linux-kernel - Re: [syzbot] [overlayfs?] WARNING in shmem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251127234129.9487-1-hdanton@sina.com>
Date: Fri, 28 Nov 2025 07:41:27 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+bfc9a0ccf0de47d04e8c@...kaller.appspotmail.com>
Cc: NeilBrown <neilb@...mail.net>,
	amir73il@...il.com,
	brauner@...nel.org,
	linux-kernel@...r.kernel.org,
	linux-unionfs@...r.kernel.org,
	miklos@...redi.hu,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [overlayfs?] WARNING in shmem_unlink (2)

On Fri, 28 Nov 2025 08:42:08 +1100 NeilBrown wrote:
> On Fri, 28 Nov 2025, syzbot wrote:
> > Hello,
> > 
> > syzbot found the following issue on:
> > 
> > HEAD commit:    30f09200cc4a Merge tag 'arm64-fixes' of git://git.kernel.o..
> > git tree:       upstream
> > console output: https://syzkaller.appspot.com/x/log.txt?x=1047ee92580000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=38a0c4cddc846161
> > dashboard link: https://syzkaller.appspot.com/bug?extid=bfc9a0ccf0de47d04e8c
> > compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1626ae12580000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1126ae12580000
> > 
> > Downloadable assets:
> > disk image: https://storage.googleapis.com/syzbot-assets/a5630d1ab1eb/disk-30f09200.raw.xz
> > vmlinux: https://storage.googleapis.com/syzbot-assets/584408ed3fcf/vmlinux-30f09200.xz
> > kernel image: https://storage.googleapis.com/syzbot-assets/69749e493b1e/bzImage-30f09200.xz
> > 
> > The issue was bisected to:
> > 
> > commit d2c995581c7c5d0ff623b2700e76bf22499c66df
> > Author: NeilBrown <neil@...wn.name>
> > Date:   Wed Jul 16 00:44:14 2025 +0000
> > 
> >     ovl: Call ovl_create_temp() without lock held.
> > 
> > bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=13db1e92580000
> > final oops:     https://syzkaller.appspot.com/x/report.txt?x=103b1e92580000
> > console output: https://syzkaller.appspot.com/x/log.txt?x=17db1e92580000
> > 
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+bfc9a0ccf0de47d04e8c@...kaller.appspotmail.com
> > Fixes: d2c995581c7c ("ovl: Call ovl_create_temp() without lock held.")
> 
> I think this was probably fixed by 
> Commit 1f480a181137 ("Add start_renaming_two_dentries()")
> 
> That patch replaced the call to ovl_lock_rename_workdir()
> with start_renaming_two_dentries()
> The new function checks that the two dentries are still hashed.
> 
> ovl_lock_rename_workdir() should have been changed to check
> that the dentries were still hashed before that patch that
> the bisect found which changed the locking in ovl_cleanup_and_whiteout.
> 
> Can you please confirm the bug no longer exists after that patch?
>
#syz test upstream master