lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 13 Feb 2021 23:26:37 +0900 From: Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp> To: Jan Kara <jack@...e.cz> Cc: jack@...e.com, linux-ext4@...r.kernel.org, linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com, tytso@....edu, mhocko@...e.cz, linux-mm@...ck.org, syzbot <syzbot+bfdded10ab7dcd7507ae@...kaller.appspotmail.com> Subject: Re: possible deadlock in start_this_handle (2) On 2021/02/11 19:49, Jan Kara wrote: > This stacktrace should never happen. ext4_xattr_set() starts a transaction. > That internally goes through start_this_handle() which calls: > > handle->saved_alloc_context = memalloc_nofs_save(); > > and we restore the allocation context only in stop_this_handle() when > stopping the handle. And with this fs_reclaim_acquire() should remove > __GFP_FS from the mask and not call __fs_reclaim_acquire(). Excuse me, but it seems to me that nothing prevents ext4_xattr_set_handle() from reaching ext4_xattr_inode_lookup_create() without memalloc_nofs_save() when hitting ext4_get_nojournal() path. Will you explain when ext4_get_nojournal() path is executed? ext4_xattr_set() { handle = ext4_journal_start(inode, EXT4_HT_XATTR, credits) == __ext4_journal_start() { return __ext4_journal_start_sb() { journal = EXT4_SB(sb)->s_journal; if (!journal || (EXT4_SB(sb)->s_mount_state & EXT4_FC_REPLAY)) return ext4_get_nojournal(); // Never calls memalloc_nofs_save() despite returning !IS_ERR() value. return jbd2__journal_start(journal, blocks, rsv_blocks, revoke_creds, GFP_NOFS, type, line); // Calls memalloc_nofs_save() when start_this_handle() returns 0. } } } error = ext4_xattr_set_handle(handle, inode, name_index, name, value, value_len, flags); { ext4_write_lock_xattr(inode, &no_expand); // Grabs &ei->xattr_sem error = ext4_xattr_ibody_set(handle, inode, &i, &is) { error = ext4_xattr_set_entry(i, s, handle, inode, false /* is_block */) { ret = ext4_xattr_inode_lookup_create(handle, inode, i->value, i->value_len, &new_ea_inode); // Using GFP_KERNEL based on assumption that ext4_journal_start() called memalloc_nofs_save(). } } } }
Powered by blists - more mailing lists