• Sungjong Seo's avatar
    exfat: release s_lock before calling dir_emit() · ff84772f
    Sungjong Seo authored
    There is a potential deadlock reported by syzbot as below:
    
    ======================================================
    WARNING: possible circular locking dependency detected
    6.4.0-next-20230707-syzkaller #0 Not tainted
    ------------------------------------------------------
    syz-executor330/5073 is trying to acquire lock:
    ffff8880218527a0 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_lock_killable include/linux/mmap_lock.h:151 [inline]
    ffff8880218527a0 (&mm->mmap_lock){++++}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:5293 [inline]
    ffff8880218527a0 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x369/0x510 mm/memory.c:5344
    but task is already holding lock:
    ffff888019f760e0 (&sbi->s_lock){+.+.}-{3:3}, at: exfat_iterate+0x117/0xb50 fs/exfat/dir.c:232
    
    which lock already depends on the new lock.
    
    Chain exists of:
      &mm->mmap_lock --> mapping.invalidate_lock#3 --> &sbi->s_lock
    
     Possible unsafe locking scenario:
    
           CPU0                    CPU1
           ----                    ----
      lock(&sbi->s_lock);
                                   lock(mapping.invalidate_lock#3);
                                   lock(&sbi->s_lock);
      rlock(&mm->mmap_lock);
    
    Let's try to avoid above potential deadlock condition by moving dir_emit*()
    out of sbi->s_lock coverage.
    
    Fixes: ca061973 ("exfat: add directory operations")
    Cc: stable@vger.kernel.org #v5.7+
    Reported-by: syzbot+1741a5d9b79989c10bdc@syzkaller.appspotmail.com
    Link: https://lore.kernel.org/lkml/00000000000078ee7e060066270b@google.com/T/#u
    Tested-by: syzbot+1741a5d9b79989c10bdc@syzkaller.appspotmail.com
    Signed-off-by: default avatarSungjong Seo <sj1557.seo@samsung.com>
    Signed-off-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
    ff84772f
dir.c 29.5 KB