From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-oi0-f65.google.com ([209.85.218.65]:43871 "EHLO mail-oi0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731140AbeGQLqh (ORCPT ); Tue, 17 Jul 2018 07:46:37 -0400 Received: by mail-oi0-f65.google.com with SMTP id b15-v6so1240276oib.10 for ; Tue, 17 Jul 2018 04:14:29 -0700 (PDT) MIME-Version: 1.0 In-Reply-To: <0000000000006a10de0570cf4d66@google.com> References: <0000000000006a10de0570cf4d66@google.com> From: Miklos Szeredi Date: Tue, 17 Jul 2018 13:14:28 +0200 Message-ID: Subject: Re: WARNING: lock held when returning to user space in fuse_lock_inode To: syzbot Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" Sender: linux-fsdevel-owner@vger.kernel.org List-ID: On Thu, Jul 12, 2018 at 5:49 PM, syzbot wrote: > Hello, > > syzbot found the following crash on: > > HEAD commit: c25c74b7476e Merge tag 'trace-v4.18-rc3-2' of git://git.ke.. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=177bcec2400000 > kernel config: https://syzkaller.appspot.com/x/.config?x=25856fac4e580aa7 > dashboard link: https://syzkaller.appspot.com/bug?extid=3f7b29af1baa9d0a55be > compiler: gcc (GCC) 8.0.1 20180413 (experimental) > syzkaller repro:https://syzkaller.appspot.com/x/repro.syz?x=13aa7678400000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17492678400000 > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+3f7b29af1baa9d0a55be@syzkaller.appspotmail.com > > random: sshd: uninitialized urandom read (32 bytes read) > random: sshd: uninitialized urandom read (32 bytes read) > random: sshd: uninitialized urandom read (32 bytes read) > > ================================================ > WARNING: lock held when returning to user space! > 4.18.0-rc4+ #143 Not tainted > ------------------------------------------------ > syz-executor012/4539 is leaving the kernel with locks still held! > 1 lock held by syz-executor012/4539: > #0: (____ptrval____) (&fi->mutex){+.+.}, at: fuse_lock_inode+0xaf/0xe0 > fs/fuse/inode.c:363 False positive. fi->mutex is definitely not held by the acquiring task when returning to userspace. Maybe syzkaller is confused by the fact that there are several interdependent tasks involved with fuse: the one calling into fuse by doing something (looking up ./file0/file0) and the one that reads the fuse device (returning with the LOOKUP request for "file0"). The second one will return with that lock held, but it's not the one that acquired it, so there's no bug at all here. Thanks, Miklos > > > --- > This bug is generated by a bot. It may contain errors. > See https://goo.gl/tpsmEJ for more information about syzbot. > syzbot engineers can be reached at syzkaller@googlegroups.com. > > syzbot will keep track of this bug report. See: > https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with > syzbot. > syzbot can test patches for this bug, for details see: > https://goo.gl/tpsmEJ#testing-patches