From: David Sterba <dsterba@suse.com>
To: linux-btrfs@vger.kernel.org
Cc: anand.jain@oracle.com, David Sterba <dsterba@suse.com>
Subject: [PATCH 7/7] btrfs: fix mount and ioctl device scan ioctl race
Date: Wed, 20 Jun 2018 19:51:42 +0200 [thread overview]
Message-ID: <4c223e9ba6d3ab54f9b41678bade731e5554d0a6.1529516229.git.dsterba@suse.com> (raw)
In-Reply-To: <cover.1529516226.git.dsterba@suse.com>
Technically this extends the critical section covered by uuid_mutex to:
- parse early mount options -- here we can call device scan on paths
that can be passed as 'device=/dev/...'
- scan the device passed to mount
- open the devices related to the fs_devices -- this increases
fs_devices::opened
The race can happen when mount calls one of the scans and there's
another one called eg. by mkfs or 'btrfs dev scan':
Mount Scan
----- ----
scan_one_device (dev1, fsid1)
scan_one_device (dev2, fsid2)
add the device
free stale devices
fsid1 fs_devices::opened == 0
find fsid1:dev1
free fsid1:dev1
if it's the last one,
free fs_devices of fsid1
too
open_devices (dev1, fsid1)
dev1 not found
When fixed, the uuid mutex will make sure that mount will increase
fs_devices::opened and this will not be touched by the racing scan
ioctl.
Reported-and-tested-by: syzbot+909a5177749d7990ffa4@syzkaller.appspotmail.com
Reported-and-tested-by: syzbot+ceb2606025ec1cc3479c@syzkaller.appspotmail.com
Signed-off-by: David Sterba <dsterba@suse.com>
---
fs/btrfs/super.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 1780eb41f203..b13b871bc584 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -1557,19 +1557,19 @@ static struct dentry *btrfs_mount_root(struct file_system_type *fs_type,
mutex_lock(&uuid_mutex);
error = btrfs_parse_early_options(data, mode, fs_type, &fs_devices);
- mutex_unlock(&uuid_mutex);
- if (error)
+ if (error) {
+ mutex_unlock(&uuid_mutex);
goto error_fs_info;
+ }
- mutex_lock(&uuid_mutex);
error = btrfs_scan_one_device(device_name, mode, fs_type, &fs_devices);
- mutex_unlock(&uuid_mutex);
- if (error)
+ if (error) {
+ mutex_unlock(&uuid_mutex);
goto error_fs_info;
+ }
fs_info->fs_devices = fs_devices;
- mutex_lock(&uuid_mutex);
error = btrfs_open_devices(fs_devices, mode, fs_type);
mutex_unlock(&uuid_mutex);
if (error)
--
2.17.0
next prev parent reply other threads:[~2018-06-20 17:54 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-06-20 17:51 [PATCH 0/7] Fix locking when scanning devices David Sterba
2018-06-20 17:51 ` [PATCH 1/7] btrfs: restore uuid_mutex in btrfs_open_devices David Sterba
2018-07-04 8:09 ` Anand Jain
2018-07-13 12:49 ` David Sterba
2018-06-20 17:51 ` [PATCH 2/7] btrfs: extend critical section when scanning a new device David Sterba
2018-06-26 7:34 ` Anand Jain
2018-07-04 8:18 ` Anand Jain
2018-07-13 12:55 ` David Sterba
2018-06-20 17:51 ` [PATCH 3/7] btrfs: lift uuid_mutex to callers of btrfs_scan_one_device David Sterba
2018-07-04 8:19 ` Anand Jain
2018-06-20 17:51 ` [PATCH 4/7] btrfs: lift uuid_mutex to callers of btrfs_open_devices David Sterba
2018-07-04 8:19 ` Anand Jain
2018-06-20 17:51 ` [PATCH 5/7] btrfs: lift uuid_mutex to callers of btrfs_parse_early_options David Sterba
2018-07-04 8:20 ` Anand Jain
2018-06-20 17:51 ` [PATCH 6/7] btrfs: reorder initialization before the mount locks uuid_mutex David Sterba
2018-07-04 8:21 ` Anand Jain
2018-06-20 17:51 ` David Sterba [this message]
2018-06-26 9:33 ` [PATCH 7/7] btrfs: fix mount and ioctl device scan ioctl race Anand Jain
2018-07-04 8:22 ` Anand Jain
2018-06-21 7:48 ` [PATCH 0/7] Fix locking when scanning devices Nikolay Borisov
2018-06-22 11:39 ` David Sterba
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4c223e9ba6d3ab54f9b41678bade731e5554d0a6.1529516229.git.dsterba@suse.com \
--to=dsterba@suse.com \
--cc=anand.jain@oracle.com \
--cc=linux-btrfs@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.