linux-kernel - Re: [PATCH] exfat: fix potential deadlock on __exfat_get_dentry

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 3 Jun 2024 20:50:29 +0900
From: Namjae Jeon <linkinjeon@...nel.org>
To: Sungjong Seo <sj1557.seo@...sung.com>
Cc: linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org, 
	stable@...r.kernel.org, syzbot+412a392a2cd4a65e71db@...kaller.appspotmail.com
Subject: Re: [PATCH] exfat: fix potential deadlock on __exfat_get_dentry_set

2024년 5월 31일 (금) 오후 7:16, Sungjong Seo <sj1557.seo@...sung.com>님이 작성:
>
> When accessing a file with more entries than ES_MAX_ENTRY_NUM, the bh-array
> is allocated in __exfat_get_entry_set. The problem is that the bh-array is
> allocated with GFP_KERNEL. It does not make sense. In the following cases,
> a deadlock for sbi->s_lock between the two processes may occur.
>
>        CPU0                CPU1
>        ----                ----
>   kswapd
>    balance_pgdat
>     lock(fs_reclaim)
>                       exfat_iterate
>                        lock(&sbi->s_lock)
>                        exfat_readdir
>                         exfat_get_uniname_from_ext_entry
>                          exfat_get_dentry_set
>                           __exfat_get_dentry_set
>                            kmalloc_array
>                             ...
>                             lock(fs_reclaim)
>     ...
>     evict
>      exfat_evict_inode
>       lock(&sbi->s_lock)
>
> To fix this, let's allocate bh-array with GFP_NOFS.
>
> Fixes: a3ff29a95fde ("exfat: support dynamic allocate bh for exfat_entry_set_cache")
> Cc: stable@...r.kernel.org # v6.2+
> Reported-by: syzbot+412a392a2cd4a65e71db@...kaller.appspotmail.com
> Closes: https://lore.kernel.org/lkml/000000000000fef47e0618c0327f@google.com
> Signed-off-by: Sungjong Seo <sj1557.seo@...sung.com>
Applied it to #dev.
Thanks for your patch!