| Message ID | 20240918172026.2532-2-pvmohammedanees2003@gmail.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | ocfs2: Fix deadlock in extent_map and handle zero | expand |
On 9/19/24 01:20, Mohammed Anees wrote: > syzbot has found a kernel BUG in ocfs2_write_cluster_by_desc, > while the next patch in the series resolves this, another > bug has been detected due to a potential deadlock [1]. > > The scenario is depicted here, > > CPU0 CPU1 > lock(&ocfs2_file_ip_alloc_sem_key); > lock(&osb->system_file_mutex); > lock(&ocfs2_file_ip_alloc_sem_key); > lock(&osb->system_file_mutex); > > The function calls which could lead to this are: > > CPU0 > ocfs2_write_begin - lock(&ocfs2_file_ip_alloc_sem_key); > . > . > . > ocfs2_get_system_file_inode - lock(&osb->system_file_mutex); > > CPU1 - > ocfs2_get_system_file_inode - lock(&osb->system_file_mutex); > . > . > . > ocfs2_read_virt_blocks - lock(&ocfs2_file_ip_alloc_sem_key); > > This issue can be resolved by making the down_read -> down_read_try > in the ocfs2_read_virt_blocks. > > [1] https://syzkaller.appspot.com/bug?extid=18a87160c7d64ba2e2f6 I haven't checked this patch, but in my view, following URL is correct. https://syzkaller.appspot.com/bug?extid=e0055ea09f1f5e6fabdd Heming > > Reported-and-tested-by: syzbot+18a87160c7d64ba2e2f6@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=18a87160c7d64ba2e2f6 > Signed-off-by: Mohammed Anees <pvmohammedanees2003@gmail.com> > --- > fs/ocfs2/extent_map.c | 16 +++++++++++++++- > 1 file changed, 15 insertions(+), 1 deletion(-) > > diff --git a/fs/ocfs2/extent_map.c b/fs/ocfs2/extent_map.c > index 70a768b62..f83d0a3b6 100644 > --- a/fs/ocfs2/extent_map.c > +++ b/fs/ocfs2/extent_map.c > @@ -12,6 +12,7 @@ > #include <linux/slab.h> > #include <linux/types.h> > #include <linux/fiemap.h> > +#include <linux/delay.h> > > #include <cluster/masklog.h> > > @@ -961,6 +962,8 @@ int ocfs2_read_virt_blocks(struct inode *inode, u64 v_block, int nr, > int rc = 0; > u64 p_block, p_count; > int i, count, done = 0; > + int retries, max_retries = 5; > + int retry_delay_ms = 30; > > trace_ocfs2_read_virt_blocks( > inode, (unsigned long long)v_block, nr, bhs, flags, > @@ -973,7 +976,18 @@ int ocfs2_read_virt_blocks(struct inode *inode, u64 v_block, int nr, > } > > while (done < nr) { > - down_read(&OCFS2_I(inode)->ip_alloc_sem); > + retries = 0; > + while (retries < max_retries) { > + if (down_read_trylock(&OCFS2_I(inode)->ip_alloc_sem)) > + break; // Lock acquired > + msleep(retry_delay_ms); > + retries++; > + } > + if (retries == max_retries) { > + rc = -EAGAIN; > + mlog(ML_ERROR, "Cannot acquire lock\n"); > + break; > + } > rc = ocfs2_extent_map_get_blocks(inode, v_block + done, > &p_block, &p_count, NULL); > up_read(&OCFS2_I(inode)->ip_alloc_sem);
Hi, I tested the patch on the URL you have provided, it seems to tackle the bug and it is appropriate, i will link this to that URL and send the new patch. Thanks!
diff --git a/fs/ocfs2/extent_map.c b/fs/ocfs2/extent_map.c index 70a768b62..f83d0a3b6 100644 --- a/fs/ocfs2/extent_map.c +++ b/fs/ocfs2/extent_map.c @@ -12,6 +12,7 @@ #include <linux/slab.h> #include <linux/types.h> #include <linux/fiemap.h> +#include <linux/delay.h> #include <cluster/masklog.h> @@ -961,6 +962,8 @@ int ocfs2_read_virt_blocks(struct inode *inode, u64 v_block, int nr, int rc = 0; u64 p_block, p_count; int i, count, done = 0; + int retries, max_retries = 5; + int retry_delay_ms = 30; trace_ocfs2_read_virt_blocks( inode, (unsigned long long)v_block, nr, bhs, flags, @@ -973,7 +976,18 @@ int ocfs2_read_virt_blocks(struct inode *inode, u64 v_block, int nr, } while (done < nr) { - down_read(&OCFS2_I(inode)->ip_alloc_sem); + retries = 0; + while (retries < max_retries) { + if (down_read_trylock(&OCFS2_I(inode)->ip_alloc_sem)) + break; // Lock acquired + msleep(retry_delay_ms); + retries++; + } + if (retries == max_retries) { + rc = -EAGAIN; + mlog(ML_ERROR, "Cannot acquire lock\n"); + break; + } rc = ocfs2_extent_map_get_blocks(inode, v_block + done, &p_block, &p_count, NULL); up_read(&OCFS2_I(inode)->ip_alloc_sem);
syzbot has found a kernel BUG in ocfs2_write_cluster_by_desc, while the next patch in the series resolves this, another bug has been detected due to a potential deadlock [1]. The scenario is depicted here, CPU0 CPU1 lock(&ocfs2_file_ip_alloc_sem_key); lock(&osb->system_file_mutex); lock(&ocfs2_file_ip_alloc_sem_key); lock(&osb->system_file_mutex); The function calls which could lead to this are: CPU0 ocfs2_write_begin - lock(&ocfs2_file_ip_alloc_sem_key); . . . ocfs2_get_system_file_inode - lock(&osb->system_file_mutex); CPU1 - ocfs2_get_system_file_inode - lock(&osb->system_file_mutex); . . . ocfs2_read_virt_blocks - lock(&ocfs2_file_ip_alloc_sem_key); This issue can be resolved by making the down_read -> down_read_try in the ocfs2_read_virt_blocks. [1] https://syzkaller.appspot.com/bug?extid=18a87160c7d64ba2e2f6 Reported-and-tested-by: syzbot+18a87160c7d64ba2e2f6@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=18a87160c7d64ba2e2f6 Signed-off-by: Mohammed Anees <pvmohammedanees2003@gmail.com> --- fs/ocfs2/extent_map.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)