diff options
| author | Sungjong Seo <sj1557.seo@samsung.com> | 2024-05-31 19:14:44 +0900 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-12-19 18:07:18 +0100 |
| commit | c052f775ee6ccacd3c97e4cf41a2a657e63d4259 (patch) | |
| tree | dedfb7afea7f11cabf0b1b4b39541b9725db9aa8 /fs/exfat | |
| parent | 4310902c766e371359e6c6311056ae80b5beeac9 (diff) | |
| download | linux-c052f775ee6ccacd3c97e4cf41a2a657e63d4259.tar.gz linux-c052f775ee6ccacd3c97e4cf41a2a657e63d4259.tar.bz2 linux-c052f775ee6ccacd3c97e4cf41a2a657e63d4259.zip | |
exfat: fix potential deadlock on __exfat_get_dentry_set
commit 89fc548767a2155231128cb98726d6d2ea1256c9 upstream.
When accessing a file with more entries than ES_MAX_ENTRY_NUM, the bh-array
is allocated in __exfat_get_entry_set. The problem is that the bh-array is
allocated with GFP_KERNEL. It does not make sense. In the following cases,
a deadlock for sbi->s_lock between the two processes may occur.
CPU0 CPU1
---- ----
kswapd
balance_pgdat
lock(fs_reclaim)
exfat_iterate
lock(&sbi->s_lock)
exfat_readdir
exfat_get_uniname_from_ext_entry
exfat_get_dentry_set
__exfat_get_dentry_set
kmalloc_array
...
lock(fs_reclaim)
...
evict
exfat_evict_inode
lock(&sbi->s_lock)
To fix this, let's allocate bh-array with GFP_NOFS.
Fixes: a3ff29a95fde ("exfat: support dynamic allocate bh for exfat_entry_set_cache")
Cc: stable@vger.kernel.org # v6.2+
Reported-by: syzbot+412a392a2cd4a65e71db@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/lkml/000000000000fef47e0618c0327f@google.com
Signed-off-by: Sungjong Seo <sj1557.seo@samsung.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
[Sherry: The problematic commit was backported to 5.15.y and 5.10.y, thus backport this fix]
Signed-off-by: Sherry Yang <sherry.yang@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs/exfat')
| -rw-r--r-- | fs/exfat/dir.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/exfat/dir.c b/fs/exfat/dir.c index be7570d01ae1..0a1b1de032ef 100644 --- a/fs/exfat/dir.c +++ b/fs/exfat/dir.c @@ -878,7 +878,7 @@ struct exfat_entry_set_cache *exfat_get_dentry_set(struct super_block *sb, num_bh = EXFAT_B_TO_BLK_ROUND_UP(off + num_entries * DENTRY_SIZE, sb); if (num_bh > ARRAY_SIZE(es->__bh)) { - es->bh = kmalloc_array(num_bh, sizeof(*es->bh), GFP_KERNEL); + es->bh = kmalloc_array(num_bh, sizeof(*es->bh), GFP_NOFS); if (!es->bh) { brelse(bh); kfree(es); |