LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Jan Kara <jack@suse.cz>
To: syzbot <syzbot+3b6f9218b1301ddda3e2@syzkaller.appspotmail.com>
Cc: dvyukov@google.com, jack@suse.cz, linux-kernel@vger.kernel.org,
	syzkaller-bugs@googlegroups.com, syzkaller@googlegroups.com,
	tytso@mit.edu
Subject: Re: [syzbot] possible deadlock in dquot_commit
Date: Thu, 7 Oct 2021 10:44:49 +0200	[thread overview]
Message-ID: <20211007084449.GA12712@quack2.suse.cz> (raw)
In-Reply-To: <000000000000aa4cd605c91fe2b3@google.com>

[-- Attachment #1: Type: text/plain, Size: 2032 bytes --]

On Mon 09-08-21 05:54:27, syzbot wrote:
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    66745863ecde Merge tag 'char-misc-5.14-rc5' of git://git.k..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=13edca6e300000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=702bfdfbf389c324
> dashboard link: https://syzkaller.appspot.com/bug?extid=3b6f9218b1301ddda3e2
> compiler:       Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.1
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15aeba6e300000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=17a609e6300000
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+3b6f9218b1301ddda3e2@syzkaller.appspotmail.com
> 
> loop0: detected capacity change from 0 to 4096
> EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
> ======================================================
> WARNING: possible circular locking dependency detected
> 5.14.0-rc4-syzkaller #0 Not tainted
> ------------------------------------------------------
> syz-executor211/9242 is trying to acquire lock:
> ffff88803a37ece8 (&dquot->dq_lock){+.+.}-{3:3}, at: dquot_commit+0x57/0x360 fs/quota/dquot.c:474
> 
> but task is already holding lock:
> ffff88803a303e48 (&ei->i_data_sem/2){++++}-{3:3}, at: ext4_map_blocks+0x9e5/0x1cb0 fs/ext4/inode.c:631
> 
> which lock already depends on the new lock.

I've got back to this and I have one more idea what could be causing this
and why I'm not able to reproduce. I think we free some inode with
i_data_sem locking class set to 2 and when the inode gets reused (which
doesn't happen in my VM for some reason) for a normal file, problems trigger.
Let's try attached patch.

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 60a9483534ed0d99090a2ee1d4bb0b8179195f51

									Honza
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR

[-- Attachment #2: 0001-ext4-Make-sure-to-reset-inode-lockdep-class-when-quo.patch --]
[-- Type: text/x-patch, Size: 1440 bytes --]

From 2c0f00967aecfbc03216feb5a6d7286346268932 Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Thu, 7 Oct 2021 10:30:46 +0200
Subject: [PATCH] ext4: Make sure to reset inode lockdep class when quota
 enabling fails

When we succeed in enabling some quota type but fail to enable another
one with quota feature, we correctly disable all enabled quota types.
However we forget to reset i_data_sem lockdep class. When the inode gets
freed and reused, it will inherit this lockdep class (i_data_sem is
initialized only when a slab is created) and thus eventually lockdep
barfs about possible deadlocks.

Signed-off-by: Jan Kara <jack@suse.cz>
---
 fs/ext4/super.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index fbe9cae63786..70b5fcbd351a 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -6355,8 +6355,19 @@ int ext4_enable_quotas(struct super_block *sb)
 					"Failed to enable quota tracking "
 					"(type=%d, err=%d). Please run "
 					"e2fsck to fix.", type, err);
-				for (type--; type >= 0; type--)
+				for (type--; type >= 0; type--) {
+					struct inode *inode;
+
+					inode = sb_dqopt(sb)->files[type];
+					if (inode)
+						inode = igrab(inode);
 					dquot_quota_off(sb, type);
+					if (inode) {
+						lockdep_set_quota_inode(inode,
+							I_DATA_SEM_NORMAL);
+						iput(inode);
+					}
+				}
 
 				return err;
 			}
-- 
2.26.2


  parent reply	other threads:[~2021-10-07  9:50 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-02-10 11:25 syzbot
2021-02-11 11:37 ` Jan Kara
2021-02-11 11:47   ` Dmitry Vyukov
2021-02-11 15:47     ` Jan Kara
2021-02-11 21:46     ` Theodore Ts'o
2021-02-12 11:01       ` Dmitry Vyukov
2021-02-12 16:10         ` Theodore Ts'o
2021-02-15 12:50           ` Dmitry Vyukov
2021-08-09 12:54 ` [syzbot] " syzbot
2021-08-09 14:52   ` Jan Kara
2021-08-09 17:43     ` syzbot
2021-10-07  8:44   ` Jan Kara [this message]
2021-10-07 13:50     ` syzbot
     [not found] ` <20210810041100.3271-1-hdanton@sina.com>
2021-08-10  9:21   ` Jan Kara
     [not found]   ` <20210811041232.2449-1-hdanton@sina.com>
2021-08-12 13:55     ` Jan Kara

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20211007084449.GA12712@quack2.suse.cz \
    --to=jack@suse.cz \
    --cc=dvyukov@google.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=syzbot+3b6f9218b1301ddda3e2@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    --cc=syzkaller@googlegroups.com \
    --cc=tytso@mit.edu \
    --subject='Re: [syzbot] possible deadlock in dquot_commit' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).