Chao Yu c11c3a4524 hfsplus: fix to avoid false alarm of circular locking ... [ Upstream commit be4edd1642 ] Syzbot report potential ABBA deadlock as below: loop0: detected capacity change from 0 to 1024 ====================================================== WARNING: possible circular locking dependency detected 6.9.0-syzkaller-10323-g8f6a15f095a6 #0 Not tainted ------------------------------------------------------ syz-executor171/5344 is trying to acquire lock: ffff88807cb980b0 (&tree->tree_lock){+.+.}-{3:3}, at: hfsplus_file_truncate+0x811/0xb50 fs/hfsplus/extents.c:595 but task is already holding lock: ffff88807a930108 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}, at: hfsplus_file_truncate+0x2da/0xb50 fs/hfsplus/extents.c:576 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 __mutex_lock_common kernel/locking/mutex.c:608 [inline] __mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752 hfsplus_file_extend+0x21b/0x1b70 fs/hfsplus/extents.c:457 hfsplus_bmap_reserve+0x105/0x4e0 fs/hfsplus/btree.c:358 hfsplus_rename_cat+0x1d0/0x1050 fs/hfsplus/catalog.c:456 hfsplus_rename+0x12e/0x1c0 fs/hfsplus/dir.c:552 vfs_rename+0xbdb/0xf00 fs/namei.c:4887 do_renameat2+0xd94/0x13f0 fs/namei.c:5044 __do_sys_rename fs/namei.c:5091 [inline] __se_sys_rename fs/namei.c:5089 [inline] __x64_sys_rename+0x86/0xa0 fs/namei.c:5089 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (&tree->tree_lock){+.+.}-{3:3}: check_prev_add kernel/locking/lockdep.c:3134 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869 __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 __mutex_lock_common kernel/locking/mutex.c:608 [inline] __mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752 hfsplus_file_truncate+0x811/0xb50 fs/hfsplus/extents.c:595 hfsplus_setattr+0x1ce/0x280 fs/hfsplus/inode.c:265 notify_change+0xb9d/0xe70 fs/attr.c:497 do_truncate+0x220/0x310 fs/open.c:65 handle_truncate fs/namei.c:3308 [inline] do_open fs/namei.c:3654 [inline] path_openat+0x2a3d/0x3280 fs/namei.c:3807 do_filp_open+0x235/0x490 fs/namei.c:3834 do_sys_openat2+0x13e/0x1d0 fs/open.c:1406 do_sys_open fs/open.c:1421 [inline] __do_sys_creat fs/open.c:1497 [inline] __se_sys_creat fs/open.c:1491 [inline] __x64_sys_creat+0x123/0x170 fs/open.c:1491 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&HFSPLUS_I(inode)->extents_lock); lock(&tree->tree_lock); lock(&HFSPLUS_I(inode)->extents_lock); lock(&tree->tree_lock); This is a false alarm as tree_lock mutex are different, one is from sbi->cat_tree, and another is from sbi->ext_tree: Thread A Thread B - hfsplus_rename - hfsplus_rename_cat - hfs_find_init - mutext_lock(cat_tree->tree_lock) - hfsplus_setattr - hfsplus_file_truncate - mutex_lock(hip->extents_lock) - hfs_find_init - mutext_lock(ext_tree->tree_lock) - hfs_bmap_reserve - hfsplus_file_extend - mutex_lock(hip->extents_lock) So, let's call mutex_lock_nested for tree_lock mutex lock, and pass correct lock class for it. Fixes: 31651c6071 ("hfsplus: avoid deadlock on file truncation") Reported-by: syzbot+6030b3b1b9bf70e538c4@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-fsdevel/000000000000e37a4005ef129563@google.com Cc: Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com> Signed-off-by: Chao Yu <chao@kernel.org> Link: https://lore.kernel.org/r/20240607142304.455441-1-chao@kernel.org Signed-off-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-08-03 08:48:53 +02:00
..
attributes.c	hfsplus: fix crash and filesystem corruption when deleting files	2020-04-10 15:36:20 -07:00
bfind.c	hfsplus: fix to avoid false alarm of circular locking	2024-08-03 08:48:53 +02:00
bitmap.c	hfsplus: convert kmap() to kmap_local_page() in bitmap.c	2022-09-11 21:55:04 -07:00
bnode.c	hfsplus: convert kmap() to kmap_local_page() in bnode.c	2022-09-11 21:55:04 -07:00
brec.c	hfsplus: fix BUG on bnode parent update	2018-10-31 08:54:13 -07:00
btree.c	hfsplus: convert kmap() to kmap_local_page() in btree.c	2022-09-11 21:55:05 -07:00
catalog.c	hfsplus: prevent btree data loss on ENOSPC	2018-10-31 08:54:13 -07:00
dir.c	hfsplus: convert to fileattr	2021-04-12 15:04:29 +02:00
extents.c	hfsplus: fix to avoid false alarm of circular locking	2024-08-03 08:48:53 +02:00
hfsplus_fs.h	hfsplus: fix to avoid false alarm of circular locking	2024-08-03 08:48:53 +02:00
hfsplus_raw.h	hfsplus: use struct_group_attr() for memcpy() region	2022-01-20 08:52:54 +02:00
inode.c	fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode()	2023-05-24 17:32:34 +01:00
ioctl.c	hfsplus: convert to fileattr	2021-04-12 15:04:29 +02:00
Kconfig	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
Makefile
options.c	hfsplus: fix bug causing custom uid and gid being unable to be assigned with mount	2023-01-04 11:28:59 +01:00
part_tbl.c	fs/hfsplus: Use the enum req_op and blk_opf_t types	2022-07-14 12:14:32 -06:00
super.c	fs: hfsplus: fix UAF issue in hfsplus_put_super	2023-03-10 09:34:07 +01:00
tables.c
unicode.c	treewide: Remove uninitialized_var() usage	2020-07-16 12:35:15 -07:00
wrapper.c	fs/hfsplus: Use the enum req_op and blk_opf_t types	2022-07-14 12:14:32 -06:00
xattr_security.c	acl: handle idmapped mounts	2021-01-24 14:27:17 +01:00
xattr_trusted.c	acl: handle idmapped mounts	2021-01-24 14:27:17 +01:00
xattr_user.c	acl: handle idmapped mounts	2021-01-24 14:27:17 +01:00
xattr.c	hfsplus: fix uninit-value in copy_name	2024-07-25 09:49:19 +02:00
xattr.h