fanotify: use fsnotify group lock helpers

Direct reclaim from fanotify mark allocation context may try to evict
inodes with evictable marks of the same group and hit this deadlock:

[<0>] fsnotify_destroy_mark+0x1f/0x3a
[<0>] fsnotify_destroy_marks+0x71/0xd9
[<0>] __destroy_inode+0x24/0x7e
[<0>] destroy_inode+0x2c/0x67
[<0>] dispose_list+0x49/0x68
[<0>] prune_icache_sb+0x5b/0x79
[<0>] super_cache_scan+0x11c/0x16f
[<0>] shrink_slab.constprop.0+0x23e/0x40f
[<0>] shrink_node+0x218/0x3e7
[<0>] do_try_to_free_pages+0x12a/0x2d2
[<0>] try_to_free_pages+0x166/0x242
[<0>] __alloc_pages_slowpath.constprop.0+0x30c/0x903
[<0>] __alloc_pages+0xeb/0x1c7
[<0>] cache_grow_begin+0x6f/0x31e
[<0>] fallback_alloc+0xe0/0x12d
[<0>] ____cache_alloc_node+0x15a/0x17e
[<0>] kmem_cache_alloc_trace+0xa1/0x143
[<0>] fanotify_add_mark+0xd5/0x2b2
[<0>] do_fanotify_mark+0x566/0x5eb
[<0>] __x64_sys_fanotify_mark+0x21/0x24
[<0>] do_syscall_64+0x6d/0x80
[<0>] entry_SYSCALL_64_after_hwframe+0x44/0xae

Set the FSNOTIFY_GROUP_NOFS flag to prevent going into direct reclaim
from allocations under fanotify group lock and use the safe group lock
helpers.

Link: https://lore.kernel.org/r/20220422120327.3459282-16-amir73il@gmail.com
Suggested-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20220321112310.vpr7oxro2xkz5llh@quack3.lan/
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>

diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index ae36138..228cf25 100644 (file)
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -1035,10 +1035,10 @@ static int fanotify_remove_mark(struct fsnotify_group *group,
        __u32 removed;
        int destroy_mark;
 
-       mutex_lock(&group->mark_mutex);
+       fsnotify_group_lock(group);
        fsn_mark = fsnotify_find_mark(connp, group);
        if (!fsn_mark) {
-               mutex_unlock(&group->mark_mutex);
+               fsnotify_group_unlock(group);
                return -ENOENT;
        }
 
@@ -1048,7 +1048,7 @@ static int fanotify_remove_mark(struct fsnotify_group *group,
                fsnotify_recalc_mask(fsn_mark->connector);
        if (destroy_mark)
                fsnotify_detach_mark(fsn_mark);
-       mutex_unlock(&group->mark_mutex);
+       fsnotify_group_unlock(group);
        if (destroy_mark)
                fsnotify_free_mark(fsn_mark);
 
@@ -1196,13 +1196,13 @@ static int fanotify_add_mark(struct fsnotify_group *group,
        bool recalc;
        int ret = 0;
 
-       mutex_lock(&group->mark_mutex);
+       fsnotify_group_lock(group);
        fsn_mark = fsnotify_find_mark(connp, group);
        if (!fsn_mark) {
                fsn_mark = fanotify_add_new_mark(group, connp, obj_type,
                                                 fan_flags, fsid);
                if (IS_ERR(fsn_mark)) {
-                       mutex_unlock(&group->mark_mutex);
+                       fsnotify_group_unlock(group);
                        return PTR_ERR(fsn_mark);
                }
        }
@@ -1231,7 +1231,7 @@ static int fanotify_add_mark(struct fsnotify_group *group,
                fsnotify_recalc_mask(fsn_mark->connector);
 
 out:
-       mutex_unlock(&group->mark_mutex);
+       fsnotify_group_unlock(group);
 
        fsnotify_put_mark(fsn_mark);
        return ret;
@@ -1385,7 +1385,7 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags)
 
        /* fsnotify_alloc_group takes a ref.  Dropped in fanotify_release */
        group = fsnotify_alloc_group(&fanotify_fsnotify_ops,
-                                    FSNOTIFY_GROUP_USER);
+                                    FSNOTIFY_GROUP_USER | FSNOTIFY_GROUP_NOFS);
        if (IS_ERR(group)) {
                return PTR_ERR(group);
        }