Filipe Manana
2e6e518335
Btrfs: fix block group ->space_info null pointer dereference ...
When we create a block group we add it to the rbtree of block groups
before setting its ->space_info field (while it's NULL). This is
problematic since other tasks can access the block group from the
rbtree and attempt to use its ->space_info before it is set by
btrfs_make_block_group().
This can happen for example when a concurrent fitrim ioctl operation
is ongoing, which produces a trace like the following when
CONFIG_DEBUG_PAGEALLOC is set.
[11509.604369] BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
[11509.606373] IP: [<ffffffff8107d675>] __lock_acquire+0xb4/0xf02
[11509.608179] PGD 2296a8067 PUD 22f4a2067 PMD 0
[11509.608179] Oops: 0000 [#1 ] PREEMPT SMP DEBUG_PAGEALLOC
[11509.608179] Modules linked in: btrfs crc32c_generic xor raid6_pq nfsd auth_rpcgss oid_registry nfs_acl nfs lockd grace fscache sunrpc loop fuse acpi_cpufreq processor i2c_piix4 psmou
[11509.608179] CPU: 10 PID: 8538 Comm: fstrim Tainted: G W 4.0.0-rc5-btrfs-next-9+ #2
[11509.608179] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5-0-ge51488c-20140602_164612-nilsson.home.kraxel.org 04/01/2014
[11509.608179] task: ffff88009f5c46d0 ti: ffff8801b3edc000 task.ti: ffff8801b3edc000
[11509.608179] RIP: 0010:[<ffffffff8107d675>] [<ffffffff8107d675>] __lock_acquire+0xb4/0xf02
[11509.608179] RSP: 0018:ffff8801b3edf9e8 EFLAGS: 00010002
[11509.608179] RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000000
[11509.608179] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000018
[11509.608179] RBP: ffff8801b3edfaa8 R08: 0000000000000001 R09: 0000000000000000
[11509.608179] R10: 0000000000000000 R11: ffff88009f5c4f98 R12: 0000000000000000
[11509.608179] R13: 0000000000000000 R14: 0000000000000018 R15: ffff88009f5c46d0
[11509.608179] FS: 00007f280a10e840(0000) GS:ffff88023ed40000(0000) knlGS:0000000000000000
[11509.608179] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[11509.608179] CR2: 0000000000000018 CR3: 00000002119bc000 CR4: 00000000000006e0
[11509.608179] Stack:
[11509.608179] 0000000000000000 0000000000000000 0000000000000004 0000000000000000
[11509.608179] ffff880100000000 ffffffff00000000 0000000000000001 ffffffff00000000
[11509.608179] 0000000000000001 0000000000000000 ffff880100000000 00000000000006c4
[11509.608179] Call Trace:
[11509.608179] [<ffffffff8107dc57>] ? __lock_acquire+0x696/0xf02
[11509.608179] [<ffffffff8107e806>] lock_acquire+0xa5/0x116
[11509.608179] [<ffffffffa04cc876>] ? do_trimming+0x51/0x145 [btrfs]
[11509.608179] [<ffffffff81434f37>] _raw_spin_lock+0x34/0x44
[11509.608179] [<ffffffffa04cc876>] ? do_trimming+0x51/0x145 [btrfs]
[11509.608179] [<ffffffffa04cc876>] do_trimming+0x51/0x145 [btrfs]
[11509.608179] [<ffffffffa04cde7d>] btrfs_trim_block_group+0x201/0x491 [btrfs]
[11509.608179] [<ffffffffa04849e2>] btrfs_trim_fs+0xe0/0x129 [btrfs]
[11509.608179] [<ffffffffa04bb80a>] btrfs_ioctl_fitrim+0x138/0x167 [btrfs]
[11509.608179] [<ffffffffa04c002f>] btrfs_ioctl+0x50d/0x21e8 [btrfs]
[11509.608179] [<ffffffff81123bda>] ? might_fault+0x58/0xb5
[11509.608179] [<ffffffff81123bda>] ? might_fault+0x58/0xb5
[11509.608179] [<ffffffff81123bda>] ? might_fault+0x58/0xb5
[11509.608179] [<ffffffff81158050>] ? cp_new_stat+0x147/0x15e
[11509.608179] [<ffffffff81163041>] do_vfs_ioctl+0x3c6/0x479
[11509.608179] [<ffffffff81158116>] ? SYSC_newfstat+0x25/0x2e
[11509.608179] [<ffffffff81435b54>] ? ret_from_sys_call+0x1d/0x58
[11509.608179] [<ffffffff8116b915>] ? __fget_light+0x2d/0x4f
[11509.608179] [<ffffffff8116314e>] SyS_ioctl+0x5a/0x7f
[11509.608179] [<ffffffff81435b32>] system_call_fastpath+0x12/0x17
[11509.608179] Code: f4 01 00 0f 85 c0 00 00 00 48 c7 c1 f3 1f 7d 81 48 c7 c2 aa cb 7c 81 be fc 0b 00 00 eb 70 83 3d 61 eb 9c 00 00 0f 84 a5 00 00 00 <49> 81 3e 40 a3 2b 82 b8 00 00 00
[11509.608179] RIP [<ffffffff8107d675>] __lock_acquire+0xb4/0xf02
[11509.608179] RSP <ffff8801b3edf9e8>
[11509.608179] CR2: 0000000000000018
[11509.608179] ---[ end trace 570a5c6769f0e49a ]---
Which corresponds to the following access in fs/btrfs/free-space-cache.c:
static int do_trimming(struct btrfs_block_group_cache *block_group,
u64 *total_trimmed, u64 start, u64 bytes,
u64 reserved_start, u64 reserved_bytes,
struct btrfs_trim_range *trim_entry)
{
struct btrfs_space_info *space_info = block_group->space_info;
(...)
spin_lock(&space_info->lock);
^^^^^ - block_group->space_info is NULL...
Fix this by ensuring the block group's ->space_info is set before adding
the block group to the rbtree.
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Chris Mason <clm@fb.com>
2015-06-02 19:34:36 -07:00
2015-04-26 17:22:07 -07:00
2015-04-26 17:22:07 -07:00
2015-04-26 17:22:07 -07:00
2015-04-15 15:06:57 -04:00
2015-04-15 15:06:57 -04:00
2015-04-26 17:22:07 -07:00
2015-04-26 17:22:07 -07:00
2015-06-02 19:34:36 -07:00
2015-04-15 15:06:59 -04:00
2015-04-26 17:22:07 -07:00
2015-05-20 13:25:55 -05:00
2015-04-15 15:06:57 -04:00
2015-05-05 17:10:11 -07:00
2015-04-26 17:22:07 -07:00
2015-04-15 15:06:57 -04:00
2015-01-18 01:03:45 -05:00
2015-04-15 15:06:57 -04:00
2015-05-06 10:57:37 -07:00
2015-04-15 15:06:57 -04:00
2015-04-15 15:06:57 -04:00
2015-02-22 11:38:41 -05:00
2015-04-26 17:22:07 -07:00
2015-04-26 17:22:07 -07:00
2015-05-15 00:24:10 -04:00
2015-05-04 14:15:16 -07:00
2015-04-26 17:22:07 -07:00
2015-04-15 15:06:57 -04:00
2015-04-15 15:06:57 -04:00
2015-04-26 17:22:07 -07:00
2015-04-26 17:22:07 -07:00
2015-04-26 17:22:07 -07:00
2015-05-04 14:50:29 +02:00
2015-04-15 15:06:57 -04:00
2015-04-15 15:06:57 -04:00
2015-04-26 17:22:07 -07:00
2015-04-15 15:06:57 -04:00
2015-05-14 19:11:50 -04:00
2015-04-26 17:22:07 -07:00
2015-04-26 17:22:07 -07:00
2015-05-14 17:55:51 -07:00
2015-04-21 16:16:02 -04:00
2015-04-15 15:06:57 -04:00
2015-04-15 15:06:57 -04:00
2015-04-15 15:06:57 -04:00
2015-05-13 14:56:06 -04:00
2015-05-04 12:02:42 -04:00
2015-05-05 17:10:11 -07:00
2015-03-12 18:46:08 -07:00
2015-04-15 15:06:57 -04:00
2015-05-05 17:10:11 -07:00
2015-05-28 18:25:19 -07:00
2015-05-19 14:30:12 +02:00
2015-04-26 17:22:07 -07:00
2015-04-26 17:22:07 -07:00
2015-04-15 15:06:57 -04:00
2015-04-26 17:22:07 -07:00
2015-04-15 15:06:57 -04:00
2015-04-26 17:22:07 -07:00
2015-04-11 22:29:40 -04:00
2015-04-15 15:06:57 -04:00
2015-03-25 13:27:57 +01:00
2015-04-15 15:06:57 -04:00
2015-02-03 12:48:43 -05:00
2015-04-26 17:22:07 -07:00
2015-04-26 17:22:07 -07:00
2015-04-15 15:06:57 -04:00
2015-05-29 08:14:55 +10:00
2015-04-16 23:27:56 -04:00
2015-02-20 04:03:58 -05:00
2015-05-28 18:25:18 -07:00
2014-12-13 12:42:51 -08:00
2015-04-26 17:22:07 -07:00
2014-12-13 12:42:51 -08:00
2015-04-24 15:45:28 -04:00
2015-04-14 16:49:01 -07:00
2015-01-20 14:02:58 -07:00
2015-04-03 23:21:34 +02:00
2015-04-11 22:29:39 -04:00
2015-04-26 17:22:07 -07:00
2015-05-28 23:45:30 -04:00
2015-04-24 15:45:28 -04:00
2015-02-12 18:54:09 -08:00
2015-02-17 14:34:52 -08:00
2015-02-13 21:21:40 -08:00
2015-05-12 22:03:44 +02:00
2015-01-08 15:10:52 -08:00
2015-04-11 22:29:43 -04:00
2015-04-17 09:04:07 -04:00
2015-04-09 11:39:55 -05:00
2015-03-17 12:23:32 -04:00
2015-04-24 15:45:28 -04:00
2015-02-22 11:38:42 -05:00
2015-02-10 14:30:30 -08:00
2015-04-10 15:08:35 -07:00
2015-04-14 16:49:05 -07:00
2015-04-15 15:06:58 -04:00
2015-04-17 09:04:12 -04:00
2015-04-14 10:22:29 -07:00
2015-01-25 23:17:29 -05:00
2015-05-09 00:12:48 -04:00
2015-05-09 11:55:50 -05:00
2015-04-15 15:06:58 -04:00
2015-04-24 07:08:41 -07:00
2015-04-15 15:06:58 -04:00
2015-04-02 20:34:20 -05:00
2015-04-09 11:39:55 -05:00
2015-04-15 15:06:59 -04:00
2015-02-05 02:45:00 -05:00
2015-04-11 22:29:46 -04:00
2015-02-12 18:54:12 -08:00
2015-02-13 21:21:39 -08:00
2015-05-06 09:27:41 -06:00
2015-04-15 15:06:59 -04:00
2015-04-14 16:49:03 -07:00
2015-02-05 02:45:00 -05:00
2e6e518335