Linux-FSCrypt Archive mirror
 help / color / mirror / Atom feed
From: Eric Biggers <ebiggers@kernel.org>
To: syzbot <syzbot+cf0b4280f19be4031cf2@syzkaller.appspotmail.com>
Cc: jack@suse.com, linux-ext4@vger.kernel.org,
	linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
	syzkaller-bugs@googlegroups.com, tytso@mit.edu,
	linux-fscrypt@vger.kernel.org
Subject: Re: [syzbot] [ext4?] possible deadlock in start_this_handle (4)
Date: Tue, 28 Feb 2023 16:19:26 -0800	[thread overview]
Message-ID: <Y/6aDmrx8Q9ob+Zi@sol.localdomain> (raw)
In-Reply-To: <00000000000009d6c905f5cb6e07@google.com>

On Tue, Feb 28, 2023 at 04:02:36PM -0800, syzbot wrote:
> -> #1 (fscrypt_init_mutex){+.+.}-{3:3}:
>        __mutex_lock_common kernel/locking/mutex.c:603 [inline]
>        __mutex_lock+0x12f/0x1350 kernel/locking/mutex.c:747
>        fscrypt_initialize+0x40/0xa0 fs/crypto/crypto.c:326
>        fscrypt_setup_encryption_info+0xef/0xeb0 fs/crypto/keysetup.c:563
>        fscrypt_get_encryption_info+0x375/0x450 fs/crypto/keysetup.c:668
>        fscrypt_setup_filename+0x23c/0xec0 fs/crypto/fname.c:458
>        ext4_fname_setup_filename+0x8c/0x110 fs/ext4/crypto.c:28
>        ext4_add_entry+0x3aa/0xe30 fs/ext4/namei.c:2380
>        ext4_rename+0x1979/0x2620 fs/ext4/namei.c:3904
>        ext4_rename2+0x1c7/0x270 fs/ext4/namei.c:4184
>        vfs_rename+0xef6/0x17a0 fs/namei.c:4772
>        do_renameat2+0xb62/0xc90 fs/namei.c:4923
>        __do_sys_renameat2 fs/namei.c:4956 [inline]
>        __se_sys_renameat2 fs/namei.c:4953 [inline]
>        __ia32_sys_renameat2+0xe8/0x120 fs/namei.c:4953
>        do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
>        __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178
>        do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203
>        entry_SYSENTER_compat_after_hwframe+0x70/0x82

Interesting.  The above call stack is not supposed to be possible.  It says that
the target directory's encryption key is being set up in the middle of
ext4_rename().  But, fscrypt_prepare_rename() is supposed to return an error if
either the source or target directory's key isn't set up already.

> Unfortunately, I don't have any reproducer for this issue yet.

That's quite unfortunate :-(

- Eric

           reply	other threads:[~2023-03-01  0:19 UTC|newest]

Thread overview: expand[flat|nested]  mbox.gz  Atom feed
 [parent not found: <00000000000009d6c905f5cb6e07@google.com>]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=Y/6aDmrx8Q9ob+Zi@sol.localdomain \
    --to=ebiggers@kernel.org \
    --cc=jack@suse.com \
    --cc=linux-ext4@vger.kernel.org \
    --cc=linux-fscrypt@vger.kernel.org \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=syzbot+cf0b4280f19be4031cf2@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    --cc=tytso@mit.edu \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).