linux-kernel - Re: [syzbot] Re: [syzbot] [jfs?] possible deadlock in diFree (2)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <6763dedd.050a0220.15da49.0008.GAE@google.com>
Date: Thu, 19 Dec 2024 00:52:45 -0800
From: syzbot <syzbot+355da3b3a74881008e8f@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org
Subject: Re: [syzbot] Re: [syzbot] [jfs?] possible deadlock in diFree (2)

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org.

***

Subject: Re: [syzbot] [jfs?] possible deadlock in diFree (2)
Author: lizhi.xu@...driver.com

In following calltrace, diAlloc and diFree need to hold same ag lock,
so before calling duplicateIXtree(), we maybe unlock it, and relock it after.

 diAlloc()->
   diAllocAG()->
     diAllocExt()->
       diNewIAG()->
         duplicateIXtree()->
	   diFreeSpecial()->
	     evict()->
	       jfs_evict_inode()->
	         diFree()

#syz test

diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
index a360b24ed320..9f105c748447 100644
--- a/fs/jfs/jfs_imap.c
+++ b/fs/jfs/jfs_imap.c
@@ -2594,7 +2594,13 @@ diNewIAG(struct inomap * imap, int *iagnop, int agno, struct metapage ** mpp)
 		txEnd(tid);
 		mutex_unlock(&JFS_IP(ipimap)->commit_mutex);
 
+		IWRITE_UNLOCK(ipimap);
+		IAGFREE_UNLOCK(imap);
+		AG_UNLOCK(imap, agno);
 		duplicateIXtree(sb, blkno, xlen, &xaddr);
+		AG_LOCK(imap, agno);
+		IAGFREE_LOCK(imap);
+		IWRITE_LOCK(ipimap, RDWRLOCK_IMAP);
 
 		/* update the next available iag number */
 		imap->im_nextiag += 1;