[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20240918172026.2532-2-pvmohammedanees2003@gmail.com>
Date: Wed, 18 Sep 2024 17:20:25 +0000
From: Mohammed Anees <pvmohammedanees2003@...il.com>
To: ocfs2-devel@...ts.linux.dev,
linux-kernel@...r.kernel.org
Cc: Mark Fasheh <mark@...heh.com>,
Joel Becker <jlbec@...lplan.org>,
Joseph Qi <joseph.qi@...ux.alibaba.com>,
Mohammed Anees <pvmohammedanees2003@...il.com>,
syzbot+18a87160c7d64ba2e2f6@...kaller.appspotmail.com
Subject: [PATCH 1/2] ocfs2: Fix deadlock in ocfs2_read_virt_blocks
syzbot has found a kernel BUG in ocfs2_write_cluster_by_desc,
while the next patch in the series resolves this, another
bug has been detected due to a potential deadlock [1].
The scenario is depicted here,
CPU0 CPU1
lock(&ocfs2_file_ip_alloc_sem_key);
lock(&osb->system_file_mutex);
lock(&ocfs2_file_ip_alloc_sem_key);
lock(&osb->system_file_mutex);
The function calls which could lead to this are:
CPU0
ocfs2_write_begin - lock(&ocfs2_file_ip_alloc_sem_key);
.
.
.
ocfs2_get_system_file_inode - lock(&osb->system_file_mutex);
CPU1 -
ocfs2_get_system_file_inode - lock(&osb->system_file_mutex);
.
.
.
ocfs2_read_virt_blocks - lock(&ocfs2_file_ip_alloc_sem_key);
This issue can be resolved by making the down_read -> down_read_try
in the ocfs2_read_virt_blocks.
[1] https://syzkaller.appspot.com/bug?extid=18a87160c7d64ba2e2f6
Reported-and-tested-by: syzbot+18a87160c7d64ba2e2f6@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=18a87160c7d64ba2e2f6
Signed-off-by: Mohammed Anees <pvmohammedanees2003@...il.com>
---
fs/ocfs2/extent_map.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
diff --git a/fs/ocfs2/extent_map.c b/fs/ocfs2/extent_map.c
index 70a768b62..f83d0a3b6 100644
--- a/fs/ocfs2/extent_map.c
+++ b/fs/ocfs2/extent_map.c
@@ -12,6 +12,7 @@
#include <linux/slab.h>
#include <linux/types.h>
#include <linux/fiemap.h>
+#include <linux/delay.h>
#include <cluster/masklog.h>
@@ -961,6 +962,8 @@ int ocfs2_read_virt_blocks(struct inode *inode, u64 v_block, int nr,
int rc = 0;
u64 p_block, p_count;
int i, count, done = 0;
+ int retries, max_retries = 5;
+ int retry_delay_ms = 30;
trace_ocfs2_read_virt_blocks(
inode, (unsigned long long)v_block, nr, bhs, flags,
@@ -973,7 +976,18 @@ int ocfs2_read_virt_blocks(struct inode *inode, u64 v_block, int nr,
}
while (done < nr) {
- down_read(&OCFS2_I(inode)->ip_alloc_sem);
+ retries = 0;
+ while (retries < max_retries) {
+ if (down_read_trylock(&OCFS2_I(inode)->ip_alloc_sem))
+ break; // Lock acquired
+ msleep(retry_delay_ms);
+ retries++;
+ }
+ if (retries == max_retries) {
+ rc = -EAGAIN;
+ mlog(ML_ERROR, "Cannot acquire lock\n");
+ break;
+ }
rc = ocfs2_extent_map_get_blocks(inode, v_block + done,
&p_block, &p_count, NULL);
up_read(&OCFS2_I(inode)->ip_alloc_sem);
--
2.46.0
Powered by blists - more mailing lists