Liu Shixin
eda6879272
hfs: fix missing hfs_bnode_get() in __hfs_bnode_create ...
commit a9dc087fd3c484fd1ed18c5efb290efaaf44ce03 upstream.
Syzbot found a kernel BUG in hfs_bnode_put():
kernel BUG at fs/hfs/bnode.c:466!
invalid opcode: 0000 [#1 ] PREEMPT SMP KASAN
CPU: 0 PID: 3634 Comm: kworker/u4:5 Not tainted 6.1.0-rc7-syzkaller-00190-g97ee9d1c1696 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: writeback wb_workfn (flush-7:0)
RIP: 0010:hfs_bnode_put+0x46f/0x480 fs/hfs/bnode.c:466
Code: 8a 80 ff e9 73 fe ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c a0 fe ff ff 48 89 df e8 db 8a 80 ff e9 93 fe ff ff e8 a1 68 2c ff <0f> 0b e8 9a 68 2c ff 0f 0b 0f 1f 84 00 00 00 00 00 55 41 57 41 56
RSP: 0018:ffffc90003b4f258 EFLAGS: 00010293
RAX: ffffffff825e318f RBX: 0000000000000000 RCX: ffff8880739dd7c0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90003b4f430 R08: ffffffff825e2d9b R09: ffffed10045157d1
R10: ffffed10045157d1 R11: 1ffff110045157d0 R12: ffff8880228abe80
R13: ffff88807016c000 R14: dffffc0000000000 R15: ffff8880228abe00
FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa6ebe88718 CR3: 000000001e93d000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
hfs_write_inode+0x1bc/0xb40
write_inode fs/fs-writeback.c:1440 [inline]
__writeback_single_inode+0x4d6/0x670 fs/fs-writeback.c:1652
writeback_sb_inodes+0xb3b/0x18f0 fs/fs-writeback.c:1878
__writeback_inodes_wb+0x125/0x420 fs/fs-writeback.c:1949
wb_writeback+0x440/0x7b0 fs/fs-writeback.c:2054
wb_check_start_all fs/fs-writeback.c:2176 [inline]
wb_do_writeback fs/fs-writeback.c:2202 [inline]
wb_workfn+0x827/0xef0 fs/fs-writeback.c:2235
process_one_work+0x877/0xdb0 kernel/workqueue.c:2289
worker_thread+0xb14/0x1330 kernel/workqueue.c:2436
kthread+0x266/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
</TASK>
The BUG_ON() is triggered at here:
/* Dispose of resources used by a node */
void hfs_bnode_put(struct hfs_bnode *node)
{
if (node) {
<skipped>
BUG_ON(!atomic_read(&node->refcnt)); <- we have issue here!!!!
<skipped>
}
}
By tracing the refcnt, I found the node is created by hfs_bmap_alloc()
with refcnt 1. Then the node is used by hfs_btree_write(). There is a
missing of hfs_bnode_get() after find the node. The issue happened in
following path:
<alloc>
hfs_bmap_alloc
hfs_bnode_find
__hfs_bnode_create <- allocate a new node with refcnt 1.
hfs_bnode_put <- decrease the refcnt
<write>
hfs_btree_write
hfs_bnode_find
__hfs_bnode_create
hfs_bnode_findhash <- find the node without refcnt increased.
hfs_bnode_put <- trigger the BUG_ON() since refcnt is 0.
Link: https://lkml.kernel.org/r/20221212021627.3766829-1-liushixin2@huawei.com
Reported-by: syzbot+5b04b49a7ec7226c7426@syzkaller.appspotmail.com
Signed-off-by: Liu Shixin <liushixin2@huawei.com>
Cc: Fabio M. De Francesco <fmdefrancesco@gmail.com>
Cc: Viacheslav Dubeyko <slava@dubeyko.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-03-11 16:43:59 +01:00
2022-06-22 14:11:02 +02:00
2023-02-06 07:52:36 +01:00
2022-12-08 11:23:03 +01:00
2019-10-25 00:03:11 -04:00
2021-01-06 14:48:39 +01:00
2023-03-03 11:41:48 +01:00
2020-11-05 11:43:36 +01:00
2023-02-22 12:50:33 +01:00
2023-03-11 16:43:49 +01:00
2023-03-11 16:43:56 +01:00
2023-01-18 11:41:09 +01:00
2019-11-23 21:44:49 -05:00
2021-09-12 08:56:38 +02:00
2023-01-18 11:40:56 +01:00
2022-02-01 17:24:34 +01:00
2022-10-26 13:22:14 +02:00
2021-05-26 12:05:19 +02:00
2020-12-02 08:49:53 +01:00
2022-08-25 11:17:36 +02:00
2019-11-10 11:56:05 -05:00
2022-08-25 11:17:28 +02:00
2023-02-25 11:53:27 +01:00
2023-02-22 12:50:29 +01:00
2022-06-14 18:11:30 +02:00
2021-09-22 12:26:25 +02:00
2022-12-08 11:23:01 +01:00
2023-03-11 16:43:49 +01:00
2023-03-11 16:43:59 +01:00
2023-01-18 11:41:59 +01:00
2021-04-14 08:24:14 +02:00
2023-01-18 11:41:38 +01:00
2022-06-14 18:11:36 +02:00
2021-11-12 14:43:03 +01:00
2022-10-26 13:22:17 +02:00
2022-06-14 18:11:55 +02:00
2023-01-18 11:41:34 +01:00
2022-11-03 23:56:54 +09:00
2021-09-22 12:26:34 +02:00
2022-04-15 14:18:35 +02:00
2023-01-24 07:17:58 +01:00
2020-12-30 11:51:22 +01:00
2023-03-11 16:43:58 +01:00
2023-02-22 12:50:41 +01:00
2022-06-14 18:11:34 +02:00
2022-11-25 17:42:22 +01:00
2023-01-18 11:42:06 +01:00
2023-01-18 11:41:39 +01:00
2023-01-18 11:41:43 +01:00
2023-02-22 12:50:28 +01:00
2023-01-18 11:41:40 +01:00
2021-09-30 10:09:26 +02:00
2023-01-18 11:42:02 +01:00
2020-10-29 09:57:53 +01:00
2023-02-06 07:52:43 +01:00
2020-08-26 10:40:51 +02:00
2023-02-22 12:50:39 +01:00
2021-03-07 12:20:48 +01:00
2023-01-18 11:40:58 +01:00
2022-09-20 12:28:00 +02:00
2022-04-15 14:18:31 +02:00
2023-03-11 16:43:53 +01:00
2020-08-21 13:05:37 +02:00
2021-10-06 15:42:30 +02:00
2023-02-22 12:50:38 +01:00
2023-02-22 12:50:35 +01:00
2022-08-25 11:17:21 +02:00
2023-01-18 11:41:46 +01:00
2023-01-18 11:41:46 +01:00
2021-10-06 15:42:35 +02:00
2023-01-18 11:41:46 +01:00
2023-01-18 11:41:33 +01:00
2021-05-22 11:38:29 +02:00
2022-11-25 17:42:22 +01:00
2023-01-18 11:41:25 +01:00
2022-06-22 14:11:03 +02:00
2020-12-11 13:23:30 +01:00
2020-10-29 09:57:45 +01:00
2022-06-14 18:11:41 +02:00
2020-10-01 13:17:19 +02:00
2021-04-14 08:24:11 +02:00
2020-01-12 12:21:37 +01:00
2020-02-11 04:35:37 -08:00
2022-12-08 11:23:05 +01:00
2022-06-06 08:33:50 +02:00
2021-09-15 09:47:28 +02:00
2022-05-25 09:14:34 +02:00
2022-03-02 11:41:18 +01:00
2020-04-17 10:50:21 +02:00
2022-02-08 18:24:29 +01:00
2022-06-14 18:11:44 +02:00
2022-10-15 07:54:36 +02:00
2021-07-31 08:19:37 +02:00
2022-10-26 13:22:59 +02:00
2019-12-17 19:55:30 +01:00
2023-01-18 11:40:55 +01:00
2020-03-25 08:25:41 +01:00
2023-01-18 11:41:59 +01:00
2020-01-17 19:48:21 +01:00
2022-11-25 17:42:22 +01:00
2021-08-26 08:36:22 -04:00
2020-03-18 07:17:51 +01:00
2021-08-12 13:21:02 +02:00
2023-01-18 11:41:44 +01:00
2021-03-17 17:03:33 +01:00
2020-02-11 04:35:23 -08:00
2021-04-21 12:56:16 +02:00
2022-01-29 10:25:11 +01:00
2021-07-20 16:10:54 +02:00
2022-09-05 10:27:47 +02:00
2022-10-17 17:24:32 +02:00
2022-04-27 13:50:48 +02:00
2019-10-03 14:21:35 -07:00
2022-02-23 11:59:55 +01:00
2022-10-26 13:22:21 +02:00
2020-02-11 04:35:12 -08:00
2023-01-18 11:40:53 +01:00
eda6879272