Received: by 2002:ac0:a5a7:0:0:0:0:0 with SMTP id m36-v6csp3487156imm; Tue, 17 Jul 2018 05:47:41 -0700 (PDT) X-Google-Smtp-Source: AAOMgpdKgHos+AnhfV+TV5Ikv9k0BEFVhPqWy3gPrsXbxuFxpHTEBqlCGBTy/MKZU6/N44KQ3QbJ X-Received: by 2002:a17:902:581:: with SMTP id f1-v6mr1517922plf.48.1531831661711; Tue, 17 Jul 2018 05:47:41 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1531831661; cv=none; d=google.com; s=arc-20160816; b=QTv6zYR10mRRVAhySMvdzyKmAkik6aI16JkMMxFmPhsq2yyOkseLOM/E4dDeVtVKOv G4ifSCBAtj/3ZGxuaz5eqbIYAW9XomREOcVxm+72xSEpGCRajpPdA9g1zZiMAjM4180g odHMAh+9pbaCSaLzVqPtrbsHRT6b/dTasy9xBRHv7UjVCSvJc+ZqLwqZo3KRK60G6OR/ KZf6zfdAsNqw3uuKj+PPp+duSo/jxfPFyHk7uv1SDXbfKGzteZ23wdVG3aq4k22etYB4 GbLwiMoumhYZBcLNCM4Ak2ybflmJUFcKrJhxR1c+/EvM8S+YCR4c4e1DO2G1s8QvSIqK 9DOA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:cc:to:subject:message-id:date:from :references:in-reply-to:mime-version:dkim-signature :arc-authentication-results; bh=/YNGtiLOrNgDJhJG7ECSwj3yCPMs9gQpx8/SEdMmmIs=; b=zaEBPA1/VKL8Rjzo4oqpED87/NiZQf8vHhWotVwMJcjNsXBPRjRSd61oEp89bLwiqo K+W/5ADXYTCRWxE+69FZcHvzfgTcOfkafQZUv8UhQbDxbgJoNoUl++RVa3IBY5EDBetu Q8+6jJd9EhWTO7ajnguTKhGNVH/ioulGFFm9ky5Kstek1klOdnkadJvUul88P20RUhrz ZmiXifCxDJQHH5YuaDhuCc2xR3MHKVRI8ipLkFd51bGevc9e8NR0PY8BwK0ZHcND+kJ0 WAW8bOqJsnpCp4nmFxzZOBI5j0WE83fyNYv0173aUkq/6BxdtAgrkExcT+yjCEyNJoGv SDhg== ARC-Authentication-Results: i=1; mx.google.com; dkim=temperror (no key for signature) header.i=@szeredi.hu header.s=google header.b=FGJVZihv; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id i1-v6si766528plt.183.2018.07.17.05.47.25; Tue, 17 Jul 2018 05:47:41 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=temperror (no key for signature) header.i=@szeredi.hu header.s=google header.b=FGJVZihv; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731629AbeGQNSk (ORCPT + 99 others); Tue, 17 Jul 2018 09:18:40 -0400 Received: from mail-oi0-f66.google.com ([209.85.218.66]:45569 "EHLO mail-oi0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731538AbeGQNSk (ORCPT ); Tue, 17 Jul 2018 09:18:40 -0400 Received: by mail-oi0-f66.google.com with SMTP id q11-v6so1697390oic.12 for ; Tue, 17 Jul 2018 05:46:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=szeredi.hu; s=google; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=/YNGtiLOrNgDJhJG7ECSwj3yCPMs9gQpx8/SEdMmmIs=; b=FGJVZihvoeIhxEV9SspksfvVfU/0StuLi1KTyXQYekny5liWzzgT9ENmkbjzXw3AIJ IIni+8fOpJZbKZUeATBRt4m+LzbLcVcSvqxKa5LbUlPa6llBNAYEExxXwryqomoCrG9u G+viMW/oSkFyzGZrWoSbN5J+nzTepAT3Y9kGk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=/YNGtiLOrNgDJhJG7ECSwj3yCPMs9gQpx8/SEdMmmIs=; b=DJB2iZiNLWiCRvPEO0B3rQI6s+B90oapWMna2VMne2rLlcVOlIsKl4giizgF3BR3yN Bu9DgwAHGQyEHc/PT+Dqc03IUYo2CjzPhhZrEfVZx+9bl9ohKB4orFxBhrFWZN07aNzK qzjV+1SpEwqTsuu5r1ps+NLTdmrWAD2KQeIOmnuwsogoDbbMmexRNQ5BqRRhdYeVNezU 4aZx5zyH5X5JjzFW1WVkNGR9xFZwIamZQQQo8O+0KKpa+hFIvSYTo5CbHNFCyoNPDUs9 xjUDfVlxsLWkb+0oY/8W4Tynz75Lke9hwoNi+OSNJgMb8XHXwzRFJu8V+5vthOcYWM9n DXgA== X-Gm-Message-State: AOUpUlFcsF5fRYEZFnPSRfAkrxxDcmOK9MzaEqjUZnD6go5YBl+JOpo1 GF/X1jZi9BhhTtoOd4bZYDhLiuDG+VbfcXVaHDgGhg== X-Received: by 2002:aca:2ec9:: with SMTP id u192-v6mr1386111oiu.17.1531831569697; Tue, 17 Jul 2018 05:46:09 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a9d:113c:0:0:0:0:0 with HTTP; Tue, 17 Jul 2018 05:46:08 -0700 (PDT) X-Originating-IP: [212.96.48.140] In-Reply-To: References: <0000000000006a10de0570cf4d66@google.com> From: Miklos Szeredi Date: Tue, 17 Jul 2018 14:46:08 +0200 Message-ID: Subject: Re: WARNING: lock held when returning to user space in fuse_lock_inode To: Dmitry Vyukov Cc: syzbot , linux-fsdevel , LKML , syzkaller-bugs , astrachan@google.com Content-Type: multipart/mixed; boundary="00000000000091881205713154fc" Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org --00000000000091881205713154fc Content-Type: text/plain; charset="UTF-8" On Tue, Jul 17, 2018 at 1:36 PM, Dmitry Vyukov wrote: > On Tue, Jul 17, 2018 at 1:14 PM, Miklos Szeredi wrote: >> On Thu, Jul 12, 2018 at 5:49 PM, syzbot >> wrote: >>> Hello, >>> >>> syzbot found the following crash on: >>> >>> HEAD commit: c25c74b7476e Merge tag 'trace-v4.18-rc3-2' of git://git.ke.. >>> git tree: upstream >>> console output: https://syzkaller.appspot.com/x/log.txt?x=177bcec2400000 >>> kernel config: https://syzkaller.appspot.com/x/.config?x=25856fac4e580aa7 >>> dashboard link: https://syzkaller.appspot.com/bug?extid=3f7b29af1baa9d0a55be >>> compiler: gcc (GCC) 8.0.1 20180413 (experimental) >>> syzkaller repro:https://syzkaller.appspot.com/x/repro.syz?x=13aa7678400000 >>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17492678400000 >>> >>> IMPORTANT: if you fix the bug, please add the following tag to the commit: >>> Reported-by: syzbot+3f7b29af1baa9d0a55be@syzkaller.appspotmail.com >>> >>> random: sshd: uninitialized urandom read (32 bytes read) >>> random: sshd: uninitialized urandom read (32 bytes read) >>> random: sshd: uninitialized urandom read (32 bytes read) >>> >>> ================================================ >>> WARNING: lock held when returning to user space! >>> 4.18.0-rc4+ #143 Not tainted >>> ------------------------------------------------ >>> syz-executor012/4539 is leaving the kernel with locks still held! >>> 1 lock held by syz-executor012/4539: >>> #0: (____ptrval____) (&fi->mutex){+.+.}, at: fuse_lock_inode+0xaf/0xe0 >>> fs/fuse/inode.c:363 >> >> False positive. >> >> fi->mutex is definitely not held by the acquiring task when returning >> to userspace. Maybe syzkaller is confused by the fact that there are >> several interdependent tasks involved with fuse: the one calling into >> fuse by doing something (looking up ./file0/file0) and the one that >> reads the fuse device (returning with the LOOKUP request for "file0"). >> The second one will return with that lock held, but it's not the one >> that acquired it, so there's no bug at all here. > > Hi Miklos, > > syzkaller is unrelated here. That's what kernel self-detects and > prints. So either way there is something to fix in kernel here: either > fuse or lockdep. > > +Alistair did some analysis offline, hope you don't mind if I repost > your description: > === > Just from reading the code, I think I can see how this happens. Fuse > is wrapping its inode mutex with a check for "parallel_dirops", which > is set up in process_init_reply(). The FUSE_PARALLEL_DIROPS appears to > always be set, in fuse_send_init(), but its initial state is to be > disabled. So if the mutex gets taken, and it'll never be unlocked if > the initial command is flushed by fuse_readdir()'s use of > fuse_lock_inode(). > === Ah, indeed. Fix attached. Thanks, Miklos --00000000000091881205713154fc Content-Type: text/x-patch; charset="US-ASCII"; name="fuse-fix-initial-parallel-dirops.patch" Content-Disposition: attachment; filename="fuse-fix-initial-parallel-dirops.patch" Content-Transfer-Encoding: base64 X-Attachment-Id: f_jjpoy1yy0 RnJvbTogTWlrbG9zIFN6ZXJlZGkgPG1zemVyZWRpQHJlZGhhdC5jb20+ClN1YmplY3Q6IGZ1c2U6 IGZpeCBpbml0YWwgcGFyYWxsZWwgZGlyb3BzCgpJZiBwYXJhbGxlbCBkaXJvcHMgYXJlIGVuYWJs ZWQgaW4gRlVTRV9JTklUIHJlcGx5LCB0aGVuIGZpcnN0IG9wZXJhdGlvbiBtYXkKbGVhdmUgZmkt Pm11dGV4IGhlbGQuCgpSZXBvcnRlZC1ieTogc3l6Ym90KzNmN2IyOWFmMWJhYTlkMGE1NWJlQHN5 emthbGxlci5hcHBzcG90bWFpbC5jb20KU2lnbmVkLW9mZi1ieTogTWlrbG9zIFN6ZXJlZGkgPG1z emVyZWRpQHJlZGhhdC5jb20+Ci0tLQogZnMvZnVzZS9kaXIuYyAgICB8ICAgMTAgKysrKysrLS0t LQogZnMvZnVzZS9mdXNlX2kuaCB8ICAgIDQgKystLQogZnMvZnVzZS9pbm9kZS5jICB8ICAgMTQg KysrKysrKysrKy0tLS0KIDMgZmlsZXMgY2hhbmdlZCwgMTggaW5zZXJ0aW9ucygrKSwgMTAgZGVs ZXRpb25zKC0pCgotLS0gYS9mcy9mdXNlL2Rpci5jCisrKyBiL2ZzL2Z1c2UvZGlyLmMKQEAgLTM1 NSwxMSArMzU1LDEyIEBAIHN0YXRpYyBzdHJ1Y3QgZGVudHJ5ICpmdXNlX2xvb2t1cChzdHJ1Y3QK IAlzdHJ1Y3QgaW5vZGUgKmlub2RlOwogCXN0cnVjdCBkZW50cnkgKm5ld2VudDsKIAlib29sIG91 dGFyZ192YWxpZCA9IHRydWU7CisJYm9vbCBsb2NrZWQ7CiAKLQlmdXNlX2xvY2tfaW5vZGUoZGly KTsKKwlsb2NrZWQgPSBmdXNlX2xvY2tfaW5vZGUoZGlyKTsKIAllcnIgPSBmdXNlX2xvb2t1cF9u YW1lKGRpci0+aV9zYiwgZ2V0X25vZGVfaWQoZGlyKSwgJmVudHJ5LT5kX25hbWUsCiAJCQkgICAg ICAgJm91dGFyZywgJmlub2RlKTsKLQlmdXNlX3VubG9ja19pbm9kZShkaXIpOworCWZ1c2VfdW5s b2NrX2lub2RlKGRpciwgbG9ja2VkKTsKIAlpZiAoZXJyID09IC1FTk9FTlQpIHsKIAkJb3V0YXJn X3ZhbGlkID0gZmFsc2U7CiAJCWVyciA9IDA7CkBAIC0xMzQwLDYgKzEzNDEsNyBAQCBzdGF0aWMg aW50IGZ1c2VfcmVhZGRpcihzdHJ1Y3QgZmlsZSAqZmlsCiAJc3RydWN0IGZ1c2VfY29ubiAqZmMg PSBnZXRfZnVzZV9jb25uKGlub2RlKTsKIAlzdHJ1Y3QgZnVzZV9yZXEgKnJlcTsKIAl1NjQgYXR0 cl92ZXJzaW9uID0gMDsKKwlib29sIGxvY2tlZDsKIAogCWlmIChpc19iYWRfaW5vZGUoaW5vZGUp KQogCQlyZXR1cm4gLUVJTzsKQEAgLTEzNjcsOSArMTM2OSw5IEBAIHN0YXRpYyBpbnQgZnVzZV9y ZWFkZGlyKHN0cnVjdCBmaWxlICpmaWwKIAkJZnVzZV9yZWFkX2ZpbGwocmVxLCBmaWxlLCBjdHgt PnBvcywgUEFHRV9TSVpFLAogCQkJICAgICAgIEZVU0VfUkVBRERJUik7CiAJfQotCWZ1c2VfbG9j a19pbm9kZShpbm9kZSk7CisJbG9ja2VkID0gZnVzZV9sb2NrX2lub2RlKGlub2RlKTsKIAlmdXNl X3JlcXVlc3Rfc2VuZChmYywgcmVxKTsKLQlmdXNlX3VubG9ja19pbm9kZShpbm9kZSk7CisJZnVz ZV91bmxvY2tfaW5vZGUoaW5vZGUsIGxvY2tlZCk7CiAJbmJ5dGVzID0gcmVxLT5vdXQuYXJnc1sw XS5zaXplOwogCWVyciA9IHJlcS0+b3V0LmguZXJyb3I7CiAJZnVzZV9wdXRfcmVxdWVzdChmYywg cmVxKTsKLS0tIGEvZnMvZnVzZS9mdXNlX2kuaAorKysgYi9mcy9mdXNlL2Z1c2VfaS5oCkBAIC05 NzQsOCArOTc0LDggQEAgaW50IGZ1c2VfZG9fc2V0YXR0cihzdHJ1Y3QgZGVudHJ5ICpkZW50cgog CiB2b2lkIGZ1c2Vfc2V0X2luaXRpYWxpemVkKHN0cnVjdCBmdXNlX2Nvbm4gKmZjKTsKIAotdm9p ZCBmdXNlX3VubG9ja19pbm9kZShzdHJ1Y3QgaW5vZGUgKmlub2RlKTsKLXZvaWQgZnVzZV9sb2Nr X2lub2RlKHN0cnVjdCBpbm9kZSAqaW5vZGUpOwordm9pZCBmdXNlX3VubG9ja19pbm9kZShzdHJ1 Y3QgaW5vZGUgKmlub2RlLCBib29sIGxvY2tlZCk7Citib29sIGZ1c2VfbG9ja19pbm9kZShzdHJ1 Y3QgaW5vZGUgKmlub2RlKTsKIAogaW50IGZ1c2Vfc2V0eGF0dHIoc3RydWN0IGlub2RlICppbm9k ZSwgY29uc3QgY2hhciAqbmFtZSwgY29uc3Qgdm9pZCAqdmFsdWUsCiAJCSAgc2l6ZV90IHNpemUs IGludCBmbGFncyk7Ci0tLSBhL2ZzL2Z1c2UvaW5vZGUuYworKysgYi9mcy9mdXNlL2lub2RlLmMK QEAgLTM1NywxNSArMzU3LDIxIEBAIGludCBmdXNlX3JldmVyc2VfaW52YWxfaW5vZGUoc3RydWN0 IHN1cGUKIAlyZXR1cm4gMDsKIH0KIAotdm9pZCBmdXNlX2xvY2tfaW5vZGUoc3RydWN0IGlub2Rl ICppbm9kZSkKK2Jvb2wgZnVzZV9sb2NrX2lub2RlKHN0cnVjdCBpbm9kZSAqaW5vZGUpCiB7Ci0J aWYgKCFnZXRfZnVzZV9jb25uKGlub2RlKS0+cGFyYWxsZWxfZGlyb3BzKQorCWJvb2wgbG9ja2Vk ID0gZmFsc2U7CisKKwlpZiAoIWdldF9mdXNlX2Nvbm4oaW5vZGUpLT5wYXJhbGxlbF9kaXJvcHMp IHsKIAkJbXV0ZXhfbG9jaygmZ2V0X2Z1c2VfaW5vZGUoaW5vZGUpLT5tdXRleCk7CisJCWxvY2tl ZCA9IHRydWU7CisJfQorCisJcmV0dXJuIGxvY2tlZDsKIH0KIAotdm9pZCBmdXNlX3VubG9ja19p bm9kZShzdHJ1Y3QgaW5vZGUgKmlub2RlKQordm9pZCBmdXNlX3VubG9ja19pbm9kZShzdHJ1Y3Qg aW5vZGUgKmlub2RlLCBib29sIGxvY2tlZCkKIHsKLQlpZiAoIWdldF9mdXNlX2Nvbm4oaW5vZGUp LT5wYXJhbGxlbF9kaXJvcHMpCisJaWYgKGxvY2tlZCkKIAkJbXV0ZXhfdW5sb2NrKCZnZXRfZnVz ZV9pbm9kZShpbm9kZSktPm11dGV4KTsKIH0KIAo= --00000000000091881205713154fc--