linux-kernel - Re: [syzbot] [overlayfs?] WARNING in shmem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-id: <176429261525.634289.6503002057772274922@noble.neil.brown.name>
Date: Fri, 28 Nov 2025 12:16:55 +1100
From: NeilBrown <neilb@...mail.net>
To: "Hillf Danton" <hdanton@...a.com>
Cc: "syzbot" <syzbot+bfc9a0ccf0de47d04e8c@...kaller.appspotmail.com>,
 amir73il@...il.com, brauner@...nel.org, linux-kernel@...r.kernel.org,
 linux-unionfs@...r.kernel.org, miklos@...redi.hu,
 syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [overlayfs?] WARNING in shmem_unlink (2)

On Fri, 28 Nov 2025, Hillf Danton wrote:
> On Fri, 28 Nov 2025 08:42:08 +1100 NeilBrown wrote:
> > On Fri, 28 Nov 2025, syzbot wrote:
> > > Hello,
> > > 
> > > syzbot found the following issue on:
> > > 
> > > HEAD commit:    30f09200cc4a Merge tag 'arm64-fixes' of git://git.kernel.o..
> > > git tree:       upstream
> > > console output: https://syzkaller.appspot.com/x/log.txt?x=1047ee92580000
> > > kernel config:  https://syzkaller.appspot.com/x/.config?x=38a0c4cddc846161
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=bfc9a0ccf0de47d04e8c
> > > compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> > > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1626ae12580000
> > > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1126ae12580000
> > > 
> > > Downloadable assets:
> > > disk image: https://storage.googleapis.com/syzbot-assets/a5630d1ab1eb/disk-30f09200.raw.xz
> > > vmlinux: https://storage.googleapis.com/syzbot-assets/584408ed3fcf/vmlinux-30f09200.xz
> > > kernel image: https://storage.googleapis.com/syzbot-assets/69749e493b1e/bzImage-30f09200.xz
> > > 
> > > The issue was bisected to:
> > > 
> > > commit d2c995581c7c5d0ff623b2700e76bf22499c66df
> > > Author: NeilBrown <neil@...wn.name>
> > > Date:   Wed Jul 16 00:44:14 2025 +0000
> > > 
> > >     ovl: Call ovl_create_temp() without lock held.
> > > 
> > > bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=13db1e92580000
> > > final oops:     https://syzkaller.appspot.com/x/report.txt?x=103b1e92580000
> > > console output: https://syzkaller.appspot.com/x/log.txt?x=17db1e92580000
> > > 
> > > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > > Reported-by: syzbot+bfc9a0ccf0de47d04e8c@...kaller.appspotmail.com
> > > Fixes: d2c995581c7c ("ovl: Call ovl_create_temp() without lock held.")
> > 
> > I think this was probably fixed by 
> > Commit 1f480a181137 ("Add start_renaming_two_dentries()")
> > 
> > That patch replaced the call to ovl_lock_rename_workdir()
> > with start_renaming_two_dentries()
> > The new function checks that the two dentries are still hashed.
> > 
> > ovl_lock_rename_workdir() should have been changed to check
> > that the dentries were still hashed before that patch that
> > the bisect found which changed the locking in ovl_cleanup_and_whiteout.
> > 
> > Can you please confirm the bug no longer exists after that patch?
> >
> #syz test upstream master
> 

Sorry, I should have said "will be fixed" as the patch isn't upstream
yet.  It is in vfs.all, and doesn't even have the hash I nominated.

Commit 833d2b3a072f ("Add start_renaming_two_dentries()")

I'll send a patch against upstream master.

NeilBrown