From: Ian Kent <raven@themaw.net>
To: syzbot <syzbot+2b1c8c58f62458852a54@syzkaller.appspotmail.com>,
autofs@vger.kernel.org, gregkh@linuxfoundation.org,
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
tj@kernel.org
Subject: Re: [syzbot] [kernfs?] possible deadlock in autofs_notify_daemon (3)
Date: Tue, 29 Sep 2026 10:46:04 +0800 [thread overview]
Message-ID: <add02708-b7de-4aa6-93eb-f2c53be52be4@themaw.net> (raw)
In-Reply-To: <6ab933fc.80e1c6cc.1e8e5f.005e.GAE@google.com>
On 27/9/26 23:19, syzbot wrote:
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: fd179f8a05be Merge tag 'ata-7.3-rc5' of git://git.kernel.o..
> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
> console output: https://syzkaller.appspot.com/x/log.txt?x=12416605580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=7d012d9c67977ee4
> dashboard link: https://syzkaller.appspot.com/bug?extid=2b1c8c58f62458852a54
> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15870ac9580000
What's your point here?
Are you saying that I need to explicitly check and reject obviously
bad/stupid requests.
Oh wait, I never see the request because there is no daemon involved.
Not sure how or where I can add a sanity check in this lot ...
Perhaps at mount, reject a list of known pseudo-fs file systems that
make no sense to
automount.
Ian
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+2b1c8c58f62458852a54@syzkaller.appspotmail.com
>
> ======================================================
> WARNING: possible circular locking dependency detected
> syzkaller #0 Not tainted
> ------------------------------------------------------
> syz-executor419/5954 is trying to acquire lock:
> ffff8880349c0938 (&sbi->pipe_mutex){+.+.}-{4:4}, at: autofs_write fs/autofs/waitq.c:55 [inline]
> ffff8880349c0938 (&sbi->pipe_mutex){+.+.}-{4:4}, at: autofs_notify_daemon+0x4f8/0xd90 fs/autofs/waitq.c:164
>
> but task is already holding lock:
> ffff888037e1c880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:336
>
> which lock already depends on the new lock.
>
>
> the existing dependency chain (in reverse order) is:
>
> -> #2 (&of->mutex){+.+.}-{4:4}:
> lock_acquire kernel/locking/lockdep.c:5942 [inline]
> lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899
> __mutex_lock_common kernel/locking/mutex.c:646 [inline]
> __mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821
> kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:336
> iter_file_splice_write+0x830/0x10b0 fs/splice.c:736
> do_splice_from fs/splice.c:936 [inline]
> do_splice+0x109c/0x1fa0 fs/splice.c:1349
> __do_splice+0x33b/0x370 fs/splice.c:1431
> __do_sys_splice fs/splice.c:1634 [inline]
> __se_sys_splice fs/splice.c:1616 [inline]
> __x64_sys_splice+0x187/0x250 fs/splice.c:1616
> do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
> do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> -> #1 (&pipe->mutex){+.+.}-{4:4}:
> lock_acquire kernel/locking/lockdep.c:5942 [inline]
> lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899
> __mutex_lock_common kernel/locking/mutex.c:646 [inline]
> __mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821
> anon_pipe_prefill_and_lock+0x16c/0x580 fs/pipe.c:165
> anon_pipe_write+0x164/0x1b50 fs/pipe.c:534
> __kernel_write_iter+0x6bb/0x930 fs/read_write.c:621
> __kernel_write+0xf6/0x140 fs/read_write.c:641
> autofs_write fs/autofs/waitq.c:57 [inline]
> autofs_notify_daemon+0x50d/0xd90 fs/autofs/waitq.c:164
> autofs_wait+0x10fd/0x1b50 fs/autofs/waitq.c:426
> autofs_mount_wait+0x132/0x3b0 fs/autofs/root.c:256
> autofs_d_automount+0x490/0x950 fs/autofs/root.c:410
> follow_automount fs/namei.c:1565 [inline]
> __traverse_mounts+0x1b9/0x8a0 fs/namei.c:1618
> traverse_mounts fs/namei.c:1647 [inline]
> handle_mounts fs/namei.c:1749 [inline]
> step_into_slowpath+0xb7e/0xf90 fs/namei.c:2104
> step_into fs/namei.c:2152 [inline]
> walk_component fs/namei.c:2288 [inline]
> lookup_last fs/namei.c:2789 [inline]
> path_lookupat+0x58b/0xc40 fs/namei.c:2813
> filename_lookup+0x202/0x590 fs/namei.c:2842
> vfs_statx+0xff/0x3f0 fs/stat.c:353
> vfs_fstatat+0x77/0xe0 fs/stat.c:373
> __do_sys_newfstatat+0x9d/0x120 fs/stat.c:538
> do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
> do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> -> #0 (&sbi->pipe_mutex){+.+.}-{4:4}:
> check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3209
> check_prevs_add kernel/locking/lockdep.c:3328 [inline]
> validate_chain kernel/locking/lockdep.c:3952 [inline]
> __lock_acquire+0x1528/0x1f40 kernel/locking/lockdep.c:5288
> lock_acquire kernel/locking/lockdep.c:5942 [inline]
> lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899
> __mutex_lock_common kernel/locking/mutex.c:646 [inline]
> __mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821
> autofs_write fs/autofs/waitq.c:55 [inline]
> autofs_notify_daemon+0x4f8/0xd90 fs/autofs/waitq.c:164
> autofs_wait+0x10fd/0x1b50 fs/autofs/waitq.c:426
> autofs_mount_wait+0x132/0x3b0 fs/autofs/root.c:256
> autofs_d_automount+0x490/0x950 fs/autofs/root.c:410
> follow_automount fs/namei.c:1565 [inline]
> __traverse_mounts+0x1b9/0x8a0 fs/namei.c:1618
> traverse_mounts fs/namei.c:1647 [inline]
> handle_mounts fs/namei.c:1749 [inline]
> step_into_slowpath+0xb7e/0xf90 fs/namei.c:2104
> step_into fs/namei.c:2152 [inline]
> walk_component fs/namei.c:2288 [inline]
> lookup_last fs/namei.c:2789 [inline]
> path_lookupat+0x58b/0xc40 fs/namei.c:2813
> filename_lookup+0x202/0x590 fs/namei.c:2842
> kern_path+0x37/0x50 fs/namei.c:3036
> lookup_bdev+0xd8/0x2a0 block/bdev.c:1268
> resume_store+0x1d6/0x460 kernel/power/hibernate.c:1280
> kobj_attr_store+0x58/0x80 lib/kobject.c:842
> sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
> kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
> new_sync_write fs/read_write.c:595 [inline]
> vfs_write+0x6af/0x1050 fs/read_write.c:687
> ksys_write+0x12a/0x250 fs/read_write.c:739
> do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
> do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> other info that might help us debug this:
>
> Chain exists of:
> &sbi->pipe_mutex --> &pipe->mutex --> &of->mutex
>
> Possible unsafe locking scenario:
>
> CPU0 CPU1
> ---- ----
> lock(&of->mutex);
> lock(&pipe->mutex);
> lock(&of->mutex);
> lock(&sbi->pipe_mutex);
>
> *** DEADLOCK ***
>
> locks held by syz-executor419/5954: 4, last CPU#0:
> #0: ffff88807a6735f0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 fs/file.c:1259
> #1: ffff888037bc2460 (sb_writers#8){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:739
> #2: ffff888037e1c880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:336
> #3: ffff888020adbe18 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline]
> #3: ffff888020adbe18 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 fs/kernfs/file.c:337
>
> stack backtrace:
> CPU: 0 UID: 0 PID: 5954 Comm: syz-executor419 Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
> print_circular_bug.cold+0x178/0x1be kernel/locking/lockdep.c:2087
> check_noncircular+0x146/0x160 kernel/locking/lockdep.c:2219
> check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3209
> check_prevs_add kernel/locking/lockdep.c:3328 [inline]
> validate_chain kernel/locking/lockdep.c:3952 [inline]
> __lock_acquire+0x1528/0x1f40 kernel/locking/lockdep.c:5288
> lock_acquire kernel/locking/lockdep.c:5942 [inline]
> lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899
> __mutex_lock_common kernel/locking/mutex.c:646 [inline]
> __mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821
> autofs_write fs/autofs/waitq.c:55 [inline]
> autofs_notify_daemon+0x4f8/0xd90 fs/autofs/waitq.c:164
> autofs_wait+0x10fd/0x1b50 fs/autofs/waitq.c:426
> autofs_mount_wait+0x132/0x3b0 fs/autofs/root.c:256
> autofs_d_automount+0x490/0x950 fs/autofs/root.c:410
> follow_automount fs/namei.c:1565 [inline]
> __traverse_mounts+0x1b9/0x8a0 fs/namei.c:1618
> traverse_mounts fs/namei.c:1647 [inline]
> handle_mounts fs/namei.c:1749 [inline]
> step_into_slowpath+0xb7e/0xf90 fs/namei.c:2104
> step_into fs/namei.c:2152 [inline]
> walk_component fs/namei.c:2288 [inline]
> lookup_last fs/namei.c:2789 [inline]
> path_lookupat+0x58b/0xc40 fs/namei.c:2813
> filename_lookup+0x202/0x590 fs/namei.c:2842
> kern_path+0x37/0x50 fs/namei.c:3036
> lookup_bdev+0xd8/0x2a0 block/bdev.c:1268
> resume_store+0x1d6/0x460 kernel/power/hibernate.c:1280
> kobj_attr_store+0x58/0x80 lib/kobject.c:842
> sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
> kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
> new_sync_write fs/read_write.c:595 [inline]
> vfs_write+0x6af/0x1050 fs/read_write.c:687
> ksys_write+0x12a/0x250 fs/read_write.c:739
> do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
> do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7fab79cd6b77
> Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
> RSP: 002b:00007ffcb4ea4ee0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
> RAX: ffffffffffffffda RBX: 000055556184c400 RCX: 00007fab79cd6b77
> RDX: 0000000000000016 RSI: 00007fab79d14c00 RDI: 0000000000000005
> RBP: 0000000000001733 R08: 0000000000000000 R09: 0000000000000000
>
>
> ---
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
prev parent reply other threads:[~2026-09-29 2:46 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-06 0:13 [syzbot] [autofs?] " syzbot
2026-09-27 15:19 ` [syzbot] [kernfs?] " syzbot
2026-09-29 2:46 ` Ian Kent [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=add02708-b7de-4aa6-93eb-f2c53be52be4@themaw.net \
--to=raven@themaw.net \
--cc=autofs@vger.kernel.org \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzbot+2b1c8c58f62458852a54@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tj@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®