| Message ID | 20240923132854.13936-1-pvmohammedanees2003@gmail.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | [v2] ocfs2: Fix deadlock in ocfs2_get_system_file_inode | expand |
On 9/23/24 9:28 PM, Mohammed Anees wrote: > syzbot has found a possible deadlock in ocfs2_get_system_file_inode [1]. > > The scenario is depicted here, > > CPU0 CPU1 > lock(&ocfs2_file_ip_alloc_sem_key); > lock(&osb->system_file_mutex); > lock(&ocfs2_file_ip_alloc_sem_key); > lock(&osb->system_file_mutex); > > The function calls which could lead to this are: > > CPU0 > ocfs2_mknod - lock(&ocfs2_file_ip_alloc_sem_key); > . > . > . > ocfs2_get_system_file_inode - lock(&osb->system_file_mutex); > > CPU1 - > ocfs2_file_super - lock(&osb->system_file_mutex); > . > . > . > ocfs2_read_virt_blocks - lock(&ocfs2_file_ip_alloc_sem_key); > > This issue can be resolved by making the down_read -> down_read_try > in the ocfs2_read_virt_blocks. > > [1] https://syzkaller.appspot.com/bug?extid=e0055ea09f1f5e6fabdd > > Reported-and-tested-by: syzbot+e0055ea09f1f5e6fabdd@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=e0055ea09f1f5e6fabdd > Signed-off-by: Mohammed Anees <pvmohammedanees2003@gmail.com> > --- > v2: > - Remove retries when doing down_read_trylock() and fail directly > --- > fs/ocfs2/extent_map.c | 7 ++++++- > 1 file changed, 6 insertions(+), 1 deletions(-) > > diff --git a/fs/ocfs2/extent_map.c b/fs/ocfs2/extent_map.c > index 70a768b62..48919464a 100644 > --- a/fs/ocfs2/extent_map.c > +++ b/fs/ocfs2/extent_map.c > @@ -973,7 +973,12 @@ int ocfs2_read_virt_blocks(struct inode *inode, u64 v_block, int nr, > } > > while (done < nr) { > - down_read(&OCFS2_I(inode)->ip_alloc_sem); > + if (!down_read_trylock(&OCFS2_I(inode)->ip_alloc_sem)) > + rc = -EAGAIN; > + if (rc) { > + mlog(ML_ERROR, "Resource is temporarily unavailable\n"); > + break; > + } Or could be simplified to: if (!down_read_trylock(&OCFS2_I(inode)->ip_alloc_sem)) { rc = -EAGAIN; mlog(ML_ERROR, "Inode #%llu ip_alloc_sem is temporarily unavailable\n", (unsigned long long)OCFS2_I(inode)->ip_blkno); break; } Thanks, Joseph > rc = ocfs2_extent_map_get_blocks(inode, v_block + done, > &p_block, &p_count, NULL); > up_read(&OCFS2_I(inode)->ip_alloc_sem);
diff --git a/fs/ocfs2/extent_map.c b/fs/ocfs2/extent_map.c index 70a768b62..48919464a 100644 --- a/fs/ocfs2/extent_map.c +++ b/fs/ocfs2/extent_map.c @@ -973,7 +973,12 @@ int ocfs2_read_virt_blocks(struct inode *inode, u64 v_block, int nr, } while (done < nr) { - down_read(&OCFS2_I(inode)->ip_alloc_sem); + if (!down_read_trylock(&OCFS2_I(inode)->ip_alloc_sem)) + rc = -EAGAIN; + if (rc) { + mlog(ML_ERROR, "Resource is temporarily unavailable\n"); + break; + } rc = ocfs2_extent_map_get_blocks(inode, v_block + done, &p_block, &p_count, NULL); up_read(&OCFS2_I(inode)->ip_alloc_sem);
syzbot has found a possible deadlock in ocfs2_get_system_file_inode [1]. The scenario is depicted here, CPU0 CPU1 lock(&ocfs2_file_ip_alloc_sem_key); lock(&osb->system_file_mutex); lock(&ocfs2_file_ip_alloc_sem_key); lock(&osb->system_file_mutex); The function calls which could lead to this are: CPU0 ocfs2_mknod - lock(&ocfs2_file_ip_alloc_sem_key); . . . ocfs2_get_system_file_inode - lock(&osb->system_file_mutex); CPU1 - ocfs2_file_super - lock(&osb->system_file_mutex); . . . ocfs2_read_virt_blocks - lock(&ocfs2_file_ip_alloc_sem_key); This issue can be resolved by making the down_read -> down_read_try in the ocfs2_read_virt_blocks. [1] https://syzkaller.appspot.com/bug?extid=e0055ea09f1f5e6fabdd Reported-and-tested-by: syzbot+e0055ea09f1f5e6fabdd@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=e0055ea09f1f5e6fabdd Signed-off-by: Mohammed Anees <pvmohammedanees2003@gmail.com> --- v2: - Remove retries when doing down_read_trylock() and fail directly --- fs/ocfs2/extent_map.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletions(-)