linux-kernel - Re: [syzbot] possible deadlock in ocfs2_try_remove_refcount

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <fe9d1d9b-c156-4e98-abe4-80997edc8828@I-love.SAKURA.ne.jp>
Date: Sun, 22 Jun 2025 01:03:21 +0900
From: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
To: Diogo Jahchan Koike <djahchankoike@...il.com>
Cc: LKML <linux-kernel@...r.kernel.org>
Subject: Re: [syzbot] possible deadlock in ocfs2_try_remove_refcount_tree

Please re-submit this change as a formal patch.
You can add

  Reported-by: syzbot+1fed2de07d8e11a3ec1b@...kaller.appspotmail.com
  Tested-by: syzbot+1fed2de07d8e11a3ec1b@...kaller.appspotmail.com

lines to this change.

On 2024/08/22 6:04, syzbot wrote:
> For archival purposes, forwarding an incoming command email to
> linux-kernel@...r.kernel.org.
> 
> ***
> 
> Subject: possible deadlock in ocfs2_try_remove_refcount_tree
> Author: djahchankoike@...il.com
> 
> #syz test
> 
> Acquiring the locks in refcounttree should follow
> the ip_alloc --> ip_xattr ordering, as done by multiple
> code paths in ocfs2; otherwise, we risk an ABBA deadlock
> (i.e in the start transaction path).
> 
> Signed-off-by: Diogo Jahchan Koike <djahchankoike@...il.com>
> ---
>  fs/ocfs2/refcounttree.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
> index 1f303b1adf1a..32c0249ff253 100644
> --- a/fs/ocfs2/refcounttree.c
> +++ b/fs/ocfs2/refcounttree.c
> @@ -927,8 +927,8 @@ int ocfs2_try_remove_refcount_tree(struct inode *inode,
>  	struct ocfs2_inode_info *oi = OCFS2_I(inode);
>  	struct ocfs2_dinode *di = (struct ocfs2_dinode *)di_bh->b_data;
>  
> -	down_write(&oi->ip_xattr_sem);
>  	down_write(&oi->ip_alloc_sem);
> +	down_write(&oi->ip_xattr_sem);
>  
>  	if (oi->ip_clusters)
>  		goto out;
> @@ -944,8 +944,8 @@ int ocfs2_try_remove_refcount_tree(struct inode *inode,
>  	if (ret)
>  		mlog_errno(ret);
>  out:
> -	up_write(&oi->ip_alloc_sem);
>  	up_write(&oi->ip_xattr_sem);
> +	up_write(&oi->ip_alloc_sem);
>  	return 0;
>  }
>