linux-kernel - f2fs F2FS_IOC_SHUTDOWN hang issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 20 Mar 2024 06:59:09 +0000
From: Light Hsieh (謝明燈) <Light.Hsieh@...iatek.com>
To: Ed Tsai (蔡宗軒) <Ed.Tsai@...iatek.com>,
	"jaegeuk@...nel.org" <jaegeuk@...nel.org>
CC: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"linux-f2fs-devel@...ts.sourceforge.net"
	<linux-f2fs-devel@...ts.sourceforge.net>, "linux-fsdevel@...r.kernel.org"
	<linux-fsdevel@...r.kernel.org>, Chun-Hung Wu (巫駿宏)
	<Chun-hung.Wu@...iatek.com>
Subject: f2fs F2FS_IOC_SHUTDOWN hang issue

Hi Jaegeuk:

We encounter a deadlock issue when Android is going to poweroff.
Please help check.

When unmounting of  f2fs partition fail in Android poweroff procedure, init thread (pid = 1) invoke F2FS_IOC_SHUTDOWN  ioctl with arg F2FS_GOING_DOWN_FULLSYNC.
This ioctl cause down_write of a semaphore in the following call sequence:
        f2fs_ioc_shutdown() --> freeze_bdev() --> freeze_super() --> sb_wait_write(sb, SB_FREEZE_FS) --> ... ->percpu_down_write().

f2fs_ioc_shutdown() will later invoke f2fs_stop_discard_thread() and wait for stopping of f2fs_discard thread in the following call sequence:
        f2fs_ioc_shutdown() -->f2fs_stop_discard_thread() -->kthread_stop(discard_thread) --> wait_for_completion().
That is, init thread go sleep with a write semaphore.

f2fs_discard thread is then waken up to process f2fs discard.
However, f2fs_discard threshold may then hang because failing to get the semaphore aleady obtained by the slept init thread: 
        issue_discard_thread() --> sb_start_intwrite() -->sb_start_write(sb, SB_FREEZE_FS) --> percpu_down_read()

Light