| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <94b4189d-dfb6-4443-a336-abbae89d36ad@linux.alibaba.com>
Date: Thu, 8 Jan 2026 09:29:11 +0800
From: Joseph Qi <joseph.qi@...ux.alibaba.com>
To: Prithvi Tambewagh <activprithvi@...il.com>, mark@...heh.com,
jlbec@...lplan.org, Heming Zhao <heming.zhao@...e.com>
Cc: heming.zhao@...e.com, ocfs2-devel@...ts.linux.dev,
linux-kernel@...r.kernel.org, linux-kernel-mentees@...ts.linux.dev,
skhan@...uxfoundation.org, david.hunter.linux@...il.com, khalid@...nel.org,
syzbot+78359d5fbb04318c35e9@...kaller.appspotmail.com
Subject: Re: [PATCH] ocfs2: Fix circular locking dependency in
ocfs2_del_inode_from_orphan()
On 2026/1/6 20:51, Prithvi Tambewagh wrote:
> A possible circular locking dependency in ocfs2_del_inode_from_orphan()
> is detected by syzbot, which occurs due to change in the sequence of
> acquiring locks. The existing chain is:
>
> &ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE] --> &dquot->dq_lock -->
> &ocfs2_quota_ip_alloc_sem_key
>
> In ocfs2_dio_end_io_write(), &ocfs2_quota_ip_alloc_sem_key is acquired,
> and then ocfs2_del_inode_from_orphan() is called, which acquires
> &ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE]. This opposes the
> existing dependency chain:
>
IIUC, ocfs2_dio_end_io_write() only gets the &ocfs2_file_ip_alloc_sem_key.
So how it happens?
Thanks,
Joseph
> -> #3 (&ocfs2_quota_ip_alloc_sem_key){++++}-{4:4}:
> lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868
> down_write+0x3a/0x50 kernel/locking/rwsem.c:1590
> ocfs2_create_local_dquot+0x19d/0x1a40 fs/ocfs2/quota_local.c:1227
> ocfs2_acquire_dquot+0x80f/0xb30 fs/ocfs2/quota_global.c:883
> dqget+0x7c1/0xf20 fs/quota/dquot.c:980
> __dquot_initialize+0x3b3/0xcb0 fs/quota/dquot.c:1508
> ocfs2_get_init_inode+0x13b/0x1b0 fs/ocfs2/namei.c:205
> ocfs2_mknod+0x863/0x2050 fs/ocfs2/namei.c:313
> ocfs2_create+0x1a5/0x440 fs/ocfs2/namei.c:676
> lookup_open fs/namei.c:3796 [inline]
> open_last_lookups fs/namei.c:3895 [inline]
> path_openat+0x1500/0x3840 fs/namei.c:4131
> do_filp_open+0x1fa/0x410 fs/namei.c:4161
> do_sys_openat2+0x121/0x1c0 fs/open.c:1437
> do_sys_open fs/open.c:1452 [inline]
> __do_sys_openat fs/open.c:1468 [inline]
> __se_sys_openat fs/open.c:1463 [inline]
> __x64_sys_openat+0x138/0x170 fs/open.c:1463
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> -> #2 (&dquot->dq_lock){+.+.}-{4:4}:
> lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868
> __mutex_lock_common kernel/locking/rtmutex_api.c:535 [inline]
> mutex_lock_nested+0x5a/0x1d0 kernel/locking/rtmutex_api.c:547
> wait_on_dquot fs/quota/dquot.c:357 [inline]
> dqget+0x73a/0xf20 fs/quota/dquot.c:975
> __dquot_initialize+0x3b3/0xcb0 fs/quota/dquot.c:1508
> ocfs2_get_init_inode+0x13b/0x1b0 fs/ocfs2/namei.c:205
> ocfs2_mknod+0x863/0x2050 fs/ocfs2/namei.c:313
> ocfs2_create+0x1a5/0x440 fs/ocfs2/namei.c:676
> lookup_open fs/namei.c:3796 [inline]
> open_last_lookups fs/namei.c:3895 [inline]
> path_openat+0x1500/0x3840 fs/namei.c:4131
> do_filp_open+0x1fa/0x410 fs/namei.c:4161
> do_sys_openat2+0x121/0x1c0 fs/open.c:1437
> do_sys_open fs/open.c:1452 [inline]
> __do_sys_openat fs/open.c:1468 [inline]
> __se_sys_openat fs/open.c:1463 [inline]
> __x64_sys_openat+0x138/0x170 fs/open.c:1463
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> -> #1 (&ocfs2_sysfile_lock_key[INODE_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}:
> lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868
> down_write+0x3a/0x50 kernel/locking/rwsem.c:1590
> inode_lock include/linux/fs.h:980 [inline]
> ocfs2_remove_inode fs/ocfs2/inode.c:731 [inline]
> ocfs2_wipe_inode fs/ocfs2/inode.c:894 [inline]
> ocfs2_delete_inode fs/ocfs2/inode.c:1155 [inline]
> ocfs2_evict_inode+0x153d/0x40d0 fs/ocfs2/inode.c:1295
> evict+0x504/0x9c0 fs/inode.c:810
> do_unlinkat+0x39f/0x570 fs/namei.c:4744
> __do_sys_unlinkat fs/namei.c:4778 [inline]
> __se_sys_unlinkat fs/namei.c:4771 [inline]
> __x64_sys_unlinkat+0xd3/0xf0 fs/namei.c:4771
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> -> #0 (&ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE]){+.+.}-{4:4}:
> check_prev_add kernel/locking/lockdep.c:3165 [inline]
> check_prevs_add kernel/locking/lockdep.c:3284 [inline]
> validate_chain+0xb9b/0x2140 kernel/locking/lockdep.c:3908
> __lock_acquire+0xab9/0xd20 kernel/locking/lockdep.c:5237
> lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868
> down_write+0x3a/0x50 kernel/locking/rwsem.c:1590
> inode_lock include/linux/fs.h:980 [inline]
> ocfs2_del_inode_from_orphan+0x134/0x740 fs/ocfs2/namei.c:2730
> ocfs2_dio_end_io_write fs/ocfs2/aops.c:2306 [inline]
> ocfs2_dio_end_io+0x47b/0x1100 fs/ocfs2/aops.c:2404
> dio_complete+0x25e/0x790 fs/direct-io.c:281
> __blockdev_direct_IO+0x2bc0/0x31f0 fs/direct-io.c:1303
> ocfs2_direct_IO+0x260/0x2d0 fs/ocfs2/aops.c:2441
> generic_file_direct_write+0x1dc/0x3e0 mm/filemap.c:4189
> __generic_file_write_iter+0x120/0x240 mm/filemap.c:4358
> ocfs2_file_write_iter+0x157d/0x1d20 fs/ocfs2/file.c:2469
> iter_file_splice_write+0x97a/0x10f0 fs/splice.c:738
> do_splice_from fs/splice.c:938 [inline]
> direct_splice_actor+0x104/0x160 fs/splice.c:1161
> splice_direct_to_actor+0x5b3/0xcd0 fs/splice.c:1105
> do_splice_direct_actor fs/splice.c:1204 [inline]
> do_splice_direct+0x187/0x270 fs/splice.c:1230
> do_sendfile+0x4ec/0x7f0 fs/read_write.c:1370
> __do_sys_sendfile64 fs/read_write.c:1431 [inline]
> __se_sys_sendfile64+0x13e/0x190 fs/read_write.c:1417
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> Fix this by acquiring &ocfs2_quota_ip_alloc_sem_key after acquiring
> &ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE], effectively calling
> down_write(&oi->ip_alloc_sem) after the call to
> ocfs2_del_inode_from_orphan().
>
> Reported-by: syzbot+78359d5fbb04318c35e9@...kaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=78359d5fbb04318c35e9
> Tested-by: syzbot+78359d5fbb04318c35e9@...kaller.appspotmail.com
> Cc: stable@...r.kernel.org
> Signed-off-by: Prithvi Tambewagh <activprithvi@...il.com>
> ---
> fs/ocfs2/aops.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
> index 76c86f1c2b1c..586e3b74d782 100644
> --- a/fs/ocfs2/aops.c
> +++ b/fs/ocfs2/aops.c
> @@ -2295,8 +2295,6 @@ static int ocfs2_dio_end_io_write(struct inode *inode,
> goto out;
> }
>
> - down_write(&oi->ip_alloc_sem);
> -
> /* Delete orphan before acquire i_rwsem. */
> if (dwc->dw_orphaned) {
> BUG_ON(dwc->dw_writer_pid != task_pid_nr(current));
> @@ -2309,6 +2307,8 @@ static int ocfs2_dio_end_io_write(struct inode *inode,
> mlog_errno(ret);
> }
>
> + down_write(&oi->ip_alloc_sem);
> +
> di = (struct ocfs2_dinode *)di_bh->b_data;
>
> ocfs2_init_dinode_extent_tree(&et, INODE_CACHE(inode), di_bh);
>
> base-commit: 765e56e41a5af2d456ddda6cbd617b9d3295ab4e
Powered by blists - more mailing lists