Chao Yu
a02982545e
f2fs: quota: fix potential deadlock
[ Upstream commit 9de71ede81e6d1a111fdd868b2d78d459fa77f80 ]
xfstest generic/587 reports a deadlock issue as below:
======================================================
WARNING: possible circular locking dependency detected
5.14.0-rc1 #69 Not tainted
------------------------------------------------------
repquota/8606 is trying to acquire lock:
ffff888022ac9320 (&sb->s_type->i_mutex_key#18){+.+.}-{3:3}, at: f2fs_quota_sync+0x207/0x300 [f2fs]
but task is already holding lock:
ffff8880084bcde8 (&sbi->quota_sem){.+.+}-{3:3}, at: f2fs_quota_sync+0x59/0x300 [f2fs]
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&sbi->quota_sem){.+.+}-{3:3}:
__lock_acquire+0x648/0x10b0
lock_acquire+0x128/0x470
down_read+0x3b/0x2a0
f2fs_quota_sync+0x59/0x300 [f2fs]
f2fs_quota_on+0x48/0x100 [f2fs]
do_quotactl+0x5e3/0xb30
__x64_sys_quotactl+0x23a/0x4e0
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae
-> #1 (&sbi->cp_rwsem){++++}-{3:3}:
__lock_acquire+0x648/0x10b0
lock_acquire+0x128/0x470
down_read+0x3b/0x2a0
f2fs_unlink+0x353/0x670 [f2fs]
vfs_unlink+0x1c7/0x380
do_unlinkat+0x413/0x4b0
__x64_sys_unlinkat+0x50/0xb0
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae
-> #0 (&sb->s_type->i_mutex_key#18){+.+.}-{3:3}:
check_prev_add+0xdc/0xb30
validate_chain+0xa67/0xb20
__lock_acquire+0x648/0x10b0
lock_acquire+0x128/0x470
down_write+0x39/0xc0
f2fs_quota_sync+0x207/0x300 [f2fs]
do_quotactl+0xaff/0xb30
__x64_sys_quotactl+0x23a/0x4e0
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae
other info that might help us debug this:
Chain exists of:
&sb->s_type->i_mutex_key#18 --> &sbi->cp_rwsem --> &sbi->quota_sem
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&sbi->quota_sem);
lock(&sbi->cp_rwsem);
lock(&sbi->quota_sem);
lock(&sb->s_type->i_mutex_key#18);
*** DEADLOCK ***
3 locks held by repquota/8606:
#0: ffff88801efac0e0 (&type->s_umount_key#53){++++}-{3:3}, at: user_get_super+0xd9/0x190
#1: ffff8880084bc380 (&sbi->cp_rwsem){++++}-{3:3}, at: f2fs_quota_sync+0x3e/0x300 [f2fs]
#2: ffff8880084bcde8 (&sbi->quota_sem){.+.+}-{3:3}, at: f2fs_quota_sync+0x59/0x300 [f2fs]
stack backtrace:
CPU: 6 PID: 8606 Comm: repquota Not tainted 5.14.0-rc1 #69
Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
Call Trace:
dump_stack_lvl+0xce/0x134
dump_stack+0x17/0x20
print_circular_bug.isra.0.cold+0x239/0x253
check_noncircular+0x1be/0x1f0
check_prev_add+0xdc/0xb30
validate_chain+0xa67/0xb20
__lock_acquire+0x648/0x10b0
lock_acquire+0x128/0x470
down_write+0x39/0xc0
f2fs_quota_sync+0x207/0x300 [f2fs]
do_quotactl+0xaff/0xb30
__x64_sys_quotactl+0x23a/0x4e0
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f883b0b4efe
The root cause is ABBA deadlock of inode lock and cp_rwsem,
reorder locks in f2fs_quota_sync() as below to fix this issue:
- lock inode
- lock cp_rwsem
- lock quota_sem
Fixes: db6ec53b7e ("f2fs: add a rw_sem to cover quota flag changes")
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
2021-09-22 12:26:22 +02:00 |
| .. |
|
9p
|
9P: Cast to loff_t before multiplying
|
2020-11-05 11:43:34 +01:00 |
|
adfs
|
|
|
|
affs
|
fs/affs: release old buffer head on error path
|
2021-03-04 10:26:48 +01:00 |
|
afs
|
afs: Fix tracepoint string placement with built-in AFS
|
2021-07-28 13:30:58 +02:00 |
|
autofs
|
autofs: fix a leak in autofs_expire_indirect()
|
2019-10-25 00:03:11 -04:00 |
|
befs
|
|
|
|
bfs
|
bfs: don't use WARNING: string when it's just info.
|
2021-01-06 14:48:39 +01:00 |
|
btrfs
|
btrfs: reset replace target device to allocation state on close
|
2021-09-22 12:26:19 +02:00 |
|
cachefiles
|
cachefiles: Handle readpage error correctly
|
2020-11-05 11:43:36 +01:00 |
|
ceph
|
ceph: take snap_empty_lock atomically with snaprealm refcount change
|
2021-08-18 08:57:04 +02:00 |
|
cifs
|
CIFS: Fix a potencially linear read overflow
|
2021-09-15 09:47:36 +02:00 |
|
coda
|
y2038: add inode timestamp clamping
|
2019-09-19 09:42:37 -07:00 |
|
configfs
|
configfs: fix memleak in configfs_release_bin_file
|
2021-07-14 16:53:46 +02:00 |
|
cramfs
|
cramfs: fix usage on non-MTD device
|
2019-11-23 21:44:49 -05:00 |
|
crypto
|
fscrypt: add fscrypt_symlink_getattr() for computing st_size
|
2021-09-12 08:56:38 +02:00 |
|
debugfs
|
debugfs: Return error during {full/open}_proxy_open() on rmmod
|
2021-09-15 09:47:33 +02:00 |
|
devpts
|
|
|
|
dlm
|
fs: dlm: fix memory leak when fenced
|
2021-07-14 16:53:17 +02:00 |
|
ecryptfs
|
Revert "ecryptfs: replace BUG_ON with error handling code"
|
2021-05-26 12:05:19 +02:00 |
|
efivarfs
|
efivarfs: revert "fix memory leak in efivarfs_create()"
|
2020-12-02 08:49:53 +01:00 |
|
efs
|
|
|
|
erofs
|
erofs: add unsupported inode i_format check
|
2021-05-11 14:04:02 +02:00 |
|
exportfs
|
exportfs_decode_fh(): negative pinned may become positive without the parent locked
|
2019-11-10 11:56:05 -05:00 |
|
ext2
|
ext2: don't update mtime on COW faults
|
2020-09-09 19:12:30 +02:00 |
|
ext4
|
ext4: report correct st_size for encrypted symlinks
|
2021-09-12 08:56:38 +02:00 |
|
f2fs
|
f2fs: quota: fix potential deadlock
|
2021-09-22 12:26:22 +02:00 |
|
fat
|
fat: don't allow to mount if the FAT length == 0
|
2020-06-17 16:40:36 +02:00 |
|
freevxfs
|
|
|
|
fscache
|
|
|
|
fuse
|
fuse: flush extending writes
|
2021-09-15 09:47:41 +02:00 |
|
gfs2
|
gfs2: Fix use-after-free in gfs2_glock_shrink_scan
|
2021-06-18 09:58:59 +02:00 |
|
hfs
|
hfs: add lock nesting notation to hfs_find_init
|
2021-07-31 08:19:38 +02:00 |
|
hfsplus
|
hfsplus: prevent corruption in shrinking truncate
|
2021-05-19 10:08:29 +02:00 |
|
hostfs
|
hostfs: fix memory handling in follow_link()
|
2021-04-14 08:24:14 +02:00 |
|
hpfs
|
|
|
|
hugetlbfs
|
hugetlbfs: fix mount mode command line processing
|
2021-07-28 13:31:01 +02:00 |
|
iomap
|
mm/swap: consider max pages in iomap_swapfile_add_extent
|
2021-09-15 09:47:35 +02:00 |
|
isofs
|
isofs: joliet: Fix iocharset=utf8 mount option
|
2021-09-15 09:47:27 +02:00 |
|
jbd2
|
jbd2: fix up sparse warnings in checkpoint code
|
2020-11-18 19:20:30 +01:00 |
|
jffs2
|
jffs2: check the validity of dstlen in jffs2_zlib_compress()
|
2021-05-11 14:04:16 +02:00 |
|
jfs
|
fs/jfs: Fix missing error code in lmLogInit()
|
2021-07-20 16:10:42 +02:00 |
|
kernfs
|
kernfs: do not call fsnotify() with name without a parent
|
2020-08-19 08:16:12 +02:00 |
|
lockd
|
lockd: Fix invalid lockowner cast after vfs_test_lock
|
2021-09-15 09:47:35 +02:00 |
|
minix
|
fs/minix: remove expected error message in block_to_path()
|
2020-08-21 13:05:37 +02:00 |
|
nfs
|
NFSv4/pNFS: Don't call _nfs4_pnfs_v3_ds_connect multiple times
|
2021-07-20 16:10:50 +02:00 |
|
nfs_common
|
nfs_common: need lock during iterate through the list
|
2020-12-30 11:51:22 +01:00 |
|
nfsd
|
nfsd4: Fix forced-expiry locking
|
2021-09-15 09:47:35 +02:00 |
|
nilfs2
|
nilfs2: fix memory leak in nilfs_sysfs_delete_device_group
|
2021-06-30 08:47:50 -04:00 |
|
nls
|
|
|
|
notify
|
fanotify: fix ignore mask logic for events on child and on dir
|
2020-06-17 16:40:24 +02:00 |
|
ntfs
|
ntfs: fix validity check for file name attribute
|
2021-07-14 16:53:01 +02:00 |
|
ocfs2
|
ocfs2: issue zeroout to EOF blocks
|
2021-08-04 12:27:37 +02:00 |
|
omfs
|
|
|
|
openpromfs
|
|
|
|
orangefs
|
orangefs: fix orangefs df output.
|
2021-07-20 16:10:48 +02:00 |
|
overlayfs
|
ovl: fix uninitialized pointer read in ovl_lookup_real_one()
|
2021-09-03 10:08:12 +02:00 |
|
proc
|
mm, oom: make the calculation of oom badness more accurate
|
2021-09-03 10:08:12 +02:00 |
|
pstore
|
pstore: Fix typo in compression option name
|
2021-03-04 10:26:45 +01:00 |
|
qnx4
|
|
|
|
qnx6
|
|
|
|
quota
|
quota: Fix memory leak when handling corrupted quota file
|
2021-03-04 10:26:26 +01:00 |
|
ramfs
|
ramfs: fix nommu mmap with gaps in the page cache
|
2020-10-29 09:57:53 +01:00 |
|
reiserfs
|
reiserfs: check directory items on read from disk
|
2021-08-12 13:21:05 +02:00 |
|
romfs
|
romfs: fix uninitialized memory leak in romfs_dev_read()
|
2020-08-26 10:40:51 +02:00 |
|
squashfs
|
squashfs: fix divide error in calculate_skip()
|
2021-05-19 10:08:29 +02:00 |
|
sysfs
|
sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output
|
2021-03-07 12:20:48 +01:00 |
|
sysv
|
|
|
|
tracefs
|
tracing: Do not create tracefs files if tracefs lockdown is in effect
|
2019-10-12 20:49:07 -04:00 |
|
ubifs
|
ubifs: report correct st_size for encrypted symlinks
|
2021-09-12 08:56:39 +02:00 |
|
udf
|
udf_get_extendedattr() had no boundary checks.
|
2021-09-15 09:47:28 +02:00 |
|
ufs
|
fs/ufs: avoid potential u32 multiplication overflow
|
2020-08-21 13:05:37 +02:00 |
|
unicode
|
|
|
|
verity
|
|
|
|
xfs
|
xfs: Fix assert failure in xfs_setattr_size()
|
2021-03-07 12:20:42 +01:00 |
|
aio.c
|
aio: fix async fsync creds
|
2020-06-17 16:40:24 +02:00 |
|
anon_inodes.c
|
|
|
|
attr.c
|
utimes: Clamp the timestamps in notify_change()
|
2020-02-11 04:35:12 -08:00 |
|
bad_inode.c
|
|
|
|
binfmt_aout.c
|
|
|
|
binfmt_elf.c
|
fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()
|
2020-06-03 08:21:27 +02:00 |
|
binfmt_elf_fdpic.c
|
|
|
|
binfmt_em86.c
|
|
|
|
binfmt_flat.c
|
binfmt_flat: revert "binfmt_flat: don't offset the data start"
|
2020-09-03 11:26:39 +02:00 |
|
binfmt_misc.c
|
binfmt_misc: fix possible deadlock in bm_register_write
|
2021-03-17 17:03:57 +01:00 |
|
binfmt_script.c
|
|
|
|
block_dev.c
|
block: reexpand iov_iter after read/write
|
2021-05-22 11:38:29 +02:00 |
|
buffer.c
|
fs: Don't invalidate page buffers in block_write_full_page()
|
2020-11-05 11:43:24 +01:00 |
|
char_dev.c
|
chardev: Avoid potential use-after-free in 'chrdev_open()'
|
2020-01-14 20:08:18 +01:00 |
|
compat.c
|
|
|
|
compat_binfmt_elf.c
|
|
|
|
compat_ioctl.c
|
fix compat handling of FICLONERANGE, FIDEDUPERANGE and FS_IOC_FIEMAP
|
2020-01-09 10:20:05 +01:00 |
|
coredump.c
|
coredump: fix core_pattern parse error
|
2020-12-11 13:23:30 +01:00 |
|
d_path.c
|
fs: fix NULL dereference due to data race in prepend_path()
|
2020-10-29 09:57:45 +01:00 |
|
dax.c
|
dax: fix ENOMEM handling in grab_mapping_entry()
|
2021-07-14 16:53:25 +02:00 |
|
dcache.c
|
fix dget_parent() fastpath race
|
2020-10-01 13:17:19 +02:00 |
|
dcookies.c
|
|
|
|
direct-io.c
|
fs: direct-io: fix missing sdio->boundary
|
2021-04-14 08:24:11 +02:00 |
|
drop_caches.c
|
fs: avoid softlockups in s_inodes iterators
|
2020-01-12 12:21:37 +01:00 |
|
eventfd.c
|
eventfd: track eventfd_signal() recursion depth
|
2020-02-11 04:35:37 -08:00 |
|
eventpoll.c
|
ep_create_wakeup_source(): dentry name can change under you...
|
2020-10-07 08:01:31 +02:00 |
|
exec.c
|
exec: Transform exec_update_mutex into a rw_semaphore
|
2021-01-09 13:44:55 +01:00 |
|
fcntl.c
|
fcntl: fix potential deadlock for &fasync_struct.fa_lock
|
2021-09-15 09:47:28 +02:00 |
|
fhandle.c
|
|
|
|
file.c
|
fix multiplication overflow in copy_fdtable()
|
2020-05-27 17:46:12 +02:00 |
|
file_table.c
|
|
|
|
filesystems.c
|
fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once()
|
2020-04-17 10:50:21 +02:00 |
|
fs-writeback.c
|
writeback: fix obtain a reference to a freeing memcg css
|
2021-07-14 16:53:35 +02:00 |
|
fs_context.c
|
|
|
|
fs_parser.c
|
|
|
|
fs_pin.c
|
|
|
|
fs_struct.c
|
|
|
|
fs_types.c
|
|
|
|
fsopen.c
|
|
|
|
inode.c
|
futex: Fix inode life-time issue
|
2020-03-25 08:25:58 +01:00 |
|
internal.h
|
cgroup1: fix leaked context root causing sporadic NULL deref in LTP
|
2021-07-31 08:19:37 +02:00 |
|
io_uring.c
|
io_uring: Fix current->fs handling in io_sq_wq_submit_work()
|
2021-01-30 13:54:10 +01:00 |
|
ioctl.c
|
compat_ioctl: add compat_ptr_ioctl()
|
2019-12-17 19:55:30 +01:00 |
|
Kconfig
|
|
|
|
Kconfig.binfmt
|
|
|
|
libfs.c
|
libfs: fix error cast of negative value in simple_attr_write()
|
2020-11-24 13:29:19 +01:00 |
|
locks.c
|
locks: reinstate locks_delete_block optimization
|
2020-03-25 08:25:41 +01:00 |
|
Makefile
|
|
|
|
mbcache.c
|
|
|
|
mount.h
|
|
|
|
mpage.c
|
fs: move guard_bio_eod() after bio_set_op_attrs
|
2020-01-17 19:48:21 +01:00 |
|
namei.c
|
namei: only return -ECHILD from follow_dotdot_rcu()
|
2020-03-05 16:43:48 +01:00 |
|
namespace.c
|
fs: warn about impending deprecation of mandatory locks
|
2021-08-26 08:36:22 -04:00 |
|
no-block.c
|
|
|
|
nsfs.c
|
|
|
|
open.c
|
cifs_atomic_open(): fix double-put on late allocation failure
|
2020-03-18 07:17:51 +01:00 |
|
pipe.c
|
pipe: increase minimum default pipe size to 2 pages
|
2021-08-12 13:21:02 +02:00 |
|
pnode.c
|
propagate_one(): mnt_set_mountpoint() needs mount_lock
|
2020-05-02 08:48:44 +02:00 |
|
pnode.h
|
mount: fix mounting of detached mounts onto targets that reside on shared mounts
|
2021-03-17 17:03:33 +01:00 |
|
posix_acl.c
|
|
|
|
proc_namespace.c
|
|
|
|
read_write.c
|
fs: allow deduplication of eof block into the end of the destination file
|
2020-02-11 04:35:23 -08:00 |
|
readdir.c
|
readdir: make sure to verify directory entry for legacy interfaces too
|
2021-04-21 12:56:16 +02:00 |
|
select.c
|
kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data()
|
2021-03-24 11:26:44 +01:00 |
|
seq_file.c
|
seq_file: disallow extremely large seq buffer allocations
|
2021-07-20 16:10:54 +02:00 |
|
signalfd.c
|
fs/signalfd.c: fix inconsistent return codes for signalfd4
|
2020-08-26 10:40:58 +02:00 |
|
splice.c
|
splice: only read in as much information as there is pipe buffer space
|
2019-12-17 19:56:52 +01:00 |
|
stack.c
|
|
|
|
stat.c
|
|
|
|
statfs.c
|
vfs: Fix EOVERFLOW testing in put_compat_statfs64
|
2019-10-03 14:21:35 -07:00 |
|
super.c
|
vfs: remove lockdep bogosity in __sb_start_write
|
2020-11-24 13:29:01 +01:00 |
|
sync.c
|
|
|
|
timerfd.c
|
|
|
|
userfaultfd.c
|
userfaultfd: do not untag user pointers
|
2021-07-28 13:31:01 +02:00 |
|
utimes.c
|
utimes: Clamp the timestamps in notify_change()
|
2020-02-11 04:35:12 -08:00 |
|
xattr.c
|
xattr: break delegations in {set,remove}xattr
|
2020-08-11 15:33:39 +02:00 |