Received: by 2002:a25:4158:0:0:0:0:0 with SMTP id o85csp995723yba; Thu, 4 Apr 2019 02:02:00 -0700 (PDT) X-Google-Smtp-Source: APXvYqxDU+/oH3ydCZN5w2dUD8Ov0WAUPUZgGhYGat+HQSDtZWTgLqSP3AUREYPDvmm7yMZq+F7H X-Received: by 2002:a17:902:5ac4:: with SMTP id g4mr4895882plm.261.1554368520735; Thu, 04 Apr 2019 02:02:00 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1554368520; cv=none; d=google.com; s=arc-20160816; b=nMLQjhCEX+/s73UHT/5n9Fae88xKPkX657uBkgbgg5By7hIrINq3MBXYvjCqgiyC2A zbr9pYgdv8D/Ph0Nmf0GSOvTbq35x30uQFFB/bjihX4z7Yj68YiJFlz8T3HHsOW++JBN 8ZInREnXMhPGWGE3nmFocif9ZGShTqzmhnTH3iQms1p+nkeIhb33iOYtP5bVkBwCOLAk kHoXXg2vIbcL0/Xx57C8qtbFEfoWLk3epYv4QY66oSb+U9dG1iEw/q1EIpju9jxgTT5O FFH0sv3kBbpBong5YHKE1Gps7Y2T4ktmLwy2jcHWuuZTm9wedVxgL9uYswOeeEnVYP2T S8qA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=kmQqaqhIEXy/4tH4q3eYW1xagrkYZKFf/47wpffnID0=; b=WQB0JAnDMoUOypgMuM49Hm0kPOVMYC2aSwJcOADZTOM/krPQoqFOYlrLGevLDcz5Wh nKDf9vr6MxU9ODIGilwa0GlNoGHpyxgMDSR0dZ8EVIopP2qlG5Yri/4EiNUAvVXct8ck M413wkZz7diMFj/XS5XfGwo/5fMzTpQNy5nkb3awmxC8n8BVPcEYSMEK8I6CYdeQIIvu r+8oLv/BiyabfLAjOvlO1kypru5/t5zAudhlOcZvf5iOYgYRxgwypbHJ3bWHfeqXAX/8 ycdwJhGUCcUZ+vip5JgiAiONnwKOBLO0poau0YHD/9Dq1/qZstbZ50+af8blrk7DA39e xkcA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=KqxWrR4L; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 35si16080333pgz.383.2019.04.04.02.01.45; Thu, 04 Apr 2019 02:02:00 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=KqxWrR4L; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730034AbfDDI76 (ORCPT + 99 others); Thu, 4 Apr 2019 04:59:58 -0400 Received: from mail.kernel.org ([198.145.29.99]:36360 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730723AbfDDI7y (ORCPT ); Thu, 4 Apr 2019 04:59:54 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 863002183E; Thu, 4 Apr 2019 08:59:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1554368393; bh=U89L+oxuOD+Wy969u+/bnkAN6Sgm+gIzWEvraNfsuqY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KqxWrR4LmTJJJY2c9/7Rx93CrMKJ+EvTSu4g3I/Eh3NkKqKIs38hpIEIp/jbg8t2j AyJR9ofCZK7WNvbjhdajNhT5AIP1MYhkZHcvWtJBo7tVa3L+6GJD98/2U+y0NeA7/v r4Tbymh1RKUCXisrI8zTv9XcO/KkV859oNVEWeFs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiqun Li , Chao Yu , Jaegeuk Kim , Sasha Levin Subject: [PATCH 4.19 008/187] f2fs: fix to avoid deadlock in f2fs_read_inline_dir() Date: Thu, 4 Apr 2019 10:45:45 +0200 Message-Id: <20190404084603.476664278@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190404084603.119654039@linuxfoundation.org> References: <20190404084603.119654039@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.19-stable review patch. If anyone has any objections, please let me know. ------------------ [ Upstream commit aadcef64b22f668c1a107b86d3521d9cac915c24 ] As Jiqun Li reported in bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=202883 sometimes, dead lock when make system call SYS_getdents64 with fsync() is called by another process. monkey running on android9.0 1. task 9785 held sbi->cp_rwsem and waiting lock_page() 2. task 10349 held mm_sem and waiting sbi->cp_rwsem 3. task 9709 held lock_page() and waiting mm_sem so this is a dead lock scenario. task stack is show by crash tools as following crash_arm64> bt ffffffc03c354080 PID: 9785 TASK: ffffffc03c354080 CPU: 1 COMMAND: "RxIoScheduler-3" >> #7 [ffffffc01b50fac0] __lock_page at ffffff80081b11e8 crash-arm64> bt 10349 PID: 10349 TASK: ffffffc018b83080 CPU: 1 COMMAND: "BUGLY_ASYNC_UPL" >> #3 [ffffffc01f8cfa40] rwsem_down_read_failed at ffffff8008a93afc PC: 00000033 LR: 00000000 SP: 00000000 PSTATE: ffffffffffffffff crash-arm64> bt 9709 PID: 9709 TASK: ffffffc03e7f3080 CPU: 1 COMMAND: "IntentService[A" >> #3 [ffffffc001e67850] rwsem_down_read_failed at ffffff8008a93afc >> #8 [ffffffc001e67b80] el1_ia at ffffff8008084fc4 PC: ffffff8008274114 [compat_filldir64+120] LR: ffffff80083584d4 [f2fs_fill_dentries+448] SP: ffffffc001e67b80 PSTATE: 80400145 X29: ffffffc001e67b80 X28: 0000000000000000 X27: 000000000000001a X26: 00000000000093d7 X25: ffffffc070d52480 X24: 0000000000000008 X23: 0000000000000028 X22: 00000000d43dfd60 X21: ffffffc001e67e90 X20: 0000000000000011 X19: ffffff80093a4000 X18: 0000000000000000 X17: 0000000000000000 X16: 0000000000000000 X15: 0000000000000000 X14: ffffffffffffffff X13: 0000000000000008 X12: 0101010101010101 X11: 7f7f7f7f7f7f7f7f X10: 6a6a6a6a6a6a6a6a X9: 7f7f7f7f7f7f7f7f X8: 0000000080808000 X7: ffffff800827409c X6: 0000000080808000 X5: 0000000000000008 X4: 00000000000093d7 X3: 000000000000001a X2: 0000000000000011 X1: ffffffc070d52480 X0: 0000000000800238 >> #9 [ffffffc001e67be0] f2fs_fill_dentries at ffffff80083584d0 PC: 0000003c LR: 00000000 SP: 00000000 PSTATE: 000000d9 X12: f48a02ff X11: d4678960 X10: d43dfc00 X9: d4678ae4 X8: 00000058 X7: d4678994 X6: d43de800 X5: 000000d9 X4: d43dfc0c X3: d43dfc10 X2: d46799c8 X1: 00000000 X0: 00001068 Below potential deadlock will happen between three threads: Thread A Thread B Thread C - f2fs_do_sync_file - f2fs_write_checkpoint - down_write(&sbi->node_change) -- 1) - do_page_fault - down_write(&mm->mmap_sem) -- 2) - do_wp_page - f2fs_vm_page_mkwrite - getdents64 - f2fs_read_inline_dir - lock_page -- 3) - f2fs_sync_node_pages - lock_page -- 3) - __do_map_lock - down_read(&sbi->node_change) -- 1) - f2fs_fill_dentries - dir_emit - compat_filldir64 - do_page_fault - down_read(&mm->mmap_sem) -- 2) Since f2fs_readdir is protected by inode.i_rwsem, there should not be any updates in inode page, we're safe to lookup dents in inode page without its lock held, so taking off the lock to improve concurrency of readdir and avoid potential deadlock. Reported-by: Jiqun Li Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim Signed-off-by: Sasha Levin --- fs/f2fs/inline.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c index 115dc219344b..92703efde36e 100644 --- a/fs/f2fs/inline.c +++ b/fs/f2fs/inline.c @@ -661,6 +661,12 @@ int f2fs_read_inline_dir(struct file *file, struct dir_context *ctx, if (IS_ERR(ipage)) return PTR_ERR(ipage); + /* + * f2fs_readdir was protected by inode.i_rwsem, it is safe to access + * ipage without page's lock held. + */ + unlock_page(ipage); + inline_dentry = inline_data_addr(inode, ipage); make_dentry_ptr_inline(inode, &d, inline_dentry); @@ -669,7 +675,7 @@ int f2fs_read_inline_dir(struct file *file, struct dir_context *ctx, if (!err) ctx->pos = d.max; - f2fs_put_page(ipage, 1); + f2fs_put_page(ipage, 0); return err < 0 ? err : 0; } -- 2.19.1