Received-SPF: pass (google.com: domain of linux-kernel+bounces-130791-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
From: Hillf Danton <hdanton@sina.com>
To: syzbot <syzbot+9a5b0ced8b1bfb238b56@syzkaller.appspotmail.com>
Cc: linux-kernel@vger.kernel.org,
	syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [kernfs?] possible deadlock in kernfs_fop_llseek
Date: Thu,  4 Apr 2024 08:42:57 +0800
Message-Id: <20240404004257.3933-1-hdanton@sina.com>
In-Reply-To: <00000000000098f75506153551a1@google.com>
References: 
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

On Wed, 03 Apr 2024 11:23:26 -0700
> syzbot found the following issue on:
> 
> HEAD commit:    fe46a7dd189e Merge tag 'sound-6.9-rc1' of git://git.kernel..
> git tree:       upstream
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=15c38139180000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git  fe46a7dd189e

--- x/fs/overlayfs/file.c
+++ y/fs/overlayfs/file.c
@@ -204,6 +204,7 @@ static loff_t ovl_llseek(struct file *fi
 	if (ret)
 		return ret;
 
+	inode_lock(inode);
 	/*
 	 * Overlay file f_pos is the master copy that is preserved
 	 * through copy up and modified on read/write, but only real
@@ -220,6 +221,7 @@ static loff_t ovl_llseek(struct file *fi
 
 	file->f_pos = real.file->f_pos;
 	ovl_inode_unlock(inode);
+	inode_unlock(inode);
 
 	fdput(real);
 
--