1. Patchew
  2. linux
  3. View series

[PATCH] f2fs: fix deadlock in f2f2_add_dentry

Lizhi Xu posted 1 patch 2 years, 5 months ago 
fs/f2fs/dir.c    | 4 +---
fs/f2fs/inline.c | 2 ++
2 files changed, 3 insertions(+), 3 deletions(-)
[PATCH] f2fs: fix deadlock in f2f2_add_dentry
Posted by Lizhi Xu 2 years, 5 months ago 
There are two paths:
1. f2fs_add_dentry->f2fs_down_read->f2fs_add_inline_entry->down_write->
   up_write->f2fs_up_read
2. f2fs_add_dentry->f2fs_add_regular_entry->down_write->
   f2fs_init_inode_metadata->f2fs_down_read->f2fs_up_read->up_write

Force order lock to read->write.

Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
Reported-and-tested-by: syzbot+a4976ce949df66b1ddf1@syzkaller.appspotmail.com
---
 fs/f2fs/dir.c    | 4 +---
 fs/f2fs/inline.c | 2 ++
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
index d635c58cf5a3..022dc02c1390 100644
--- a/fs/f2fs/dir.c
+++ b/fs/f2fs/dir.c
@@ -736,12 +736,12 @@ int f2fs_add_regular_entry(struct inode *dir, const struct f2fs_filename *fname,
 	f2fs_wait_on_page_writeback(dentry_page, DATA, true, true);
 
 	if (inode) {
-		f2fs_down_write(&F2FS_I(inode)->i_sem);
 		page = f2fs_init_inode_metadata(inode, dir, fname, NULL);
 		if (IS_ERR(page)) {
 			err = PTR_ERR(page);
 			goto fail;
 		}
+		f2fs_down_write(&F2FS_I(inode)->i_sem);
 	}
 
 	make_dentry_ptr_block(NULL, &d, dentry_blk);
@@ -780,9 +780,7 @@ int f2fs_add_dentry(struct inode *dir, const struct f2fs_filename *fname,
 		 * Should get i_xattr_sem to keep the lock order:
 		 * i_xattr_sem -> inode_page lock used by f2fs_setxattr.
 		 */
-		f2fs_down_read(&F2FS_I(dir)->i_xattr_sem);
 		err = f2fs_add_inline_entry(dir, fname, inode, ino, mode);
-		f2fs_up_read(&F2FS_I(dir)->i_xattr_sem);
 	}
 	if (err == -EAGAIN)
 		err = f2fs_add_regular_entry(dir, fname, inode, ino, mode);
diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
index 4638fee16a91..7618b383c2b7 100644
--- a/fs/f2fs/inline.c
+++ b/fs/f2fs/inline.c
@@ -628,10 +628,12 @@ int f2fs_add_inline_entry(struct inode *dir, const struct f2fs_filename *fname,
 	if (IS_ERR(ipage))
 		return PTR_ERR(ipage);
 
+	f2fs_down_read(&F2FS_I(dir)->i_xattr_sem);
 	inline_dentry = inline_data_addr(dir, ipage);
 	make_dentry_ptr_inline(dir, &d, inline_dentry);
 
 	bit_pos = f2fs_room_for_filename(d.bitmap, slots, d.max);
+	f2fs_up_read(&F2FS_I(dir)->i_xattr_sem);
 	if (bit_pos >= d.max) {
 		err = do_convert_inline_dir(dir, ipage, inline_dentry);
 		if (err)
-- 
2.25.1
Re: [PATCH] f2fs: fix deadlock in f2f2_add_dentry
Posted by Tetsuo Handa 2 years, 5 months ago 
On 2023/08/25 14:37, Lizhi Xu wrote:
> @@ -736,12 +736,12 @@ int f2fs_add_regular_entry(struct inode *dir, const struct f2fs_filename *fname,
>  	f2fs_wait_on_page_writeback(dentry_page, DATA, true, true);
>  
>  	if (inode) {
> -		f2fs_down_write(&F2FS_I(inode)->i_sem);
>  		page = f2fs_init_inode_metadata(inode, dir, fname, NULL);
>  		if (IS_ERR(page)) {
>  			err = PTR_ERR(page);
>  			goto fail;
>  		}
> +		f2fs_down_write(&F2FS_I(inode)->i_sem);
>  	}

Above change does not match below.

fail:
	if (inode)
		f2fs_up_write(&F2FS_I(inode)->i_sem);

>  
>  	make_dentry_ptr_block(NULL, &d, dentry_blk);
Re: [PATCH] f2fs: fix deadlock in f2f2_add_dentry
Posted by Chao Yu 2 years, 5 months ago 
On 2023/8/25 13:37, Lizhi Xu wrote:
> There are two paths:
> 1. f2fs_add_dentry->f2fs_down_read->f2fs_add_inline_entry->down_write->
>     up_write->f2fs_up_read
> 2. f2fs_add_dentry->f2fs_add_regular_entry->down_write->
>     f2fs_init_inode_metadata->f2fs_down_read->f2fs_up_read->up_write
> 
> Force order lock to read->write.

Hi Lizhi,

Thanks for the fix.

Can you please check below patch? it has fixed reported issue.

https://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git/commit/?h=dev&id=5c13e2388bf3426fd69a89eb46e50469e9624e56

Feedback from syzbot:

https://lore.kernel.org/linux-f2fs-devel/0000000000001ba17a0603b5871e@google.com/

> 
> Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
> Reported-and-tested-by: syzbot+a4976ce949df66b1ddf1@syzkaller.appspotmail.com
> ---
>   fs/f2fs/dir.c    | 4 +---
>   fs/f2fs/inline.c | 2 ++
>   2 files changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
> index d635c58cf5a3..022dc02c1390 100644
> --- a/fs/f2fs/dir.c
> +++ b/fs/f2fs/dir.c
> @@ -736,12 +736,12 @@ int f2fs_add_regular_entry(struct inode *dir, const struct f2fs_filename *fname,
>   	f2fs_wait_on_page_writeback(dentry_page, DATA, true, true);
>   
>   	if (inode) {
> -		f2fs_down_write(&F2FS_I(inode)->i_sem);
>   		page = f2fs_init_inode_metadata(inode, dir, fname, NULL);
>   		if (IS_ERR(page)) {
>   			err = PTR_ERR(page);
>   			goto fail;
>   		}
> +		f2fs_down_write(&F2FS_I(inode)->i_sem);
>   	}
>   
>   	make_dentry_ptr_block(NULL, &d, dentry_blk);
> @@ -780,9 +780,7 @@ int f2fs_add_dentry(struct inode *dir, const struct f2fs_filename *fname,
>   		 * Should get i_xattr_sem to keep the lock order:
>   		 * i_xattr_sem -> inode_page lock used by f2fs_setxattr.
>   		 */
> -		f2fs_down_read(&F2FS_I(dir)->i_xattr_sem);
>   		err = f2fs_add_inline_entry(dir, fname, inode, ino, mode);
> -		f2fs_up_read(&F2FS_I(dir)->i_xattr_sem);
>   	}
>   	if (err == -EAGAIN)
>   		err = f2fs_add_regular_entry(dir, fname, inode, ino, mode);
> diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
> index 4638fee16a91..7618b383c2b7 100644
> --- a/fs/f2fs/inline.c
> +++ b/fs/f2fs/inline.c
> @@ -628,10 +628,12 @@ int f2fs_add_inline_entry(struct inode *dir, const struct f2fs_filename *fname,
>   	if (IS_ERR(ipage))
>   		return PTR_ERR(ipage);
>   
> +	f2fs_down_read(&F2FS_I(dir)->i_xattr_sem);
>   	inline_dentry = inline_data_addr(dir, ipage);
>   	make_dentry_ptr_inline(dir, &d, inline_dentry);
>   
>   	bit_pos = f2fs_room_for_filename(d.bitmap, slots, d.max);
> +	f2fs_up_read(&F2FS_I(dir)->i_xattr_sem);
>   	if (bit_pos >= d.max) {
>   		err = do_convert_inline_dir(dir, ipage, inline_dentry);
>   		if (err)
Re: [f2fs-dev] [PATCH] f2fs: fix deadlock in f2f2_add_dentry
Posted by Lizhi Xu 2 years, 5 months ago 
On Fri, 25 Aug 2023 18:41:38, chao@kernel.org wrote:
> Can you please check below patch? it has fixed reported issue.
>
> https://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git/commit/?h=dev&id=5c13e2388bf3426fd69a89eb46e50469e9624e56
> 
> Feedback from syzbot:
> 
> https://lore.kernel.org/linux-f2fs-devel/0000000000001ba17a0603b5871e@google.com/
This fix uses nest lock to avoid deadlocks, which I personally believe is feasible.

Patchew 2.1-devel-b67e4c2

© 2016 - 2026 Red Hat, Inc.