From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
To: Al Viro <viro@zeniv.linux.org.uk>
Cc: syzbot <syzbot+69b40dc5fd40f32c199f@syzkaller.appspotmail.com>,
syzkaller-bugs@googlegroups.com,
Andrew Morton <akpm@linux-foundation.org>,
hch@infradead.org, linux-fsdevel <linux-fsdevel@vger.kernel.org>,
"Matthew Wilcox (Oracle)" <willy@infradead.org>,
Chen Zhongjin <chenzhongjin@huawei.com>,
Dave Chinner <dchinner@redhat.com>,
Christian Brauner <brauner@kernel.org>,
Christoph Hellwig <hch@lst.de>
Subject: [PATCH v2] sysv: don't call sb_bread() with pointers_lock held
Date: Mon, 10 Apr 2023 23:56:28 +0900 [thread overview]
Message-ID: <38509ddd-51a2-70da-6564-9ded34b2f363@I-love.SAKURA.ne.jp> (raw)
In-Reply-To: <0d195f93-a22a-49a2-0020-103534d6f7f6@I-love.SAKURA.ne.jp>
syzbot is reporting sleep in atomic context in SysV filesystem [1], for
sb_bread() is called with rw_spinlock held.
A "write_lock(&pointers_lock) => read_lock(&pointers_lock) deadlock" bug
and a "sb_bread() with write_lock(&pointers_lock)" bug were introduced by
"Replace BKL for chain locking with sysvfs-private rwlock" in Linux 2.5.12.
Then, "[PATCH] err1-40: sysvfs locking fix" in Linux 2.6.8 fixed the
former bug by moving pointers_lock lock to the callers, but instead
introduced a "sb_bread() with read_lock(&pointers_lock)" bug (which made
this problem easier to hit).
Al Viro suggested that why not to do like get_branch()/get_block()/
find_shared() in Minix filesystem does. And doing like that is a revert
of "[PATCH] err1-40: sysvfs locking fix" except that get_branch() from
find_shared() is called without write_lock(&pointers_lock).
Reported-by: syzbot <syzbot+69b40dc5fd40f32c199f@syzkaller.appspotmail.com>
Link: https://syzkaller.appspot.com/bug?extid=69b40dc5fd40f32c199f
Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
---
Changes in v2:
Correct patch description.
fs/sysv/itree.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/fs/sysv/itree.c b/fs/sysv/itree.c
index b22764fe669c..ab4756c94755 100644
--- a/fs/sysv/itree.c
+++ b/fs/sysv/itree.c
@@ -82,9 +82,6 @@ static inline sysv_zone_t *block_end(struct buffer_head *bh)
return (sysv_zone_t*)((char*)bh->b_data + bh->b_size);
}
-/*
- * Requires read_lock(&pointers_lock) or write_lock(&pointers_lock)
- */
static Indirect *get_branch(struct inode *inode,
int depth,
int offsets[],
@@ -104,15 +101,18 @@ static Indirect *get_branch(struct inode *inode,
bh = sb_bread(sb, block);
if (!bh)
goto failure;
+ read_lock(&pointers_lock);
if (!verify_chain(chain, p))
goto changed;
add_chain(++p, bh, (sysv_zone_t*)bh->b_data + *++offsets);
+ read_unlock(&pointers_lock);
if (!p->key)
goto no_block;
}
return NULL;
changed:
+ read_unlock(&pointers_lock);
brelse(bh);
*err = -EAGAIN;
goto no_block;
@@ -214,9 +214,7 @@ static int get_block(struct inode *inode, sector_t iblock, struct buffer_head *b
goto out;
reread:
- read_lock(&pointers_lock);
partial = get_branch(inode, depth, offsets, chain, &err);
- read_unlock(&pointers_lock);
/* Simplest case - block found, no allocation needed */
if (!partial) {
@@ -286,9 +284,9 @@ static Indirect *find_shared(struct inode *inode,
*top = 0;
for (k = depth; k > 1 && !offsets[k-1]; k--)
;
+ partial = get_branch(inode, k, offsets, chain, &err);
write_lock(&pointers_lock);
- partial = get_branch(inode, k, offsets, chain, &err);
if (!partial)
partial = chain + k-1;
/*
--
2.34.1
next prev parent reply other threads:[~2023-04-10 14:57 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <0000000000000ccf9a05ee84f5b0@google.com>
2023-03-26 22:24 ` [PATCH] sysv: convert pointers_lock from rw_lock to rw_sem Tetsuo Handa
2023-03-27 0:04 ` Al Viro
2023-03-27 10:19 ` Tetsuo Handa
2023-03-27 13:02 ` Al Viro
2023-03-27 13:09 ` Tetsuo Handa
2023-04-10 12:04 ` [PATCH] sysv: don't call sb_bread() with pointers_lock held Tetsuo Handa
2023-04-10 14:56 ` Tetsuo Handa [this message]
2024-01-30 9:36 ` Christian Brauner
2024-01-30 1:15 ` [syzbot] [fs?] BUG: sleeping function called from invalid context in __getblk_gfp syzbot
2024-01-30 11:54 ` Jan Kara
2024-01-30 15:57 ` Christoph Hellwig
2024-01-31 10:56 ` Christian Brauner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=38509ddd-51a2-70da-6564-9ded34b2f363@I-love.SAKURA.ne.jp \
--to=penguin-kernel@i-love.sakura.ne.jp \
--cc=akpm@linux-foundation.org \
--cc=brauner@kernel.org \
--cc=chenzhongjin@huawei.com \
--cc=dchinner@redhat.com \
--cc=hch@infradead.org \
--cc=hch@lst.de \
--cc=linux-fsdevel@vger.kernel.org \
--cc=syzbot+69b40dc5fd40f32c199f@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=viro@zeniv.linux.org.uk \
--cc=willy@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).