linux-kernel - Re: [syzbot] [ext4?] [ocfs2?] possible deadlock in dqget

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <8950a6e1-287c-43c7-b36a-cc42ca7e267c@I-love.SAKURA.ne.jp>
Date: Tue, 21 Oct 2025 19:38:29 +0900
From: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
To: syzbot <syzbot+6e493c165d26d6fcbf72@...kaller.appspotmail.com>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [syzbot] [ext4?] [ocfs2?] possible deadlock in dqget

#syz test

diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index d480b94117cd..097c0dd24000 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -1521,7 +1521,6 @@ static journal_t *journal_init_common(struct block_device *bdev,
 			struct block_device *fs_dev,
 			unsigned long long start, int len, int blocksize)
 {
-	static struct lock_class_key jbd2_trans_commit_key;
 	journal_t *journal;
 	int err;
 	int n;
@@ -1530,6 +1529,13 @@ static journal_t *journal_init_common(struct block_device *bdev,
 	if (!journal)
 		return ERR_PTR(-ENOMEM);
 
+	lockdep_register_key(&journal->jbd2_trans_commit_key);
+	lockdep_register_key(&journal->j_abort_mutex_key);
+	mutex_init_with_key(&journal->j_abort_mutex, &journal->j_abort_mutex_key);
+	lockdep_register_key(&journal->j_barrier_key);
+	mutex_init_with_key(&journal->j_barrier, &journal->j_barrier_key);
+	lockdep_register_key(&journal->j_checkpoint_mutex_key);
+	mutex_init_with_key(&journal->j_checkpoint_mutex, &journal->j_checkpoint_mutex_key);
 	journal->j_blocksize = blocksize;
 	journal->j_dev = bdev;
 	journal->j_fs_dev = fs_dev;
@@ -1547,9 +1553,6 @@ static journal_t *journal_init_common(struct block_device *bdev,
 	init_waitqueue_head(&journal->j_wait_updates);
 	init_waitqueue_head(&journal->j_wait_reserved);
 	init_waitqueue_head(&journal->j_fc_wait);
-	mutex_init(&journal->j_abort_mutex);
-	mutex_init(&journal->j_barrier);
-	mutex_init(&journal->j_checkpoint_mutex);
 	spin_lock_init(&journal->j_revoke_lock);
 	spin_lock_init(&journal->j_list_lock);
 	spin_lock_init(&journal->j_history_lock);
@@ -1560,7 +1563,7 @@ static journal_t *journal_init_common(struct block_device *bdev,
 	journal->j_max_batch_time = 15000; /* 15ms */
 	atomic_set(&journal->j_reserved_credits, 0);
 	lockdep_init_map(&journal->j_trans_commit_map, "jbd2_handle",
-			 &jbd2_trans_commit_key, 0);
+			 &journal->jbd2_trans_commit_key, 0);
 
 	/* The journal is marked for error until we succeed with recovery! */
 	journal->j_flags = JBD2_ABORT;
@@ -1611,6 +1614,13 @@ static journal_t *journal_init_common(struct block_device *bdev,
 	kfree(journal->j_wbuf);
 	jbd2_journal_destroy_revoke(journal);
 	journal_fail_superblock(journal);
+	mutex_destroy(&journal->j_abort_mutex);
+	lockdep_unregister_key(&journal->j_abort_mutex_key);
+	mutex_destroy(&journal->j_barrier);
+	lockdep_unregister_key(&journal->j_barrier_key);
+	mutex_destroy(&journal->j_checkpoint_mutex);
+	lockdep_unregister_key(&journal->j_checkpoint_mutex_key);
+	lockdep_unregister_key(&journal->jbd2_trans_commit_key);
 	kfree(journal);
 	return ERR_PTR(err);
 }
@@ -2187,6 +2197,13 @@ int jbd2_journal_destroy(journal_t *journal)
 		jbd2_journal_destroy_revoke(journal);
 	kfree(journal->j_fc_wbuf);
 	kfree(journal->j_wbuf);
+	mutex_destroy(&journal->j_abort_mutex);
+	lockdep_unregister_key(&journal->j_abort_mutex_key);
+	mutex_destroy(&journal->j_barrier);
+	lockdep_unregister_key(&journal->j_barrier_key);
+	mutex_destroy(&journal->j_checkpoint_mutex);
+	lockdep_unregister_key(&journal->j_checkpoint_mutex_key);
+	lockdep_unregister_key(&journal->jbd2_trans_commit_key);
 	kfree(journal);
 
 	return err;
diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
index 43b9297fe8a7..c6d497219e1c 100644
--- a/include/linux/jbd2.h
+++ b/include/linux/jbd2.h
@@ -1253,6 +1253,30 @@ struct journal_s
 	 */
 	struct lockdep_map	j_trans_commit_map;
 #endif
+	/**
+	 * @jbd2_trans_commit_key:
+	 *
+	 * "struct lock_class_key" for @j_trans_commit_map
+	 */
+	struct lock_class_key	jbd2_trans_commit_key;
+	/**
+	 * @j_abort_mutex_key:
+	 *
+	 * "struct lock_class_key" for @j_abort_mutex
+	 */
+	struct lock_class_key	j_abort_mutex_key;
+	/**
+	 * @j_barrier_key:
+	 *
+	 * "struct lock_class_key" for @j_barrier
+	 */
+	struct lock_class_key	j_barrier_key;
+	/**
+	 * @j_checkpoint_mutex_key:
+	 *
+	 * "struct lock_class_key" for @j_checkpoint_mutex
+	 */
+	struct lock_class_key	j_checkpoint_mutex_key;
 
 	/**
 	 * @j_fc_cleanup_callback: