Hi Christian,
Could you please pick up the patch?
Thanks,
Slava.
On Thu, 2025-05-29 at 18:34 +0000, Viacheslav Dubeyko wrote:
> On Thu, 2025-05-29 at 00:18 -0600, Yangtao Li wrote:
> > Syzbot reported an issue in hfsplus filesystem:
> >
> > ------------[ cut here ]------------
> > WARNING: CPU: 0 PID: 4400 at fs/hfsplus/extents.c:346
> > hfsplus_free_extents+0x700/0xad0
> > Call Trace:
> > <TASK>
> > hfsplus_file_truncate+0x768/0xbb0 fs/hfsplus/extents.c:606
> > hfsplus_write_begin+0xc2/0xd0 fs/hfsplus/inode.c:56
> > cont_expand_zero fs/buffer.c:2383 [inline]
> > cont_write_begin+0x2cf/0x860 fs/buffer.c:2446
> > hfsplus_write_begin+0x86/0xd0 fs/hfsplus/inode.c:52
> > generic_cont_expand_simple+0x151/0x250 fs/buffer.c:2347
> > hfsplus_setattr+0x168/0x280 fs/hfsplus/inode.c:263
> > notify_change+0xe38/0x10f0 fs/attr.c:420
> > do_truncate+0x1fb/0x2e0 fs/open.c:65
> > do_sys_ftruncate+0x2eb/0x380 fs/open.c:193
> > do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> > do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
> > entry_SYSCALL_64_after_hwframe+0x63/0xcd
> >
> > To avoid deadlock, Commit 31651c607151 ("hfsplus: avoid deadlock
> > on file truncation") unlock extree before hfsplus_free_extents(),
> > and add check wheather extree is locked in hfsplus_free_extents().
> >
> > However, when operations such as hfsplus_file_release,
> > hfsplus_setattr, hfsplus_unlink, and hfsplus_get_block are executed
> > concurrently in different files, it is very likely to trigger the
> > WARN_ON, which will lead syzbot and xfstest to consider it as an
> > abnormality.
> >
> > The comment above this warning also describes one of the easy
> > triggering situations, which can easily trigger and cause
> > xfstest&syzbot to report errors.
> >
> > [task A] [task B]
> > ->hfsplus_file_release
> > ->hfsplus_file_truncate
> > ->hfs_find_init
> > ->mutex_lock
> > ->mutex_unlock
> > ->hfsplus_write_begin
> > ->hfsplus_get_block
> > ->hfsplus_file_extend
> > ->hfsplus_ext_read_extent
> > ->hfs_find_init
> > ->mutex_lock
> > ->hfsplus_free_extents
> > WARN_ON(mutex_is_locked) !!!
> >
> > Several threads could try to lock the shared extents tree.
> > And warning can be triggered in one thread when another thread
> > has locked the tree. This is the wrong behavior of the code and
> > we need to remove the warning.
> >
> > Fixes: 31651c607151f ("hfsplus: avoid deadlock on file truncation")
> > Reported-by: syzbot+8c0bc9f818702ff75b76@xxxxxxxxxxxxxxxxxxxxxxxxx
> > Closes:
> > https://lore.kernel.org/all/00000000000057fa4605ef101c4c@xxxxxxxxxx/
> >
> > Signed-off-by: Yangtao Li <frank.li@xxxxxxxx>
> > ---
> > fs/hfsplus/extents.c | 3 ---
> > 1 file changed, 3 deletions(-)
> >
> > diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c
> > index a6d61685ae79..b1699b3c246a 100644
> > --- a/fs/hfsplus/extents.c
> > +++ b/fs/hfsplus/extents.c
> > @@ -342,9 +342,6 @@ static int hfsplus_free_extents(struct
> > super_block *sb,
> > int i;
> > int err = 0;
> >
> > - /* Mapping the allocation file may lock the extent tree */
> > - WARN_ON(mutex_is_locked(&HFSPLUS_SB(sb)->ext_tree-
> > >tree_lock));
> > -
>
> Makes sense to me. Looks good.
>
> But I really like your mentioning of reproducing the issue in
> generic/013 and
> really nice analysis of the issue there. Sadly, we haven't it in the
> comment. :)
>
> Reviewed-by: Viacheslav Dubeyko <slava@xxxxxxxxxxx>
>
> Thanks,
> Slava.
>
> > hfsplus_dump_extent(extent);
> > for (i = 0; i < 8; extent++, i++) {
> > count = be32_to_cpu(extent->block_count);
