linux-kernel - Re: [syzbot] [exfat?] [ext4?] WARNING in __rt_mutex_slowlock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAKYAXd_koTJzp4hJhojnB9d_=Pgu6jaATySZ61zN4s=vZqe_FA@mail.gmail.com>
Date: Sat, 23 Aug 2025 09:59:22 +0900
From: Namjae Jeon <linkinjeon@...nel.org>
To: Sebastian Andrzej Siewior <bigeasy@...utronix.de>
Cc: syzbot <syzbot+a725ab460fc1def9896f@...kaller.appspotmail.com>, 
	brauner@...nel.org, jack@...e.cz, linux-ext4@...r.kernel.org, 
	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org, 
	sj1557.seo@...sung.com, syzkaller-bugs@...glegroups.com, tglx@...utronix.de, 
	viro@...iv.linux.org.uk
Subject: Re: [syzbot] [exfat?] [ext4?] WARNING in __rt_mutex_slowlock_locked

On Sat, Aug 23, 2025 at 1:20 AM Sebastian Andrzej Siewior
<bigeasy@...utronix.de> wrote:
>
> On 2025-08-21 07:08:32 [-0700], syzbot wrote:
> > dashboard link: https://syzkaller.appspot.com/bug?extid=a725ab460fc1def9896f
> …
> > The issue was bisected to:
> >
> > commit d2d6422f8bd17c6bb205133e290625a564194496
> > Author: Sebastian Andrzej Siewior <bigeasy@...utronix.de>
> > Date:   Fri Sep 6 10:59:04 2024 +0000
> >
> >     x86: Allow to enable PREEMPT_RT.
> >
> …
> > exFAT-fs (loop0): Medium has reported failures. Some data may be lost.
> > exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0xe5674ec2, utbl_chksum : 0xe619d30d)
> > ------------[ cut here ]------------
> > rtmutex deadlock detected
> > WARNING: CPU: 0 PID: 6000 at kernel/locking/rtmutex.c:1674 rt_mutex_handle_deadlock kernel/locking/rtmutex.c:1674 [inline]
> > WARNING: CPU: 0 PID: 6000 at kernel/locking/rtmutex.c:1674 __rt_mutex_slowlock kernel/locking/rtmutex.c:1734 [inline]
> > WARNING: CPU: 0 PID: 6000 at kernel/locking/rtmutex.c:1674 __rt_mutex_slowlock_locked+0xed2/0x25e0 kernel/locking/rtmutex.c:1760
>
> RT detected a deadlock and complained. The same testcase on !RT results
> in:
>
> | [   15.363878] loop0: detected capacity change from 0 to 256
> | [   15.367981] exFAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
> | [   15.373808] exFAT-fs (loop0): Medium has reported failures. Some data may be lost.
> | [   15.380396] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0xe5674ec2, utbl_chksum : 0xe619d30d)
> | [   62.668182] INFO: task exfat-repro:2155 blocked for more than 30 seconds.
> | [   62.669405]       Not tainted 6.17.0-rc2+ #10
> | [   62.670181] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
> | [   62.671612] task:exfat-repro     state:D stack:0     pid:2155  tgid:2155  ppid:1      task_flags:0x400140 flags:0x00004006
> | [   62.673557] Call Trace:
> | [   62.674008]  <TASK>
> | [   62.674400]  __schedule+0x4ef/0xbb0
> | [   62.675069]  schedule+0x22/0xd0
> | [   62.675656]  schedule_preempt_disabled+0x10/0x20
> | [   62.676495]  rwsem_down_write_slowpath+0x1e2/0x6c0
> | [   62.679028]  down_write+0x66/0x70
> | [   62.679645]  vfs_rename+0x5c6/0xc30
> | [   62.681734]  do_renameat2+0x3c4/0x570
> | [   62.682395]  __x64_sys_renameat2+0x7b/0xc0
> | [   62.683187]  do_syscall_64+0x7f/0x290
> | [   62.695576]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
>
> After ctrl+c that testcase terminates but one thread remains in D state.
> This is from
> |         lock_new_subdir = new_dir != old_dir || !(flags & RENAME_EXCHANGE);
> |         if (is_dir) {
> |                 if (lock_old_subdir)
> |                         inode_lock_nested(source, I_MUTEX_CHILD);
>                           ^^^
> | 5 locks held by exfat-repro/2156:
> |  #0: ffff888113b69400 (sb_writers#11){.+.+}-{0:0}, at: do_renameat2+0x1c8/0x580
> |  #1: ffff888113b69710 (&type->s_vfs_rename_key){+.+.}-{4:4}, at: do_renameat2+0x24d/0x580
> |  #2: ffff88810fb79b88 (&sb->s_type->i_mutex_key#16/1){+.+.}-{4:4}, at: lock_two_directories+0x6c/0x110
> |  #3: ffff88810fb7a1c0 (&sb->s_type->i_mutex_key#17/5){+.+.}-{4:4}, at: lock_two_directories+0x82/0x110
> |  #4: ffffffff82f618a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184
>
> #2 and #3 are from the "(r == p1)" case. The lock it appears to acquire
> is #2.
> Could an exfat take a look, please?
I will take a look.
Thanks!
>
> Sebastian