* Potential Linux Crash: possible deadlock in do_lock_mount in linux6.12.24(longterm maintenance)
@ 2025-04-27 2:28 Jianzhou Zhao
2025-04-28 11:46 ` Jan Kara
0 siblings, 1 reply; 2+ messages in thread
From: Jianzhou Zhao @ 2025-04-27 2:28 UTC (permalink / raw)
To: stable; +Cc: viro, brauner, jack, linux-fsdevel, linux-kernel
Hello, I found a potential bug titled " possible deadlock in do_lock_mount " with modified syzkaller in the Linux6.12.24(longterm maintenance, last updated on April 20, 2025).
(The latest version of 6.12 is 6.12-25 at present. However, after comparison, I found that there seems to be no fix for this bug in the latest version.)
Unfortunately, I am unable to reproduce this bug.
If you fix this issue, please add the following tag to the commit: Reported-by: Jianzhou Zhao <luckd0g@163.com>, xingwei lee <xrivendell7@gmail.com>
The commit of the kernel is : b6efa8ce222e58cfe2bbaa4e3329818c2b4bd74e
kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=55f8591b98dd132
compiler: gcc version 11.4.0
------------[ cut here ]-----------------------------------------
TITLE: possible deadlock in do_lock_mount
------------[ cut here ]------------
======================================================
======================================================
WARNING: possible circular locking dependency detected
6.12.24 #3 Not tainted
------------------------------------------------------
syz.6.1765/29153 is trying to acquire lock:
ffffffff8e14afc0 (fs_reclaim){+.+.}-{0:0}, at: might_alloc include/linux/sched/mm.h:318 [inline]
ffffffff8e14afc0 (fs_reclaim){+.+.}-{0:0}, at: slab_pre_alloc_hook mm/slub.c:4058 [inline]
ffffffff8e14afc0 (fs_reclaim){+.+.}-{0:0}, at: slab_alloc_node mm/slub.c:4136 [inline]
ffffffff8e14afc0 (fs_reclaim){+.+.}-{0:0}, at: __kmalloc_cache_noprof+0x4b/0x310 mm/slub.c:4312
but task is already holding lock:
ffffffff8e1bfdd0 (namespace_sem){++++}-{3:3}, at: namespace_lock fs/namespace.c:1713 [inline]
ffffffff8e1bfdd0 (namespace_sem){++++}-{3:3}, at: do_lock_mount+0x150/0x5b0 fs/namespace.c:2618
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #7 (namespace_sem){++++}-{3:3}:
down_write+0x92/0x200 kernel/locking/rwsem.c:1577
namespace_lock fs/namespace.c:1713 [inline]
do_lock_mount+0x150/0x5b0 fs/namespace.c:2618
lock_mount fs/namespace.c:2654 [inline]
do_loopback fs/namespace.c:2777 [inline]
path_mount+0xcda/0x1ea0 fs/namespace.c:3833
do_mount fs/namespace.c:3852 [inline]
__do_sys_mount fs/namespace.c:4062 [inline]
__se_sys_mount fs/namespace.c:4039 [inline]
__x64_sys_mount+0x284/0x310 fs/namespace.c:4039
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcb/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #6 (&sb->s_type->i_mutex_key#3){++++}-{3:3}:
down_write+0x92/0x200 kernel/locking/rwsem.c:1577
inode_lock include/linux/fs.h:815 [inline]
start_creating.part.0+0xb2/0x370 fs/debugfs/inode.c:374
start_creating fs/debugfs/inode.c:351 [inline]
debugfs_create_dir+0x72/0x600 fs/debugfs/inode.c:593
blk_register_queue+0x16a/0x4f0 block/blk-sysfs.c:766
device_add_disk+0x77f/0x12f0 block/genhd.c:489
add_disk include/linux/blkdev.h:741 [inline]
brd_alloc.isra.0+0x57a/0x800 drivers/block/brd.c:401
brd_init+0xf5/0x1e0 drivers/block/brd.c:481
do_one_initcall+0x10e/0x6d0 init/main.c:1269
do_initcall_level init/main.c:1331 [inline]
do_initcalls init/main.c:1347 [inline]
do_basic_setup init/main.c:1366 [inline]
kernel_init_freeable+0x5ae/0x8a0 init/main.c:1580
kernel_init+0x1e/0x2d0 init/main.c:1469
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
-> #5 (&q->debugfs_mutex){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x147/0x930 kernel/locking/mutex.c:752
blk_mq_init_sched+0x436/0x650 block/blk-mq-sched.c:473
elevator_init_mq+0x2cc/0x420 block/elevator.c:610
device_add_disk+0x10e/0x12f0 block/genhd.c:411
sd_probe+0xa0e/0xf80 drivers/scsi/sd.c:4024
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x24f/0xa90 drivers/base/dd.c:658
__driver_probe_device+0x1df/0x450 drivers/base/dd.c:800
driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:830
__device_attach_driver+0x1db/0x2f0 drivers/base/dd.c:958
bus_for_each_drv+0x149/0x1d0 drivers/base/bus.c:459
__device_attach_async_helper+0x1d1/0x290 drivers/base/dd.c:987
async_run_entry_fn+0x9c/0x530 kernel/async.c:129
process_one_work+0xa02/0x1bf0 kernel/workqueue.c:3232
process_scheduled_works kernel/workqueue.c:3314 [inline]
worker_thread+0x677/0xe90 kernel/workqueue.c:3395
kthread+0x2c7/0x3b0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
-> #4 (&q->q_usage_counter(queue)#51){++++}-{0:0}:
blk_queue_enter+0x4d0/0x600 block/blk-core.c:328
blk_mq_alloc_request+0x422/0x9c0 block/blk-mq.c:680
scsi_alloc_request drivers/scsi/scsi_lib.c:1227 [inline]
scsi_execute_cmd+0x1fe/0xf20 drivers/scsi/scsi_lib.c:304
read_capacity_16+0x1f2/0xe60 drivers/scsi/sd.c:2655
sd_read_capacity drivers/scsi/sd.c:2824 [inline]
sd_revalidate_disk.isra.0+0x1989/0xa440 drivers/scsi/sd.c:3734
sd_probe+0x887/0xf80 drivers/scsi/sd.c:4010
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x24f/0xa90 drivers/base/dd.c:658
__driver_probe_device+0x1df/0x450 drivers/base/dd.c:800
driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:830
__device_attach_driver+0x1db/0x2f0 drivers/base/dd.c:958
bus_for_each_drv+0x149/0x1d0 drivers/base/bus.c:459
__device_attach_async_helper+0x1d1/0x290 drivers/base/dd.c:987
async_run_entry_fn+0x9c/0x530 kernel/async.c:129
process_one_work+0xa02/0x1bf0 kernel/workqueue.c:3232
process_scheduled_works kernel/workqueue.c:3314 [inline]
worker_thread+0x677/0xe90 kernel/workqueue.c:3395
kthread+0x2c7/0x3b0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
-> #3 (&q->limits_lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x147/0x930 kernel/locking/mutex.c:752
queue_limits_start_update include/linux/blkdev.h:935 [inline]
loop_reconfigure_limits+0x1f2/0x960 drivers/block/loop.c:1004
loop_set_block_size drivers/block/loop.c:1474 [inline]
lo_simple_ioctl drivers/block/loop.c:1497 [inline]
lo_ioctl+0xb92/0x1870 drivers/block/loop.c:1560
blkdev_ioctl+0x27b/0x6c0 block/ioctl.c:693
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl fs/ioctl.c:893 [inline]
__x64_sys_ioctl+0x19d/0x210 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcb/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #2 (&q->q_usage_counter(io)#19){++++}-{0:0}:
bio_queue_enter block/blk.h:76 [inline]
blk_mq_submit_bio+0x2167/0x2b70 block/blk-mq.c:3090
__submit_bio+0x399/0x630 block/blk-core.c:629
__submit_bio_noacct_mq block/blk-core.c:716 [inline]
submit_bio_noacct_nocheck+0x6c3/0xd00 block/blk-core.c:745
submit_bio_noacct+0x57a/0x1fa0 block/blk-core.c:868
xfs_buf_ioapply_map fs/xfs/xfs_buf.c:1585 [inline]
_xfs_buf_ioapply+0x8a4/0xbe0 fs/xfs/xfs_buf.c:1673
__xfs_buf_submit+0x241/0x840 fs/xfs/xfs_buf.c:1757
xfs_buf_submit fs/xfs/xfs_buf.c:61 [inline]
_xfs_buf_read fs/xfs/xfs_buf.c:808 [inline]
xfs_buf_read_map+0x3e7/0xb40 fs/xfs/xfs_buf.c:872
xfs_trans_read_buf_map+0x10a/0x9b0 fs/xfs/xfs_trans_buf.c:289
xfs_trans_read_buf fs/xfs/xfs_trans.h:212 [inline]
xfs_read_agf+0x2c1/0x5b0 fs/xfs/libxfs/xfs_alloc.c:3367
xfs_alloc_read_agf+0x152/0xb90 fs/xfs/libxfs/xfs_alloc.c:3401
xfs_alloc_fix_freelist+0x925/0xff0 fs/xfs/libxfs/xfs_alloc.c:2863
xfs_alloc_vextent_prepare_ag+0x7c/0x6c0 fs/xfs/libxfs/xfs_alloc.c:3532
xfs_alloc_vextent_iterate_ags.constprop.0+0x1b0/0x970 fs/xfs/libxfs/xfs_alloc.c:3717
xfs_alloc_vextent_start_ag+0x32b/0x800 fs/xfs/libxfs/xfs_alloc.c:3806
xfs_bmap_btalloc_best_length fs/xfs/libxfs/xfs_bmap.c:3731 [inline]
xfs_bmap_btalloc+0xbc4/0x17d0 fs/xfs/libxfs/xfs_bmap.c:3776
xfs_bmapi_allocate+0x23d/0xe80 fs/xfs/libxfs/xfs_bmap.c:4189
xfs_bmapi_write+0x686/0xca0 fs/xfs/libxfs/xfs_bmap.c:4518
xfs_dquot_disk_alloc+0x654/0xbb0 fs/xfs/xfs_dquot.c:376
xfs_qm_dqread+0x55d/0x5f0 fs/xfs/xfs_dquot.c:715
xfs_qm_dqget+0x142/0x470 fs/xfs/xfs_dquot.c:927
xfs_qm_quotacheck_dqadjust+0xaa/0x570 fs/xfs/xfs_qm.c:1125
xfs_qm_dqusage_adjust+0x511/0x680 fs/xfs/xfs_qm.c:1248
xfs_iwalk_ag_recs+0x476/0x7c0 fs/xfs/xfs_iwalk.c:213
xfs_iwalk_run_callbacks+0x1fa/0x560 fs/xfs/xfs_iwalk.c:371
xfs_iwalk_ag+0x73a/0x940 fs/xfs/xfs_iwalk.c:477
xfs_iwalk_ag_work+0x14e/0x1c0 fs/xfs/xfs_iwalk.c:619
xfs_pwork_work+0x7f/0x160 fs/xfs/xfs_pwork.c:47
process_one_work+0xa02/0x1bf0 kernel/workqueue.c:3232
process_scheduled_works kernel/workqueue.c:3314 [inline]
worker_thread+0x677/0xe90 kernel/workqueue.c:3395
kthread+0x2c7/0x3b0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
-> #1 (&xfs_nondir_ilock_class#3){++++}-{3:3}:
down_write_nested+0x96/0x210 kernel/locking/rwsem.c:1693
xfs_ilock+0x198/0x210 fs/xfs/xfs_inode.c:164
xfs_reclaim_inode fs/xfs/xfs_icache.c:981 [inline]
xfs_icwalk_process_inode fs/xfs/xfs_icache.c:1675 [inline]
xfs_icwalk_ag+0xa5e/0x17b0 fs/xfs/xfs_icache.c:1757
xfs_icwalk fs/xfs/xfs_icache.c:1805 [inline]
xfs_reclaim_inodes_nr+0x1bd/0x300 fs/xfs/xfs_icache.c:1047
super_cache_scan+0x412/0x570 fs/super.c:227
do_shrink_slab+0x44b/0x1190 mm/shrinker.c:437
shrink_slab+0x332/0x12a0 mm/shrinker.c:664
shrink_one+0x4ad/0x7c0 mm/vmscan.c:4835
shrink_many mm/vmscan.c:4896 [inline]
lru_gen_shrink_node mm/vmscan.c:4974 [inline]
shrink_node+0x2420/0x3890 mm/vmscan.c:5954
kswapd_shrink_node mm/vmscan.c:6782 [inline]
balance_pgdat+0xbe5/0x18c0 mm/vmscan.c:6974
kswapd+0x702/0xd50 mm/vmscan.c:7243
kthread+0x2c7/0x3b0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
-> #0 (fs_reclaim){+.+.}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain kernel/locking/lockdep.c:3904 [inline]
__lock_acquire+0x2425/0x3b90 kernel/locking/lockdep.c:5202
lock_acquire.part.0+0x11b/0x370 kernel/locking/lockdep.c:5825
__fs_reclaim_acquire mm/page_alloc.c:3853 [inline]
fs_reclaim_acquire+0x102/0x150 mm/page_alloc.c:3867
might_alloc include/linux/sched/mm.h:318 [inline]
slab_pre_alloc_hook mm/slub.c:4058 [inline]
slab_alloc_node mm/slub.c:4136 [inline]
__kmalloc_cache_noprof+0x4b/0x310 mm/slub.c:4312
kmalloc_noprof include/linux/slab.h:878 [inline]
get_mountpoint+0x14c/0x410 fs/namespace.c:909
do_lock_mount+0x171/0x5b0 fs/namespace.c:2639
lock_mount fs/namespace.c:2654 [inline]
do_new_mount_fc fs/namespace.c:3449 [inline]
do_new_mount fs/namespace.c:3514 [inline]
path_mount+0x1695/0x1ea0 fs/namespace.c:3839
do_mount fs/namespace.c:3852 [inline]
__do_sys_mount fs/namespace.c:4062 [inline]
__se_sys_mount fs/namespace.c:4039 [inline]
__x64_sys_mount+0x284/0x310 fs/namespace.c:4039
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcb/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Chain exists of:
fs_reclaim --> &sb->s_type->i_mutex_key#3 --> namespace_sem
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(namespace_sem);
lock(&sb->s_type->i_mutex_key#3);
lock(namespace_sem);
lock(fs_reclaim);
*** DEADLOCK ***
2 locks held by syz.6.1765/29153:
#0: ffff888055a94158 (&sb->s_type->i_mutex_key#29){++++}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline]
#0: ffff888055a94158 (&sb->s_type->i_mutex_key#29){++++}-{3:3}, at: do_lock_mount+0xae/0x5b0 fs/namespace.c:2612
#1: ffffffff8e1bfdd0 (namespace_sem){++++}-{3:3}, at: namespace_lock fs/namespace.c:1713 [inline]
#1: ffffffff8e1bfdd0 (namespace_sem){++++}-{3:3}, at: do_lock_mount+0x150/0x5b0 fs/namespace.c:2618
stack backtrace:
CPU: 1 UID: 0 PID: 29153 Comm: syz.6.1765 Not tainted 6.12.24 #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120
print_circular_bug+0x406/0x5c0 kernel/locking/lockdep.c:2074
check_noncircular+0x2f7/0x3e0 kernel/locking/lockdep.c:2206
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain kernel/locking/lockdep.c:3904 [inline]
__lock_acquire+0x2425/0x3b90 kernel/locking/lockdep.c:5202
lock_acquire.part.0+0x11b/0x370 kernel/locking/lockdep.c:5825
__fs_reclaim_acquire mm/page_alloc.c:3853 [inline]
fs_reclaim_acquire+0x102/0x150 mm/page_alloc.c:3867
might_alloc include/linux/sched/mm.h:318 [inline]
slab_pre_alloc_hook mm/slub.c:4058 [inline]
slab_alloc_node mm/slub.c:4136 [inline]
__kmalloc_cache_noprof+0x4b/0x310 mm/slub.c:4312
kmalloc_noprof include/linux/slab.h:878 [inline]
get_mountpoint+0x14c/0x410 fs/namespace.c:909
do_lock_mount+0x171/0x5b0 fs/namespace.c:2639
lock_mount fs/namespace.c:2654 [inline]
do_new_mount_fc fs/namespace.c:3449 [inline]
do_new_mount fs/namespace.c:3514 [inline]
path_mount+0x1695/0x1ea0 fs/namespace.c:3839
do_mount fs/namespace.c:3852 [inline]
__do_sys_mount fs/namespace.c:4062 [inline]
__se_sys_mount fs/namespace.c:4039 [inline]
__x64_sys_mount+0x284/0x310 fs/namespace.c:4039
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcb/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff6353ad5ad
Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ff6361edf98 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ff6355e5fa0 RCX: 00007ff6353ad5ad
RDX: 00002000000000c0 RSI: 0000200000000080 RDI: 0000000000000000
RBP: 00007ff635446d56 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007ff6355e5fa0 R15: 00007ff6361ce000
</TASK>
==================================================================
I hope it helps.
Best regards
Jianzhou Zhao
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Potential Linux Crash: possible deadlock in do_lock_mount in linux6.12.24(longterm maintenance)
2025-04-27 2:28 Potential Linux Crash: possible deadlock in do_lock_mount in linux6.12.24(longterm maintenance) Jianzhou Zhao
@ 2025-04-28 11:46 ` Jan Kara
0 siblings, 0 replies; 2+ messages in thread
From: Jan Kara @ 2025-04-28 11:46 UTC (permalink / raw)
To: Jianzhou Zhao; +Cc: stable, viro, brauner, jack, linux-fsdevel, linux-kernel
On Sun 27-04-25 10:28:11, Jianzhou Zhao wrote:
> Hello, I found a potential bug titled " possible deadlock in do_lock_mount " with modified syzkaller in the Linux6.12.24(longterm maintenance, last updated on April 20, 2025).
> (The latest version of 6.12 is 6.12-25 at present. However, after comparison, I found that there seems to be no fix for this bug in the latest version.)
> Unfortunately, I am unable to reproduce this bug.
> If you fix this issue, please add the following tag to the commit: Reported-by: Jianzhou Zhao <luckd0g@163.com>, xingwei lee <xrivendell7@gmail.com>
> The commit of the kernel is : b6efa8ce222e58cfe2bbaa4e3329818c2b4bd74e
> kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=55f8591b98dd132
> compiler: gcc version 11.4.0
>
> ------------[ cut here ]-----------------------------------------
> TITLE: possible deadlock in do_lock_mount
> ------------[ cut here ]------------
> ======================================================
> ======================================================
> WARNING: possible circular locking dependency detected
> 6.12.24 #3 Not tainted
> ------------------------------------------------------
> syz.6.1765/29153 is trying to acquire lock:
> ffffffff8e14afc0 (fs_reclaim){+.+.}-{0:0}, at: might_alloc include/linux/sched/mm.h:318 [inline]
> ffffffff8e14afc0 (fs_reclaim){+.+.}-{0:0}, at: slab_pre_alloc_hook mm/slub.c:4058 [inline]
> ffffffff8e14afc0 (fs_reclaim){+.+.}-{0:0}, at: slab_alloc_node mm/slub.c:4136 [inline]
> ffffffff8e14afc0 (fs_reclaim){+.+.}-{0:0}, at: __kmalloc_cache_noprof+0x4b/0x310 mm/slub.c:4312
>
> but task is already holding lock:
> ffffffff8e1bfdd0 (namespace_sem){++++}-{3:3}, at: namespace_lock fs/namespace.c:1713 [inline]
> ffffffff8e1bfdd0 (namespace_sem){++++}-{3:3}, at: do_lock_mount+0x150/0x5b0 fs/namespace.c:2618
>
> which lock already depends on the new lock.
Hum, the lockdep report looks like a possible deadlock but not overly
concerning. The core of the deadlock loop is that we do GFP_KERNEL
allocation under inode_lock in do_loopback()->lock_mount()->do_lock_mount()
however for debugfs, the inode lock gets burried deep in the locking chain
e.g. by device discovery path. So to deadlock the kernel, you need
something like:
task 1 task 2
try to bind mount a debugfs dir
enter reclaim
wants to do some IO freeze request queue
blocks on request queue being frozen
wants to modify debugfs
blocks on debugfs inode lock
I'm not sure if we care...
Honza
> the existing dependency chain (in reverse order) is:
>
> -> #7 (namespace_sem){++++}-{3:3}:
> down_write+0x92/0x200 kernel/locking/rwsem.c:1577
> namespace_lock fs/namespace.c:1713 [inline]
> do_lock_mount+0x150/0x5b0 fs/namespace.c:2618
> lock_mount fs/namespace.c:2654 [inline]
> do_loopback fs/namespace.c:2777 [inline]
> path_mount+0xcda/0x1ea0 fs/namespace.c:3833
> do_mount fs/namespace.c:3852 [inline]
> __do_sys_mount fs/namespace.c:4062 [inline]
> __se_sys_mount fs/namespace.c:4039 [inline]
> __x64_sys_mount+0x284/0x310 fs/namespace.c:4039
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xcb/0x250 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> -> #6 (&sb->s_type->i_mutex_key#3){++++}-{3:3}:
> down_write+0x92/0x200 kernel/locking/rwsem.c:1577
> inode_lock include/linux/fs.h:815 [inline]
> start_creating.part.0+0xb2/0x370 fs/debugfs/inode.c:374
> start_creating fs/debugfs/inode.c:351 [inline]
> debugfs_create_dir+0x72/0x600 fs/debugfs/inode.c:593
> blk_register_queue+0x16a/0x4f0 block/blk-sysfs.c:766
> device_add_disk+0x77f/0x12f0 block/genhd.c:489
> add_disk include/linux/blkdev.h:741 [inline]
> brd_alloc.isra.0+0x57a/0x800 drivers/block/brd.c:401
> brd_init+0xf5/0x1e0 drivers/block/brd.c:481
> do_one_initcall+0x10e/0x6d0 init/main.c:1269
> do_initcall_level init/main.c:1331 [inline]
> do_initcalls init/main.c:1347 [inline]
> do_basic_setup init/main.c:1366 [inline]
> kernel_init_freeable+0x5ae/0x8a0 init/main.c:1580
> kernel_init+0x1e/0x2d0 init/main.c:1469
> ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:152
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>
> -> #5 (&q->debugfs_mutex){+.+.}-{3:3}:
> __mutex_lock_common kernel/locking/mutex.c:608 [inline]
> __mutex_lock+0x147/0x930 kernel/locking/mutex.c:752
> blk_mq_init_sched+0x436/0x650 block/blk-mq-sched.c:473
> elevator_init_mq+0x2cc/0x420 block/elevator.c:610
> device_add_disk+0x10e/0x12f0 block/genhd.c:411
> sd_probe+0xa0e/0xf80 drivers/scsi/sd.c:4024
> call_driver_probe drivers/base/dd.c:579 [inline]
> really_probe+0x24f/0xa90 drivers/base/dd.c:658
> __driver_probe_device+0x1df/0x450 drivers/base/dd.c:800
> driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:830
> __device_attach_driver+0x1db/0x2f0 drivers/base/dd.c:958
> bus_for_each_drv+0x149/0x1d0 drivers/base/bus.c:459
> __device_attach_async_helper+0x1d1/0x290 drivers/base/dd.c:987
> async_run_entry_fn+0x9c/0x530 kernel/async.c:129
> process_one_work+0xa02/0x1bf0 kernel/workqueue.c:3232
> process_scheduled_works kernel/workqueue.c:3314 [inline]
> worker_thread+0x677/0xe90 kernel/workqueue.c:3395
> kthread+0x2c7/0x3b0 kernel/kthread.c:389
> ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:152
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>
> -> #4 (&q->q_usage_counter(queue)#51){++++}-{0:0}:
> blk_queue_enter+0x4d0/0x600 block/blk-core.c:328
> blk_mq_alloc_request+0x422/0x9c0 block/blk-mq.c:680
> scsi_alloc_request drivers/scsi/scsi_lib.c:1227 [inline]
> scsi_execute_cmd+0x1fe/0xf20 drivers/scsi/scsi_lib.c:304
> read_capacity_16+0x1f2/0xe60 drivers/scsi/sd.c:2655
> sd_read_capacity drivers/scsi/sd.c:2824 [inline]
> sd_revalidate_disk.isra.0+0x1989/0xa440 drivers/scsi/sd.c:3734
> sd_probe+0x887/0xf80 drivers/scsi/sd.c:4010
> call_driver_probe drivers/base/dd.c:579 [inline]
> really_probe+0x24f/0xa90 drivers/base/dd.c:658
> __driver_probe_device+0x1df/0x450 drivers/base/dd.c:800
> driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:830
> __device_attach_driver+0x1db/0x2f0 drivers/base/dd.c:958
> bus_for_each_drv+0x149/0x1d0 drivers/base/bus.c:459
> __device_attach_async_helper+0x1d1/0x290 drivers/base/dd.c:987
> async_run_entry_fn+0x9c/0x530 kernel/async.c:129
> process_one_work+0xa02/0x1bf0 kernel/workqueue.c:3232
> process_scheduled_works kernel/workqueue.c:3314 [inline]
> worker_thread+0x677/0xe90 kernel/workqueue.c:3395
> kthread+0x2c7/0x3b0 kernel/kthread.c:389
> ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:152
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>
> -> #3 (&q->limits_lock){+.+.}-{3:3}:
> __mutex_lock_common kernel/locking/mutex.c:608 [inline]
> __mutex_lock+0x147/0x930 kernel/locking/mutex.c:752
> queue_limits_start_update include/linux/blkdev.h:935 [inline]
> loop_reconfigure_limits+0x1f2/0x960 drivers/block/loop.c:1004
> loop_set_block_size drivers/block/loop.c:1474 [inline]
> lo_simple_ioctl drivers/block/loop.c:1497 [inline]
> lo_ioctl+0xb92/0x1870 drivers/block/loop.c:1560
> blkdev_ioctl+0x27b/0x6c0 block/ioctl.c:693
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:907 [inline]
> __se_sys_ioctl fs/ioctl.c:893 [inline]
> __x64_sys_ioctl+0x19d/0x210 fs/ioctl.c:893
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xcb/0x250 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> -> #2 (&q->q_usage_counter(io)#19){++++}-{0:0}:
> bio_queue_enter block/blk.h:76 [inline]
> blk_mq_submit_bio+0x2167/0x2b70 block/blk-mq.c:3090
> __submit_bio+0x399/0x630 block/blk-core.c:629
> __submit_bio_noacct_mq block/blk-core.c:716 [inline]
> submit_bio_noacct_nocheck+0x6c3/0xd00 block/blk-core.c:745
> submit_bio_noacct+0x57a/0x1fa0 block/blk-core.c:868
> xfs_buf_ioapply_map fs/xfs/xfs_buf.c:1585 [inline]
> _xfs_buf_ioapply+0x8a4/0xbe0 fs/xfs/xfs_buf.c:1673
> __xfs_buf_submit+0x241/0x840 fs/xfs/xfs_buf.c:1757
> xfs_buf_submit fs/xfs/xfs_buf.c:61 [inline]
> _xfs_buf_read fs/xfs/xfs_buf.c:808 [inline]
> xfs_buf_read_map+0x3e7/0xb40 fs/xfs/xfs_buf.c:872
> xfs_trans_read_buf_map+0x10a/0x9b0 fs/xfs/xfs_trans_buf.c:289
> xfs_trans_read_buf fs/xfs/xfs_trans.h:212 [inline]
> xfs_read_agf+0x2c1/0x5b0 fs/xfs/libxfs/xfs_alloc.c:3367
> xfs_alloc_read_agf+0x152/0xb90 fs/xfs/libxfs/xfs_alloc.c:3401
> xfs_alloc_fix_freelist+0x925/0xff0 fs/xfs/libxfs/xfs_alloc.c:2863
> xfs_alloc_vextent_prepare_ag+0x7c/0x6c0 fs/xfs/libxfs/xfs_alloc.c:3532
> xfs_alloc_vextent_iterate_ags.constprop.0+0x1b0/0x970 fs/xfs/libxfs/xfs_alloc.c:3717
> xfs_alloc_vextent_start_ag+0x32b/0x800 fs/xfs/libxfs/xfs_alloc.c:3806
> xfs_bmap_btalloc_best_length fs/xfs/libxfs/xfs_bmap.c:3731 [inline]
> xfs_bmap_btalloc+0xbc4/0x17d0 fs/xfs/libxfs/xfs_bmap.c:3776
> xfs_bmapi_allocate+0x23d/0xe80 fs/xfs/libxfs/xfs_bmap.c:4189
> xfs_bmapi_write+0x686/0xca0 fs/xfs/libxfs/xfs_bmap.c:4518
> xfs_dquot_disk_alloc+0x654/0xbb0 fs/xfs/xfs_dquot.c:376
> xfs_qm_dqread+0x55d/0x5f0 fs/xfs/xfs_dquot.c:715
> xfs_qm_dqget+0x142/0x470 fs/xfs/xfs_dquot.c:927
> xfs_qm_quotacheck_dqadjust+0xaa/0x570 fs/xfs/xfs_qm.c:1125
> xfs_qm_dqusage_adjust+0x511/0x680 fs/xfs/xfs_qm.c:1248
> xfs_iwalk_ag_recs+0x476/0x7c0 fs/xfs/xfs_iwalk.c:213
> xfs_iwalk_run_callbacks+0x1fa/0x560 fs/xfs/xfs_iwalk.c:371
> xfs_iwalk_ag+0x73a/0x940 fs/xfs/xfs_iwalk.c:477
> xfs_iwalk_ag_work+0x14e/0x1c0 fs/xfs/xfs_iwalk.c:619
> xfs_pwork_work+0x7f/0x160 fs/xfs/xfs_pwork.c:47
> process_one_work+0xa02/0x1bf0 kernel/workqueue.c:3232
> process_scheduled_works kernel/workqueue.c:3314 [inline]
> worker_thread+0x677/0xe90 kernel/workqueue.c:3395
> kthread+0x2c7/0x3b0 kernel/kthread.c:389
> ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:152
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>
> -> #1 (&xfs_nondir_ilock_class#3){++++}-{3:3}:
> down_write_nested+0x96/0x210 kernel/locking/rwsem.c:1693
> xfs_ilock+0x198/0x210 fs/xfs/xfs_inode.c:164
> xfs_reclaim_inode fs/xfs/xfs_icache.c:981 [inline]
> xfs_icwalk_process_inode fs/xfs/xfs_icache.c:1675 [inline]
> xfs_icwalk_ag+0xa5e/0x17b0 fs/xfs/xfs_icache.c:1757
> xfs_icwalk fs/xfs/xfs_icache.c:1805 [inline]
> xfs_reclaim_inodes_nr+0x1bd/0x300 fs/xfs/xfs_icache.c:1047
> super_cache_scan+0x412/0x570 fs/super.c:227
> do_shrink_slab+0x44b/0x1190 mm/shrinker.c:437
> shrink_slab+0x332/0x12a0 mm/shrinker.c:664
> shrink_one+0x4ad/0x7c0 mm/vmscan.c:4835
> shrink_many mm/vmscan.c:4896 [inline]
> lru_gen_shrink_node mm/vmscan.c:4974 [inline]
> shrink_node+0x2420/0x3890 mm/vmscan.c:5954
> kswapd_shrink_node mm/vmscan.c:6782 [inline]
> balance_pgdat+0xbe5/0x18c0 mm/vmscan.c:6974
> kswapd+0x702/0xd50 mm/vmscan.c:7243
> kthread+0x2c7/0x3b0 kernel/kthread.c:389
> ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:152
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>
> -> #0 (fs_reclaim){+.+.}-{0:0}:
> check_prev_add kernel/locking/lockdep.c:3161 [inline]
> check_prevs_add kernel/locking/lockdep.c:3280 [inline]
> validate_chain kernel/locking/lockdep.c:3904 [inline]
> __lock_acquire+0x2425/0x3b90 kernel/locking/lockdep.c:5202
> lock_acquire.part.0+0x11b/0x370 kernel/locking/lockdep.c:5825
> __fs_reclaim_acquire mm/page_alloc.c:3853 [inline]
> fs_reclaim_acquire+0x102/0x150 mm/page_alloc.c:3867
> might_alloc include/linux/sched/mm.h:318 [inline]
> slab_pre_alloc_hook mm/slub.c:4058 [inline]
> slab_alloc_node mm/slub.c:4136 [inline]
> __kmalloc_cache_noprof+0x4b/0x310 mm/slub.c:4312
> kmalloc_noprof include/linux/slab.h:878 [inline]
> get_mountpoint+0x14c/0x410 fs/namespace.c:909
> do_lock_mount+0x171/0x5b0 fs/namespace.c:2639
> lock_mount fs/namespace.c:2654 [inline]
> do_new_mount_fc fs/namespace.c:3449 [inline]
> do_new_mount fs/namespace.c:3514 [inline]
> path_mount+0x1695/0x1ea0 fs/namespace.c:3839
> do_mount fs/namespace.c:3852 [inline]
> __do_sys_mount fs/namespace.c:4062 [inline]
> __se_sys_mount fs/namespace.c:4039 [inline]
> __x64_sys_mount+0x284/0x310 fs/namespace.c:4039
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xcb/0x250 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> other info that might help us debug this:
>
> Chain exists of:
> fs_reclaim --> &sb->s_type->i_mutex_key#3 --> namespace_sem
>
> Possible unsafe locking scenario:
>
> CPU0 CPU1
> ---- ----
> lock(namespace_sem);
> lock(&sb->s_type->i_mutex_key#3);
> lock(namespace_sem);
> lock(fs_reclaim);
>
> *** DEADLOCK ***
>
> 2 locks held by syz.6.1765/29153:
> #0: ffff888055a94158 (&sb->s_type->i_mutex_key#29){++++}-{3:3}, at: inode_lock include/linux/fs.h:815 [inline]
> #0: ffff888055a94158 (&sb->s_type->i_mutex_key#29){++++}-{3:3}, at: do_lock_mount+0xae/0x5b0 fs/namespace.c:2612
> #1: ffffffff8e1bfdd0 (namespace_sem){++++}-{3:3}, at: namespace_lock fs/namespace.c:1713 [inline]
> #1: ffffffff8e1bfdd0 (namespace_sem){++++}-{3:3}, at: do_lock_mount+0x150/0x5b0 fs/namespace.c:2618
>
> stack backtrace:
> CPU: 1 UID: 0 PID: 29153 Comm: syz.6.1765 Not tainted 6.12.24 #3
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120
> print_circular_bug+0x406/0x5c0 kernel/locking/lockdep.c:2074
> check_noncircular+0x2f7/0x3e0 kernel/locking/lockdep.c:2206
> check_prev_add kernel/locking/lockdep.c:3161 [inline]
> check_prevs_add kernel/locking/lockdep.c:3280 [inline]
> validate_chain kernel/locking/lockdep.c:3904 [inline]
> __lock_acquire+0x2425/0x3b90 kernel/locking/lockdep.c:5202
> lock_acquire.part.0+0x11b/0x370 kernel/locking/lockdep.c:5825
> __fs_reclaim_acquire mm/page_alloc.c:3853 [inline]
> fs_reclaim_acquire+0x102/0x150 mm/page_alloc.c:3867
> might_alloc include/linux/sched/mm.h:318 [inline]
> slab_pre_alloc_hook mm/slub.c:4058 [inline]
> slab_alloc_node mm/slub.c:4136 [inline]
> __kmalloc_cache_noprof+0x4b/0x310 mm/slub.c:4312
> kmalloc_noprof include/linux/slab.h:878 [inline]
> get_mountpoint+0x14c/0x410 fs/namespace.c:909
> do_lock_mount+0x171/0x5b0 fs/namespace.c:2639
> lock_mount fs/namespace.c:2654 [inline]
> do_new_mount_fc fs/namespace.c:3449 [inline]
> do_new_mount fs/namespace.c:3514 [inline]
> path_mount+0x1695/0x1ea0 fs/namespace.c:3839
> do_mount fs/namespace.c:3852 [inline]
> __do_sys_mount fs/namespace.c:4062 [inline]
> __se_sys_mount fs/namespace.c:4039 [inline]
> __x64_sys_mount+0x284/0x310 fs/namespace.c:4039
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xcb/0x250 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7ff6353ad5ad
> Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007ff6361edf98 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
> RAX: ffffffffffffffda RBX: 00007ff6355e5fa0 RCX: 00007ff6353ad5ad
> RDX: 00002000000000c0 RSI: 0000200000000080 RDI: 0000000000000000
> RBP: 00007ff635446d56 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 0000000000000000 R14: 00007ff6355e5fa0 R15: 00007ff6361ce000
> </TASK>
>
> ==================================================================
>
> I hope it helps.
> Best regards
> Jianzhou Zhao
--
Jan Kara <jack@suse.com>
SUSE Labs, CR
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-04-28 11:46 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-04-27 2:28 Potential Linux Crash: possible deadlock in do_lock_mount in linux6.12.24(longterm maintenance) Jianzhou Zhao
2025-04-28 11:46 ` Jan Kara
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®