lkml.org 
[lkml]   [2019]   [Jan]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.20 105/111] loop: Move loop_reread_partitions() out of loop_ctl_mutex
    Date
    4.20-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Jan Kara <jack@suse.cz>

    commit 85b0a54a82e4fbceeb1aebb7cb6909edd1a24668 upstream.

    Calling loop_reread_partitions() under loop_ctl_mutex causes lockdep to
    complain about circular lock dependency between bdev->bd_mutex and
    lo->lo_ctl_mutex. The problem is that on loop device open or close
    lo_open() and lo_release() get called with bdev->bd_mutex held and they
    need to acquire loop_ctl_mutex. OTOH when loop_reread_partitions() is
    called with loop_ctl_mutex held, it will call blkdev_reread_part() which
    acquires bdev->bd_mutex. See syzbot report for details [1].

    Move all calls of loop_rescan_partitions() out of loop_ctl_mutex to
    avoid lockdep warning and fix deadlock possibility.

    [1] https://syzkaller.appspot.com/bug?id=bf154052f0eea4bc7712499e4569505907d1588

    Reported-by: syzbot <syzbot+4684a000d5abdade83fac55b1e7d1f935ef1936e@syzkaller.appspotmail.com>
    Signed-off-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/block/loop.c | 19 ++++++++++++++-----
    1 file changed, 14 insertions(+), 5 deletions(-)

    --- a/drivers/block/loop.c
    +++ b/drivers/block/loop.c
    @@ -679,6 +679,7 @@ static int loop_change_fd(struct loop_de
    {
    struct file *file, *old_file;
    int error;
    + bool partscan;

    error = mutex_lock_killable_nested(&loop_ctl_mutex, 1);
    if (error)
    @@ -720,9 +721,10 @@ static int loop_change_fd(struct loop_de
    blk_mq_unfreeze_queue(lo->lo_queue);

    fput(old_file);
    - if (lo->lo_flags & LO_FLAGS_PARTSCAN)
    - loop_reread_partitions(lo, bdev);
    + partscan = lo->lo_flags & LO_FLAGS_PARTSCAN;
    mutex_unlock(&loop_ctl_mutex);
    + if (partscan)
    + loop_reread_partitions(lo, bdev);
    return 0;

    out_putf:
    @@ -903,6 +905,7 @@ static int loop_set_fd(struct loop_devic
    int lo_flags = 0;
    int error;
    loff_t size;
    + bool partscan;

    /* This is safe, since we have a reference from open(). */
    __module_get(THIS_MODULE);
    @@ -969,14 +972,15 @@ static int loop_set_fd(struct loop_devic
    lo->lo_state = Lo_bound;
    if (part_shift)
    lo->lo_flags |= LO_FLAGS_PARTSCAN;
    - if (lo->lo_flags & LO_FLAGS_PARTSCAN)
    - loop_reread_partitions(lo, bdev);
    + partscan = lo->lo_flags & LO_FLAGS_PARTSCAN;

    /* Grab the block_device to prevent its destruction after we
    * put /dev/loopXX inode. Later in __loop_clr_fd() we bdput(bdev).
    */
    bdgrab(bdev);
    mutex_unlock(&loop_ctl_mutex);
    + if (partscan)
    + loop_reread_partitions(lo, bdev);
    return 0;

    out_unlock:
    @@ -1157,6 +1161,8 @@ loop_set_status(struct loop_device *lo,
    int err;
    struct loop_func_table *xfer;
    kuid_t uid = current_uid();
    + struct block_device *bdev;
    + bool partscan = false;

    err = mutex_lock_killable_nested(&loop_ctl_mutex, 1);
    if (err)
    @@ -1245,10 +1251,13 @@ out_unfreeze:
    !(lo->lo_flags & LO_FLAGS_PARTSCAN)) {
    lo->lo_flags |= LO_FLAGS_PARTSCAN;
    lo->lo_disk->flags &= ~GENHD_FL_NO_PART_SCAN;
    - loop_reread_partitions(lo, lo->lo_device);
    + bdev = lo->lo_device;
    + partscan = true;
    }
    out_unlock:
    mutex_unlock(&loop_ctl_mutex);
    + if (partscan)
    + loop_reread_partitions(lo, bdev);

    return err;
    }

    \
     
     \ /
      Last update: 2019-01-21 15:18    [W:2.377 / U:0.000 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site