[PATCH 0/2] gfs2: fix sleep from invalid context bug in gfs2_glock_wait()

[PATCH 0/2] gfs2: fix sleep from invalid context bug in gfs2_glock_wait()

[ChenXiaoSong]

ChenXiaoSong (2):
  gfs2: factor out __gfs2_ail1_empty() and gfs2_ail1_withdraw()
  gfs2: fix sleep from invalid context bug in gfs2_glock_wait()

 fs/gfs2/log.c | 35 +++++++++++++++++++++++++----------
 1 file changed, 25 insertions(+), 10 deletions(-)

-- 
2.31.1

[PATCH 1/2] gfs2: factor out __gfs2_ail1_empty() and gfs2_ail1_withdraw()

[ChenXiaoSong]

Factor out __gfs2_ail1_empty() and gfs2_ail1_withdraw() from
gfs2_ail1_empty(). No functional change.

Signed-off-by: ChenXiaoSong <chenxiaosong2@huawei.com>
---
 fs/gfs2/log.c | 31 ++++++++++++++++++++++---------
 1 file changed, 22 insertions(+), 9 deletions(-)

diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
index 61323deb80bc..c62c914702ba 100644
--- a/fs/gfs2/log.c
+++ b/fs/gfs2/log.c
@@ -347,15 +347,7 @@ static int gfs2_ail1_empty_one(struct gfs2_sbd *sdp, struct gfs2_trans *tr,
 	return active_count;
 }
 
-/**
- * gfs2_ail1_empty - Try to empty the ail1 lists
- * @sdp: The superblock
- * @max_revokes: If non-zero, add revokes where appropriate
- *
- * Tries to empty the ail1 lists, starting with the oldest first
- */
-
-static int gfs2_ail1_empty(struct gfs2_sbd *sdp, int max_revokes)
+static int __gfs2_ail1_empty(struct gfs2_sbd *sdp, int max_revokes)
 {
 	struct gfs2_trans *tr, *s;
 	int oldest_tr = 1;
@@ -372,10 +364,31 @@ static int gfs2_ail1_empty(struct gfs2_sbd *sdp, int max_revokes)
 	ret = list_empty(&sdp->sd_ail1_list);
 	spin_unlock(&sdp->sd_ail_lock);
 
+	return ret;
+}
+
+static void gfs2_ail1_withdraw(struct gfs2_sbd *sdp)
+{
 	if (test_bit(SDF_WITHDRAWING, &sdp->sd_flags)) {
 		gfs2_lm(sdp, "fatal: I/O error(s)\n");
 		gfs2_withdraw(sdp);
 	}
+}
+
+/**
+ * gfs2_ail1_empty - Try to empty the ail1 lists
+ * @sdp: The superblock
+ * @max_revokes: If non-zero, add revokes where appropriate
+ *
+ * Tries to empty the ail1 lists, starting with the oldest first
+ */
+
+static int gfs2_ail1_empty(struct gfs2_sbd *sdp, int max_revokes)
+{
+	int ret;
+
+	ret = __gfs2_ail1_empty(sdp, max_revokes);
+	gfs2_ail1_withdraw(sdp);
 
 	return ret;
 }
-- 
2.31.1

[PATCH 2/2] gfs2: fix sleep from invalid context bug in gfs2_glock_wait()

[ChenXiaoSong]

Syzkaller reported BUG as follows:

  BUG: sleeping function called from invalid context at
       fs/gfs2/glock.c:1316
  Call Trace:
   __dump_stack lib/dump_stack.c:88 [inline]
   dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106
   __might_resched+0x4e9/0x6b0 kernel/sched/core.c:10036
   gfs2_glock_wait+0x52/0x2a0 fs/gfs2/glock.c:1316
   gfs2_glock_nq_init fs/gfs2/glock.h:262 [inline]
   gfs2_freeze_lock+0x5f/0xc0 fs/gfs2/util.c:107
   signal_our_withdraw fs/gfs2/util.c:160 [inline]
   gfs2_withdraw+0x5cc/0x1540 fs/gfs2/util.c:351
   gfs2_ail1_empty+0x8c9/0x950 fs/gfs2/log.c:368
   gfs2_flush_revokes+0x59/0x80 fs/gfs2/log.c:806
   revoke_lo_before_commit+0x2b/0xcf0 fs/gfs2/lops.c:869
   lops_before_commit fs/gfs2/lops.h:40 [inline]
   gfs2_log_flush+0xc8e/0x26a0 fs/gfs2/log.c:1093
   do_sync+0xa3c/0xc80 fs/gfs2/quota.c:975
   gfs2_quota_sync+0x3da/0x8b0 fs/gfs2/quota.c:1318
   gfs2_sync_fs+0x49/0xb0 fs/gfs2/super.c:650
   sync_filesystem+0xe8/0x220 fs/sync.c:56
   generic_shutdown_super+0x6b/0x310 fs/super.c:474
   kill_block_super+0x79/0xd0 fs/super.c:1386
   deactivate_locked_super+0xa7/0xf0 fs/super.c:332
   cleanup_mnt+0x494/0x520 fs/namespace.c:1291
   task_work_run+0x243/0x300 kernel/task_work.c:179
   exit_task_work include/linux/task_work.h:38 [inline]
   do_exit+0x644/0x2150 kernel/exit.c:867
   do_group_exit+0x1fd/0x2b0 kernel/exit.c:1012
   __do_sys_exit_group kernel/exit.c:1023 [inline]
   __se_sys_exit_group kernel/exit.c:1021 [inline]
   __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1021
   do_syscall_x64 arch/x86/entry/common.c:50 [inline]
   do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
   entry_SYSCALL_64_after_hwframe+0x63/0xcd

Fix this by calling gfs2_withdraw() outside of the spinlock context.

Link: https://syzkaller.appspot.com/bug?id=7bd882c47078df844b5a82550559d69482d5c3c1
Signed-off-by: ChenXiaoSong <chenxiaosong2@huawei.com>
---
 fs/gfs2/log.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
index c62c914702ba..945540c0a3cf 100644
--- a/fs/gfs2/log.c
+++ b/fs/gfs2/log.c
@@ -825,8 +825,10 @@ void gfs2_flush_revokes(struct gfs2_sbd *sdp)
 	unsigned int max_revokes = atomic_read(&sdp->sd_log_revokes_available);
 
 	gfs2_log_lock(sdp);
-	gfs2_ail1_empty(sdp, max_revokes);
+	__gfs2_ail1_empty(sdp, max_revokes);
 	gfs2_log_unlock(sdp);
+
+	gfs2_ail1_withdraw(sdp);
 }
 
 /**
-- 
2.31.1