releases/4.19.32/f2fs-fix-to-avoid-deadlock-of-atomic-file-operations.patch

   1 From 48432984d718c95cf13e26d487c2d1b697c3c01f Mon Sep 17 00:00:00 2001
   2 From: Chao Yu <yuchao0@huawei.com>
   3 Date: Mon, 25 Feb 2019 17:11:03 +0800
   4 Subject: f2fs: fix to avoid deadlock of atomic file operations
   5
   6 From: Chao Yu <yuchao0@huawei.com>
   7
   8 commit 48432984d718c95cf13e26d487c2d1b697c3c01f upstream.
   9
  10 Thread A                                Thread B
  11 - __fput
  12  - f2fs_release_file
  13   - drop_inmem_pages
  14    - mutex_lock(&fi->inmem_lock)
  15    - __revoke_inmem_pages
  16     - lock_page(page)
  17                                         - open
  18                                         - f2fs_setattr
  19                                         - truncate_setsize
  20                                          - truncate_inode_pages_range
  21                                           - lock_page(page)
  22                                           - truncate_cleanup_page
  23                                            - f2fs_invalidate_page
  24                                             - drop_inmem_page
  25                                             - mutex_lock(&fi->inmem_lock);
  26
  27 We may encounter above ABBA deadlock as reported by Kyungtae Kim:
  28
  29 I'm reporting a bug in linux-4.17.19: "INFO: task hung in
  30 drop_inmem_page" (no reproducer)
  31
  32 I think this might be somehow related to the following:
  33 https://groups.google.com/forum/#!searchin/syzkaller-bugs/INFO$3A$20task$20hung$20in$20%7Csort:date/syzkaller-bugs/c6soBTrdaIo/AjAzPeIzCgAJ
  34
  35 =========================================
  36 INFO: task syz-executor7:10822 blocked for more than 120 seconds.
  37       Not tainted 4.17.19 #1
  38 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
  39 syz-executor7   D27024 10822   6346 0x00000004
  40 Call Trace:
  41  context_switch kernel/sched/core.c:2867 [inline]
  42  __schedule+0x721/0x1e60 kernel/sched/core.c:3515
  43  schedule+0x88/0x1c0 kernel/sched/core.c:3559
  44  schedule_preempt_disabled+0x18/0x30 kernel/sched/core.c:3617
  45  __mutex_lock_common kernel/locking/mutex.c:833 [inline]
  46  __mutex_lock+0x5bd/0x1410 kernel/locking/mutex.c:893
  47  mutex_lock_nested+0x1b/0x20 kernel/locking/mutex.c:908
  48  drop_inmem_page+0xcb/0x810 fs/f2fs/segment.c:327
  49  f2fs_invalidate_page+0x337/0x5e0 fs/f2fs/data.c:2401
  50  do_invalidatepage mm/truncate.c:165 [inline]
  51  truncate_cleanup_page+0x261/0x330 mm/truncate.c:187
  52  truncate_inode_pages_range+0x552/0x1610 mm/truncate.c:367
  53  truncate_inode_pages mm/truncate.c:478 [inline]
  54  truncate_pagecache+0x6d/0x90 mm/truncate.c:801
  55  truncate_setsize+0x81/0xa0 mm/truncate.c:826
  56  f2fs_setattr+0x44f/0x1270 fs/f2fs/file.c:781
  57  notify_change+0xa62/0xe80 fs/attr.c:313
  58  do_truncate+0x12e/0x1e0 fs/open.c:63
  59  do_last fs/namei.c:2955 [inline]
  60  path_openat+0x2042/0x29f0 fs/namei.c:3505
  61  do_filp_open+0x1bd/0x2c0 fs/namei.c:3540
  62  do_sys_open+0x35e/0x4e0 fs/open.c:1101
  63  __do_sys_open fs/open.c:1119 [inline]
  64  __se_sys_open fs/open.c:1114 [inline]
  65  __x64_sys_open+0x89/0xc0 fs/open.c:1114
  66  do_syscall_64+0xc4/0x4e0 arch/x86/entry/common.c:287
  67  entry_SYSCALL_64_after_hwframe+0x49/0xbe
  68 RIP: 0033:0x4497b9
  69 RSP: 002b:00007f734e459c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
  70 RAX: ffffffffffffffda RBX: 00007f734e45a6cc RCX: 00000000004497b9
  71 RDX: 0000000000000104 RSI: 00000000000a8280 RDI: 0000000020000080
  72 RBP: 000000000071bea0 R08: 0000000000000000 R09: 0000000000000000
  73 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
  74 R13: 0000000000007230 R14: 00000000006f02d0 R15: 00007f734e45a700
  75 INFO: task syz-executor7:10858 blocked for more than 120 seconds.
  76       Not tainted 4.17.19 #1
  77 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
  78 syz-executor7   D28880 10858   6346 0x00000004
  79 Call Trace:
  80  context_switch kernel/sched/core.c:2867 [inline]
  81  __schedule+0x721/0x1e60 kernel/sched/core.c:3515
  82  schedule+0x88/0x1c0 kernel/sched/core.c:3559
  83  __rwsem_down_write_failed_common kernel/locking/rwsem-xadd.c:565 [inline]
  84  rwsem_down_write_failed+0x5e6/0xc90 kernel/locking/rwsem-xadd.c:594
  85  call_rwsem_down_write_failed+0x17/0x30 arch/x86/lib/rwsem.S:117
  86  __down_write arch/x86/include/asm/rwsem.h:142 [inline]
  87  down_write+0x58/0xa0 kernel/locking/rwsem.c:72
  88  inode_lock include/linux/fs.h:713 [inline]
  89  do_truncate+0x120/0x1e0 fs/open.c:61
  90  do_last fs/namei.c:2955 [inline]
  91  path_openat+0x2042/0x29f0 fs/namei.c:3505
  92  do_filp_open+0x1bd/0x2c0 fs/namei.c:3540
  93  do_sys_open+0x35e/0x4e0 fs/open.c:1101
  94  __do_sys_open fs/open.c:1119 [inline]
  95  __se_sys_open fs/open.c:1114 [inline]
  96  __x64_sys_open+0x89/0xc0 fs/open.c:1114
  97  do_syscall_64+0xc4/0x4e0 arch/x86/entry/common.c:287
  98  entry_SYSCALL_64_after_hwframe+0x49/0xbe
  99 RIP: 0033:0x4497b9
 100 RSP: 002b:00007f734e3b4c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
 101 RAX: ffffffffffffffda RBX: 00007f734e3b56cc RCX: 00000000004497b9
 102 RDX: 0000000000000104 RSI: 00000000000a8280 RDI: 0000000020000080
 103 RBP: 000000000071c238 R08: 0000000000000000 R09: 0000000000000000
 104 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
 105 R13: 0000000000007230 R14: 00000000006f02d0 R15: 00007f734e3b5700
 106 INFO: task syz-executor5:10829 blocked for more than 120 seconds.
 107       Not tainted 4.17.19 #1
 108 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
 109 syz-executor5   D28760 10829   6308 0x80000002
 110 Call Trace:
 111  context_switch kernel/sched/core.c:2867 [inline]
 112  __schedule+0x721/0x1e60 kernel/sched/core.c:3515
 113  schedule+0x88/0x1c0 kernel/sched/core.c:3559
 114  io_schedule+0x21/0x80 kernel/sched/core.c:5179
 115  wait_on_page_bit_common mm/filemap.c:1100 [inline]
 116  __lock_page+0x2b5/0x390 mm/filemap.c:1273
 117  lock_page include/linux/pagemap.h:483 [inline]
 118  __revoke_inmem_pages+0xb35/0x11c0 fs/f2fs/segment.c:231
 119  drop_inmem_pages+0xa3/0x3e0 fs/f2fs/segment.c:306
 120  f2fs_release_file+0x2c7/0x330 fs/f2fs/file.c:1556
 121  __fput+0x2c7/0x780 fs/file_table.c:209
 122  ____fput+0x1a/0x20 fs/file_table.c:243
 123  task_work_run+0x151/0x1d0 kernel/task_work.c:113
 124  exit_task_work include/linux/task_work.h:22 [inline]
 125  do_exit+0x8ba/0x30a0 kernel/exit.c:865
 126  do_group_exit+0x13b/0x3a0 kernel/exit.c:968
 127  get_signal+0x6bb/0x1650 kernel/signal.c:2482
 128  do_signal+0x84/0x1b70 arch/x86/kernel/signal.c:810
 129  exit_to_usermode_loop+0x155/0x190 arch/x86/entry/common.c:162
 130  prepare_exit_to_usermode arch/x86/entry/common.c:196 [inline]
 131  syscall_return_slowpath arch/x86/entry/common.c:265 [inline]
 132  do_syscall_64+0x445/0x4e0 arch/x86/entry/common.c:290
 133  entry_SYSCALL_64_after_hwframe+0x49/0xbe
 134 RIP: 0033:0x4497b9
 135 RSP: 002b:00007f1c68e74ce8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
 136 RAX: fffffffffffffe00 RBX: 000000000071bf80 RCX: 00000000004497b9
 137 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000071bf80
 138 RBP: 000000000071bf80 R08: 0000000000000000 R09: 000000000071bf58
 139 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
 140 R13: 0000000000000000 R14: 00007f1c68e759c0 R15: 00007f1c68e75700
 141
 142 This patch tries to use trylock_page to mitigate such deadlock condition
 143 for fix.
 144
 145 Signed-off-by: Chao Yu <yuchao0@huawei.com>
 146 Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
 147 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 148
 149 ---
 150  fs/f2fs/segment.c |   43 +++++++++++++++++++++++++++++++------------
 151  1 file changed, 31 insertions(+), 12 deletions(-)
 152
 153 --- a/fs/f2fs/segment.c
 154 +++ b/fs/f2fs/segment.c
 155 @@ -216,7 +216,8 @@ void f2fs_register_inmem_page(struct ino
 156  }
 157
 158  static int __revoke_inmem_pages(struct inode *inode,
 159 -                               struct list_head *head, bool drop, bool recover)
 160 +                               struct list_head *head, bool drop, bool recover,
 161 +                               bool trylock)
 162  {
 163         struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
 164         struct inmem_pages *cur, *tmp;
 165 @@ -228,7 +229,16 @@ static int __revoke_inmem_pages(struct i
 166                 if (drop)
 167                         trace_f2fs_commit_inmem_page(page, INMEM_DROP);
 168
 169 -               lock_page(page);
 170 +               if (trylock) {
 171 +                       /*
 172 +                        * to avoid deadlock in between page lock and
 173 +                        * inmem_lock.
 174 +                        */
 175 +                       if (!trylock_page(page))
 176 +                               continue;
 177 +               } else {
 178 +                       lock_page(page);
 179 +               }
 180
 181                 f2fs_wait_on_page_writeback(page, DATA, true);
 182
 183 @@ -317,13 +327,19 @@ void f2fs_drop_inmem_pages(struct inode
 184         struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
 185         struct f2fs_inode_info *fi = F2FS_I(inode);
 186
 187 -       mutex_lock(&fi->inmem_lock);
 188 -       __revoke_inmem_pages(inode, &fi->inmem_pages, true, false);
 189 -       spin_lock(&sbi->inode_lock[ATOMIC_FILE]);
 190 -       if (!list_empty(&fi->inmem_ilist))
 191 -               list_del_init(&fi->inmem_ilist);
 192 -       spin_unlock(&sbi->inode_lock[ATOMIC_FILE]);
 193 -       mutex_unlock(&fi->inmem_lock);
 194 +       while (!list_empty(&fi->inmem_pages)) {
 195 +               mutex_lock(&fi->inmem_lock);
 196 +               __revoke_inmem_pages(inode, &fi->inmem_pages,
 197 +                                               true, false, true);
 198 +
 199 +               if (list_empty(&fi->inmem_pages)) {
 200 +                       spin_lock(&sbi->inode_lock[ATOMIC_FILE]);
 201 +                       if (!list_empty(&fi->inmem_ilist))
 202 +                               list_del_init(&fi->inmem_ilist);
 203 +                       spin_unlock(&sbi->inode_lock[ATOMIC_FILE]);
 204 +               }
 205 +               mutex_unlock(&fi->inmem_lock);
 206 +       }
 207
 208         clear_inode_flag(inode, FI_ATOMIC_FILE);
 209         fi->i_gc_failures[GC_FAILURE_ATOMIC] = 0;
 210 @@ -427,12 +443,15 @@ retry:
 211                  * recovery or rewrite & commit last transaction. For other
 212                  * error number, revoking was done by filesystem itself.
 213                  */
 214 -               err = __revoke_inmem_pages(inode, &revoke_list, false, true);
 215 +               err = __revoke_inmem_pages(inode, &revoke_list,
 216 +                                               false, true, false);
 217
 218                 /* drop all uncommitted pages */
 219 -               __revoke_inmem_pages(inode, &fi->inmem_pages, true, false);
 220 +               __revoke_inmem_pages(inode, &fi->inmem_pages,
 221 +                                               true, false, false);
 222         } else {
 223 -               __revoke_inmem_pages(inode, &revoke_list, false, false);
 224 +               __revoke_inmem_pages(inode, &revoke_list,
 225 +                                               false, false, false);
 226         }
 227
 228         return err;