+1
−1
Loading
mainline inclusion from mainline-v6.11-rc1 commit 89fc548767a2155231128cb98726d6d2ea1256c9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPQ2 CVE: CVE-2024-42315 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=89fc548767a2155231128cb98726d6d2ea1256c9 -------------------------------------------------------- When accessing a file with more entries than ES_MAX_ENTRY_NUM, the bh-array is allocated in __exfat_get_entry_set. The problem is that the bh-array is allocated with GFP_KERNEL. It does not make sense. In the following cases, a deadlock for sbi->s_lock between the two processes may occur. CPU0 CPU1 ---- ---- kswapd balance_pgdat lock(fs_reclaim) exfat_iterate lock(&sbi->s_lock) exfat_readdir exfat_get_uniname_from_ext_entry exfat_get_dentry_set __exfat_get_dentry_set kmalloc_array ... lock(fs_reclaim) ... evict exfat_evict_inode lock(&sbi->s_lock) To fix this, let's allocate bh-array with GFP_NOFS. Fixes: a3ff29a9 ("exfat: support dynamic allocate bh for exfat_entry_set_cache") Cc: stable@vger.kernel.org # v6.2+ Reported-by:<syzbot+412a392a2cd4a65e71db@syzkaller.appspotmail.com> Closes: https://lore.kernel.org/lkml/000000000000fef47e0618c0327f@google.com Signed-off-by:
Sungjong Seo <sj1557.seo@samsung.com> Signed-off-by:
Namjae Jeon <linkinjeon@kernel.org> Conflicts: fs/exfat/dir.c [There is a context defference, no functional difference] Signed-off-by:
Zhang Zekun <zhangzekun11@huawei.com>