Received-SPF: pass (google.com: domain of linux-kernel+bounces-147757-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Precedence: bulk
MIME-Version: 1.0
References: <000000000000145ce00616368490@google.com> <Zh8DP48j0ECw5BeN@dread.disaster.area>
In-Reply-To: <Zh8DP48j0ECw5BeN@dread.disaster.area>
From: Namjae Jeon <linkinjeon@kernel.org>
Date: Wed, 17 Apr 2024 08:38:15 +0900
Message-ID: <CAKYAXd_1v7sCwy0UYiixXOBA7xUkQK0EPtJcLOC0LYuJ9cHyfg@mail.gmail.com>
Subject: Re: [syzbot] [exfat?] possible deadlock in exfat_page_mkwrite
To: Dave Chinner <david@fromorbit.com>
Cc: syzbot <syzbot+d88216a7af9446d57d59@syzkaller.appspotmail.com>, 
	linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, 
	sj1557.seo@samsung.com, syzkaller-bugs@googlegroups.com
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

2024=EB=85=84 4=EC=9B=94 17=EC=9D=BC (=EC=88=98) =EC=98=A4=EC=A0=84 8:02, D=
ave Chinner <david@fromorbit.com>=EB=8B=98=EC=9D=B4 =EC=9E=91=EC=84=B1:
>
> On Tue, Apr 16, 2024 at 06:14:20AM -0700, syzbot wrote:
> > Hello,
> >
> > syzbot found the following issue on:
> >
> > HEAD commit:    66e4190e92ce Add linux-next specific files for 20240416
> > git tree:       linux-next
> > console output: https://syzkaller.appspot.com/x/log.txt?x=3D15817767180=
000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=3Dc247afaa437=
e6409
> > dashboard link: https://syzkaller.appspot.com/bug?extid=3Dd88216a7af944=
6d57d59
> > compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for D=
ebian) 2.40
> >
> > Unfortunately, I don't have any reproducer for this issue yet.
> >
> > Downloadable assets:
> > disk image: https://storage.googleapis.com/syzbot-assets/86891dae5f9c/d=
isk-66e4190e.raw.xz
> > vmlinux: https://storage.googleapis.com/syzbot-assets/1ca383660bf2/vmli=
nux-66e4190e.xz
> > kernel image: https://storage.googleapis.com/syzbot-assets/bf6ff37d3fcc=
/bzImage-66e4190e.xz
> >
> > IMPORTANT: if you fix the issue, please add the following tag to the co=
mmit:
> > Reported-by: syzbot+d88216a7af9446d57d59@syzkaller.appspotmail.com
> >
> > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D
> > WARNING: possible circular locking dependency detected
> > 6.9.0-rc4-next-20240416-syzkaller #0 Not tainted
> > ------------------------------------------------------
> > syz-executor.0/17125 is trying to acquire lock:
> > ffff88805e616b38 (&sb->s_type->i_mutex_key#24){++++}-{3:3}, at: inode_l=
ock include/linux/fs.h:791 [inline]
> > ffff88805e616b38 (&sb->s_type->i_mutex_key#24){++++}-{3:3}, at: exfat_p=
age_mkwrite+0x43a/0xea0 fs/exfat/file.c:629
>
> exfat_page_mkwrite() is taking the inode_lock() in the page fault
> handler:
>
>         folio_lock(folio);
>         .....
>         if (ei->valid_size < folio_pos(folio)) {
>                 inode_lock(inode);
>                 err =3D exfat_extend_valid_size(file, ei->valid_size, fol=
io_pos(folio));
>                 inode_unlock(inode);
>                 if (err < 0) {
>                         ret =3D vmf_fs_error(err);
>                         goto out;
>                 }
>         }
>
> This is can deadlock in a couple of ways:
>
> 1. page faults nest inside the inode lock (e.g. read/write IO path)
> 2. folio locks nest inside the inode lock (e.g. truncate)
> 3. IIUC, exfat_extend_valid_size() will allocate, lock and zero new
> folios and call balance_dirty_pages_ratelimited(). None of these
> things should be done with some other folio already held locked.
>
> As I've previously said: doing sparse file size extension in page
> fault context is complex and difficult to do correctly. It is far
> easier and safer to do it when the file is actually extended, and in
> that case the context doing the extension takes the perf penalty of
> allocaiton and zeroing, not the downstream application doing mmap()
> operations on the (extended) file....
Okay, Let me take a look.
Thanks for your comment.
>
> -Dave.
> --
> Dave Chinner
> david@fromorbit.com