iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/fs/btrfs
History
Filipe Manana b31cb5a6eb btrfs: fix race when deleting quota root from the dirty cow roots list 
When disabling quotas we are deleting the quota root from the list
fs_info->dirty_cowonly_roots without taking the lock that protects it,
which is struct btrfs_fs_info::trans_lock. This unsynchronized list
manipulation may cause chaos if there's another concurrent manipulation
of this list, such as when adding a root to it with
ctree.c:add_root_to_dirty_list().

This can result in all sorts of weird failures caused by a race, such as
the following crash:

  [337571.278245] general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] PREEMPT SMP PTI
  [337571.278933] CPU: 1 PID: 115447 Comm: btrfs Tainted: G        W          6.4.0-rc6-btrfs-next-134+ #1
  [337571.279153] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
  [337571.279572] RIP: 0010:commit_cowonly_roots+0x11f/0x250 [btrfs]
  [337571.279928] Code: 85 38 06 00 (...)
  [337571.280363] RSP: 0018:ffff9f63446efba0 EFLAGS: 00010206
  [337571.280582] RAX: ffff942d98ec2638 RBX: ffff9430b82b4c30 RCX: 0000000449e1c000
  [337571.280798] RDX: dead000000000100 RSI: ffff9430021e4900 RDI: 0000000000036070
  [337571.281015] RBP: ffff942d98ec2000 R08: ffff942d98ec2000 R09: 000000000000015b
  [337571.281254] R10: 0000000000000009 R11: 0000000000000001 R12: ffff942fe8fbf600
  [337571.281476] R13: ffff942dabe23040 R14: ffff942dabe20800 R15: ffff942d92cf3b48
  [337571.281723] FS:  00007f478adb7340(0000) GS:ffff94349fa40000(0000) knlGS:0000000000000000
  [337571.281950] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  [337571.282184] CR2: 00007f478ab9a3d5 CR3: 000000001e02c001 CR4: 0000000000370ee0
  [337571.282416] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  [337571.282647] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  [337571.282874] Call Trace:
  [337571.283101]  <TASK>
  [337571.283327]  ? __die_body+0x1b/0x60
  [337571.283570]  ? die_addr+0x39/0x60
  [337571.283796]  ? exc_general_protection+0x22e/0x430
  [337571.284022]  ? asm_exc_general_protection+0x22/0x30
  [337571.284251]  ? commit_cowonly_roots+0x11f/0x250 [btrfs]
  [337571.284531]  btrfs_commit_transaction+0x42e/0xf90 [btrfs]
  [337571.284803]  ? _raw_spin_unlock+0x15/0x30
  [337571.285031]  ? release_extent_buffer+0x103/0x130 [btrfs]
  [337571.285305]  reset_balance_state+0x152/0x1b0 [btrfs]
  [337571.285578]  btrfs_balance+0xa50/0x11e0 [btrfs]
  [337571.285864]  ? __kmem_cache_alloc_node+0x14a/0x410
  [337571.286086]  btrfs_ioctl+0x249a/0x3320 [btrfs]
  [337571.286358]  ? mod_objcg_state+0xd2/0x360
  [337571.286577]  ? refill_obj_stock+0xb0/0x160
  [337571.286798]  ? seq_release+0x25/0x30
  [337571.287016]  ? __rseq_handle_notify_resume+0x3ba/0x4b0
  [337571.287235]  ? percpu_counter_add_batch+0x2e/0xa0
  [337571.287455]  ? __x64_sys_ioctl+0x88/0xc0
  [337571.287675]  __x64_sys_ioctl+0x88/0xc0
  [337571.287901]  do_syscall_64+0x38/0x90
  [337571.288126]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
  [337571.288352] RIP: 0033:0x7f478aaffe9b

So fix this by locking struct btrfs_fs_info::trans_lock before deleting
the quota root from that list.

Fixes: bed92eae26cc ("Btrfs: qgroup implementation and prototypes")
CC: stable@vger.kernel.org # 4.14+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
2023-06-19 20:07:41 +02:00
..
tests
btrfs: drop gfp from parameter extent state helpers
2023-06-19 13:59:30 +02:00
accessors.c
btrfs: add eb to btrfs_node_key_ptr_offset
2022-12-05 18:00:58 +01:00
accessors.h
btrfs: add stack helpers for a few btrfs items
2022-12-05 18:00:58 +01:00
acl.c
fs: port acl to mnt_idmap
2023-01-19 09:24:28 +01:00
acl.h
fs: port ->set_acl() to pass mnt_idmap
2023-01-19 09:24:27 +01:00
async-thread.c
btrfs: use alloc_ordered_workqueue() to create ordered workqueues
2023-06-19 13:59:30 +02:00
async-thread.h
btrfs: use alloc_ordered_workqueue() to create ordered workqueues
2023-06-19 13:59:30 +02:00
backref.c
btrfs: fix backref walking not returning all inode refs
2023-05-09 22:09:11 +02:00
backref.h
btrfs: fix backref walking not returning all inode refs
2023-05-09 22:09:11 +02:00
bio.c
btrfs: add an ordered_extent pointer to struct btrfs_bio
2023-06-19 13:59:36 +02:00
bio.h
btrfs: add an ordered_extent pointer to struct btrfs_bio
2023-06-19 13:59:36 +02:00
block-group.c
btrfs: add handling for RAID1C23/DUP to btrfs_reduce_alloc_profile
2023-06-19 13:59:40 +02:00
block-group.h
btrfs: update documentation for a block group's bg_list member
2023-06-19 13:59:38 +02:00
block-rsv.c
btrfs: move btrfs_check_trunc_cache_free_space into block-rsv.c
2023-06-19 13:59:24 +02:00
block-rsv.h
btrfs: move btrfs_check_trunc_cache_free_space into block-rsv.c
2023-06-19 13:59:24 +02:00
btrfs_inode.h
btrfs: tracepoints: also show actual number of the outstanding extents
2023-06-19 19:47:58 +02:00
check-integrity.c
btrfs: rename __btrfs_map_block to btrfs_map_block
2023-06-19 13:59:34 +02:00
check-integrity.h
btrfs: check-integrity: split submit_bio from btrfsic checking
2022-05-16 17:03:12 +02:00
compression.c
btrfs: make btrfs_compressed_bioset static
2023-06-19 17:01:44 +02:00
compression.h
btrfs: pass an ordered_extent to btrfs_submit_compressed_write
2023-06-19 13:59:36 +02:00
ctree.c
btrfs: replace BUG_ON() at split_item() with proper error handling
2023-06-19 13:59:39 +02:00
ctree.h
btrfs: do not BUG_ON() on tree mod log failures at btrfs_del_ptr()
2023-06-19 13:59:39 +02:00
defrag.c
btrfs: drop gfp from parameter extent state helpers
2023-06-19 13:59:30 +02:00
defrag.h
btrfs: move defrag related prototypes to their own header
2022-12-05 18:00:46 +01:00
delalloc-space.c
btrfs: count extents before taking inode's spinlock when reserving metadata
2023-04-17 18:01:19 +02:00
delalloc-space.h
btrfs: move delalloc space related prototypes to delalloc-space.h
2022-12-05 18:00:44 +01:00
delayed-inode.c
btrfs: handle btrfs_del_item errors in __btrfs_update_delayed_inode
2023-03-06 19:28:19 +01:00
delayed-inode.h
btrfs: extend btrfs_dir_item type to store encryption status
2022-12-05 18:00:43 +01:00
delayed-ref.c
btrfs: use a single switch statement when initializing delayed ref head
2023-06-19 13:59:32 +02:00
delayed-ref.h
btrfs: use bool type for delayed ref head fields that are used as booleans
2023-06-19 13:59:32 +02:00
dev-replace.c
btrfs: rename __btrfs_map_block to btrfs_map_block
2023-06-19 13:59:34 +02:00
dev-replace.h
btrfs: move dev-replace prototypes into dev-replace.h
2022-12-05 18:00:47 +01:00
dir-item.c
btrfs: move dir-item prototypes into dir-item.h
2022-12-05 18:00:46 +01:00
dir-item.h
btrfs: move dir-item prototypes into dir-item.h
2022-12-05 18:00:46 +01:00
discard.c
btrfs: unexport btrfs_run_discard_work and make it static
2023-06-19 13:59:25 +02:00
discard.h
btrfs: unexport btrfs_run_discard_work and make it static
2023-06-19 13:59:25 +02:00
disk-io.c
btrfs: add xxhash to fast checksum implementations
2023-06-19 13:59:33 +02:00
disk-io.h
btrfs: use a separate end_io handler for read_extent_buffer
2023-06-19 13:59:27 +02:00
export.c
btrfs: move super_block specific helpers into super.h
2022-12-05 18:00:47 +01:00
export.h
btrfs: simplify generation check in btrfs_get_dentry
2022-12-05 18:00:41 +01:00
extent_io.c
btrfs: use btrfs_finish_ordered_extent to complete buffered writes
2023-06-19 13:59:37 +02:00
extent_io.h
btrfs: don't treat zoned writeback as being from an async helper thread
2023-06-19 13:59:35 +02:00
extent_map.c
btrfs: pass the new logical address to split_extent_map
2023-06-19 13:59:33 +02:00
extent_map.h
btrfs: pass the new logical address to split_extent_map
2023-06-19 13:59:33 +02:00
extent-io-tree.c
btrfs: drop gfp from parameter extent state helpers
2023-06-19 13:59:30 +02:00
extent-io-tree.h
btrfs: drop gfp from parameter extent state helpers
2023-06-19 13:59:30 +02:00
extent-tree.c
btrfs: use bool type for delayed ref head fields that are used as booleans
2023-06-19 13:59:32 +02:00
extent-tree.h
btrfs: remove level argument from btrfs_set_block_flags
2023-06-19 13:59:24 +02:00
file-item.c
btrfs: use bbio->ordered in btrfs_csum_one_bio
2023-06-19 13:59:37 +02:00
file-item.h
btrfs: optimize the logical to physical mapping for zoned writes
2023-06-19 13:59:32 +02:00
file.c
btrfs: set FMODE_CAN_ODIRECT instead of a dummy direct_IO method
2023-06-19 13:59:38 +02:00
file.h
btrfs: use cached state when looking for delalloc ranges with fiemap
2022-12-05 18:00:56 +01:00
free-space-cache.c
btrfs: move btrfs_check_trunc_cache_free_space into block-rsv.c
2023-06-19 13:59:24 +02:00
free-space-cache.h
btrfs: move btrfs_check_trunc_cache_free_space into block-rsv.c
2023-06-19 13:59:24 +02:00
free-space-tree.c
btrfs: make clear_cache mount option to rebuild FST without disabling it
2023-05-10 14:51:27 +02:00
free-space-tree.h
btrfs: make clear_cache mount option to rebuild FST without disabling it
2023-05-10 14:51:27 +02:00
fs.c
btrfs: sysfs: update fs features directory asynchronously
2023-02-13 17:50:35 +01:00
fs.h
btrfs: scrub: remove btrfs_fs_info::scrub_wr_completion_workers
2023-06-19 13:59:40 +02:00
inode-item.c
btrfs: remove obsolete delayed ref throttling logic when truncating items
2023-04-17 18:01:19 +02:00
inode-item.h
btrfs: move split_flags/combine_flags helpers to inode-item.h
2023-06-19 13:59:25 +02:00
inode.c
btrfs: do not BUG_ON after failure to migrate space during truncation
2023-06-19 13:59:39 +02:00
ioctl.c
btrfs: trigger orphan inode cleanup during START_SYNC ioctl
2023-06-19 13:59:26 +02:00
ioctl.h
fs: port ->fileattr_set() to pass mnt_idmap
2023-01-19 09:24:27 +01:00
Kconfig
block: make blkcg_punt_bio_submit optional
2023-04-17 18:01:22 +02:00
locking.c
btrfs: add block-group tree to lockdep classes
2023-06-19 13:59:35 +02:00
locking.h
btrfs: locking: use atomic for DREW lock writers
2023-04-17 18:01:17 +02:00
lru_cache.c
btrfs: send: cache utimes operations for directories if possible
2023-02-15 19:38:50 +01:00
lru_cache.h
btrfs: remove btrfs_lru_cache_is_full() inline function
2023-04-17 18:01:18 +02:00
lzo.c
btrfs: disable allocation warnings for compression workspaces
2023-06-19 13:59:34 +02:00
Makefile
btrfs: send: genericize the backref cache to allow it to be reused
2023-02-13 17:50:35 +01:00
messages.c
btrfs: print assertion failure report and stack trace from the same line
2023-06-19 13:59:31 +02:00
messages.h
btrfs: print assertion failure report and stack trace from the same line
2023-06-19 13:59:31 +02:00
misc.h
btrfs: export bitmap_test_range_all_{set,zero}
2023-06-19 13:59:22 +02:00
ordered-data.c
btrfs: add a btrfs_finish_ordered_extent helper
2023-06-19 13:59:37 +02:00
ordered-data.h
btrfs: add a btrfs_finish_ordered_extent helper
2023-06-19 13:59:37 +02:00
orphan.c
btrfs: move orphan prototypes into orphan.h
2022-12-05 18:00:47 +01:00
orphan.h
btrfs: move orphan prototypes into orphan.h
2022-12-05 18:00:47 +01:00
print-tree.c
btrfs: print-tree: pass const extent buffer pointer
2023-06-19 13:59:22 +02:00
print-tree.h
btrfs: print-tree: pass const extent buffer pointer
2023-06-19 13:59:22 +02:00
props.c
btrfs: move super_block specific helpers into super.h
2022-12-05 18:00:47 +01:00
props.h
btrfs: make module init/exit match their sequence
2022-12-05 18:00:40 +01:00
qgroup.c
btrfs: fix race when deleting quota root from the dirty cow roots list
2023-06-19 20:07:41 +02:00
qgroup.h
btrfs: sink gfp_t parameter to btrfs_qgroup_trace_extent
2022-12-05 18:00:43 +01:00
raid56.c
btrfs: scrub: use recovered data stripes as cache to avoid unnecessary read
2023-06-19 13:59:24 +02:00
raid56.h
btrfs: scrub: use recovered data stripes as cache to avoid unnecessary read
2023-06-19 13:59:24 +02:00
rcu-string.h
btrfs: replace strncpy() with strscpy()
2022-12-05 18:00:59 +01:00
ref-verify.c
btrfs: move accessor helpers into accessors.h
2022-12-05 18:00:42 +01:00
ref-verify.h
…
reflink.c
btrfs: pass btrfs_inode to btrfs_inode_unlock
2022-12-05 18:00:53 +01:00
reflink.h
…
relocation.c
btrfs: pass an ordered_extent to btrfs_reloc_clone_csums
2023-06-19 13:59:36 +02:00
relocation.h
btrfs: pass an ordered_extent to btrfs_reloc_clone_csums
2023-06-19 13:59:36 +02:00
root-tree.c
btrfs: move orphan prototypes into orphan.h
2022-12-05 18:00:47 +01:00
root-tree.h
btrfs: move root tree prototypes to their own header
2022-12-05 18:00:44 +01:00
scrub.c
btrfs: scrub: remove btrfs_fs_info::scrub_wr_completion_workers
2023-06-19 13:59:40 +02:00
scrub.h
btrfs: scrub: remove scrub_bio structure
2023-04-17 18:01:24 +02:00
send.c
btrfs: send: do not BUG_ON() on unexpected symlink data extent
2023-06-19 13:59:39 +02:00
send.h
btrfs: send add define for v2 buffer size
2022-12-05 18:00:41 +01:00
space-info.c
btrfs: add helper to calculate space for delayed references
2023-04-17 18:01:19 +02:00
space-info.h
btrfs: update documentation for BTRFS_RESERVE_FLUSH_EVICT flush method
2023-04-17 18:01:18 +02:00
subpage.c
btrfs: stop setting PageError in the data I/O path
2023-06-19 13:59:35 +02:00
subpage.h
btrfs: stop setting PageError in the data I/O path
2023-06-19 13:59:35 +02:00
super.c
btrfs: remove hipri_workers workqueue
2023-06-19 13:59:23 +02:00
super.h
btrfs: move super_block specific helpers into super.h
2022-12-05 18:00:47 +01:00
sysfs.c
btrfs: sysfs: relax bg_reclaim_threshold for debugging purposes
2023-04-17 18:01:18 +02:00
sysfs.h
btrfs: sysfs: update fs features directory asynchronously
2023-02-13 17:50:35 +01:00
transaction.c
btrfs: do not BUG_ON on failure to get dir index for new snapshot
2023-06-19 13:59:39 +02:00
transaction.h
btrfs: don't hold an extra reference for redirtied buffers
2023-06-19 13:59:26 +02:00
tree-checker.c
btrfs: move split_flags/combine_flags helpers to inode-item.h
2023-06-19 13:59:25 +02:00
tree-checker.h
btrfs: move btrfs_verify_level_key into tree-checker.c
2023-06-19 13:59:25 +02:00
tree-log.c
btrfs: do not BUG_ON() when dropping inode items from log root
2023-06-19 13:59:39 +02:00
tree-log.h
btrfs: change for_rename argument of btrfs_record_unlink_dir() to bool
2023-06-19 13:59:26 +02:00
tree-mod-log.c
btrfs: avoid tree mod log ENOMEM failures when we don't need to log
2023-06-19 13:59:38 +02:00
tree-mod-log.h
btrfs: fix SPDX comment in tree-mod-log.h
2022-12-05 18:00:48 +01:00
ulist.c
btrfs: constify ulist parameter of ulist_next()
2022-12-05 18:00:50 +01:00
ulist.h
btrfs: constify ulist parameter of ulist_next()
2022-12-05 18:00:50 +01:00
uuid-tree.c
btrfs: move uuid tree prototypes to uuid-tree.h
2022-12-05 18:00:46 +01:00
uuid-tree.h
btrfs: move uuid tree prototypes to uuid-tree.h
2022-12-05 18:00:46 +01:00
verity.c
fsverity: pass pos and size to ->write_merkle_tree_block
2023-01-01 15:46:48 -08:00
verity.h
btrfs: move verity prototypes into verity.h
2022-12-05 18:00:47 +01:00
volumes.c
btrfs: update i_version in update_dev_time
2023-06-19 17:38:50 +02:00
volumes.h
btrfs: open code btrfs_map_sblock
2023-06-19 13:59:34 +02:00
xattr.c
fs: drop unused posix acl handlers
2023-03-06 09:57:12 +01:00
xattr.h
…
zlib.c
btrfs: disable allocation warnings for compression workspaces
2023-06-19 13:59:34 +02:00
zoned.c
btrfs: open code btrfs_map_sblock
2023-06-19 13:59:34 +02:00
zoned.h
btrfs: defer splitting of ordered extents until I/O completion
2023-06-19 13:59:33 +02:00
zstd.c
btrfs: disable allocation warnings for compression workspaces
2023-06-19 13:59:34 +02:00