linux-kernel - INFO: task hung in chmod

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <79192769.9da0.195faff9e75.Coremail.baishuoran@hrbeu.edu.cn>
Date: Thu, 3 Apr 2025 17:33:31 +0800 (GMT+08:00)
From: 白烁冉 <baishuoran@...eu.edu.cn>
To: "Alexander Viro" <viro@...iv.linux.org.uk>,
	"Christian Brauner" <brauner@...nel.org>
Cc: "Jan Kara" <jack@...e.cz>, linux-fsdevel@...r.kernel.org,
	"Kun Hu" <huk23@...udan.edu.cn>,
	"Jiaji Qin" <jjtan24@...udan.edu.cn>, linux-kernel@...r.kernel.org,
	syzkaller@...glegroups.com
Subject: INFO: task hung in chmod_common

Dear Maintainers,

When using our customized Syzkaller to fuzz the latest Linux kernel, the following crash (95th)was triggered.


HEAD commit: 6537cfb395f352782918d8ee7b7f10ba2cc3cbf2
git tree: upstream
Output:https://github.com/pghk13/Kernel-Bug/tree/main/0305_6.14rc5/95-INFO_%20rcu%20detected%20stall%20in%20sys_chdir
Kernel config:https://github.com/pghk13/Kernel-Bug/blob/main/0305_6.14rc5/config.txt
C reproducer:https://github.com/pghk13/Kernel-Bug/blob/main/0305_6.14rc5/95-INFO_%20rcu%20detected%20stall%20in%20sys_chdir/95repro.c
Syzlang reproducer: https://github.com/pghk13/Kernel-Bug/blob/main/0305_6.14rc5/95-INFO_%20rcu%20detected%20stall%20in%20sys_chdir/95call_trace.txt



Our reproducer uses mounts a constructed filesystem image.
This could be a file system deadlock issue that occurs on lines 547-548 of the chmod_common function. When this function is called, the code already holds the inode lock (via the inode_lock (inode)), but the notify_change may need to perform RCU-protected operations internally. The core of the problem is that the chmod_common function calls the notify_change while holding the inode lock, and the notify_change internally relies on the RCU protection mechanism. At a specific path to the SYSV file system, this combination results in a deadlock.
We have reproduced this issue several times on 6.14-rc5 again.



If you fix this issue, please add the following tag to the commit:
Reported-by: Kun Hu <huk23@...udan.edu.cn>, Jiaji Qin <jjtan24@...udan.edu.cn>, Shuoran Bai <baishuoran@...eu.edu.cn>




=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 47 Comm: khungtaskd Not tainted 6.14.0 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x116/0x1b0
 nmi_cpu_backtrace+0x2a0/0x350
 nmi_trigger_cpumask_backtrace+0x29b/0x300
 watchdog+0xf4c/0x1210
 kthread+0x42a/0x880
 ret_from_fork+0x48/0x80
 ret_from_fork_asm+0x1a/0x30
 </TASK>
Sending NMI from CPU 0 to CPUs 1-3:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 14642 Comm: syz.6.22 Not tainted 6.14.0 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:rcu_lockdep_current_cpu_online+0xcd/0x150
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 75 76 48 8d 7d 70 48 8b 5b 20 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 <75> 5e 48 8b 55 70 b8 01 00 00 00 48 85 d3 74 10 65 ff 0d b4 45 64
RSP: 0018:ffffc90012c8f0e8 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: 0000000000000002 RCX: ffffffff8b58034f
RDX: 1ffffffff1c38d6e RSI: 0000000000000001 RDI: ffffffff8e1c6b70
RBP: ffffffff8e1c6b00 R08: 0000000000000000 R09: fffffbfff2de7999
R10: fffffbfff2de7998 R11: ffffffff96f3ccc7 R12: ffff8880709f9e42
R13: ffffc90012c8f260 R14: ffff88801d9c0880 R15: ffffc90012c8f248
FS:  00007f5cbd890700(0000) GS:ffff88807ee00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f40cbc8f000 CR3: 00000000531ac000 CR4: 0000000000750ef0
PKRU: 00000000
Call Trace:
 <NMI>
 </NMI>
 <TASK>
 rcu_read_lock_held_common+0x4c/0xa0
 rcu_read_lock_held+0x5e/0xb0
 xas_start+0x241/0x7a0
 xas_load+0x2c/0x560
 filemap_get_entry+0x118/0x740
 __filemap_get_folio+0x57/0xb30
 __find_get_block+0x14f/0xcc0
 bdev_getblk+0x17c/0x640
 __bread_gfp+0x8f/0x350
 get_branch+0x2ce/0x6a0
 get_block+0x18b/0x1570
 block_read_full_folio+0x3da/0xca0
 filemap_read_folio+0xbf/0x2b0
 do_read_cache_folio+0x24f/0x590
 dir_get_folio.isra.0+0x21/0xa0
 sysv_find_entry+0x1bc/0x5f0
 sysv_inode_by_name+0x71/0x280
 sysv_lookup+0x84/0x100
 __lookup_slow+0x25b/0x490
 walk_component+0x345/0x5b0
 path_lookupat.isra.0+0x180/0x560
 filename_lookup+0x211/0x470
 user_path_at+0x3e/0x90
 __x64_sys_chdir+0xb5/0x260
 do_syscall_64+0xcf/0x250
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5cbc9acadd
Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5cbd88fba8 EFLAGS: 00000246 ORIG_RAX: 0000000000000050
RAX: ffffffffffffffda RBX: 00007f5cbcba5fa0 RCX: 00007f5cbc9acadd
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000140
RBP: 00007f5cbca2ab8f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5cbcba5fac R14: 00007f5cbcba6038 R15: 00007f5cbd88fd40
--------------------------------






thanks,
Kun Hu