[PATCH] f2fs: fix deadlock in f2f2_add_dentry

[Lizhi Xu <lizhi.xu@xxxxxxxxxxxxx>]

There are two paths:
1. f2fs_add_dentry->f2fs_down_read->f2fs_add_inline_entry->down_write->
   up_write->f2fs_up_read
2. f2fs_add_dentry->f2fs_add_regular_entry->down_write->
   f2fs_init_inode_metadata->f2fs_down_read->f2fs_up_read->up_write

Force order lock to read->write.

Signed-off-by: Lizhi Xu <lizhi.xu@xxxxxxxxxxxxx>
Reported-and-tested-by: syzbot+a4976ce949df66b1ddf1@xxxxxxxxxxxxxxxxxxxxxxxxx
---
 fs/f2fs/dir.c    | 4 +---
 fs/f2fs/inline.c | 2 ++
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
index d635c58cf5a3..022dc02c1390 100644
--- a/fs/f2fs/dir.c
+++ b/fs/f2fs/dir.c
@@ -736,12 +736,12 @@ int f2fs_add_regular_entry(struct inode *dir, const struct f2fs_filename *fname,
 	f2fs_wait_on_page_writeback(dentry_page, DATA, true, true);
 
 	if (inode) {
-		f2fs_down_write(&F2FS_I(inode)->i_sem);
 		page = f2fs_init_inode_metadata(inode, dir, fname, NULL);
 		if (IS_ERR(page)) {
 			err = PTR_ERR(page);
 			goto fail;
 		}
+		f2fs_down_write(&F2FS_I(inode)->i_sem);
 	}
 
 	make_dentry_ptr_block(NULL, &d, dentry_blk);
@@ -780,9 +780,7 @@ int f2fs_add_dentry(struct inode *dir, const struct f2fs_filename *fname,
 		 * Should get i_xattr_sem to keep the lock order:
 		 * i_xattr_sem -> inode_page lock used by f2fs_setxattr.
 		 */
-		f2fs_down_read(&F2FS_I(dir)->i_xattr_sem);
 		err = f2fs_add_inline_entry(dir, fname, inode, ino, mode);
-		f2fs_up_read(&F2FS_I(dir)->i_xattr_sem);
 	}
 	if (err == -EAGAIN)
 		err = f2fs_add_regular_entry(dir, fname, inode, ino, mode);
diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
index 4638fee16a91..7618b383c2b7 100644
--- a/fs/f2fs/inline.c
+++ b/fs/f2fs/inline.c
@@ -628,10 +628,12 @@ int f2fs_add_inline_entry(struct inode *dir, const struct f2fs_filename *fname,
 	if (IS_ERR(ipage))
 		return PTR_ERR(ipage);
 
+	f2fs_down_read(&F2FS_I(dir)->i_xattr_sem);
 	inline_dentry = inline_data_addr(dir, ipage);
 	make_dentry_ptr_inline(dir, &d, inline_dentry);
 
 	bit_pos = f2fs_room_for_filename(d.bitmap, slots, d.max);
+	f2fs_up_read(&F2FS_I(dir)->i_xattr_sem);
 	if (bit_pos >= d.max) {
 		err = do_convert_inline_dir(dir, ipage, inline_dentry);
 		if (err)
-- 
2.25.1