Skip to content

Commit ec3e32d

Browse files
donutAneesgregkh
authored andcommitted
ocfs2: fix deadlock in ocfs2_get_system_file_inode
commit 7bf1823 upstream. syzbot has found a possible deadlock in ocfs2_get_system_file_inode [1]. The scenario is depicted here, CPU0 CPU1 lock(&ocfs2_file_ip_alloc_sem_key); lock(&osb->system_file_mutex); lock(&ocfs2_file_ip_alloc_sem_key); lock(&osb->system_file_mutex); The function calls which could lead to this are: CPU0 ocfs2_mknod - lock(&ocfs2_file_ip_alloc_sem_key); . . . ocfs2_get_system_file_inode - lock(&osb->system_file_mutex); CPU1 - ocfs2_fill_super - lock(&osb->system_file_mutex); . . . ocfs2_read_virt_blocks - lock(&ocfs2_file_ip_alloc_sem_key); This issue can be resolved by making the down_read -> down_read_try in the ocfs2_read_virt_blocks. [1] https://syzkaller.appspot.com/bug?extid=e0055ea09f1f5e6fabdd Link: https://lkml.kernel.org/r/20240924093257.7181-1-pvmohammedanees2003@gmail.com Signed-off-by: Mohammed Anees <pvmohammedanees2003@gmail.com> Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com> Reported-by: <syzbot+e0055ea09f1f5e6fabdd@syzkaller.appspotmail.com> Closes: https://syzkaller.appspot.com/bug?extid=e0055ea09f1f5e6fabdd Tested-by: syzbot+e0055ea09f1f5e6fabdd@syzkaller.appspotmail.com Cc: Mark Fasheh <mark@fasheh.com> Cc: Joel Becker <jlbec@evilplan.org> Cc: Junxiao Bi <junxiao.bi@oracle.com> Cc: Changwei Ge <gechangwei@live.cn> Cc: Gang He <ghe@suse.com> Cc: Jun Piao <piaojun@huawei.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Cc: Xingyu Li <xli399@ucr.edu> Cc: Zheng Zhang <zzhan173@ucr.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent 1364a29 commit ec3e32d

File tree

1 file changed

+7
-1
lines changed

1 file changed

+7
-1
lines changed

fs/ocfs2/extent_map.c

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -973,7 +973,13 @@ int ocfs2_read_virt_blocks(struct inode *inode, u64 v_block, int nr,
973973
}
974974

975975
while (done < nr) {
976-
down_read(&OCFS2_I(inode)->ip_alloc_sem);
976+
if (!down_read_trylock(&OCFS2_I(inode)->ip_alloc_sem)) {
977+
rc = -EAGAIN;
978+
mlog(ML_ERROR,
979+
"Inode #%llu ip_alloc_sem is temporarily unavailable\n",
980+
(unsigned long long)OCFS2_I(inode)->ip_blkno);
981+
break;
982+
}
977983
rc = ocfs2_extent_map_get_blocks(inode, v_block + done,
978984
&p_block, &p_count, NULL);
979985
up_read(&OCFS2_I(inode)->ip_alloc_sem);

0 commit comments

Comments
 (0)