From patchwork Fri Nov 11 09:02:12 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: ChenXiaoSong X-Patchwork-Id: 18553 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp623850wru; Fri, 11 Nov 2022 00:52:33 -0800 (PST) X-Google-Smtp-Source: AA0mqf7WG8lAcs+ly/4Co7EfbCmuA4T0+kZi5+44YUX66z5ScZThRoj5h6dGv1aX8rQMdEd9t4YK X-Received: by 2002:a17:902:8e81:b0:181:b55a:f987 with SMTP id bg1-20020a1709028e8100b00181b55af987mr1658066plb.67.1668156753482; Fri, 11 Nov 2022 00:52:33 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1668156753; cv=none; d=google.com; s=arc-20160816; b=t8Hu9gQT1scadMx7uAHHJOU5G0u9Bn4vQc7i+Arj6CiRWcyMr80NnWDHc//bSbhfkg iU7AWznPNEkNNyfJl7TMQGya5T42g2BUyEP+NYSzs1dRnaAz7Q3iY3xatoytU+OuQEOT Q8yYNO89ZAAiZuNPVx5Jpl9/uohYHpKhE4rzmoeKmuLafBs+nZoy6q0Maia9DuOosEUb QRRbZpNOVzz4fQxC3EkBp3B+prAapC/t8VxOb+Aq2lZYMqm7zUlGxQwrqYINtZs99Sz7 Wqeu7UkIsMyEKW/Qh1p3QLBphedw3NsLjYDQ1adroYgiwCvZSDI67uBG96u7+RBfG7An GpHg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=LyGeb+Iv8qvpHIrcy6iRBUjNL4shjhE4YIHFesIaPfw=; b=i2I1TrkejK7gYag9eR1Xl76UcC4pmciXGmifSgqNE1byU/WFEsPRc9M44+kEN/ehkQ quQ1s6aLPNeCRqEZhCsv7SvweBjeFx7X0Ci8BXoqGQ8NlGTaPANEafYQb0qQ5CrjjU0+ s1xA5/wQqwGjWPOVEBDC0FOHvMJYfQBWR+mnJeYlKqj2mW/wvI5DiAICEcN8kVM7hb4k 25+cjo2pHEpAjoKP8l1VSJEdOFNqQKXPdW8R1sWSjcwz3LfCuGzjjal3Av/+zS3PMq7V RcuS/SV0kjI/hEZ8TgiW/8R2NwF55f1HHirDh1ZusnSSR38bF1u+/N+3yLlvAGLyFdCk tdUw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id v17-20020aa799d1000000b0056cdb20de28si1662917pfi.320.2022.11.11.00.52.19; Fri, 11 Nov 2022 00:52:33 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233337AbiKKIrs (ORCPT + 99 others); Fri, 11 Nov 2022 03:47:48 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38134 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233256AbiKKIrr (ORCPT ); Fri, 11 Nov 2022 03:47:47 -0500 Received: from szxga08-in.huawei.com (szxga08-in.huawei.com [45.249.212.255]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AD98B79D00; Fri, 11 Nov 2022 00:47:45 -0800 (PST) Received: from dggemv703-chm.china.huawei.com (unknown [172.30.72.53]) by szxga08-in.huawei.com (SkyGuard) with ESMTP id 4N7slj12cgz15MVs; Fri, 11 Nov 2022 16:47:29 +0800 (CST) Received: from kwepemm600015.china.huawei.com (7.193.23.52) by dggemv703-chm.china.huawei.com (10.3.19.46) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Fri, 11 Nov 2022 16:47:43 +0800 Received: from huawei.com (10.175.101.6) by kwepemm600015.china.huawei.com (7.193.23.52) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Fri, 11 Nov 2022 16:47:43 +0800 From: ChenXiaoSong To: , , CC: , , , , Subject: [PATCH v2] btrfs: qgroup: fix sleep from invalid context bug in update_qgroup_limit_item() Date: Fri, 11 Nov 2022 17:02:12 +0800 Message-ID: <20221111090212.2266807-1-chenxiaosong2@huawei.com> X-Mailer: git-send-email 2.31.1 MIME-Version: 1.0 X-Originating-IP: [10.175.101.6] X-ClientProxiedBy: dggems701-chm.china.huawei.com (10.3.19.178) To kwepemm600015.china.huawei.com (7.193.23.52) X-CFilter-Loop: Reflected X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1749118782381037016?= X-GMAIL-MSGID: =?utf-8?q?1749189136292653383?= Syzkaller reported BUG as follows: BUG: sleeping function called from invalid context at include/linux/sched/mm.h:274 Call Trace: dump_stack_lvl+0xcd/0x134 __might_resched.cold+0x222/0x26b kmem_cache_alloc+0x2e7/0x3c0 update_qgroup_limit_item+0xe1/0x390 btrfs_qgroup_inherit+0x147b/0x1ee0 create_subvol+0x4eb/0x1710 btrfs_mksubvol+0xfe5/0x13f0 __btrfs_ioctl_snap_create+0x2b0/0x430 btrfs_ioctl_snap_create_v2+0x25a/0x520 btrfs_ioctl+0x2a1c/0x5ce0 __x64_sys_ioctl+0x193/0x200 do_syscall_64+0x35/0x80 Fix this by delaying the limit item updates until unlock the spin lock. Signed-off-by: ChenXiaoSong --- fs/btrfs/qgroup.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c index 9334c3157c22..2792d63c0da4 100644 --- a/fs/btrfs/qgroup.c +++ b/fs/btrfs/qgroup.c @@ -2860,6 +2860,7 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid, bool need_rescan = false; u32 level_size = 0; u64 nums; + bool update_limit = false; /* * There are only two callers of this function. @@ -2950,15 +2951,7 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid, dstgroup->max_excl = inherit->lim.max_excl; dstgroup->rsv_rfer = inherit->lim.rsv_rfer; dstgroup->rsv_excl = inherit->lim.rsv_excl; - - ret = update_qgroup_limit_item(trans, dstgroup); - if (ret) { - qgroup_mark_inconsistent(fs_info); - btrfs_info(fs_info, - "unable to update quota limit for %llu", - dstgroup->qgroupid); - goto unlock; - } + update_limit = true; } if (srcid) { @@ -2985,6 +2978,7 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid, dstgroup->max_excl = srcgroup->max_excl; dstgroup->rsv_rfer = srcgroup->rsv_rfer; dstgroup->rsv_excl = srcgroup->rsv_excl; + update_limit = true; qgroup_dirty(fs_info, dstgroup); qgroup_dirty(fs_info, srcgroup); @@ -3053,6 +3047,12 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid, unlock: spin_unlock(&fs_info->qgroup_lock); + if (update_limit && update_qgroup_limit_item(trans, dstgroup)) { + qgroup_mark_inconsistent(fs_info); + btrfs_info(fs_info, + "unable to update quota limit for %llu", + dstgroup->qgroupid); + } if (!ret) ret = btrfs_sysfs_add_one_qgroup(fs_info, dstgroup); out: