[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20240510102643.2517-1-hdanton@sina.com>
Date: Fri, 10 May 2024 18:26:43 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+4c493dcd5a68168a94b2@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [kernfs?] possible deadlock in kernfs_seq_start
On Tue, 07 May 2024 22:36:18 -0700
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: dccb07f2914c Merge tag 'for-6.9-rc7-tag' of git://git.kern..
> git tree: upstream
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1367a504980000
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git dccb07f2914c
--- l/fs/overlayfs/dir.c
+++ d/fs/overlayfs/dir.c
@@ -654,10 +654,44 @@ out:
return err;
}
+static int __ovl_create_object(struct dentry *dentry, int mode, dev_t rdev, const char *link)
+{
+ int err;
+ struct inode *inode;
+ struct ovl_cattr attr = {
+ .rdev = rdev,
+ .link = link,
+ };
+
+ err = ovl_copy_up(dentry->d_parent);
+ if (err)
+ return err;
+
+ /* Preallocate inode to be used by ovl_get_inode() */
+ err = -ENOMEM;
+ inode = ovl_new_inode(dentry->d_sb, mode, rdev);
+ if (!inode)
+ return err;
+
+ spin_lock(&inode->i_lock);
+ inode->i_state |= I_CREATING;
+ spin_unlock(&inode->i_lock);
+
+ inode_init_owner(&nop_mnt_idmap, inode, dentry->d_parent->d_inode, mode);
+ attr.mode = inode->i_mode;
+
+ err = ovl_create_or_link(dentry, inode, &attr, false);
+ /* Did we end up using the preallocated inode? */
+ if (inode != d_inode(dentry))
+ iput(inode);
+
+ return err;
+}
+
static int ovl_create(struct mnt_idmap *idmap, struct inode *dir,
struct dentry *dentry, umode_t mode, bool excl)
{
- return ovl_create_object(dentry, (mode & 07777) | S_IFREG, 0, NULL);
+ return __ovl_create_object(dentry, (mode & 07777) | S_IFREG, 0, NULL);
}
static int ovl_mkdir(struct mnt_idmap *idmap, struct inode *dir,
--
Powered by blists - more mailing lists