David Sterba 760d0077ab btrfs: fix mount and ioctl device scan ioctl race
[ Upstream commit 81ffd56b5745355b70d54ca4e1bdd0d64a66ff9f ]

Technically this extends the critical section covered by uuid_mutex to:

- parse early mount options -- here we can call device scan on paths
  that can be passed as 'device=/dev/...'

- scan the device passed to mount

- open the devices related to the fs_devices -- this increases
  fs_devices::opened

The race can happen when mount calls one of the scans and there's
another one called eg. by mkfs or 'btrfs dev scan':

Mount                                  Scan
-----                                  ----
scan_one_device (dev1, fsid1)
                                       scan_one_device (dev2, fsid1)
				           add the device
					   free stale devices
					       fsid1 fs_devices::opened == 0
					           find fsid1:dev1
					           free fsid1:dev1
					           if it's the last one,
					            free fs_devices of fsid1
						    too

open_devices (dev1, fsid1)
   dev1 not found

When fixed, the uuid mutex will make sure that mount will increase
fs_devices::opened and this will not be touched by the racing scan
ioctl.

Reported-and-tested-by: syzbot+909a5177749d7990ffa4@syzkaller.appspotmail.com
Reported-and-tested-by: syzbot+ceb2606025ec1cc3479c@syzkaller.appspotmail.com
Reviewed-by: Anand Jain <anand.jain@oracle.com>
Signed-off-by: David Sterba <dsterba@suse.com>

Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-09-15 09:46:57 +02:00
..
2018-06-11 10:16:13 -07:00
2018-06-15 07:55:24 +09:00
2018-09-15 09:46:46 +02:00
2018-05-22 14:27:52 -04:00
2018-05-22 14:27:52 -04:00
2018-05-22 14:27:53 -04:00
2018-06-15 18:11:26 -03:00
2018-07-27 12:51:00 -07:00
2018-06-07 17:34:40 -07:00
2018-06-05 19:23:26 +02:00
2018-06-08 17:21:52 -07:00
2018-06-07 17:34:35 -07:00
2018-05-03 16:11:37 -06:00
2018-06-11 08:22:34 -07:00
2018-09-09 10:32:41 +02:00