Received-SPF: pass (google.com: domain of linux-kernel+bounces-8537-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.48.161 as permitted sender) client-ip=147.75.48.161;
Message-ID: <f2fefbfd-0ec9-4d4a-b065-bf68ad8e1641@I-love.SAKURA.ne.jp>
Date: Thu, 21 Dec 2023 22:52:20 +0900
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [syzbot] [fs?] INFO: trying to register non-static key in
 debugfs_file_get
Content-Language: en-US
To: syzbot <syzbot+fb20af23d0671a82c9a2@syzkaller.appspotmail.com>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Johannes Berg <johannes.berg@intel.com>,
        syzkaller-bugs@googlegroups.com
References: <000000000000fc306f060d052b5f@google.com>
Cc: linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org,
        rafael@kernel.org
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
In-Reply-To: <000000000000fc306f060d052b5f@google.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

#syz fix: Revert "debugfs: annotate debugfs handlers vs. removal with lockdep"

By the way, use of cmpxchg() implies that this path might run in parallel?
If yes, I think you need to finish lockdep_init_map() before cmpxchg(), or
concurrently running threads might reach lock_map_acquire_read() before
lockdep_init_map() completes...

        d_fsd = READ_ONCE(dentry->d_fsdata);
        if (!((unsigned long)d_fsd & DEBUGFS_FSDATA_IS_REAL_FOPS_BIT)) {
                fsd = d_fsd;
        } else {
                fsd = kmalloc(sizeof(*fsd), GFP_KERNEL);
                if (!fsd)
                        return -ENOMEM;

                fsd->real_fops = (void *)((unsigned long)d_fsd &
                                        ~DEBUGFS_FSDATA_IS_REAL_FOPS_BIT);
                refcount_set(&fsd->active_users, 1);
                init_completion(&fsd->active_users_drained);
                if (cmpxchg(&dentry->d_fsdata, d_fsd, fsd) != d_fsd) {
                        kfree(fsd);
                        fsd = READ_ONCE(dentry->d_fsdata);
                }
+#ifdef CONFIG_LOCKDEP
+               fsd->lock_name = kasprintf(GFP_KERNEL, "debugfs:%pd", dentry);
+               lockdep_register_key(&fsd->key);
+               lockdep_init_map(&fsd->lockdep_map, fsd->lock_name ?: "debugfs",
+                                &fsd->key, 0);
+#endif
        }

        /*
         * In case of a successful cmpxchg() above, this check is
         * strictly necessary and must follow it, see the comment in
         * __debugfs_remove_file().
         * OTOH, if the cmpxchg() hasn't been executed or wasn't
         * successful, this serves the purpose of not starving
         * removers.
         */
        if (d_unlinked(dentry))
                return -EIO;

        if (!refcount_inc_not_zero(&fsd->active_users))
                return -EIO;

+       lock_map_acquire_read(&fsd->lockdep_map);


On 2023/12/21 22:35, syzbot wrote:
> HEAD commit:    b10a3ccaf6e3 Merge tag 'loongarch-fixes-6.7-2' of git://gi..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=1278f06ce80000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=70dcde26e6b912e5
> dashboard link: https://syzkaller.appspot.com/bug?extid=fb20af23d0671a82c9a2
> compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40