[PATCH 6.1.y 1/2] exfat: support dynamic allocate bh for exfat_entry_set_cache

[PATCH 6.1.y 1/2] exfat: support dynamic allocate bh for exfat_entry_set_cache

[Harshit Mogalapalli]

From: Yuezhang Mo <Yuezhang.Mo@sony.com>

[ Upstream commit a3ff29a95fde16906304455aa8c0bd84eb770258 ]

In special cases, a file or a directory may occupied more than 19
directory entries, pre-allocating 3 bh is not enough. Such as
  - Support vendor secondary directory entry in the future.
  - Since file directory entry is damaged, the SecondaryCount
    field is bigger than 18.

So this commit supports dynamic allocation of bh.

Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
Reviewed-by: Andy Wu <Andy.Wu@sony.com>
Reviewed-by: Aoyama Wataru <wataru.aoyama@sony.com>
Reviewed-by: Sungjong Seo <sj1557.seo@samsung.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
(cherry picked from commit a3ff29a95fde16906304455aa8c0bd84eb770258)
[Harshit: Backport - clean cherry-pick to 6.1.y]
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
---
This is already in 5.10.y and 5.15.y, let us apply this to 6.1.y, this
also has a fix commit: 89fc548767a2 ("exfat: fix potential deadlock on
__exfat_get_dentry_set"). Both apply cleanly on 6.1.y and builds fine.
No exfat specific testing is done.
---
 fs/exfat/dir.c      | 15 +++++++++++++++
 fs/exfat/exfat_fs.h |  5 ++++-
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/fs/exfat/dir.c b/fs/exfat/dir.c
index 51b03b0dd5f7..6fd9a06cc7d0 100644
--- a/fs/exfat/dir.c
+++ b/fs/exfat/dir.c
@@ -613,6 +613,10 @@ int exfat_free_dentry_set(struct exfat_entry_set_cache *es, int sync)
 			bforget(es->bh[i]);
 		else
 			brelse(es->bh[i]);
+
+	if (IS_DYNAMIC_ES(es))
+		kfree(es->bh);
+
 	kfree(es);
 	return err;
 }
@@ -845,6 +849,7 @@ struct exfat_entry_set_cache *exfat_get_dentry_set(struct super_block *sb,
 	/* byte offset in sector */
 	off = EXFAT_BLK_OFFSET(byte_offset, sb);
 	es->start_off = off;
+	es->bh = es->__bh;
 
 	/* sector offset in cluster */
 	sec = EXFAT_B_TO_BLK(byte_offset, sb);
@@ -864,6 +869,16 @@ struct exfat_entry_set_cache *exfat_get_dentry_set(struct super_block *sb,
 	es->num_entries = num_entries;
 
 	num_bh = EXFAT_B_TO_BLK_ROUND_UP(off + num_entries * DENTRY_SIZE, sb);
+	if (num_bh > ARRAY_SIZE(es->__bh)) {
+		es->bh = kmalloc_array(num_bh, sizeof(*es->bh), GFP_KERNEL);
+		if (!es->bh) {
+			brelse(bh);
+			kfree(es);
+			return NULL;
+		}
+		es->bh[0] = bh;
+	}
+
 	for (i = 1; i < num_bh; i++) {
 		/* get the next sector */
 		if (exfat_is_last_sector_in_cluster(sbi, sec)) {
diff --git a/fs/exfat/exfat_fs.h b/fs/exfat/exfat_fs.h
index e0af6ace633c..c79c78bf265b 100644
--- a/fs/exfat/exfat_fs.h
+++ b/fs/exfat/exfat_fs.h
@@ -169,10 +169,13 @@ struct exfat_entry_set_cache {
 	bool modified;
 	unsigned int start_off;
 	int num_bh;
-	struct buffer_head *bh[DIR_CACHE_SIZE];
+	struct buffer_head *__bh[DIR_CACHE_SIZE];
+	struct buffer_head **bh;
 	unsigned int num_entries;
 };
 
+#define IS_DYNAMIC_ES(es)	((es)->__bh != (es)->bh)
+
 struct exfat_dir_entry {
 	struct exfat_chain dir;
 	int entry;
-- 
2.46.0

[PATCH 6.1.y 2/2] exfat: fix potential deadlock on __exfat_get_dentry_set

[Harshit Mogalapalli]

From: Sungjong Seo <sj1557.seo@samsung.com>

[ Upstream commit 89fc548767a2155231128cb98726d6d2ea1256c9 ]

When accessing a file with more entries than ES_MAX_ENTRY_NUM, the bh-array
is allocated in __exfat_get_entry_set. The problem is that the bh-array is
allocated with GFP_KERNEL. It does not make sense. In the following cases,
a deadlock for sbi->s_lock between the two processes may occur.

       CPU0                CPU1
       ----                ----
  kswapd
   balance_pgdat
    lock(fs_reclaim)
                      exfat_iterate
                       lock(&sbi->s_lock)
                       exfat_readdir
                        exfat_get_uniname_from_ext_entry
                         exfat_get_dentry_set
                          __exfat_get_dentry_set
                           kmalloc_array
                            ...
                            lock(fs_reclaim)
    ...
    evict
     exfat_evict_inode
      lock(&sbi->s_lock)

To fix this, let's allocate bh-array with GFP_NOFS.

Fixes: a3ff29a95fde ("exfat: support dynamic allocate bh for exfat_entry_set_cache")
Cc: stable@vger.kernel.org # v6.2+
Reported-by: syzbot+412a392a2cd4a65e71db@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/lkml/000000000000fef47e0618c0327f@google.com
Signed-off-by: Sungjong Seo <sj1557.seo@samsung.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
(cherry picked from commit 89fc548767a2155231128cb98726d6d2ea1256c9)
[Harshit: Backport to 6.1.y, clean cherry-pick]
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
---
 fs/exfat/dir.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/exfat/dir.c b/fs/exfat/dir.c
index 6fd9a06cc7d0..d58c69018051 100644
--- a/fs/exfat/dir.c
+++ b/fs/exfat/dir.c
@@ -870,7 +870,7 @@ struct exfat_entry_set_cache *exfat_get_dentry_set(struct super_block *sb,
 
 	num_bh = EXFAT_B_TO_BLK_ROUND_UP(off + num_entries * DENTRY_SIZE, sb);
 	if (num_bh > ARRAY_SIZE(es->__bh)) {
-		es->bh = kmalloc_array(num_bh, sizeof(*es->bh), GFP_KERNEL);
+		es->bh = kmalloc_array(num_bh, sizeof(*es->bh), GFP_NOFS);
 		if (!es->bh) {
 			brelse(bh);
 			kfree(es);
-- 
2.46.0

Re: [PATCH 6.1.y 2/2] exfat: fix potential deadlock on __exfat_get_dentry_set

[Sasha Levin]

[ Sasha's backport helper bot ]

Hi,

The upstream commit SHA1 provided is correct: 89fc548767a2155231128cb98726d6d2ea1256c9

WARNING: Author mismatch between patch and upstream commit:
Backport author: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Commit author: Sungjong Seo <sj1557.seo@samsung.com>


Status in newer kernel trees:
6.12.y | Present (exact SHA1)
6.6.y | Present (different SHA1: a7ac198f8dba)
6.1.y | Not found

Note: The patch differs from the upstream commit:
---
Failed to apply patch cleanly, falling back to interdiff...

interdiff error output:
/home/sasha/stable/mailbot.sh: line 525: interdiff: command not found
interdiff failed, falling back to standard diff...
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.1.y        |  Success    |  Success   |

Re: [PATCH 6.1.y 1/2] exfat: support dynamic allocate bh for exfat_entry_set_cache

[Sasha Levin]

[ Sasha's backport helper bot ]

Hi,

The upstream commit SHA1 provided is correct: a3ff29a95fde16906304455aa8c0bd84eb770258

WARNING: Author mismatch between patch and upstream commit:
Backport author: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Commit author: Yuezhang Mo <Yuezhang.Mo@sony.com>


Status in newer kernel trees:
6.12.y | Present (exact SHA1)
6.6.y | Present (exact SHA1)
6.1.y | Not found

Note: The patch differs from the upstream commit:
---
1:  a3ff29a95fde ! 1:  bb39fa77df0f exfat: support dynamic allocate bh for exfat_entry_set_cache
    @@ Metadata
      ## Commit message ##
         exfat: support dynamic allocate bh for exfat_entry_set_cache
     
    +    [ Upstream commit a3ff29a95fde16906304455aa8c0bd84eb770258 ]
    +
         In special cases, a file or a directory may occupied more than 19
         directory entries, pre-allocating 3 bh is not enough. Such as
           - Support vendor secondary directory entry in the future.
    @@ Commit message
         Reviewed-by: Aoyama Wataru <wataru.aoyama@sony.com>
         Reviewed-by: Sungjong Seo <sj1557.seo@samsung.com>
         Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
    +    (cherry picked from commit a3ff29a95fde16906304455aa8c0bd84eb770258)
    +    [Harshit: Backport - clean cherry-pick to 6.1.y]
    +    Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
     
      ## fs/exfat/dir.c ##
     @@ fs/exfat/dir.c: int exfat_free_dentry_set(struct exfat_entry_set_cache *es, int sync)
    @@ fs/exfat/dir.c: struct exfat_entry_set_cache *exfat_get_dentry_set(struct super_
     
      ## fs/exfat/exfat_fs.h ##
     @@ fs/exfat/exfat_fs.h: struct exfat_entry_set_cache {
    - 	struct super_block *sb;
    + 	bool modified;
      	unsigned int start_off;
      	int num_bh;
     -	struct buffer_head *bh[DIR_CACHE_SIZE];
     +	struct buffer_head *__bh[DIR_CACHE_SIZE];
     +	struct buffer_head **bh;
      	unsigned int num_entries;
    - 	bool modified;
      };
      
     +#define IS_DYNAMIC_ES(es)	((es)->__bh != (es)->bh)
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.1.y        |  Success    |  Success   |