Commit fff0c6cc authored by Sungjong Seo's avatar Sungjong Seo Committed by Zhang Zekun
Browse files

exfat: fix potential deadlock on __exfat_get_dentry_set

mainline inclusion
from mainline-v6.11-rc1
commit 89fc548767a2155231128cb98726d6d2ea1256c9
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPQ2
CVE: CVE-2024-42315

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=89fc548767a2155231128cb98726d6d2ea1256c9



--------------------------------------------------------

When accessing a file with more entries than ES_MAX_ENTRY_NUM, the bh-array
is allocated in __exfat_get_entry_set. The problem is that the bh-array is
allocated with GFP_KERNEL. It does not make sense. In the following cases,
a deadlock for sbi->s_lock between the two processes may occur.

       CPU0                CPU1
       ----                ----
  kswapd
   balance_pgdat
    lock(fs_reclaim)
                      exfat_iterate
                       lock(&sbi->s_lock)
                       exfat_readdir
                        exfat_get_uniname_from_ext_entry
                         exfat_get_dentry_set
                          __exfat_get_dentry_set
                           kmalloc_array
                            ...
                            lock(fs_reclaim)
    ...
    evict
     exfat_evict_inode
      lock(&sbi->s_lock)

To fix this, let's allocate bh-array with GFP_NOFS.

Fixes: a3ff29a9 ("exfat: support dynamic allocate bh for exfat_entry_set_cache")
Cc: stable@vger.kernel.org # v6.2+
Reported-by: default avatar <syzbot+412a392a2cd4a65e71db@syzkaller.appspotmail.com>
Closes: https://lore.kernel.org/lkml/000000000000fef47e0618c0327f@google.com


Signed-off-by: default avatarSungjong Seo <sj1557.seo@samsung.com>
Signed-off-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
Conflicts:
	fs/exfat/dir.c
[There is a context defference, no functional difference]
Signed-off-by: default avatarZhang Zekun <zhangzekun11@huawei.com>
parent 96a40671
Loading
Loading
Loading
Loading
+1 −1
Original line number Diff line number Diff line
@@ -873,7 +873,7 @@ struct exfat_entry_set_cache *exfat_get_dentry_set(struct super_block *sb,

	num_bh = EXFAT_B_TO_BLK_ROUND_UP(off + num_entries * DENTRY_SIZE, sb);
	if (num_bh > ARRAY_SIZE(es->__bh)) {
		es->bh = kmalloc_array(num_bh, sizeof(*es->bh), GFP_KERNEL);
		es->bh = kmalloc_array(num_bh, sizeof(*es->bh), GFP_NOFS);
		if (!es->bh) {
			brelse(bh);
			kfree(es);