task hung in xlog_grant_head_check - still reproducible on 7.2-rc7 (2018 report went dormant)

Hello,


syzbot reported "INFO: task hung in xlog_grant_head_check" back in May
2018 [1][2]; the tracker entry has been dormant (no-reminders) for years
and the cause bisection was inconclusive.


While fuzzing current mainline (7.2.0-rc7-00232-gdcb68831eac7) with
syzkaller I hit the same hang again, and syzkaller minimized it to just
two syscalls: mount a crafted XFS image (v5, small log) and issue one
setxattr("security.ima", ..., size=0xfffe):


syz_mount_image$xfs(..., './file0', ..., image)
setxattr$security_ima('./file0', 'security.ima',
      {sha1, ...}, 0xfffe, 0)


INFO: task syz.0.17:10462 blocked for more than 143 seconds.
Call Trace:
__schedule+0x12e4/0x64e0
schedule+0xe7/0x2d0
xlog_grant_head_wait+0x13f/0xd00 fs/xfs/xfs_log.c:217
xlog_grant_head_check+0x48f/0x4e0 fs/xfs/xfs_log.c:279
xfs_log_reserve+0x2d2/0x850 fs/xfs/xfs_log.c:387
xfs_trans_reserve fs/xfs/trans.c:174 [inline]
xfs_trans_alloc+0x3c5/0xd40 fs/xfs/xfs_trans.c:256
xfs_trans_alloc_inode+0x198/0x3b0 fs/xfs/xfs_trans.c:1080
xfs_attr_set+0x40b/0x10f0 fs/xfs/libxfs/xfs_attr.c:1184
xfs_attr_change+0x379/0x500 fs/xfs/xfs_xattr.c:128
...
__x64_sys_setxattr+0xc6/0x140 fs/xattr.c:764


The 64 KB xattr value forces a transaction larger than the log of the
crafted image can ever satisfy, and xlog_grant_head_wait() then waits
forever - the task is not killable and eventually trips the hung-task
detector.


So this looks like an unbounded/unkillable wait rather than something
that resolves with log tail pushing: with a transaction reservation
larger than the total log size, no amount of tail progress can ever
grant it.  If that analysis holds, a reservation-size sanity check
(xlog_grant_head_check refusing reservations > usable log size, or the
attr code splitting such transactions further) would turn the hang into
a clean -ENOSPC.


Full syzkaller reproducer (image + program) and logs available on
request.


Kernel: stock mainline 7.2.0-rc7-00232-gdcb68831eac7, syzkaller's
upstream KASAN config.


[1] https://lwn.net/Articles/755633/
[2] https://lkml.org/lkml/2018/5/22/1056 (Dave Chinner's analysis of the
    grant head wait logic, 2018)


Found-by: syzkaller on linux-7.2.0-rc7-00232-gdcb68831eac7