f2fs: fix to avoid potential deadlock

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to avoid potential deadlock

As Jiaming Zhang and syzbot reported, there is potential deadlock in

f2fs as below:

Chain exists of:

&sbi->cp_rwsem --> fs_reclaim --> sb_internal#2

Possible unsafe locking scenario:

CPU0 CPU1

---- ----

rlock(sb_internal#2);

lock(fs_reclaim);

lock(sb_internal#2);

rlock(&sbi->cp_rwsem);

*** DEADLOCK ***

3 locks held by kswapd0/73:

#0: ffffffff8e247a40 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat mm/vmscan.c:7015 [inline]

#0: ffffffff8e247a40 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x951/0x2800 mm/vmscan.c:7389

#1: ffff8880118400e0 (&type->s_umount_key#50){.+.+}-{4:4}, at: super_trylock_shared fs/super.c:562 [inline]

#1: ffff8880118400e0 (&type->s_umount_key#50){.+.+}-{4:4}, at: super_cache_scan+0x91/0x4b0 fs/super.c:197

#2: ffff888011840610 (sb_internal#2){.+.+}-{0:0}, at: f2fs_evict_inode+0x8d9/0x1b60 fs/f2fs/inode.c:890

stack backtrace:

CPU: 0 UID: 0 PID: 73 Comm: kswapd0 Not tainted syzkaller #0 PREEMPT(full)

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014

Call Trace:

<TASK>

dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120

print_circular_bug+0x2ee/0x310 kernel/locking/lockdep.c:2043

check_noncircular+0x134/0x160 kernel/locking/lockdep.c:2175

check_prev_add kernel/locking/lockdep.c:3165 [inline]

check_prevs_add kernel/locking/lockdep.c:3284 [inline]

validate_chain+0xb9b/0x2140 kernel/locking/lockdep.c:3908

__lock_acquire+0xab9/0xd20 kernel/locking/lockdep.c:5237

lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868

down_read+0x46/0x2e0 kernel/locking/rwsem.c:1537

f2fs_down_read fs/f2fs/f2fs.h:2278 [inline]

f2fs_lock_op fs/f2fs/f2fs.h:2357 [inline]

f2fs_do_truncate_blocks+0x21c/0x10c0 fs/f2fs/file.c:791

f2fs_truncate_blocks+0x10a/0x300 fs/f2fs/file.c:867

f2fs_truncate+0x489/0x7c0 fs/f2fs/file.c:925

f2fs_evict_inode+0x9f2/0x1b60 fs/f2fs/inode.c:897

evict+0x504/0x9c0 fs/inode.c:810

f2fs_evict_inode+0x1dc/0x1b60 fs/f2fs/inode.c:853

evict+0x504/0x9c0 fs/inode.c:810

dispose_list fs/inode.c:852 [inline]

prune_icache_sb+0x21b/0x2c0 fs/inode.c:1000

super_cache_scan+0x39b/0x4b0 fs/super.c:224

do_shrink_slab+0x6ef/0x1110 mm/shrinker.c:437

shrink_slab_memcg mm/shrinker.c:550 [inline]

shrink_slab+0x7ef/0x10d0 mm/shrinker.c:628

shrink_one+0x28a/0x7c0 mm/vmscan.c:4955

shrink_many mm/vmscan.c:5016 [inline]

lru_gen_shrink_node mm/vmscan.c:5094 [inline]

shrink_node+0x315d/0x3780 mm/vmscan.c:6081

kswapd_shrink_node mm/vmscan.c:6941 [inline]

balance_pgdat mm/vmscan.c:7124 [inline]

kswapd+0x147c/0x2800 mm/vmscan.c:7389

kthread+0x70e/0x8a0 kernel/kthread.c:463

ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158

ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

</TASK>

The root cause is deadlock among four locks as below:

kswapd

- fs_reclaim --- Lock A

- shrink_one

- evict

- f2fs_evict_inode

- sb_start_intwrite --- Lock B

- iput

- evict

- f2fs_evict_inode

- sb_start_intwrite --- Lock B

- f2fs_truncate

- f2fs_truncate_blocks

- f2fs_do_truncate_blocks

- f2fs_lock_op --- Lock C

ioctl

- f2fs_ioc_commit_atomic_write

- f2fs_lock_op --- Lock C

- __f2fs_commit_atomic_write

- __replace_atomic_write_block

- f2fs_get_dnode_of_data

- __get_node_folio

- f2fs_check_nid_range

- f2fs_handle_error

- f2fs_record_errors

- f2fs_down_write --- Lock D

open

- do_open

- do_truncate

- security_inode_need_killpriv

- f2fs_getxattr

- lookup_all_xattrs

- f2fs_handle_error

- f2fs_record_errors

- f2fs_down_write --- Lock D

- f2fs_commit_super

- read_mapping_folio

- filemap_alloc_folio_noprof

- prepare_alloc_pages

- fs_reclaim_acquire --- Lock A

In order to a

---truncated---