• Chao Yu's avatar
    f2fs: fix to avoid potential deadlock · 5eaac835
    Chao Yu authored
    There is a potential deadlock reported by syzbot as below:
    
    F2FS-fs (loop2): invalid crc value
    F2FS-fs (loop2): Found nat_bits in checkpoint
    F2FS-fs (loop2): Mounted with checkpoint version = 48b305e4
    ======================================================
    WARNING: possible circular locking dependency detected
    6.1.0-rc8-syzkaller-33330-ga5541c0811a0 #0 Not tainted
    ------------------------------------------------------
    syz-executor.2/32123 is trying to acquire lock:
    ffff0000c0e1a608 (&mm->mmap_lock){++++}-{3:3}, at: __might_fault+0x54/0xb4 mm/memory.c:5644
    
    but task is already holding lock:
    ffff0001317c6088 (&sbi->sb_lock){++++}-{3:3}, at: f2fs_down_write fs/f2fs/f2fs.h:2205 [inline]
    ffff0001317c6088 (&sbi->sb_lock){++++}-{3:3}, at: f2fs_ioc_get_encryption_pwsalt fs/f2fs/file.c:2334 [inline]
    ffff0001317c6088 (&sbi->sb_lock){++++}-{3:3}, at: __f2fs_ioctl+0x1370/0x3318 fs/f2fs/file.c:4151
    
    which lock already depends on the new lock.
    
    Chain exists of:
      &mm->mmap_lock --> &nm_i->nat_tree_lock --> &sbi->sb_lock
    
     Possible unsafe locking scenario:
    
           CPU0                    CPU1
           ----                    ----
      lock(&sbi->sb_lock);
                                   lock(&nm_i->nat_tree_lock);
                                   lock(&sbi->sb_lock);
      lock(&mm->mmap_lock);
    
    Let's try to avoid above deadlock condition by moving __might_fault()
    out of sbi->sb_lock coverage.
    
    Fixes: 95fa90c9 ("f2fs: support recording errors into superblock")
    Link: https://lore.kernel.org/linux-f2fs-devel/000000000000cd5fe305ef617fe2@google.com/T/#u
    Reported-by: syzbot+4793f6096d174c90b4f7@syzkaller.appspotmail.com
    Signed-off-by: default avatarChao Yu <chao@kernel.org>
    Reviewed-by: default avatarEric Biggers <ebiggers@google.com>
    Signed-off-by: default avatarJaegeuk Kim <jaegeuk@kernel.org>
    5eaac835
file.c 118 KB