diff options
| author | Theodore Ts'o <tytso@mit.edu> | 2023-05-06 21:04:01 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-05-17 11:48:17 +0200 |
| commit | 5f8b55136ad787aed2c184f7cb3e93772ae637a3 (patch) | |
| tree | fcea0e42c518b44f8679549e4facdc20a08f44c3 | |
| parent | 37c69da3adc45fc34df0b8d07a158a6fa5b2a3f7 (diff) | |
| download | linux-5f8b55136ad787aed2c184f7cb3e93772ae637a3.tar.gz linux-5f8b55136ad787aed2c184f7cb3e93772ae637a3.tar.bz2 linux-5f8b55136ad787aed2c184f7cb3e93772ae637a3.zip | |
ext4: fix deadlock when converting an inline directory in nojournal mode
commit f4ce24f54d9cca4f09a395f3eecce20d6bec4663 upstream.
In no journal mode, ext4_finish_convert_inline_dir() can self-deadlock
by calling ext4_handle_dirty_dirblock() when it already has taken the
directory lock. There is a similar self-deadlock in
ext4_incvert_inline_data_nolock() for data files which we'll fix at
the same time.
A simple reproducer demonstrating the problem:
mke2fs -Fq -t ext2 -O inline_data -b 4k /dev/vdc 64
mount -t ext4 -o dirsync /dev/vdc /vdc
cd /vdc
mkdir file0
cd file0
touch file0
touch file1
attr -s BurnSpaceInEA -V abcde .
touch supercalifragilisticexpialidocious
Cc: stable@kernel.org
Link: https://lore.kernel.org/r/20230507021608.1290720-1-tytso@mit.edu
Reported-by: syzbot+91dccab7c64e2850a4e5@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=ba84cc80a9491d65416bc7877e1650c87530fe8a
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | fs/ext4/inline.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c index 0758f606f006..fd0567d0219c 100644 --- a/fs/ext4/inline.c +++ b/fs/ext4/inline.c @@ -1172,6 +1172,7 @@ static int ext4_finish_convert_inline_dir(handle_t *handle, ext4_initialize_dirent_tail(dir_block, inode->i_sb->s_blocksize); set_buffer_uptodate(dir_block); + unlock_buffer(dir_block); err = ext4_handle_dirty_dirblock(handle, inode, dir_block); if (err) return err; @@ -1245,6 +1246,7 @@ static int ext4_convert_inline_data_nolock(handle_t *handle, if (!S_ISDIR(inode->i_mode)) { memcpy(data_bh->b_data, buf, inline_size); set_buffer_uptodate(data_bh); + unlock_buffer(data_bh); error = ext4_handle_dirty_metadata(handle, inode, data_bh); } else { @@ -1252,7 +1254,6 @@ static int ext4_convert_inline_data_nolock(handle_t *handle, buf, inline_size); } - unlock_buffer(data_bh); out_restore: if (error) ext4_restore_inline_data(handle, inode, iloc, buf, inline_size); |