From patchwork Wed Oct 19 08:23:27 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 4586 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4ac7:0:0:0:0:0 with SMTP id y7csp206000wrs; Wed, 19 Oct 2022 01:51:13 -0700 (PDT) X-Google-Smtp-Source: AMsMyM4vMC70v+fCDAZCE6FfbfRGFJZ7IlpnJo6vuK9Y1mKDy0677HVae30SjomvB9S6TW6tqjgT X-Received: by 2002:a05:6a00:cce:b0:565:cbe0:16c6 with SMTP id b14-20020a056a000cce00b00565cbe016c6mr7545159pfv.56.1666169472739; Wed, 19 Oct 2022 01:51:12 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666169472; cv=none; d=google.com; s=arc-20160816; b=ioPYwWqQMy50Gu4JJoBYI2lLtwso38Cvw7ZSAqpSue92FxeDbvgDijN0NKMs8MaFPk r6Pgv0Uwch/Xf68HSYKQqWDFLg6R0DRvoybU7lz3Dc02DtYgXuAg1bKHsDne9ZIEID5k 5YOIZ5ELiL5DfN3bZzRByCISDAaojidaA5WJko0Fq7RGz9R4n78uSPxsnPShe9or8k2G /otUoCSxQxSpb7YVJ5onBES91k8lEBPD0usQ32TnByIr26mevzWXHDt837tFLHzw8rvi k8vMiwIfXzLiIUchRky+sKnwQYsEAOpYblqoXhknFLNdWTDdSM91pfQKa/5YeI6kOnh9 J7kQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=bo/eZhqN7ddbxQAWAgRCEo+12zdQ1aGVpJ+QWM5IQu0=; b=o9W6h6HTNTqDUPY/GMqYiwlNiaqvU/KwkqyfIcDS+9Ov3B4RqurU7CMeaiE064IWwr ry1FFnofAqnQOJAnNUSqW0TtjBAoM7nLL5JgE1ap6QYQtxWz08+KP/UhUqndlOyJ0/rR RLVDzMYea6vcyQW3Hckk8tFMjW+z0vfSEcg5L51ta9bcghOTLka8qPyuVqJ8Q9K5XIlz 9iDXcVYr3SeG7+gJ0xtI6YPjIMkQ7sOxyb53IP14Zo4Y7iq+sPeRHLDgpmHQVTVlquzL 2KR0V6redwo7moUczacILheNSJsOEPP+EiAhhmmLJxWwAj502rsUXY/WUzkDXa/yqPqC GK0w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=E02MFpIt; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id 4-20020a630304000000b0045466b00436si17036939pgd.702.2022.10.19.01.51.00; Wed, 19 Oct 2022 01:51:12 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=E02MFpIt; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231433AbiJSIup (ORCPT + 99 others); Wed, 19 Oct 2022 04:50:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59504 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231190AbiJSIsn (ORCPT ); Wed, 19 Oct 2022 04:48:43 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8B6858A7CC; Wed, 19 Oct 2022 01:46:38 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D9F88B822E8; Wed, 19 Oct 2022 08:43:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5160EC433D6; Wed, 19 Oct 2022 08:43:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666168984; bh=J3hY5Ke9dVOuH+qLSGit5n24qZH/9BcKbPIcxeJC+gA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=E02MFpItxfWQV/ySY/R0dnXBKrftwD8opc2f+5/PPlLJomyyV0v/SVHCP+ZvNTgTv 3oD4CjygG3Zye6dzqqZhsHK3mLu8zzHse+GDs3TgY4PIZlzMKgrGKSWvjxlSnF6F+y P/I/L4BCrsSrpwOwDssvmIAdFrDbZkH+Ga/Kn8QE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ye Bin , Qu Wenruo , Filipe Manana , David Sterba Subject: [PATCH 6.0 120/862] btrfs: fix race between quota enable and quota rescan ioctl Date: Wed, 19 Oct 2022 10:23:27 +0200 Message-Id: <20221019083255.255485433@linuxfoundation.org> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20221019083249.951566199@linuxfoundation.org> References: <20221019083249.951566199@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.4 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747105321170942360?= X-GMAIL-MSGID: =?utf-8?q?1747105321170942360?= From: Filipe Manana commit 331cd9461412e103d07595a10289de90004ac890 upstream. When enabling quotas, at btrfs_quota_enable(), after committing the transaction, we change fs_info->quota_root to point to the quota root we created and set BTRFS_FS_QUOTA_ENABLED at fs_info->flags. Then we try to start the qgroup rescan worker, first by initializing it with a call to qgroup_rescan_init() - however if that fails we end up freeing the quota root but we leave fs_info->quota_root still pointing to it, this can later result in a use-after-free somewhere else. We have previously set the flags BTRFS_FS_QUOTA_ENABLED and BTRFS_QGROUP_STATUS_FLAG_ON, so we can only fail with -EINPROGRESS at btrfs_quota_enable(), which is possible if someone already called the quota rescan ioctl, and therefore started the rescan worker. So fix this by ignoring an -EINPROGRESS and asserting we can't get any other error. Reported-by: Ye Bin Link: https://lore.kernel.org/linux-btrfs/20220823015931.421355-1-yebin10@huawei.com/ CC: stable@vger.kernel.org # 4.19+ Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba Signed-off-by: Greg Kroah-Hartman --- fs/btrfs/qgroup.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) --- a/fs/btrfs/qgroup.c +++ b/fs/btrfs/qgroup.c @@ -1174,6 +1174,21 @@ out_add_root: fs_info->qgroup_rescan_running = true; btrfs_queue_work(fs_info->qgroup_rescan_workers, &fs_info->qgroup_rescan_work); + } else { + /* + * We have set both BTRFS_FS_QUOTA_ENABLED and + * BTRFS_QGROUP_STATUS_FLAG_ON, so we can only fail with + * -EINPROGRESS. That can happen because someone started the + * rescan worker by calling quota rescan ioctl before we + * attempted to initialize the rescan worker. Failure due to + * quotas disabled in the meanwhile is not possible, because + * we are holding a write lock on fs_info->subvol_sem, which + * is also acquired when disabling quotas. + * Ignore such error, and any other error would need to undo + * everything we did in the transaction we just committed. + */ + ASSERT(ret == -EINPROGRESS); + ret = 0; } out_free_path: