lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

exfat: release s_lock before calling dir_emit()

Browse Source 
There is a potential deadlock reported by syzbot as below:

======================================================
WARNING: possible circular locking dependency detected
6.4.0-next-20230707-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor330/5073 is trying to acquire lock:
ffff8880218527a0 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_lock_killable include/linux/mmap_lock.h:151 [inline]
ffff8880218527a0 (&mm->mmap_lock){++++}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:5293 [inline]
ffff8880218527a0 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x369/0x510 mm/memory.c:5344
but task is already holding lock:
ffff888019f760e0 (&sbi->s_lock){+.+.}-{3:3}, at: exfat_iterate+0x117/0xb50 fs/exfat/dir.c:232

which lock already depends on the new lock.

Chain exists of:
  &mm->mmap_lock --> mapping.invalidate_lock#3 --> &sbi->s_lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&sbi->s_lock);
                               lock(mapping.invalidate_lock#3);
                               lock(&sbi->s_lock);
  rlock(&mm->mmap_lock);

Let's try to avoid above potential deadlock condition by moving dir_emit*()
out of sbi->s_lock coverage.

Fixes: ca06197382bd ("exfat: add directory operations")
Cc: stable@vger.kernel.org #v5.7+
Reported-by: syzbot+1741a5d9b79989c10bdc@syzkaller.appspotmail.com
Link: https://lore.kernel.org/lkml/00000000000078ee7e060066270b@google.com/T/#u
Signed-off-by: Sungjong Seo <sj1557.seo@samsung.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
This commit is contained in:
Sungjong Seo 2023-07-14 23:45:15 +09:00 committed by Namjae Jeon
parent 0bf9ccffd2
commit 803d714374
1 changed files with 12 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
dir.c
View File

@ -219,7 +219,10 @@ static void exfat_free_namebuf(struct exfat_dentry_namebuf *nb)
exfat_init_namebuf(nb); exfat_init_namebuf(nb);
} }
/* skip iterating emit_dots when dir is empty */ /*
* Before calling dir_emit*(), sbi->s_lock should be released
* because page fault can occur in dir_emit*().
*/
#define ITER_POS_FILLED_DOTS (2) #define ITER_POS_FILLED_DOTS (2)
static int exfat_iterate(struct file *filp, struct dir_context *ctx) static int exfat_iterate(struct file *filp, struct dir_context *ctx)
{ {
@ -234,11 +237,10 @@ static int exfat_iterate(struct file *filp, struct dir_context *ctx)
int err = 0, fake_offset = 0; int err = 0, fake_offset = 0;
exfat_init_namebuf(nb); exfat_init_namebuf(nb);
mutex_lock(&EXFAT_SB(sb)->s_lock);
cpos = ctx->pos; cpos = ctx->pos;
if (!dir_emit_dots(filp, ctx)) if (!dir_emit_dots(filp, ctx))
goto unlock; goto out;
if (ctx->pos == ITER_POS_FILLED_DOTS) { if (ctx->pos == ITER_POS_FILLED_DOTS) {
cpos = 0; cpos = 0;
@ -250,16 +252,18 @@ static int exfat_iterate(struct file *filp, struct dir_context *ctx)
/* name buffer should be allocated before use */ /* name buffer should be allocated before use */
err = exfat_alloc_namebuf(nb); err = exfat_alloc_namebuf(nb);
if (err) if (err)
goto unlock; goto out;
get_new: get_new:
mutex_lock(&EXFAT_SB(sb)->s_lock);
if (ei->flags == ALLOC_NO_FAT_CHAIN && cpos >= i_size_read(inode)) if (ei->flags == ALLOC_NO_FAT_CHAIN && cpos >= i_size_read(inode))
goto end_of_dir; goto end_of_dir;
err = exfat_readdir(inode, &cpos, &de); err = exfat_readdir(inode, &cpos, &de);
if (err) { if (err) {
/* /*
* At least we tried to read a sector. Move cpos to next sector * At least we tried to read a sector.
* position (should be aligned). * Move cpos to next sector position (should be aligned).
*/ */
if (err == -EIO) { if (err == -EIO) {
cpos += 1 << (sb->s_blocksize_bits); cpos += 1 << (sb->s_blocksize_bits);
@ -282,16 +286,10 @@ get_new:
inum = iunique(sb, EXFAT_ROOT_INO); inum = iunique(sb, EXFAT_ROOT_INO);
} }
/*
* Before calling dir_emit(), sb_lock should be released.
* Because page fault can occur in dir_emit() when the size
* of buffer given from user is larger than one page size.
*/
mutex_unlock(&EXFAT_SB(sb)->s_lock); mutex_unlock(&EXFAT_SB(sb)->s_lock);
if (!dir_emit(ctx, nb->lfn, strlen(nb->lfn), inum, if (!dir_emit(ctx, nb->lfn, strlen(nb->lfn), inum,
(de.attr & ATTR_SUBDIR) ? DT_DIR : DT_REG)) (de.attr & ATTR_SUBDIR) ? DT_DIR : DT_REG))
goto out_unlocked; goto out;
mutex_lock(&EXFAT_SB(sb)->s_lock);
ctx->pos = cpos; ctx->pos = cpos;
goto get_new; goto get_new;
@ -299,9 +297,8 @@ end_of_dir:
if (!cpos && fake_offset) if (!cpos && fake_offset)
cpos = ITER_POS_FILLED_DOTS; cpos = ITER_POS_FILLED_DOTS;
ctx->pos = cpos; ctx->pos = cpos;
unlock:
mutex_unlock(&EXFAT_SB(sb)->s_lock); mutex_unlock(&EXFAT_SB(sb)->s_lock);
out_unlocked: out:
/* /*
* To improve performance, free namebuf after unlock sb_lock. * To improve performance, free namebuf after unlock sb_lock.
* If namebuf is not allocated, this function do nothing * If namebuf is not allocated, this function do nothing