linux-kernel - Re: [syzbot] [mm?] possible deadlock in __vma_start

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250605104819.GP39944@noisy.programming.kicks-ass.net>
Date: Thu, 5 Jun 2025 12:48:19 +0200
From: Peter Zijlstra <peterz@...radead.org>
To: Petr Mladek <pmladek@...e.com>
Cc: Vlastimil Babka <vbabka@...e.cz>,
	syzbot <syzbot+23de6daeb71241d36a18@...kaller.appspotmail.com>,
	Liam.Howlett@...cle.com, akpm@...ux-foundation.org,
	jannh@...gle.com, linux-kernel@...r.kernel.org, linux-mm@...ck.org,
	lorenzo.stoakes@...cle.com, pfalcato@...e.de,
	syzkaller-bugs@...glegroups.com,
	Suren Baghdasaryan <surenb@...gle.com>,
	John Ogness <john.ogness@...utronix.de>
Subject: Re: [syzbot] [mm?] possible deadlock in __vma_start_write

On Thu, Jun 05, 2025 at 11:40:04AM +0200, Petr Mladek wrote:

> I just wanted to better understand what was going on here ;-)
> Let me share my thoughts.
> 
> First, the deadlock might happen only when all these (or similar) code
> paths might be called in parallel.

I've found that this is often easier than you think.

> The two backtraces, right above, are from initcalls. It is possible
> that the code path in the 1st backtrace can't be called before
> the device is initialized. So, it is possible that the deadlock
> can't happen in the real life.

This is a very shaky assumption. Lockdep only records the first time it
sees a particular order. So seeing an initcall in the stack trace only
means it happens first during an initcall. It does *NOT* mean it only
happens during initcall.

The only conclusion that can be had is that nobody thereafter uses those
locks in the reverse order -- because that would result in a splat.