linux-kernel - [PATCH 2/2] gfs2: fix sleep from invalid context bug in gfs2_glock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230206095543.539186-3-chenxiaosong2@huawei.com>
Date:   Mon, 6 Feb 2023 17:55:43 +0800
From:   ChenXiaoSong <chenxiaosong2@...wei.com>
To:     <rpeterso@...hat.com>, <agruenba@...hat.com>
CC:     <cluster-devel@...hat.com>, <linux-kernel@...r.kernel.org>,
        <chenxiaosong2@...wei.com>
Subject: [PATCH 2/2] gfs2: fix sleep from invalid context bug in gfs2_glock_wait()

Syzkaller reported BUG as follows:

  BUG: sleeping function called from invalid context at
       fs/gfs2/glock.c:1316
  Call Trace:
   __dump_stack lib/dump_stack.c:88 [inline]
   dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106
   __might_resched+0x4e9/0x6b0 kernel/sched/core.c:10036
   gfs2_glock_wait+0x52/0x2a0 fs/gfs2/glock.c:1316
   gfs2_glock_nq_init fs/gfs2/glock.h:262 [inline]
   gfs2_freeze_lock+0x5f/0xc0 fs/gfs2/util.c:107
   signal_our_withdraw fs/gfs2/util.c:160 [inline]
   gfs2_withdraw+0x5cc/0x1540 fs/gfs2/util.c:351
   gfs2_ail1_empty+0x8c9/0x950 fs/gfs2/log.c:368
   gfs2_flush_revokes+0x59/0x80 fs/gfs2/log.c:806
   revoke_lo_before_commit+0x2b/0xcf0 fs/gfs2/lops.c:869
   lops_before_commit fs/gfs2/lops.h:40 [inline]
   gfs2_log_flush+0xc8e/0x26a0 fs/gfs2/log.c:1093
   do_sync+0xa3c/0xc80 fs/gfs2/quota.c:975
   gfs2_quota_sync+0x3da/0x8b0 fs/gfs2/quota.c:1318
   gfs2_sync_fs+0x49/0xb0 fs/gfs2/super.c:650
   sync_filesystem+0xe8/0x220 fs/sync.c:56
   generic_shutdown_super+0x6b/0x310 fs/super.c:474
   kill_block_super+0x79/0xd0 fs/super.c:1386
   deactivate_locked_super+0xa7/0xf0 fs/super.c:332
   cleanup_mnt+0x494/0x520 fs/namespace.c:1291
   task_work_run+0x243/0x300 kernel/task_work.c:179
   exit_task_work include/linux/task_work.h:38 [inline]
   do_exit+0x644/0x2150 kernel/exit.c:867
   do_group_exit+0x1fd/0x2b0 kernel/exit.c:1012
   __do_sys_exit_group kernel/exit.c:1023 [inline]
   __se_sys_exit_group kernel/exit.c:1021 [inline]
   __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1021
   do_syscall_x64 arch/x86/entry/common.c:50 [inline]
   do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
   entry_SYSCALL_64_after_hwframe+0x63/0xcd

Fix this by calling gfs2_withdraw() outside of the spinlock context.

Link: https://syzkaller.appspot.com/bug?id=7bd882c47078df844b5a82550559d69482d5c3c1
Signed-off-by: ChenXiaoSong <chenxiaosong2@...wei.com>
---
 fs/gfs2/log.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
index c62c914702ba..945540c0a3cf 100644
--- a/fs/gfs2/log.c
+++ b/fs/gfs2/log.c
@@ -825,8 +825,10 @@ void gfs2_flush_revokes(struct gfs2_sbd *sdp)
 	unsigned int max_revokes = atomic_read(&sdp->sd_log_revokes_available);
 
 	gfs2_log_lock(sdp);
-	gfs2_ail1_empty(sdp, max_revokes);
+	__gfs2_ail1_empty(sdp, max_revokes);
 	gfs2_log_unlock(sdp);
+
+	gfs2_ail1_withdraw(sdp);
 }
 
 /**
-- 
2.31.1