Miklos Szeredi c4461ca7a8 ovl: fix deadlock in splice write
commit 9b91b6b019fda817eb52f728eb9c79b3579760bc upstream.

There's possibility of an ABBA deadlock in case of a splice write to an
overlayfs file and a concurrent splice write to a corresponding real file.

The call chain for splice to an overlay file:

 -> do_splice                     [takes sb_writers on overlay file]
   -> do_splice_from
     -> iter_file_splice_write    [takes pipe->mutex]
       -> vfs_iter_write
         ...
         -> ovl_write_iter        [takes sb_writers on real file]

And the call chain for splice to a real file:

 -> do_splice                     [takes sb_writers on real file]
   -> do_splice_from
     -> iter_file_splice_write    [takes pipe->mutex]

Syzbot successfully bisected this to commit 82a763e61e2b ("ovl: simplify
file splice").

Fix by reverting the write part of the above commit and by adding missing
bits from ovl_write_iter() into ovl_splice_write().

Fixes: 82a763e61e2b ("ovl: simplify file splice")
Reported-and-tested-by: syzbot+579885d1a9a833336209@syzkaller.appspotmail.com
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-11-17 09:48:49 +01:00
..
2020-11-05 11:43:34 +01:00
2021-10-27 09:54:27 +02:00
2021-09-30 10:09:24 +02:00
2019-09-19 09:42:37 -07:00
2021-07-14 16:53:17 +02:00
2021-09-22 12:26:25 +02:00
2021-11-17 09:48:19 +01:00
2021-11-17 09:48:42 +01:00
2020-06-17 16:40:24 +02:00
2020-10-01 13:17:19 +02:00
2019-08-07 21:51:47 -04:00
2020-03-25 08:25:58 +01:00
2019-12-17 19:55:30 +01:00
2019-09-18 16:59:14 -07:00
2019-09-18 16:59:14 -07:00
2019-08-01 20:51:23 +02:00