linux-kernel - Re: [syzbot] [exfat?] [ext4?] WARNING in __rt_mutex_slowlock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250822162041.gXcLgwIW@linutronix.de>
Date: Fri, 22 Aug 2025 18:20:41 +0200
From: Sebastian Andrzej Siewior <bigeasy@...utronix.de>
To: syzbot <syzbot+a725ab460fc1def9896f@...kaller.appspotmail.com>
Cc: brauner@...nel.org, jack@...e.cz, linkinjeon@...nel.org,
	linux-ext4@...r.kernel.org, linux-fsdevel@...r.kernel.org,
	linux-kernel@...r.kernel.org, sj1557.seo@...sung.com,
	syzkaller-bugs@...glegroups.com, tglx@...utronix.de,
	viro@...iv.linux.org.uk
Subject: Re: [syzbot] [exfat?] [ext4?] WARNING in __rt_mutex_slowlock_locked

On 2025-08-21 07:08:32 [-0700], syzbot wrote:
> dashboard link: https://syzkaller.appspot.com/bug?extid=a725ab460fc1def9896f
…
> The issue was bisected to:
> 
> commit d2d6422f8bd17c6bb205133e290625a564194496
> Author: Sebastian Andrzej Siewior <bigeasy@...utronix.de>
> Date:   Fri Sep 6 10:59:04 2024 +0000
> 
>     x86: Allow to enable PREEMPT_RT.
> 
…
> exFAT-fs (loop0): Medium has reported failures. Some data may be lost.
> exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0xe5674ec2, utbl_chksum : 0xe619d30d)
> ------------[ cut here ]------------
> rtmutex deadlock detected
> WARNING: CPU: 0 PID: 6000 at kernel/locking/rtmutex.c:1674 rt_mutex_handle_deadlock kernel/locking/rtmutex.c:1674 [inline]
> WARNING: CPU: 0 PID: 6000 at kernel/locking/rtmutex.c:1674 __rt_mutex_slowlock kernel/locking/rtmutex.c:1734 [inline]
> WARNING: CPU: 0 PID: 6000 at kernel/locking/rtmutex.c:1674 __rt_mutex_slowlock_locked+0xed2/0x25e0 kernel/locking/rtmutex.c:1760

RT detected a deadlock and complained. The same testcase on !RT results
in:

| [   15.363878] loop0: detected capacity change from 0 to 256
| [   15.367981] exFAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
| [   15.373808] exFAT-fs (loop0): Medium has reported failures. Some data may be lost.
| [   15.380396] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0xe5674ec2, utbl_chksum : 0xe619d30d)
| [   62.668182] INFO: task exfat-repro:2155 blocked for more than 30 seconds.
| [   62.669405]       Not tainted 6.17.0-rc2+ #10
| [   62.670181] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
| [   62.671612] task:exfat-repro     state:D stack:0     pid:2155  tgid:2155  ppid:1      task_flags:0x400140 flags:0x00004006
| [   62.673557] Call Trace:
| [   62.674008]  <TASK>
| [   62.674400]  __schedule+0x4ef/0xbb0
| [   62.675069]  schedule+0x22/0xd0
| [   62.675656]  schedule_preempt_disabled+0x10/0x20
| [   62.676495]  rwsem_down_write_slowpath+0x1e2/0x6c0
| [   62.679028]  down_write+0x66/0x70
| [   62.679645]  vfs_rename+0x5c6/0xc30
| [   62.681734]  do_renameat2+0x3c4/0x570
| [   62.682395]  __x64_sys_renameat2+0x7b/0xc0
| [   62.683187]  do_syscall_64+0x7f/0x290
| [   62.695576]  entry_SYSCALL_64_after_hwframe+0x76/0x7e

After ctrl+c that testcase terminates but one thread remains in D state.
This is from 
|         lock_new_subdir = new_dir != old_dir || !(flags & RENAME_EXCHANGE);
|         if (is_dir) {
|                 if (lock_old_subdir)
|                         inode_lock_nested(source, I_MUTEX_CHILD);
                          ^^^
| 5 locks held by exfat-repro/2156:
|  #0: ffff888113b69400 (sb_writers#11){.+.+}-{0:0}, at: do_renameat2+0x1c8/0x580
|  #1: ffff888113b69710 (&type->s_vfs_rename_key){+.+.}-{4:4}, at: do_renameat2+0x24d/0x580
|  #2: ffff88810fb79b88 (&sb->s_type->i_mutex_key#16/1){+.+.}-{4:4}, at: lock_two_directories+0x6c/0x110
|  #3: ffff88810fb7a1c0 (&sb->s_type->i_mutex_key#17/5){+.+.}-{4:4}, at: lock_two_directories+0x82/0x110
|  #4: ffffffff82f618a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184

#2 and #3 are from the "(r == p1)" case. The lock it appears to acquire
is #2.
Could an exfat take a look, please?

Sebastian