[PATCH] hfs: fix potential race conditions in b-tree functionality

[Viacheslav Dubeyko]

The HFS_BNODE_DELETED flag is checked in hfs_bnode_put()
under locked tree->hash_lock. Add locking for the case of
setting the HFS_BNODE_DELETED flag in hfs_bnode_unlink()
with the goal to avoid potential race conditions.

The hfs_btree_write() method should be called under
tree->tree_lock. Rework logic by adding locking
the tree->tree_lock for the calls of hfs_btree_write()
in hfs_write_inode() for the case of Extents and
Catalog b-tree inodes.

Also, add the lockdep_assert_held() in
hfs_bmap_reserve(), hfs_bmap_alloc(), and hfs_bmap_free().

HFS port of the HFS+ commit:
commit 6dca66d7ba17 ("hfsplus: fix potential race conditions in b-tree functionality")

Signed-off-by: Viacheslav Dubeyko <slava@xxxxxxxxxxx>
cc: John Paul Adrian Glaubitz <glaubitz@xxxxxxxxxxxxxxxxxxx>
cc: Yangtao Li <frank.li@xxxxxxxx>
cc: linux-fsdevel@xxxxxxxxxxxxxxx
---
 fs/hfs/bnode.c |  3 +++
 fs/hfs/btree.c |  5 +++++
 fs/hfs/inode.c | 13 +++++++++++--
 3 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/fs/hfs/bnode.c b/fs/hfs/bnode.c
index 1b331108d9c0..93a13ece1eb4 100644
--- a/fs/hfs/bnode.c
+++ b/fs/hfs/bnode.c
@@ -271,7 +271,10 @@ void hfs_bnode_unlink(struct hfs_bnode *node)
 		tree->root = 0;
 		tree->depth = 0;
 	}
+
+	spin_lock(&tree->hash_lock);
 	set_bit(HFS_BNODE_DELETED, &node->flags);
+	spin_unlock(&tree->hash_lock);
 }
 
 static inline int hfs_bnode_hash(u32 num)
diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c
index 4f0ddc76e8c5..b140d8597474 100644
--- a/fs/hfs/btree.c
+++ b/fs/hfs/btree.c
@@ -398,6 +398,8 @@ int hfs_bmap_reserve(struct hfs_btree *tree, u32 rsvd_nodes)
 	u32 count;
 	int res;
 
+	lockdep_assert_held(&tree->tree_lock);
+
 	while (tree->free_nodes < rsvd_nodes) {
 		res = hfs_extend_file(inode);
 		if (res)
@@ -424,6 +426,8 @@ struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree)
 	u8 *data, byte, m;
 	int i, res;
 
+	lockdep_assert_held(&tree->tree_lock);
+
 	res = hfs_bmap_reserve(tree, 1);
 	if (res)
 		return ERR_PTR(res);
@@ -500,6 +504,7 @@ void hfs_bmap_free(struct hfs_bnode *node)
 
 	hfs_dbg("node %u\n", node->this);
 	tree = node->tree;
+	lockdep_assert_held(&tree->tree_lock);
 	nidx = node->this;
 	node = hfs_bnode_find(tree, 0);
 	if (IS_ERR(node))
diff --git a/fs/hfs/inode.c b/fs/hfs/inode.c
index cce3a7bb95e9..9dde4b43c88f 100644
--- a/fs/hfs/inode.c
+++ b/fs/hfs/inode.c
@@ -468,6 +468,7 @@ int hfs_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
 	struct inode *main_inode = inode;
 	struct hfs_find_data fd;
+	struct hfs_btree *tree;
 	hfs_cat_rec rec;
 	int res;
 
@@ -481,10 +482,18 @@ int hfs_write_inode(struct inode *inode, struct writeback_control *wbc)
 		case HFS_ROOT_CNID:
 			break;
 		case HFS_EXT_CNID:
-			hfs_btree_write(HFS_SB(inode->i_sb)->ext_tree);
+			tree = HFS_SB(inode->i_sb)->ext_tree;
+			mutex_lock_nested(&tree->tree_lock,
+					  EXTENTS_BTREE_MUTEX);
+			hfs_btree_write(tree);
+			mutex_unlock(&tree->tree_lock);
 			return 0;
 		case HFS_CAT_CNID:
-			hfs_btree_write(HFS_SB(inode->i_sb)->cat_tree);
+			tree = HFS_SB(inode->i_sb)->cat_tree;
+			mutex_lock_nested(&tree->tree_lock,
+					  CATALOG_BTREE_MUTEX);
+			hfs_btree_write(tree);
+			mutex_unlock(&tree->tree_lock);
 			return 0;
 		default:
 			BUG();
-- 
2.43.0