diff options
| author | Jan Kara <jack@suse.cz> | 2023-10-18 17:29:24 +0200 |
|---|---|---|
| committer | Christian Brauner <brauner@kernel.org> | 2023-10-28 13:29:22 +0200 |
| commit | fd1464105cb37a3b50a72c1d2902e97a71950af8 (patch) | |
| tree | 1ef7340dc0d2c358a4c8f0e46015e29ca5c2f5ac /block | |
| parent | jfs: fix log->bdev_handle null ptr deref in lbmStartIO (diff) | |
| download | linux-fd1464105cb37a3b50a72c1d2902e97a71950af8.tar.xz linux-fd1464105cb37a3b50a72c1d2902e97a71950af8.zip | |
fs: Avoid grabbing sb->s_umount under bdev->bd_holder_lock
The implementation of bdev holder operations such as fs_bdev_mark_dead()
and fs_bdev_sync() grab sb->s_umount semaphore under
bdev->bd_holder_lock. This is problematic because it leads to
disk->open_mutex -> sb->s_umount lock ordering which is counterintuitive
(usually we grab higher level (e.g. filesystem) locks first and lower
level (e.g. block layer) locks later) and indeed makes lockdep complain
about possible locking cycles whenever we open a block device while
holding sb->s_umount semaphore. Implement a function
bdev_super_lock_shared() which safely transitions from holding
bdev->bd_holder_lock to holding sb->s_umount on alive superblock without
introducing the problematic lock dependency. We use this function
fs_bdev_sync() and fs_bdev_mark_dead().
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20231018152924.3858-1-jack@suse.cz
Link: https://lore.kernel.org/r/20231017184823.1383356-1-hch@lst.de
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Diffstat (limited to 'block')
| -rw-r--r-- | block/bdev.c | 5 | ||||
| -rw-r--r-- | block/ioctl.c | 5 |
2 files changed, 6 insertions, 4 deletions
diff --git a/block/bdev.c b/block/bdev.c index 4628dcb1da8a..9838085102b3 100644 --- a/block/bdev.c +++ b/block/bdev.c @@ -1012,9 +1012,10 @@ void bdev_mark_dead(struct block_device *bdev, bool surprise) mutex_lock(&bdev->bd_holder_lock); if (bdev->bd_holder_ops && bdev->bd_holder_ops->mark_dead) bdev->bd_holder_ops->mark_dead(bdev, surprise); - else + else { + mutex_unlock(&bdev->bd_holder_lock); sync_blockdev(bdev); - mutex_unlock(&bdev->bd_holder_lock); + } invalidate_bdev(bdev); } diff --git a/block/ioctl.c b/block/ioctl.c index 5d356c964352..4160f4e6bd5b 100644 --- a/block/ioctl.c +++ b/block/ioctl.c @@ -370,9 +370,10 @@ static int blkdev_flushbuf(struct block_device *bdev, unsigned cmd, mutex_lock(&bdev->bd_holder_lock); if (bdev->bd_holder_ops && bdev->bd_holder_ops->sync) bdev->bd_holder_ops->sync(bdev); - else + else { + mutex_unlock(&bdev->bd_holder_lock); sync_blockdev(bdev); - mutex_unlock(&bdev->bd_holder_lock); + } invalidate_bdev(bdev); return 0; |