Commit 2a8061ee authored Jul 02, 2025 by Al Viro

better lockdep annotations for simple_recursive_removal()



We want a class that nests outside of I_MUTEX_NORMAL (for the sake of
callbacks that might want to lock the victim) and inside I_MUTEX_PARENT
(so that a variant of that could be used with parent of the victim
held locked by the caller).

In reality, simple_recursive_removal()
	* never holds two locks at once
	* holds the lock on parent of dentry passed to callback
	* is used only on the trees with fixed topology, so the depths
are not changing.

So the locking order is actually fine.

AFAICS, the best solution is to assign I_MUTEX_CHILD to the locks
grabbed by that thing.

Reported-by:  <syzbot+169de184e9defe7fe709@syzkaller.appspotmail.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

parent 61c5d53e

fs/libfs.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -613,7 +613,7 @@ void simple_recursive_removal(struct dentry *dentry,
		struct dentry victim = NULL, child;
		struct inode *inode = this->d_inode;

		inode_lock(inode);
		inode_lock_nested(inode, I_MUTEX_CHILD);
		if (d_is_dir(this))
		inode->i_flags \|= S_DEAD;
		while ((child = find_next_child(this, victim)) == NULL) {
		@@ -625,7 +625,7 @@ void simple_recursive_removal(struct dentry *dentry,
		victim = this;
		this = this->d_parent;
		inode = this->d_inode;
		inode_lock(inode);
		inode_lock_nested(inode, I_MUTEX_CHILD);
		if (simple_positive(victim)) {
		d_invalidate(victim); // avoid lost mounts
		if (callback)