mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-12-25 12:04:46 +08:00
sysv: don't call sb_bread() with pointers_lock held
[ Upstream commit f123dc8638
]
syzbot is reporting sleep in atomic context in SysV filesystem [1], for
sb_bread() is called with rw_spinlock held.
A "write_lock(&pointers_lock) => read_lock(&pointers_lock) deadlock" bug
and a "sb_bread() with write_lock(&pointers_lock)" bug were introduced by
"Replace BKL for chain locking with sysvfs-private rwlock" in Linux 2.5.12.
Then, "[PATCH] err1-40: sysvfs locking fix" in Linux 2.6.8 fixed the
former bug by moving pointers_lock lock to the callers, but instead
introduced a "sb_bread() with read_lock(&pointers_lock)" bug (which made
this problem easier to hit).
Al Viro suggested that why not to do like get_branch()/get_block()/
find_shared() in Minix filesystem does. And doing like that is almost a
revert of "[PATCH] err1-40: sysvfs locking fix" except that get_branch()
from with find_shared() is called without write_lock(&pointers_lock).
Reported-by: syzbot <syzbot+69b40dc5fd40f32c199f@syzkaller.appspotmail.com>
Link: https://syzkaller.appspot.com/bug?extid=69b40dc5fd40f32c199f
Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Link: https://lore.kernel.org/r/0d195f93-a22a-49a2-0020-103534d6f7f6@I-love.SAKURA.ne.jp
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
0b75d679e8
commit
fd203d2c67
@ -82,9 +82,6 @@ static inline sysv_zone_t *block_end(struct buffer_head *bh)
|
||||
return (sysv_zone_t*)((char*)bh->b_data + bh->b_size);
|
||||
}
|
||||
|
||||
/*
|
||||
* Requires read_lock(&pointers_lock) or write_lock(&pointers_lock)
|
||||
*/
|
||||
static Indirect *get_branch(struct inode *inode,
|
||||
int depth,
|
||||
int offsets[],
|
||||
@ -104,15 +101,18 @@ static Indirect *get_branch(struct inode *inode,
|
||||
bh = sb_bread(sb, block);
|
||||
if (!bh)
|
||||
goto failure;
|
||||
read_lock(&pointers_lock);
|
||||
if (!verify_chain(chain, p))
|
||||
goto changed;
|
||||
add_chain(++p, bh, (sysv_zone_t*)bh->b_data + *++offsets);
|
||||
read_unlock(&pointers_lock);
|
||||
if (!p->key)
|
||||
goto no_block;
|
||||
}
|
||||
return NULL;
|
||||
|
||||
changed:
|
||||
read_unlock(&pointers_lock);
|
||||
brelse(bh);
|
||||
*err = -EAGAIN;
|
||||
goto no_block;
|
||||
@ -218,9 +218,7 @@ static int get_block(struct inode *inode, sector_t iblock, struct buffer_head *b
|
||||
goto out;
|
||||
|
||||
reread:
|
||||
read_lock(&pointers_lock);
|
||||
partial = get_branch(inode, depth, offsets, chain, &err);
|
||||
read_unlock(&pointers_lock);
|
||||
|
||||
/* Simplest case - block found, no allocation needed */
|
||||
if (!partial) {
|
||||
@ -290,9 +288,9 @@ static Indirect *find_shared(struct inode *inode,
|
||||
*top = 0;
|
||||
for (k = depth; k > 1 && !offsets[k-1]; k--)
|
||||
;
|
||||
partial = get_branch(inode, k, offsets, chain, &err);
|
||||
|
||||
write_lock(&pointers_lock);
|
||||
partial = get_branch(inode, k, offsets, chain, &err);
|
||||
if (!partial)
|
||||
partial = chain + k-1;
|
||||
/*
|
||||
|
Loading…
Reference in New Issue
Block a user