From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
To: Linus Torvalds <torvalds@linux-foundation.org>,
Hillf Danton <hdanton@sina.com>
Cc: syzbot <syzbot+bed15dbf10294aa4f2ae@syzkaller.appspotmail.com>,
linux-kernel@vger.kernel.org, linux-mm@kvack.org,
Waiman Long <longman@redhat.com>,
Matthew Wilcox <willy@infradead.org>,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [ntfs3?] INFO: task hung in do_user_addr_fault (3)
Date: Mon, 2 Jan 2023 17:24:24 +0900 [thread overview]
Message-ID: <6383cde5-cf4b-facf-6e07-1378a485657d@I-love.SAKURA.ne.jp> (raw)
In-Reply-To: <CAHk-=wim+_xutuWdeykqM34EQxbE3As7+91L5uEVLUCXbUL1CA@mail.gmail.com>
On 2023/01/02 10:40, Linus Torvalds wrote:
> So I think that we have:
>
> - ntfs_truncate() gets the ni_lock (fs/ntfs3/file.c:393)
>
> - it then - while holding that lock - calls (on line 395):
>
> truncate_setsize ->
> truncate_pagecache ->
> truncate_inode_pages ->
> truncate_inode_pages_range ->
> folio_lock
>
> but that deadlocks on another process that wants to read that page,
> and that needs ni_lock to do so.
>
> So yes, it does look like a ntfs3 deadlock involving ni_lock.
Yes, I think you are right. My patch confirmed that other threads are not
holding ni_lock lock, which means that this is a deadlock between
PG_locked bit and ni_lock lock.
filemap_update_page() calls filemap_read_folio() after calling
folio_trylock(). Since folio_trylock() sets PG_locked bit,
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:799
ni_lock fs/ntfs3/ntfs_fs.h:1122 [inline]
attr_data_get_block+0x4a6/0x2e40 fs/ntfs3/attrib.c:919
ntfs_get_block_vbo+0x374/0xd20 fs/ntfs3/inode.c:573
do_mpage_readpage+0x98b/0x1bb0 fs/mpage.c:208
mpage_read_folio+0x103/0x1d0 fs/mpage.c:379
filemap_read_folio+0x1ba/0x7f0 mm/filemap.c:2426
filemap_update_page+0x3ca/0x550 mm/filemap.c:2511
filemap_get_pages+0x8d8/0x1110 mm/filemap.c:2624
filemap_read+0x3e7/0xee0 mm/filemap.c:2694
is trying to take ni_lock after setting PG_locked bit.
On the other hand, folio_lock() waits until PG_locked bit is cleared,
but unfortunately ntfs3_setattr() already took ni_lock before calling
folio_lock().
io_schedule+0x83/0x100 kernel/sched/core.c:8811
folio_wait_bit_common+0x8ca/0x1390 mm/filemap.c:1297
folio_lock include/linux/pagemap.h:938 [inline]
truncate_inode_pages_range+0xc8d/0x1650 mm/truncate.c:421
truncate_inode_pages mm/truncate.c:448 [inline]
truncate_pagecache mm/truncate.c:743 [inline]
truncate_setsize+0xcb/0xf0 mm/truncate.c:768
ntfs_truncate fs/ntfs3/file.c:395 [inline]
ntfs3_setattr+0x5a5/0xca0 fs/ntfs3/file.c:696
Since no lockdep annotation is used for e.g. PG_locked bit, this deadlock
cannot be detected by lockdep...
next prev parent reply other threads:[~2023-01-02 8:25 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-01-01 20:27 [syzbot] [ntfs3?] INFO: task hung in do_user_addr_fault (3) syzbot
[not found] ` <20230102005409.3474-1-hdanton@sina.com>
2023-01-02 1:40 ` Linus Torvalds
2023-01-02 8:24 ` Tetsuo Handa [this message]
2023-01-02 15:37 ` Matthew Wilcox
[not found] ` <20230102094125.3552-1-hdanton@sina.com>
2023-01-02 14:05 ` [PATCH] fs/ntfs3: don't hold ni_lock when calling truncate_setsize() Tetsuo Handa
2023-01-02 14:56 ` [syzbot] [ntfs3?] INFO: task hung in do_user_addr_fault (3) syzbot
2023-01-02 5:27 ` Tetsuo Handa
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6383cde5-cf4b-facf-6e07-1378a485657d@I-love.SAKURA.ne.jp \
--to=penguin-kernel@i-love.sakura.ne.jp \
--cc=hdanton@sina.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=longman@redhat.com \
--cc=syzbot+bed15dbf10294aa4f2ae@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=torvalds@linux-foundation.org \
--cc=willy@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).