linux-kernel - Re: [syzbot] task hung in exfat_write

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <000000000000078063060b59fb38@google.com>
Date:   Wed, 29 Nov 2023 23:55:51 -0800
From:   syzbot <syzbot+2f73ed585f115e98aee8@...kaller.appspotmail.com>
To:     linux-kernel@...r.kernel.org
Subject: Re: [syzbot] task hung in exfat_write_inode

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org.

***

Subject: task hung in exfat_write_inode
Author: lizhi.xu@...driver.com

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git f9ff5644bcc0

diff --git a/fs/exfat/file.c b/fs/exfat/file.c
index bfdfafe00993..a3ace4fc555c 100644
--- a/fs/exfat/file.c
+++ b/fs/exfat/file.c
@@ -116,6 +116,7 @@ int __exfat_truncate(struct inode *inode)
 
 	exfat_chain_set(&clu, ei->start_clu, num_clusters_phys, ei->flags);
 
+	mutex_unlock(&sbi->s_lock);
 	if (i_size_read(inode) > 0) {
 		/*
 		 * Truncate FAT chain num_clusters after the first cluster
@@ -134,8 +135,10 @@ int __exfat_truncate(struct inode *inode)
 		} else {
 			while (num_clusters > 0) {
 				last_clu = clu.dir;
+				mutex_lock(&sbi->s_lock);
 				if (exfat_get_next_cluster(sb, &(clu.dir)))
 					return -EIO;
+				mutex_unlock(&sbi->s_lock);
 
 				num_clusters--;
 				clu.size--;
@@ -160,6 +163,7 @@ int __exfat_truncate(struct inode *inode)
 	 * __exfat_write_inode() is called for directory entry, bitmap
 	 * and FAT to be written in a same writeback.
 	 */
+	mutex_lock(&sbi->s_lock);
 	if (__exfat_write_inode(inode, inode_needs_sync(inode)))
 		return -EIO;