocfs2_init_acl+0x2f7/0x7d0 fs/ocfs2/acl.c:366
ocfs2_mknod+0xdac/0x24c0 fs/ocfs2/namei.c:408
ocfs2_create+0x167/0x420 fs/ocfs2/namei.c:672
lookup_open.isra.0+0x106e/0x1450 fs/namei.c:3595
open_last_lookups fs/namei.c:3694 [inline]
path_openat+0xcb9/0x2940 fs/namei.c:3930
do_filp_open+0x1c7/0x410 fs/namei.c:3960
do_sys_openat2+0x164/0x1d0 fs/open.c:1415
do_sys_open fs/open.c:1430 [inline]
__do_sys_openat fs/open.c:1446 [inline]
__se_sys_openat fs/open.c:1441 [inline]
__x64_sys_openat+0x140/0x1f0 fs/open.c:1441
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xc1/0x1d0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #2 (jbd2_handle){++++}-{0:0}:
start_this_handle+0xe5b/0x1300 fs/jbd2/transaction.c:448
jbd2__journal_start+0x394/0x6a0 fs/jbd2/transaction.c:505
jbd2_journal_start+0x2c/0x40 fs/jbd2/transaction.c:544
ocfs2_start_trans+0x3ba/0x960 fs/ocfs2/journal.c:352
ocfs2_mknod+0xc70/0x24c0 fs/ocfs2/namei.c:359
ocfs2_create+0x167/0x420 fs/ocfs2/namei.c:672
lookup_open.isra.0+0x106e/0x1450 fs/namei.c:3595
open_last_lookups fs/namei.c:3694 [inline]
path_openat+0xcb9/0x2940 fs/namei.c:3930
do_filp_open+0x1c7/0x410 fs/namei.c:3960
do_sys_openat2+0x164/0x1d0 fs/open.c:1415
do_sys_open fs/open.c:1430 [inline]
__do_sys_openat fs/open.c:1446 [inline]
__se_sys_openat fs/open.c:1441 [inline]
__x64_sys_openat+0x140/0x1f0 fs/open.c:1441
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xc1/0x1d0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #1 (&journal->j_trans_barrier){.+.+}-{3:3}:
down_read+0x9a/0x320 kernel/locking/rwsem.c:1524
ocfs2_start_trans+0x3af/0x960 fs/ocfs2/journal.c:350
ocfs2_mknod+0xc70/0x24c0 fs/ocfs2/namei.c:359
ocfs2_create+0x167/0x420 fs/ocfs2/namei.c:672
lookup_open.isra.0+0x106e/0x1450 fs/namei.c:3595
open_last_lookups fs/namei.c:3694 [inline]
path_openat+0xcb9/0x2940 fs/namei.c:3930
do_filp_open+0x1c7/0x410 fs/namei.c:3960
do_sys_openat2+0x164/0x1d0 fs/open.c:1415
do_sys_open fs/open.c:1430 [inline]
__do_sys_openat fs/open.c:1446 [inline]
__se_sys_openat fs/open.c:1441 [inline]
__x64_sys_openat+0x140/0x1f0 fs/open.c:1441
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xc1/0x1d0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (sb_internal#4){.+.+}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain kernel/locking/lockdep.c:3904 [inline]
__lock_acquire+0x2381/0x3a20 kernel/locking/lockdep.c:5202
lock_acquire kernel/locking/lockdep.c:5825 [inline]
lock_acquire+0x19d/0x530 kernel/locking/lockdep.c:5790
percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
__sb_start_write include/linux/fs.h:1716 [inline]
sb_start_intwrite include/linux/fs.h:1899 [inline]
ocfs2_start_trans+0x2a8/0x960 fs/ocfs2/journal.c:348
ocfs2_write_begin_inline fs/ocfs2/aops.c:1479 [inline]
ocfs2_try_to_write_inline_data fs/ocfs2/aops.c:1582 [inline]
ocfs2_write_begin_nolock+0x18d5/0x66e0 fs/ocfs2/aops.c:1668
ocfs2_write_begin+0x1d9/0x350 fs/ocfs2/aops.c:1902
generic_perform_write+0x281/0x7e0 mm/filemap.c:4054
__generic_file_write_iter+0x160/0x1a0 mm/filemap.c:4155
ocfs2_file_write_iter+0xc55/0x2180 fs/ocfs2/file.c:2467
new_sync_write fs/read_write.c:590 [inline]
vfs_write+0xbea/0x10c0 fs/read_write.c:683
ksys_write+0x122/0x250 fs/read_write.c:736
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xc1/0x1d0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Chain exists of:
sb_internal#4 --> &oi->ip_xattr_sem --> &oi->ip_alloc_sem
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&oi->ip_alloc_sem);
lock(&oi->ip_xattr_sem);
lock(&oi->ip_alloc_sem);
rlock(sb_internal#4);
*** DEADLOCK ***
4 locks held by syz.7.168/6155:
#0: ff11000149e307f8 (&f->f_pos_lock){+.+.}-{3:3}, at:
fdget_pos+0x24c/0x360 fs/file.c:1160
#1: ff110001596743f8 (sb_writers#28){.+.+}-{0:0}, at:
ksys_write+0x122/0x250 fs/read_write.c:736
#2: ff11000158592640 (&sb->s_type->i_mutex_key#31){+.+.}-{3:3}, at:
inode_lock include/linux/fs.h:815 [inline]
#2: ff11000158592640 (&sb->s_type->i_mutex_key#31){+.+.}-{3:3}, at:
ocfs2_file_write_iter+0x3d6/0x2180 fs/ocfs2/file.c:2399
#3: ff110001585922e0 (&oi->ip_alloc_sem){++++}-{3:3}, at:
ocfs2_write_begin+0x1ba/0x350 fs/ocfs2/aops.c:1900
Content of type "text/html" skipped
Download attachment "bisect.log" of type "application/octet-stream" (26522 bytes)
Download attachment "kconfig" of type "application/octet-stream" (149021 bytes)
Download attachment "repro.c" of type "application/octet-stream" (95679 bytes)
Download attachment "report1" of type "application/octet-stream" (10941 bytes)
Powered by blists - more mailing lists