[PATCH] fs: Fix bug in lock_rename_child that can cause deadlock

[PATCH] fs: Fix bug in lock_rename_child that can cause deadlock

[Li Dong]

Function xx causes a deadlock，because s_vfs_rename_mutex was not released when return

Signed-off-by: Li Dong <lidong@vivo.com>
---
 fs/namei.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/namei.c b/fs/namei.c
index 91171da719c5..63b3fd05fef2 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -3076,8 +3076,10 @@ struct dentry *lock_rename_child(struct dentry *c1, struct dentry *p2)
 	/*
 	 * nobody can move out of any directories on this fs.
 	 */
-	if (likely(c1->d_parent != p2))
+	if (likely(c1->d_parent != p2)) {
+		mutex_unlock(&c1->d_sb->s_vfs_rename_mutex);
 		return lock_two_directories(c1->d_parent, p2);
+	}
 
 	/*
 	 * c1 got moved into p2 while we were taking locks;
-- 
2.31.1.windows.1

Re: [PATCH] fs: Fix bug in lock_rename_child that can cause deadlock

[Christian Brauner]

On Mon, Jun 19, 2023 at 09:37:14PM +0800, Li Dong wrote:
> Function xx causes a deadlock，because s_vfs_rename_mutex was not released when return
> 
> Signed-off-by: Li Dong <lidong@vivo.com>
> ---

This is a cross-directory rename which requires s_vfs_rename_mutex to be
held. You're suggesting to drop it, violating basic locking assumptions
with dire consequences:

lock_rename_child()
{
        c1->d_parent != p2
        -> acquire s_vfs_rename_mutex
}

pairs with

old_parent = c1->d_parent;
unlock_rename(old_parent, p2)
{
        if (old_parent != p2)
        -> release s_vfs_rename_mutex
}

See the usage in ksmbd:

trap = lock_rename_child(old_child, new_path.dentry);
old_parent = dget(old_child->d_parent);
unlock_rename(old_parent, new_path.dentry);