From patchwork Sat May 27 01:40:17 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ye Bin X-Patchwork-Id: 99737 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp70645vqr; Fri, 26 May 2023 18:43:39 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ7LmvZgA9pDEH5TnvBLP9hNNk884guWtRIJTJbvG2YC2WgGGQQOoAEuhNOMj4yMvhZq0C0R X-Received: by 2002:a17:903:1209:b0:1af:e2e2:2bd9 with SMTP id l9-20020a170903120900b001afe2e22bd9mr5264898plh.17.1685151819434; Fri, 26 May 2023 18:43:39 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1685151819; cv=none; d=google.com; s=arc-20160816; b=W15Ma0LsNXxmZU8JQqfMbskAL90mXrOda2+Y92ajG5pK7/RP0di/zOND7JFgdt4FN2 6qcR7G0gQpyZj62H6SuIeI1/mpVZ22EKwj72E7Gzp+Nd7fWH3OPUg4sdAJwFjJqqZoMZ EQkC4PQl+H+2UOcqg8PXT410ZMEWnzXdrPHHgXK4WM5HIsRm7/8QVfF9rN2fvWEHvl5n 1Ef0SzToKPQyIkZwGc/HJYongjmdHYzV8Nl5RQz0ha+o4cXM8HKOjPTOosvTZz7LhJfD zwI0bgIowsLfKoXma1kjlXPvkr9vs5b0yM8zZpZ4m8DXm+0n7ce9i51szInSCp9t31u2 5c6Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=wUFxIyQ38KnQa3kynjNjRSeE4Eme8yDb31PM0hFTaLc=; b=jC7nlXdC2bctw5lWZbHxO5Vou4NmVTtKkrraP9jfceE17zul5gI5ZMsks68eM4Ckc9 fJtsSFQGkEYa4Ar2le2jn7cULz8xuPt/W4X9fAHi07vlnAd8YYQBfziwd/yHytBtfeGs 4mYcbBoeBXJlsZuyRFZl8MJYiARqOCw2Dat/8ARW1ror5l1gke55papzR6r4SBYbMVbQ ccLwBJYKNeQLrBWrC7gqckpHveUfTkpkJEGlDNiugFx6QlRvSzKkVYa7ymHp+1vULSUl bB27N+Gzh5BiCzBdbsUhv2WFe+yk7uFKNgxl//sHhg4iq4mHMcVZq6R4SSi12ka+kjl/ SRsg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id o13-20020a170902d4cd00b001aaffa9923asi5838127plg.306.2023.05.26.18.43.25; Fri, 26 May 2023 18:43:39 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238336AbjE0BmD (ORCPT + 99 others); Fri, 26 May 2023 21:42:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35162 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230414AbjE0BmB (ORCPT ); Fri, 26 May 2023 21:42:01 -0400 Received: from szxga08-in.huawei.com (szxga08-in.huawei.com [45.249.212.255]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F160AF3 for ; Fri, 26 May 2023 18:41:58 -0700 (PDT) Received: from canpemm500010.china.huawei.com (unknown [172.30.72.54]) by szxga08-in.huawei.com (SkyGuard) with ESMTP id 4QSktX5hpMz18Ldx; Sat, 27 May 2023 09:37:24 +0800 (CST) Received: from huawei.com (10.175.127.227) by canpemm500010.china.huawei.com (7.192.105.118) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.23; Sat, 27 May 2023 09:41:57 +0800 From: Ye Bin To: , CC: , Subject: [PATCH 1/2] quota: fix null-ptr-deref in ext4_acquire_dquot() Date: Sat, 27 May 2023 09:40:17 +0800 Message-ID: <20230527014018.47396-2-yebin10@huawei.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20230527014018.47396-1-yebin10@huawei.com> References: <20230527014018.47396-1-yebin10@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.175.127.227] X-ClientProxiedBy: dggems706-chm.china.huawei.com (10.3.19.183) To canpemm500010.china.huawei.com (7.192.105.118) X-CFilter-Loop: Reflected X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1767009754539051366?= X-GMAIL-MSGID: =?utf-8?q?1767009754539051366?= Syzbot found the following issue: Unable to handle kernel paging request at virtual address dfff800000000005 KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 [dfff800000000005] address between user and kernel address ranges Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 6080 Comm: syz-executor747 Not tainted 6.3.0-rc7-syzkaller-g14f8db1c0f9a #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : ext4_acquire_dquot+0x1d4/0x398 fs/ext4/super.c:6766 lr : dquot_to_inode fs/ext4/super.c:6740 [inline] lr : ext4_acquire_dquot+0x1ac/0x398 fs/ext4/super.c:6766 sp : ffff80001eb27280 x29: ffff80001eb27280 x28: 1fffe0001c3c01fc x27: ffff800015d705b0 x26: ffff0000dd93c000 x25: ffff0000dd93e000 x24: 1fffe0001c3c021c x23: dfff800000000000 x22: 0000000000000049 x21: 0000000000000028 x20: 0000000000000000 x19: ffff0000e1e00fc0 x18: ffff0001b426cca8 x17: 0000000000000000 x16: ffff8000089669b0 x15: 0000000000000001 x14: 1ffff00002bae0b0 x13: dfff800000000000 x12: 0000000000000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : 0000000000000005 x7 : ffff800008c11f68 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800012441b4c x2 : 0000000000000001 x1 : 0000000000000001 x0 : 0000000000000003 Call trace: ext4_acquire_dquot+0x1d4/0x398 fs/ext4/super.c:6766 dqget+0x844/0xc48 fs/quota/dquot.c:914 __dquot_initialize+0x2cc/0xb54 fs/quota/dquot.c:1492 dquot_initialize fs/quota/dquot.c:1550 [inline] dquot_file_open+0x90/0xc8 fs/quota/dquot.c:2181 ext4_file_open+0x230/0x590 fs/ext4/file.c:903 do_dentry_open+0x724/0xf90 fs/open.c:920 vfs_open+0x7c/0x90 fs/open.c:1051 do_open fs/namei.c:3560 [inline] path_openat+0x1f2c/0x27f8 fs/namei.c:3715 do_filp_open+0x1bc/0x3cc fs/namei.c:3742 do_sys_openat2+0x128/0x3d8 fs/open.c:1348 do_sys_open fs/open.c:1364 [inline] __do_sys_openat fs/open.c:1380 [inline] __se_sys_openat fs/open.c:1375 [inline] __arm64_sys_openat+0x1f0/0x240 fs/open.c:1375 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:193 el0_svc+0x4c/0x15c arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591 Code: 97e8a7df f94002a8 9100a115 d343fea8 (38776908) ---[ end trace 0000000000000000 ]--- Above issue may happens as follows: ProcessA ProcessB ProcessC sys_fsconfig vfs_fsconfig_locked reconfigure_super ext4_remount dquot_suspend -> suspend all type quota sys_fsconfig vfs_fsconfig_locked reconfigure_super ext4_remount dquot_resume ret = dquot_load_quota_sb add_dquot_ref do_open -> open file O_RDWR vfs_open do_dentry_open get_write_access atomic_inc_unless_negative(&inode->i_writecount) ext4_file_open dquot_file_open dquot_initialize __dquot_initialize dqget if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) __dquot_initialize __dquot_initialize dqget if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) ext4_acquire_dquot -> Return error if (ret < 0) vfs_cleanup_quota_inode dqopt->files[type] = NULL; ext4_acquire_dquot -->dquot_to_inode(dquot) is NULL To solve above issue, if quota has been loaded, there's unneed to cleaup quota inode if dquot_load_quota_sb() return failed when do dquot_resume(); Reported-by: syzbot+e633c79ceaecbf479854@syzkaller.appspotmail.com Signed-off-by: Ye Bin --- fs/quota/dquot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c index ffd40dc3e4e9..4b913faa48ec 100644 --- a/fs/quota/dquot.c +++ b/fs/quota/dquot.c @@ -2476,7 +2476,7 @@ int dquot_resume(struct super_block *sb, int type) flags = dquot_generic_flag(flags, cnt); ret = dquot_load_quota_sb(sb, cnt, dqopt->info[cnt].dqi_fmt_id, flags); - if (ret < 0) + if (ret < 0 && !sb_has_quota_loaded(sb, cnt)) vfs_cleanup_quota_inode(sb, cnt); } From patchwork Sat May 27 01:40:18 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ye Bin X-Patchwork-Id: 99747 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp75698vqr; Fri, 26 May 2023 18:58:51 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ6Aro1kLY2P0s0TFO9DII9rkYlbMk089gTBaUnaFZOb6/t4MDJdDfKbgJr1GpKgkHx0kbs/ X-Received: by 2002:a05:6a00:2e02:b0:64d:68dc:b942 with SMTP id fc2-20020a056a002e0200b0064d68dcb942mr7645191pfb.7.1685152731077; Fri, 26 May 2023 18:58:51 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1685152731; cv=none; d=google.com; s=arc-20160816; b=DzxsWpLLebz71WRGpLkFJmsvf+KCsZlnbj0kahd7aJQTq28ZrFtd4bWtLiVkUJrFuB 0Gtgg2Iyjst5iNSgAV4d09ZI/wEN6Bj8w4lYLtscSdroJXyd9EgprDuJi9zxLS9zR2iz 3yZVII9J6rHuyH8qww8QVIzAi5vyU3Sj1VtWDsufbVXtAHw7KDHLXXzYgaC55ijyF9S2 lmXPuwRXW83w9A0Qmn608iBkjkjOoNsWA2iXEKiiwX2jN+RyqtWxuONjVmMB4Z5Y9u5o aPEe/xoyQkcIi/ooF8FXPoZa2+lmGImmGkliN0ND/B6xVBVl0a8o/XVZwVeVVCLfviRj LjCw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=zV3yEQ/sIlNz0A+Gg187/Q5GR6zz7TuyVYbBzxkAZhk=; b=l7Fv5ncBfY8P9nLr86jbKopvXfS5ZjhZ/ZGcuNcwcdHpbZ3M0MTmospxde9YI5M3bu 3nllCXDKeDrwCmD6YBs9SYoPtdOmyZxVOwhCaHZinsgO4ObgqUVBGrspXnI9Ewg956Ez 0NglGxp+xFnMwkR9vGQfYd+B/+AfKz4BrRaMkwDZUo6e2xFenZs7y70rnJ/vhpEKRAMe IQpookizIXucQoVISZcN//ilhYLXJzQHrQT+ZsBfcA/nzt6oQJwB06kmpdZszYFBTbvO jlnRLB8nTBsCJ6X+3l7oOplvMucWjcdzxGBrjIAFzbM2mCIn2gf9kjgmJSMSPD/gzZB2 vWZQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id k24-20020aa79738000000b00643c4d0d0f5si3124353pfg.39.2023.05.26.18.58.37; Fri, 26 May 2023 18:58:51 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241965AbjE0BmF (ORCPT + 99 others); Fri, 26 May 2023 21:42:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35164 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230179AbjE0BmB (ORCPT ); Fri, 26 May 2023 21:42:01 -0400 Received: from szxga03-in.huawei.com (szxga03-in.huawei.com [45.249.212.189]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CBA7AFB for ; Fri, 26 May 2023 18:41:59 -0700 (PDT) Received: from canpemm500010.china.huawei.com (unknown [172.30.72.56]) by szxga03-in.huawei.com (SkyGuard) with ESMTP id 4QSky26JXzzLmPR; Sat, 27 May 2023 09:40:26 +0800 (CST) Received: from huawei.com (10.175.127.227) by canpemm500010.china.huawei.com (7.192.105.118) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.23; Sat, 27 May 2023 09:41:57 +0800 From: Ye Bin To: , CC: Subject: [PATCH 2/2] quota: fix warning in dqgrab() Date: Sat, 27 May 2023 09:40:18 +0800 Message-ID: <20230527014018.47396-3-yebin10@huawei.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20230527014018.47396-1-yebin10@huawei.com> References: <20230527014018.47396-1-yebin10@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.175.127.227] X-ClientProxiedBy: dggems706-chm.china.huawei.com (10.3.19.183) To canpemm500010.china.huawei.com (7.192.105.118) X-CFilter-Loop: Reflected X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1767010710107137643?= X-GMAIL-MSGID: =?utf-8?q?1767010710107137643?= There's issue as follows when do fault injection: WARNING: CPU: 1 PID: 14870 at include/linux/quotaops.h:51 dquot_disable+0x13b7/0x18c0 Modules linked in: CPU: 1 PID: 14870 Comm: fsconfig Not tainted 6.3.0-next-20230505-00006-g5107a9c821af-dirty #541 RIP: 0010:dquot_disable+0x13b7/0x18c0 RSP: 0018:ffffc9000acc79e0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88825e41b980 RDX: 0000000000000000 RSI: ffff88825e41b980 RDI: 0000000000000002 RBP: ffff888179f68000 R08: ffffffff82087ca7 R09: 0000000000000000 R10: 0000000000000001 R11: ffffed102f3ed026 R12: ffff888179f68130 R13: ffff888179f68110 R14: dffffc0000000000 R15: ffff888179f68118 FS: 00007f450a073740(0000) GS:ffff88882fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe96f2efd8 CR3: 000000025c8ad000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: dquot_load_quota_sb+0xd53/0x1060 dquot_resume+0x172/0x230 ext4_reconfigure+0x1dc6/0x27b0 reconfigure_super+0x515/0xa90 __x64_sys_fsconfig+0xb19/0xd20 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd Above issue may happens as follows: ProcessA ProcessB ProcessC sys_fsconfig vfs_fsconfig_locked reconfigure_super ext4_remount dquot_suspend -> suspend all type quota sys_fsconfig vfs_fsconfig_locked reconfigure_super ext4_remount dquot_resume ret = dquot_load_quota_sb add_dquot_ref do_open -> open file O_RDWR vfs_open do_dentry_open get_write_access atomic_inc_unless_negative(&inode->i_writecount) ext4_file_open dquot_file_open dquot_initialize __dquot_initialize dqget atomic_inc(&dquot->dq_count); __dquot_initialize __dquot_initialize dqget if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) ext4_acquire_dquot -> Return error DQ_ACTIVE_B flag isn't set dquot_disable invalidate_dquots if (atomic_read(&dquot->dq_count)) dqgrab WARN_ON_ONCE(!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) -> Trigger warning In the above scenario, 'dquot->dq_flags' has no DQ_ACTIVE_B is normal when dqgrab(). So just remove 'WARN_ON_ONCE(!test_bit(DQ_ACTIVE_B, &dquot->dq_flags))' in dqgrab(). Signed-off-by: Ye Bin --- include/linux/quotaops.h | 1 - 1 file changed, 1 deletion(-) diff --git a/include/linux/quotaops.h b/include/linux/quotaops.h index 11a4becff3a9..cb5e4c11e503 100644 --- a/include/linux/quotaops.h +++ b/include/linux/quotaops.h @@ -48,7 +48,6 @@ static inline struct dquot *dqgrab(struct dquot *dquot) { /* Make sure someone else has active reference to dquot */ WARN_ON_ONCE(!atomic_read(&dquot->dq_count)); - WARN_ON_ONCE(!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)); atomic_inc(&dquot->dq_count); return dquot; }