linux-kernel - [PATCH] f2fs: fix deadlock in f2f2_add

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230825053732.3098387-1-lizhi.xu@windriver.com>
Date:   Fri, 25 Aug 2023 13:37:32 +0800
From:   Lizhi Xu <lizhi.xu@...driver.com>
To:     <syzbot+a4976ce949df66b1ddf1@...kaller.appspotmail.com>
CC:     <chao@...nel.org>, <jaegeuk@...nel.org>,
        <linux-f2fs-devel@...ts.sourceforge.net>,
        <linux-fsdevel@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <syzkaller-bugs@...glegroups.com>
Subject: [PATCH] f2fs: fix deadlock in f2f2_add_dentry

There are two paths:
1. f2fs_add_dentry->f2fs_down_read->f2fs_add_inline_entry->down_write->
   up_write->f2fs_up_read
2. f2fs_add_dentry->f2fs_add_regular_entry->down_write->
   f2fs_init_inode_metadata->f2fs_down_read->f2fs_up_read->up_write

Force order lock to read->write.

Signed-off-by: Lizhi Xu <lizhi.xu@...driver.com>
Reported-and-tested-by: syzbot+a4976ce949df66b1ddf1@...kaller.appspotmail.com
---
 fs/f2fs/dir.c    | 4 +---
 fs/f2fs/inline.c | 2 ++
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
index d635c58cf5a3..022dc02c1390 100644
--- a/fs/f2fs/dir.c
+++ b/fs/f2fs/dir.c
@@ -736,12 +736,12 @@ int f2fs_add_regular_entry(struct inode *dir, const struct f2fs_filename *fname,
 	f2fs_wait_on_page_writeback(dentry_page, DATA, true, true);
 
 	if (inode) {
-		f2fs_down_write(&F2FS_I(inode)->i_sem);
 		page = f2fs_init_inode_metadata(inode, dir, fname, NULL);
 		if (IS_ERR(page)) {
 			err = PTR_ERR(page);
 			goto fail;
 		}
+		f2fs_down_write(&F2FS_I(inode)->i_sem);
 	}
 
 	make_dentry_ptr_block(NULL, &d, dentry_blk);
@@ -780,9 +780,7 @@ int f2fs_add_dentry(struct inode *dir, const struct f2fs_filename *fname,
 		 * Should get i_xattr_sem to keep the lock order:
 		 * i_xattr_sem -> inode_page lock used by f2fs_setxattr.
 		 */
-		f2fs_down_read(&F2FS_I(dir)->i_xattr_sem);
 		err = f2fs_add_inline_entry(dir, fname, inode, ino, mode);
-		f2fs_up_read(&F2FS_I(dir)->i_xattr_sem);
 	}
 	if (err == -EAGAIN)
 		err = f2fs_add_regular_entry(dir, fname, inode, ino, mode);
diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
index 4638fee16a91..7618b383c2b7 100644
--- a/fs/f2fs/inline.c
+++ b/fs/f2fs/inline.c
@@ -628,10 +628,12 @@ int f2fs_add_inline_entry(struct inode *dir, const struct f2fs_filename *fname,
 	if (IS_ERR(ipage))
 		return PTR_ERR(ipage);
 
+	f2fs_down_read(&F2FS_I(dir)->i_xattr_sem);
 	inline_dentry = inline_data_addr(dir, ipage);
 	make_dentry_ptr_inline(dir, &d, inline_dentry);
 
 	bit_pos = f2fs_room_for_filename(d.bitmap, slots, d.max);
+	f2fs_up_read(&F2FS_I(dir)->i_xattr_sem);
 	if (bit_pos >= d.max) {
 		err = do_convert_inline_dir(dir, ipage, inline_dentry);
 		if (err)
-- 
2.25.1