linux-kernel - Re: [PATCH next] btrfs: fix deadlock in btrfs_read_chunk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1d765fc0-e971-4c8b-95ab-4cdfcea183c8@gmx.com>
Date: Thu, 26 Jun 2025 06:59:14 +0930
From: Qu Wenruo <quwenruo.btrfs@....com>
To: Hillf Danton <hdanton@...a.com>
Cc: Edward Adam Davis <eadavis@...com>,
 syzbot+fa90fcaa28f5cd4b1fc1@...kaller.appspotmail.com, clm@...com,
 josef@...icpanda.com, linux-btrfs@...r.kernel.org,
 linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Re: [PATCH next] btrfs: fix deadlock in btrfs_read_chunk_tree



在 2025/6/25 22:10, Hillf Danton 写道:
> On Wed, 25 Jun 2025 20:19:06 +0930 Qu Wenruo wrote:
>> =E5=9C=A8 2025/6/25 09:26, Hillf Danton =E5=86=99=E9=81=93:
>>> On Wed, 25 Jun 2025 06:00:09 +0930 Qu Wenruo wrote:
>>>> =3DE5=3D9C=3DA8 2025/6/25 00:00, Edward Adam Davis =3DE5=3D86=3D99=3DE9=
>> =3D81=3D93:
>>>>> Remove the lock uuid_mutex outside of sget_fc() to avoid the deadlock
>>>>> reported by [1].
>>>>> =3D20
>>>>> [1]
>>>>> -> #1 (&type->s_umount_key#41/1){+.+.}-{4:4}:
>>>>>           lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871
>>>>>           down_write_nested+0x9d/0x200 kernel/locking/rwsem.c:1693
>>>>>           alloc_super+0x204/0x970 fs/super.c:345
>>> =20
>>> Given kzalloc [3], the syzbot report is false positive (a known lockdep
>>> issue) as nobody else should acquire s->s_umount lock.
>>> =20
>>> [3] https://web.git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.=
>> git/tree/fs/super.c?id=3D7aacdf6feed1#n319
>>
>> Not a false alert either.
>>
>> sget_fc() can return an existing super block, we can race between a=20
>> mount and an unmount on the same super block.
>>
>> In that case it's going to cause problem.
>>
>> This is already fixed in the v4 (and later v5) patchset:
>>
>> https://lore.kernel.org/linux-btrfs/cover.1750724841.git.wqu@suse.com/
>>
> Can v5 survive the syzbot test?

Yes, I enabled lockdep during v5 tests.