linux-kernel - [PATCH] deadlock when swapping to FAT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.64.0903120819010.26206@hs20-bc2-1.build.redhat.com>
Date:	Thu, 12 Mar 2009 08:30:05 -0400 (EDT)
From:	Mikulas Patocka <mpatocka@...hat.com>
To:	linux-kernel@...r.kernel.org
cc:	hirofumi@...l.parknet.co.jp
Subject: [PATCH] deadlock when swapping to FAT

Hi

swapon will deadlock when an attempt to swap to a file on FAT filesystem 
is made. swapon holds i_mutex and FAT bmap is attempting to take it again.

This bug was introduced somewhere between 2.6.27 and 2.6.28.

No other filesystem is taking i_mutex in bmap, so I removed it as well.

Note that there are many other cases where bmap can race with truncate in 
almost all the filesystems. They don't impose an immediate threat because 
bmap can be only called by root. These problems should be solved in a 
generic way, not in individual filesystems.

Mikulas

Signed-off-by: Mikulas Patocka <mpatocka@...hat.com
Cc: <stable@...nel.org>

---
 fs/fat/inode.c |    2 --
 1 file changed, 2 deletions(-)

Index: linux-2.6.29-rc7-devel/fs/fat/inode.c
===================================================================
--- linux-2.6.29-rc7-devel.orig/fs/fat/inode.c	2009-03-10 21:17:22.000000000 +0100
+++ linux-2.6.29-rc7-devel/fs/fat/inode.c	2009-03-11 22:52:38.000000000 +0100
@@ -202,9 +202,7 @@ static sector_t _fat_bmap(struct address
 	sector_t blocknr;
 
 	/* fat_get_cluster() assumes the requested blocknr isn't truncated. */
-	mutex_lock(&mapping->host->i_mutex);
 	blocknr = generic_block_bmap(mapping, block, fat_get_block);
-	mutex_unlock(&mapping->host->i_mutex);
 
 	return blocknr;
 }
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/