• Jan Kara's avatar
    udf: Fix lock ordering in udf_evict_inode() · 8832fc1e
    Jan Kara authored
    udf_evict_inode() calls udf_setsize() to truncate deleted inode.
    However inode deletion through udf_evict_inode() can happen from inode
    reclaim context and udf_setsize() grabs mapping->invalidate_lock which
    isn't generally safe to acquire from fs reclaim context since we
    allocate pages under mapping->invalidate_lock for example in a page
    fault path.  This is however not a real deadlock possibility as by the
    time udf_evict_inode() is called, nobody can be accessing the inode,
    even less work with its page cache. So this is just a lockdep triggering
    false positive. Fix the problem by moving mapping->invalidate_lock
    locking outsize of udf_setsize() into udf_setattr() as grabbing
    mapping->invalidate_lock from udf_evict_inode() is pointless.
    
    Reported-by: syzbot+0333a6f4b88bcd68a62f@syzkaller.appspotmail.com
    Fixes: b9a861fd ("udf: Protect truncate and file type conversion with invalidate_lock")
    Signed-off-by: default avatarJan Kara <jack@suse.cz>
    8832fc1e
inode.c 67.1 KB