Re: [syzbot] possible deadlock in ocfs2_try_remove_refcount_tree

[Tetsuo Handa]

Please re-submit this change as a formal patch.
You can add

  Reported-by: syzbot+1fed2de07d8e11a3ec1b@xxxxxxxxxxxxxxxxxxxxxxxxx
  Tested-by: syzbot+1fed2de07d8e11a3ec1b@xxxxxxxxxxxxxxxxxxxxxxxxx

lines to this change.

On 2024/08/22 6:04, syzbot wrote:
> For archival purposes, forwarding an incoming command email to
> linux-kernel@xxxxxxxxxxxxxxx.
> 
> ***
> 
> Subject: possible deadlock in ocfs2_try_remove_refcount_tree
> Author: djahchankoike@xxxxxxxxx
> 
> #syz test
> 
> Acquiring the locks in refcounttree should follow
> the ip_alloc --> ip_xattr ordering, as done by multiple
> code paths in ocfs2; otherwise, we risk an ABBA deadlock
> (i.e in the start transaction path).
> 
> Signed-off-by: Diogo Jahchan Koike <djahchankoike@xxxxxxxxx>
> ---
>  fs/ocfs2/refcounttree.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
> index 1f303b1adf1a..32c0249ff253 100644
> --- a/fs/ocfs2/refcounttree.c
> +++ b/fs/ocfs2/refcounttree.c
> @@ -927,8 +927,8 @@ int ocfs2_try_remove_refcount_tree(struct inode *inode,
>  	struct ocfs2_inode_info *oi = OCFS2_I(inode);
>  	struct ocfs2_dinode *di = (struct ocfs2_dinode *)di_bh->b_data;
>  
> -	down_write(&oi->ip_xattr_sem);
>  	down_write(&oi->ip_alloc_sem);
> +	down_write(&oi->ip_xattr_sem);
>  
>  	if (oi->ip_clusters)
>  		goto out;
> @@ -944,8 +944,8 @@ int ocfs2_try_remove_refcount_tree(struct inode *inode,
>  	if (ret)
>  		mlog_errno(ret);
>  out:
> -	up_write(&oi->ip_alloc_sem);
>  	up_write(&oi->ip_xattr_sem);
> +	up_write(&oi->ip_alloc_sem);
>  	return 0;
>  }
>