Ryusuke Konishi 36ff974b03 nilfs2: fix deadlock in nilfs_count_free_blocks() ... commit 8ac932a492 upstream. A semaphore deadlock can occur if nilfs_get_block() detects metadata corruption while locating data blocks and a superblock writeback occurs at the same time: task 1 task 2 ------ ------ * A file operation * nilfs_truncate() nilfs_get_block() down_read(rwsem A) <-- nilfs_bmap_lookup_contig() ... generic_shutdown_super() nilfs_put_super() * Prepare to write superblock * down_write(rwsem B) <-- nilfs_cleanup_super() * Detect b-tree corruption * nilfs_set_log_cursor() nilfs_bmap_convert_error() nilfs_count_free_blocks() __nilfs_error() down_read(rwsem A) <-- nilfs_set_error() down_write(rwsem B) <-- *** DEADLOCK *** Here, nilfs_get_block() readlocks rwsem A (= NILFS_MDT(dat_inode)->mi_sem) and then calls nilfs_bmap_lookup_contig(), but if it fails due to metadata corruption, __nilfs_error() is called from nilfs_bmap_convert_error() inside the lock section. Since __nilfs_error() calls nilfs_set_error() unless the filesystem is read-only and nilfs_set_error() attempts to writelock rwsem B (= nilfs->ns_sem) to write back superblock exclusively, hierarchical lock acquisition occurs in the order rwsem A -> rwsem B. Now, if another task starts updating the superblock, it may writelock rwsem B during the lock sequence above, and can deadlock trying to readlock rwsem A in nilfs_count_free_blocks(). However, there is actually no need to take rwsem A in nilfs_count_free_blocks() because it, within the lock section, only reads a single integer data on a shared struct with nilfs_sufile_get_ncleansegs(). This has been the case after commit aa474a2201 ("nilfs2: add local variable to cache the number of clean segments"), that is, even before this bug was introduced. So, this resolves the deadlock problem by just not taking the semaphore in nilfs_count_free_blocks(). Link: https://lkml.kernel.org/r/20221029044912.9139-1-konishi.ryusuke@gmail.com Fixes: e828949e5b ("nilfs2: call nilfs_error inside bmap routines") Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com> Reported-by: syzbot+45d6ce7b7ad7ef455d03@syzkaller.appspotmail.com Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com> Cc: <stable@vger.kernel.org> [2.6.38+ Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-11-25 17:42:09 +01:00
..
9p	9p: missing chunk of "fs/9p: Don't update file type when updating file attributes"	2022-06-22 14:11:02 +02:00
adfs
affs	fs/affs: release old buffer head on error path	2021-03-04 10:26:48 +01:00
afs	afs: Return -EAGAIN, not -EREMOTEIO, when a file already locked	2022-09-28 11:03:59 +02:00
autofs
befs
bfs	bfs: don't use WARNING: string when it's just info.	2021-01-06 14:48:39 +01:00
btrfs	btrfs: fix type of parameter generation in btrfs_get_dentry	2022-11-10 17:57:55 +01:00
cachefiles	cachefiles: Handle readpage error correctly	2020-11-05 11:43:36 +01:00
ceph	ceph: don't truncate file in atomic_open	2022-10-15 07:54:39 +02:00
cifs	cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message	2022-10-26 13:22:12 +02:00
coda
configfs	configfs: fix a race in configfs_{,un}register_subsystem()	2022-03-02 11:41:10 +01:00
cramfs
crypto	fscrypt: add fscrypt_symlink_getattr() for computing st_size	2021-09-12 08:56:38 +02:00
debugfs	debugfs: add debugfs_lookup_and_remove()	2022-09-15 12:04:54 +02:00
devpts	fsnotify: fix fsnotify hooks in pseudo filesystems	2022-02-01 17:24:34 +01:00
dlm	fs: dlm: handle -EBUSY first in lock arg validation	2022-10-26 13:22:14 +02:00
ecryptfs	Revert "ecryptfs: replace BUG_ON with error handling code"	2021-05-26 12:05:19 +02:00
efivarfs	efivarfs: revert "fix memory leak in efivarfs_create()"	2020-12-02 08:49:53 +01:00
efs
erofs	erofs: avoid consecutive detection for Highmem memory	2022-08-25 11:17:36 +02:00
exportfs
ext2	ext2: Add more validity checks for inode counts	2022-08-25 11:17:28 +02:00
ext4	ext4: fix BUG_ON() when directory entry has invalid rec_len	2022-11-10 17:57:56 +01:00
f2fs	f2fs: fix race condition on setting FI_NO_EXTENT flag	2022-10-26 13:22:46 +02:00
fat	fat: add ratelimit to fat*_ent_bread()	2022-06-14 18:11:30 +02:00
freevxfs
fscache	fscache: Fix cookie key hashing	2021-09-22 12:26:25 +02:00
fuse	fuse: add file_modified() to fallocate	2022-11-10 17:57:55 +01:00
gfs2	gfs2: Fix filesystem block deallocation for short writes	2022-05-18 09:47:26 +02:00
hfs	hfs: add lock nesting notation to hfs_find_init	2021-07-31 08:19:38 +02:00
hfsplus	hfsplus: prevent corruption in shrinking truncate	2021-05-19 10:08:29 +02:00
hostfs	hostfs: fix memory handling in follow_link()	2021-04-14 08:24:14 +02:00
hpfs
hugetlbfs	mm, hugetlb: allow for "high" userspace addresses	2022-05-09 09:03:28 +02:00
iomap	iomap: iomap_write_failed fix	2022-06-14 18:11:36 +02:00
isofs	isofs: Fix out of bound access for corrupted isofs image	2021-11-12 14:43:03 +01:00
jbd2	jbd2: wake up journal waiters in FIFO order, not LIFO	2022-10-26 13:22:17 +02:00
jffs2	jffs2: fix memory leak in jffs2_do_fill_super	2022-06-14 18:11:55 +02:00
jfs	fs: jfs: fix possible NULL pointer dereference in dbFree()	2022-06-14 18:11:29 +02:00
kernfs	kernfs: fix use-after-free in __kernfs_remove	2022-11-03 23:56:54 +09:00
lockd	lockd: lockd server-side shouldn't set fl_ops	2021-09-22 12:26:34 +02:00
minix	minix: fix bug when opening a file with O_DIRECT	2022-04-15 14:18:35 +02:00
nfs	nfs4: Fix kmemleak when allocate slot failed	2022-11-10 17:57:49 +01:00
nfs_common	nfs_common: need lock during iterate through the list	2020-12-30 11:51:22 +01:00
nfsd	NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data	2022-10-26 13:22:47 +02:00
nilfs2	nilfs2: fix deadlock in nilfs_count_free_blocks()	2022-11-25 17:42:09 +01:00
nls
notify	fsnotify: fix wrong lockdep annotations	2022-06-14 18:11:34 +02:00
ntfs	ntfs: fix BUG_ON in ntfs_lookup_inode_by_name()	2022-10-05 10:37:42 +02:00
ocfs2	ocfs2: fix BUG when iput after ocfs2_mknod fails	2022-10-29 10:20:34 +02:00
omfs
openpromfs
orangefs	orangefs: Fix the size of a memory allocation in orangefs_bufmap_alloc()	2022-01-20 09:19:17 +01:00
overlayfs	ovl: drop WARN_ON() dentry is NULL in ovl_encode_fh()	2022-08-25 11:17:23 +02:00
proc	mm: /proc/pid/smaps_rollup: fix no vma's null-deref	2022-10-29 10:20:36 +02:00
pstore	pstore: Fix typo in compression option name	2021-03-04 10:26:45 +01:00
qnx4	qnx4: work around gcc false positive warning bug	2021-09-30 10:09:26 +02:00
qnx6
quota	quota: Check next/prev free block number after reading from quota file	2022-10-26 13:22:14 +02:00
ramfs	ramfs: fix nommu mmap with gaps in the page cache	2020-10-29 09:57:53 +01:00
reiserfs	reiserfs: check directory items on read from disk	2021-08-12 13:21:05 +02:00
romfs	romfs: fix uninitialized memory leak in romfs_dev_read()	2020-08-26 10:40:51 +02:00
squashfs	squashfs: fix divide error in calculate_skip()	2021-05-19 10:08:29 +02:00
sysfs	sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output	2021-03-07 12:20:48 +01:00
sysv
tracefs	tracefs: Only clobber mode/uid/gid on remount if asked	2022-09-20 12:28:00 +02:00
ubifs	ubifs: Rectify space amount budget for mkdir/tmpfile operations	2022-04-15 14:18:31 +02:00
udf	udf: Fix NULL ptr deref when converting from inline format	2022-02-01 17:24:34 +01:00
ufs	fs/ufs: avoid potential u32 multiplication overflow	2020-08-21 13:05:37 +02:00
unicode
verity	fs-verity: fix signed integer overflow with i_size near S64_MAX	2021-10-06 15:42:30 +02:00
xfs	xfs: drain the buf delwri queue before xfsaild idles	2022-11-25 17:42:03 +01:00
aio.c	aio: fix use-after-free due to missing POLLFREE handling	2021-12-14 14:49:02 +01:00
anon_inodes.c
attr.c	vfs: Check the truncate maximum size in inode_newsize_ok()	2022-08-25 11:17:21 +02:00
bad_inode.c
binfmt_aout.c
binfmt_elf.c	elf: don't use MAP_FIXED_NOREPLACE for elf interpreter mappings	2021-10-06 15:42:35 +02:00
binfmt_elf_fdpic.c
binfmt_em86.c
binfmt_flat.c	binfmt_flat: do not stop relocating GOT entries prematurely on riscv	2022-06-14 18:11:23 +02:00
binfmt_misc.c	binfmt_misc: fix possible deadlock in bm_register_write	2021-03-17 17:03:57 +01:00
binfmt_script.c
block_dev.c	block: reexpand iov_iter after read/write	2021-05-22 11:38:29 +02:00
buffer.c	fs: Don't invalidate page buffers in block_write_full_page()	2020-11-05 11:43:24 +01:00
char_dev.c	chardev: Avoid potential use-after-free in 'chrdev_open()'	2020-01-14 20:08:18 +01:00
compat.c
compat_binfmt_elf.c
compat_ioctl.c	compat_ioctl: remove /dev/random commands	2022-06-22 14:11:03 +02:00
coredump.c	coredump: fix core_pattern parse error	2020-12-11 13:23:30 +01:00
d_path.c	fs: fix NULL dereference due to data race in prepend_path()	2020-10-29 09:57:45 +01:00
dax.c	dax: fix cache flush on PMD-mapped pages	2022-06-14 18:11:41 +02:00
dcache.c	fix dget_parent() fastpath race	2020-10-01 13:17:19 +02:00
dcookies.c
direct-io.c	fs: direct-io: fix missing sdio->boundary	2021-04-14 08:24:11 +02:00
drop_caches.c	fs: avoid softlockups in s_inodes iterators	2020-01-12 12:21:37 +01:00
eventfd.c	eventfd: track eventfd_signal() recursion depth	2020-02-11 04:35:37 -08:00
eventpoll.c	epoll: autoremove wakers even more aggressively	2022-08-25 11:17:28 +02:00
exec.c	exec: Force single empty string when argv is empty	2022-06-06 08:33:50 +02:00
fcntl.c	fcntl: fix potential deadlock for &fasync_struct.fa_lock	2021-09-15 09:47:28 +02:00
fhandle.c
file.c	fget: clarify and improve __fget_files() implementation	2022-03-02 11:41:18 +01:00
file_table.c	SUNRPC: Ensure we flush any closed sockets before xs_xprt_free()	2022-05-25 09:14:34 +02:00
filesystems.c	fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once()	2020-04-17 10:50:21 +02:00
fs-writeback.c	fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages	2022-06-14 18:11:44 +02:00
fs_context.c	memcg: charge fs_context and legacy_fs_context	2022-02-08 18:24:29 +01:00
fs_parser.c
fs_pin.c
fs_struct.c
fs_types.c
fsopen.c
inode.c	fs: fix UAF/GPF bug in nilfs_mdt_destroy	2022-10-15 07:54:36 +02:00
internal.h	cgroup1: fix leaked context root causing sporadic NULL deref in LTP	2021-07-31 08:19:37 +02:00
io_uring.c	io_uring/af_unix: defer registered files gc to io_uring release	2022-10-26 13:22:59 +02:00
ioctl.c	compat_ioctl: add compat_ptr_ioctl()	2019-12-17 19:55:30 +01:00
Kconfig
Kconfig.binfmt
libfs.c	libfs: fix error cast of negative value in simple_attr_write()	2020-11-24 13:29:19 +01:00
locks.c	locks: reinstate locks_delete_block optimization	2020-03-25 08:25:41 +01:00
Makefile
mbcache.c
mount.h
mpage.c	fs: move guard_bio_eod() after bio_set_op_attrs	2020-01-17 19:48:21 +01:00
namei.c	fs: Add missing umask strip in vfs_tmpfile	2022-08-25 11:17:22 +02:00
namespace.c	fs: warn about impending deprecation of mandatory locks	2021-08-26 08:36:22 -04:00
no-block.c
nsfs.c
open.c	cifs_atomic_open(): fix double-put on late allocation failure	2020-03-18 07:17:51 +01:00
pipe.c	pipe: increase minimum default pipe size to 2 pages	2021-08-12 13:21:02 +02:00
pnode.c	propagate_one(): mnt_set_mountpoint() needs mount_lock	2020-05-02 08:48:44 +02:00
pnode.h	mount: fix mounting of detached mounts onto targets that reside on shared mounts	2021-03-17 17:03:33 +01:00
posix_acl.c
proc_namespace.c
read_write.c	fs: allow deduplication of eof block into the end of the destination file	2020-02-11 04:35:23 -08:00
readdir.c	readdir: make sure to verify directory entry for legacy interfaces too	2021-04-21 12:56:16 +02:00
select.c	select: Fix indefinitely sleeping task in poll_schedule_timeout()	2022-01-29 10:25:11 +01:00
seq_file.c	seq_file: disallow extremely large seq buffer allocations	2021-07-20 16:10:54 +02:00
signalfd.c	io_uring: disable polling pollfree files	2022-09-05 10:27:47 +02:00
splice.c	Revert "fs: check FMODE_LSEEK to control internal pipe splicing"	2022-10-17 17:24:32 +02:00
stack.c
stat.c	stat: fix inconsistency between struct stat and struct compat_stat	2022-04-27 13:50:48 +02:00
statfs.c
super.c	vfs: make freeze_super abort when sync_filesystem returns error	2022-02-23 11:59:55 +01:00
sync.c
timerfd.c
userfaultfd.c	userfaultfd: open userfaultfds with O_RDONLY	2022-10-26 13:22:21 +02:00
utimes.c	utimes: Clamp the timestamps in notify_change()	2020-02-11 04:35:12 -08:00
xattr.c	xattr: break delegations in {set,remove}xattr	2020-08-11 15:33:39 +02:00