linux-kernel - Re: [PATCH] f2fs: fix deadlock in f2f2_add

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <517380b7-77e6-3b79-5156-234b51dbb104@kernel.org>
Date:   Fri, 25 Aug 2023 18:41:38 +0800
From:   Chao Yu <chao@...nel.org>
To:     Lizhi Xu <lizhi.xu@...driver.com>
Cc:     jaegeuk@...nel.org, linux-f2fs-devel@...ts.sourceforge.net,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] f2fs: fix deadlock in f2f2_add_dentry

On 2023/8/25 13:37, Lizhi Xu wrote:
> There are two paths:
> 1. f2fs_add_dentry->f2fs_down_read->f2fs_add_inline_entry->down_write->
>     up_write->f2fs_up_read
> 2. f2fs_add_dentry->f2fs_add_regular_entry->down_write->
>     f2fs_init_inode_metadata->f2fs_down_read->f2fs_up_read->up_write
> 
> Force order lock to read->write.

Hi Lizhi,

Thanks for the fix.

Can you please check below patch? it has fixed reported issue.

https://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git/commit/?h=dev&id=5c13e2388bf3426fd69a89eb46e50469e9624e56

Feedback from syzbot:

https://lore.kernel.org/linux-f2fs-devel/0000000000001ba17a0603b5871e@google.com/

> 
> Signed-off-by: Lizhi Xu <lizhi.xu@...driver.com>
> Reported-and-tested-by: syzbot+a4976ce949df66b1ddf1@...kaller.appspotmail.com
> ---
>   fs/f2fs/dir.c    | 4 +---
>   fs/f2fs/inline.c | 2 ++
>   2 files changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
> index d635c58cf5a3..022dc02c1390 100644
> --- a/fs/f2fs/dir.c
> +++ b/fs/f2fs/dir.c
> @@ -736,12 +736,12 @@ int f2fs_add_regular_entry(struct inode *dir, const struct f2fs_filename *fname,
>   	f2fs_wait_on_page_writeback(dentry_page, DATA, true, true);
>   
>   	if (inode) {
> -		f2fs_down_write(&F2FS_I(inode)->i_sem);
>   		page = f2fs_init_inode_metadata(inode, dir, fname, NULL);
>   		if (IS_ERR(page)) {
>   			err = PTR_ERR(page);
>   			goto fail;
>   		}
> +		f2fs_down_write(&F2FS_I(inode)->i_sem);
>   	}
>   
>   	make_dentry_ptr_block(NULL, &d, dentry_blk);
> @@ -780,9 +780,7 @@ int f2fs_add_dentry(struct inode *dir, const struct f2fs_filename *fname,
>   		 * Should get i_xattr_sem to keep the lock order:
>   		 * i_xattr_sem -> inode_page lock used by f2fs_setxattr.
>   		 */
> -		f2fs_down_read(&F2FS_I(dir)->i_xattr_sem);
>   		err = f2fs_add_inline_entry(dir, fname, inode, ino, mode);
> -		f2fs_up_read(&F2FS_I(dir)->i_xattr_sem);
>   	}
>   	if (err == -EAGAIN)
>   		err = f2fs_add_regular_entry(dir, fname, inode, ino, mode);
> diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
> index 4638fee16a91..7618b383c2b7 100644
> --- a/fs/f2fs/inline.c
> +++ b/fs/f2fs/inline.c
> @@ -628,10 +628,12 @@ int f2fs_add_inline_entry(struct inode *dir, const struct f2fs_filename *fname,
>   	if (IS_ERR(ipage))
>   		return PTR_ERR(ipage);
>   
> +	f2fs_down_read(&F2FS_I(dir)->i_xattr_sem);
>   	inline_dentry = inline_data_addr(dir, ipage);
>   	make_dentry_ptr_inline(dir, &d, inline_dentry);
>   
>   	bit_pos = f2fs_room_for_filename(d.bitmap, slots, d.max);
> +	f2fs_up_read(&F2FS_I(dir)->i_xattr_sem);
>   	if (bit_pos >= d.max) {
>   		err = do_convert_inline_dir(dir, ipage, inline_dentry);
>   		if (err)