linux-kernel - Re: [PATCH next] btrfs: fix deadlock in btrfs_read_chunk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2e81c9bf-64ea-4d6b-a771-1befd4c319c8@gmx.com>
Date: Wed, 25 Jun 2025 06:00:09 +0930
From: Qu Wenruo <quwenruo.btrfs@....com>
To: Edward Adam Davis <eadavis@...com>,
 syzbot+fa90fcaa28f5cd4b1fc1@...kaller.appspotmail.com
Cc: clm@...com, dsterba@...e.com, josef@...icpanda.com,
 linux-btrfs@...r.kernel.org, linux-kernel@...r.kernel.org,
 syzkaller-bugs@...glegroups.com, wqu@...e.com
Subject: Re: [PATCH next] btrfs: fix deadlock in btrfs_read_chunk_tree



在 2025/6/25 00:00, Edward Adam Davis 写道:
> Remove the lock uuid_mutex outside of sget_fc() to avoid the deadlock
> reported by [1].
> 
> [1]
> -> #1 (&type->s_umount_key#41/1){+.+.}-{4:4}:
>         lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871
>         down_write_nested+0x9d/0x200 kernel/locking/rwsem.c:1693
>         alloc_super+0x204/0x970 fs/super.c:345
>         sget_fc+0x329/0xa40 fs/super.c:761
>         btrfs_get_tree_super fs/btrfs/super.c:1867 [inline]
>         btrfs_get_tree_subvol fs/btrfs/super.c:2059 [inline]
>         btrfs_get_tree+0x4c6/0x12d0 fs/btrfs/super.c:2093
>         vfs_get_tree+0x8f/0x2b0 fs/super.c:1804
>         do_new_mount+0x24a/0xa40 fs/namespace.c:3902
>         do_mount fs/namespace.c:4239 [inline]
>         __do_sys_mount fs/namespace.c:4450 [inline]
>         __se_sys_mount+0x317/0x410 fs/namespace.c:4427
>         do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>         do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
>         entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> -> #0 (uuid_mutex){+.+.}-{4:4}:
>         check_prev_add kernel/locking/lockdep.c:3168 [inline]
>         check_prevs_add kernel/locking/lockdep.c:3287 [inline]
>         validate_chain+0xb9b/0x2140 kernel/locking/lockdep.c:3911
>         __lock_acquire+0xab9/0xd20 kernel/locking/lockdep.c:5240
>         lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871
>         __mutex_lock_common kernel/locking/mutex.c:602 [inline]
>         __mutex_lock+0x182/0xe80 kernel/locking/mutex.c:747
>         btrfs_read_chunk_tree+0xef/0x2170 fs/btrfs/volumes.c:7462
>         open_ctree+0x17f2/0x3a10 fs/btrfs/disk-io.c:3458
>         btrfs_fill_super fs/btrfs/super.c:984 [inline]
>         btrfs_get_tree_super fs/btrfs/super.c:1922 [inline]
>         btrfs_get_tree_subvol fs/btrfs/super.c:2059 [inline]
>         btrfs_get_tree+0xc6f/0x12d0 fs/btrfs/super.c:2093
>         vfs_get_tree+0x8f/0x2b0 fs/super.c:1804
>         do_new_mount+0x24a/0xa40 fs/namespace.c:3902
>         do_mount fs/namespace.c:4239 [inline]
>         __do_sys_mount fs/namespace.c:4450 [inline]
>         __se_sys_mount+0x317/0x410 fs/namespace.c:4427
>         do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>         do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
>         entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> other info that might help us debug this:
> 
>   Possible unsafe locking scenario:
> 
>         CPU0                    CPU1
>         ----                    ----
>    lock(&type->s_umount_key#41/1);
>                                 lock(uuid_mutex);
>                                 lock(&type->s_umount_key#41/1);
>    lock(uuid_mutex);
> 
>   *** DEADLOCK ***
> 
> Fixes: 7aacdf6feed1 ("btrfs: delay btrfs_open_devices() until super block is created")
> Reported-by: syzbot+fa90fcaa28f5cd4b1fc1@...kaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=fa90fcaa28f5cd4b1fc1
> Tested-by: syzbot+fa90fcaa28f5cd4b1fc1@...kaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <eadavis@...com>
> ---
>   fs/btrfs/super.c | 7 ++++---
>   1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
> index 237e60b53192..c2ce1eb53ad7 100644
> --- a/fs/btrfs/super.c
> +++ b/fs/btrfs/super.c
> @@ -1864,11 +1864,10 @@ static int btrfs_get_tree_super(struct fs_context *fc)
>   	fs_devices = device->fs_devices;
>   	fs_info->fs_devices = fs_devices;
>   
> +	mutex_unlock(&uuid_mutex);

No, you can not unlock uuid_mutex without opening the devices.

Just run the test case generic/604.

>   	sb = sget_fc(fc, btrfs_fc_test_super, set_anon_super_fc);
> -	if (IS_ERR(sb)) {
> -		mutex_unlock(&uuid_mutex);
> +	if (IS_ERR(sb))
>   		return PTR_ERR(sb);
> -	}
>   
>   	set_device_specific_options(fs_info);
>   
> @@ -1887,6 +1886,7 @@ static int btrfs_get_tree_super(struct fs_context *fc)
>   		 * But the fs_info->fs_devices is not opened, we should not let
>   		 * btrfs_free_fs_context() to close them.
>   		 */
> +		mutex_lock(&uuid_mutex);
>   		fs_info->fs_devices = NULL;
>   		mutex_unlock(&uuid_mutex);
>   
> @@ -1906,6 +1906,7 @@ static int btrfs_get_tree_super(struct fs_context *fc)
>   		 */
>   		ASSERT(fc->s_fs_info == NULL);
>   
> +		mutex_lock(&uuid_mutex);
>   		ret = btrfs_open_devices(fs_devices, mode, sb);
>   		mutex_unlock(&uuid_mutex);
>   		if (ret < 0) {