iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/fs
History
David Howells f89ea63f1c
netfs, 9p: Fix race between umount and async request completion 
There's a problem in 9p's interaction with netfslib whereby a crash occurs
because the 9p_fid structs get forcibly destroyed during client teardown
(without paying attention to their refcounts) before netfslib has finished
with them.  However, it's not a simple case of deferring the clunking that
p9_fid_put() does as that requires the p9_client record to still be
present.

The problem is that netfslib has to unlock pages and clear the IN_PROGRESS
flag before destroying the objects involved - including the fid - and, in
any case, nothing checks to see if writeback completed barring looking at
the page flags.

Fix this by keeping a count of outstanding I/O requests (of any type) and
waiting for it to quiesce during inode eviction.

Reported-by: syzbot+df038d463cca332e8414@syzkaller.appspotmail.com
Link: https://lore.kernel.org/all/0000000000005be0aa061846f8d6@google.com/
Reported-by: syzbot+d7c7a495a5e466c031b6@syzkaller.appspotmail.com
Link: https://lore.kernel.org/all/000000000000b86c5e06130da9c6@google.com/
Reported-by: syzbot+1527696d41a634cc1819@syzkaller.appspotmail.com
Link: https://lore.kernel.org/all/000000000000041f960618206d7e@google.com/
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://lore.kernel.org/r/755891.1716560771@warthog.procyon.org.uk
Tested-by: syzbot+d7c7a495a5e466c031b6@syzkaller.appspotmail.com
Reviewed-by: Dominique Martinet <asmadeus@codewreck.org>
cc: Eric Van Hensbergen <ericvh@kernel.org>
cc: Latchesar Ionkov <lucho@ionkov.net>
cc: Christian Schoenebeck <linux_oss@crudebyte.com>
cc: Jeff Layton <jlayton@kernel.org>
cc: Steve French <sfrench@samba.org>
cc: Hillf Danton <hdanton@sina.com>
cc: v9fs@lists.linux.dev
cc: linux-afs@lists.infradead.org
cc: linux-cifs@vger.kernel.org
cc: netfs@lists.linux.dev
cc: linux-fsdevel@vger.kernel.org
Reported-and-tested-by: syzbot+d7c7a495a5e466c031b6@syzkaller.appspotmail.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
2024-05-27 13:12:13 +02:00
..
9p
netfs, 9p: Fix race between umount and async request completion
2024-05-27 13:12:13 +02:00
adfs
mm, slab: remove last vestiges of SLAB_MEM_SPREAD
2024-03-12 20:32:19 -07:00
affs
affs: remove SLAB_MEM_SPREAD flag usage
2024-02-26 11:36:28 +01:00
afs
netfs, 9p: Fix race between umount and async request completion
2024-05-27 13:12:13 +02:00
autofs
dcache stuff for this cycle
2024-01-11 20:11:35 -08:00
bcachefs
bcachefs changes for 6.10-rc1
2024-05-19 13:45:48 -07:00
befs
mm, slab: remove last vestiges of SLAB_MEM_SPREAD
2024-03-12 20:32:19 -07:00
bfs
mm, slab: remove last vestiges of SLAB_MEM_SPREAD
2024-03-12 20:32:19 -07:00
btrfs
Networking changes for 6.10.
2024-05-14 19:42:24 -07:00
cachefiles
netfs, cachefiles: Implement helpers for new write code
2024-05-01 18:07:37 +01:00
ceph
netfs: Switch to using unsigned long long rather than loff_t
2024-05-01 18:07:35 +01:00
coda
mm, slab: remove last vestiges of SLAB_MEM_SPREAD
2024-03-12 20:32:19 -07:00
configfs
…
cramfs
fs,block: yield devices early
2024-03-27 13:17:15 +01:00
crypto
The usual shower of singleton fixes and minor series all over MM,
2024-05-19 09:21:03 -07:00
debugfs
vfs: Convert debugfs to use the new mount API
2024-03-26 09:04:54 +01:00
devpts
fs: Remove the now superfluous sentinel elements from ctl_table array
2023-12-28 04:57:57 -08:00
dlm
dlm: return -ENOMEM if ls_recover_buf fails
2024-04-23 16:08:55 -05:00
ecryptfs
hardening updates for 6.10-rc1
2024-05-13 14:14:05 -07:00
efivarfs
efi: Clear up misconceptions about a maximum variable name size
2024-04-13 10:33:02 +02:00
efs
efs: remove SLAB_MEM_SPREAD flag usage
2024-02-27 11:21:33 +01:00
erofs
erofs: Zstandard compression support
2024-05-09 07:46:56 +08:00
exfat
exfat: zero the reserved fields of file and stream extension dentries
2024-04-25 21:59:59 +09:00
exportfs
fs: Create a generic is_dot_dotdot() utility
2024-01-23 10:58:56 -05:00
ext2
ext2: Remove LEGACY_DIRECT_IO dependency
2024-05-03 11:50:28 +02:00
ext4
Ext4 patches for the 6.10-rc1 merge window:
2024-05-18 14:11:54 -07:00
f2fs
f2fs update for 6.10-rc1
2024-05-20 13:23:43 -07:00
fat
fs: add kernel-doc comments to fat_parse_long()
2024-04-25 21:07:02 -07:00
freevxfs
freevxfs: Convert freevxfs to the new mount API.
2024-03-26 09:04:53 +01:00
fuse
virtiofs: include a newline in sysfs tag
2024-05-08 09:31:21 +02:00
gfs2
gfs2 updates
2024-05-14 17:35:22 -07:00
hfs
hfs: really remove hfs_writepage
2023-12-29 11:58:34 -08:00
hfsplus
hfsplus: refactor copy_name to not use strncpy
2024-04-24 16:55:28 -07:00
hostfs
hostfs: use d_splice_alias() calling conventions to simplify failure exits
2023-12-21 12:51:00 -05:00
hpfs
mm, slab: remove last vestiges of SLAB_MEM_SPREAD
2024-03-12 20:32:19 -07:00
hugetlbfs
The usual shower of singleton fixes and minor series all over MM,
2024-05-19 09:21:03 -07:00
iomap
iomap: fault in smaller chunks for non-large folio mappings
2024-05-24 13:34:07 +02:00
isofs
isofs: Use *-y instead of *-objs in Makefile
2024-05-09 18:09:57 +02:00
jbd2
jbd2: add prefix 'jbd2' for 'shrink_type'
2024-05-09 10:52:31 -04:00
jffs2
jffs2: prevent xattr node from overflowing the eraseblock
2024-04-17 13:21:34 +02:00
jfs
fs,block: yield devices early
2024-03-27 13:17:15 +01:00
kernfs
kernfs: annotate different lockdep class for of->mutex of writable files
2024-04-14 06:55:46 -04:00
lockd
lockd: host: Remove unnecessary statements＇host = NULL;＇
2024-05-06 09:07:20 -04:00
minix
minix: convert minix to use the new mount api
2024-03-26 09:04:55 +01:00
netfs
netfs, 9p: Fix race between umount and async request completion
2024-05-27 13:12:13 +02:00
nfs
The usual shower of singleton fixes and minor series all over MM,
2024-05-19 09:21:03 -07:00
nfs_common
…
nfsd
\n
2024-05-20 12:31:43 -07:00
nilfs2
Mainly singleton patches, documented in their respective changelogs.
2024-05-19 14:02:03 -07:00
nls
…
notify
Revert "fanotify: remove unneeded sub-zero check for unsigned value"
2024-05-20 12:43:58 -07:00
ntfs3
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2024-05-02 12:06:25 -07:00
ocfs2
Mainly singleton patches, documented in their respective changelogs.
2024-05-19 14:02:03 -07:00
omfs
…
openpromfs
openpromfs: finish conversion to the new mount API
2024-03-26 09:04:54 +01:00
orangefs
orangefs: fix out-of-bounds fsid access
2024-05-14 17:44:14 -07:00
overlayfs
integrity-v6.10
2024-05-15 08:43:02 -07:00
proc
Mainly singleton patches, documented in their respective changelogs.
2024-05-19 14:02:03 -07:00
pstore
pstore/zone: Don't clear memory twice
2024-03-09 12:33:22 -08:00
qnx4
mm, slab: remove last vestiges of SLAB_MEM_SPREAD
2024-03-12 20:32:19 -07:00
qnx6
qnx6: convert qnx6 to use the new mount api
2024-03-26 09:04:53 +01:00
quota
quota: fix to propagate error of mark_dquot_dirty() to caller
2024-04-12 14:52:29 +02:00
ramfs
mm: switch mm->get_unmapped_area() to a flag
2024-04-25 20:56:25 -07:00
reiserfs
\n
2024-05-20 12:49:25 -07:00
romfs
fs,block: yield devices early
2024-03-27 13:17:15 +01:00
smb
netfs, 9p: Fix race between umount and async request completion
2024-05-27 13:12:13 +02:00
squashfs
Mainly singleton patches, documented in their respective changelogs.
2024-05-19 14:02:03 -07:00
sysfs
fs: sysfs: Fix reference leak in sysfs_break_active_protection()
2024-04-11 15:16:48 +02:00
sysv
sysv: remove SLAB_MEM_SPREAD flag usage
2024-02-27 11:21:31 +01:00
tracefs
tracing cleanups for v6.10:
2024-05-17 18:34:27 -07:00
ubifs
This pull request contains updates for UBI and UBIFS:
2024-03-21 15:09:29 -07:00
udf
udf: Use a folio in udf_write_end()
2024-04-23 15:37:02 +02:00
ufs
mm, slab: remove last vestiges of SLAB_MEM_SPREAD
2024-03-12 20:32:19 -07:00
unicode
kbuild: use $(src) instead of $(srctree)/$(src) for source directory
2024-05-10 04:34:52 +09:00
vboxsf
vboxsf: explicitly deny setlease attempts
2024-04-03 16:06:39 +02:00
verity
fsverity: use register_sysctl_init() to avoid kmemleak warning
2024-05-03 08:30:58 -07:00
xfs
New code for 6.10:
2024-05-20 12:55:12 -07:00
zonefs
zonefs: Use str_plural() to fix Coccinelle warning
2024-04-10 07:23:47 +09:00
aio.c
vfs-6.10.misc
2024-05-13 11:40:06 -07:00
anon_inodes.c
fs: Create anon_inode_getfile_fmode()
2024-04-26 10:33:05 +02:00
attr.c
lsm/stable-6.9 PR 20240312
2024-03-12 20:03:34 -07:00
backing-file.c
fs: Use KMEM_CACHE instead of kmem_cache_create
2024-02-02 13:11:50 +01:00
bad_inode.c
…
binfmt_elf_fdpic.c
binfmt_elf_fdpic: fix /proc/<pid>/auxv
2024-04-24 15:55:28 -07:00
binfmt_elf_test.c
…
binfmt_elf.c
Mainly singleton patches, documented in their respective changelogs.
2024-05-19 14:02:03 -07:00
binfmt_flat.c
…
binfmt_misc.c
execve updates for v6.7-rc1
2023-10-30 19:28:19 -10:00
binfmt_script.c
…
buffer.c
buffer: improve bdev_getblk documentation
2024-05-05 17:53:40 -07:00
char_dev.c
As usual, lots of singleton and doubleton patches all over the tree and
2023-11-02 20:53:31 -10:00
compat_binfmt_elf.c
…
coredump.c
fs/coredump: Enable dynamic configuration of max file note size
2024-05-08 09:53:00 -07:00
d_path.c
…
dax.c
dax: use huge_zero_folio
2024-04-25 20:56:20 -07:00
dcache.c
fs/dcache: Re-use value stored to dentry->d_flags instead of re-reading
2024-04-09 12:29:03 +02:00
direct-io.c
fs/direct-io: remove redundant assignment to variable retval
2024-04-11 10:21:24 +02:00
drop_caches.c
…
eventfd.c
eventfd: strictly check the count parameter of eventfd_write to avoid inputting illegal strings
2024-02-08 10:12:26 +01:00
eventpoll.c
epoll: be better about file lifetimes
2024-05-05 14:00:48 -07:00
exec.c
The usual shower of singleton fixes and minor series all over MM,
2024-05-19 09:21:03 -07:00
fcntl.c
fcntl: add F_DUPFD_QUERY fcntl()
2024-05-10 08:26:31 +02:00
fhandle.c
fs: Annotate struct file_handle with __counted_by() and use struct_size()
2024-04-05 15:53:47 +02:00
file_table.c
lsm/stable-6.9 PR 20240312
2024-03-12 20:03:34 -07:00
file.c
file: remove __receive_fd()
2023-12-12 14:24:14 +01:00
filesystems.c
…
fs_context.c
…
fs_parser.c
__fs_parse: Correct a documentation comment
2024-02-02 13:11:50 +01:00
fs_pin.c
…
fs_struct.c
…
fs_types.c
…
fs-writeback.c
fs/writeback: remove unnecessary return in writeback_inodes_sb
2024-04-05 15:53:45 +02:00
fsopen.c
…
init.c
…
inode.c
bcachefs updates for 6.9
2024-03-15 09:00:09 -07:00
internal.h
pidfs: remove config option
2024-03-13 12:53:53 -07:00
ioctl.c
fs/ioctl: Add a comment to keep the logic in sync with LSM policies
2024-05-13 06:58:35 +02:00
Kconfig
- Sumanth Korikkar has taught s390 to allocate hotplug-time page frames
2024-03-14 17:43:30 -07:00
Kconfig.binfmt
…
kernel_read_file.c
…
libfs.c
shmem: Fix shmem_rename2()
2024-04-17 13:49:44 +02:00
locks.c
filelock: fix deadlock detection in POSIX locking
2024-02-20 09:53:33 +01:00
Makefile
vfs-6.9.pidfd
2024-03-11 10:21:06 -07:00
mbcache.c
vfs: remove SLAB_MEM_SPREAD flag usage
2024-02-27 11:21:31 +01:00
mnt_idmapping.c
fs/mnt_idmapping.c: Return -EINVAL when no map is written
2024-02-08 10:12:37 +01:00
mount.h
mounts: keep list of mounts in an rbtree
2023-11-18 14:56:16 +01:00
mpage.c
block, fs: Restore the per-bio/request data lifetime fields
2024-02-06 14:31:05 +01:00
namei.c
vfs-6.10.misc
2024-05-13 11:40:06 -07:00
namespace.c
fs: relax mount_setattr() permission checks
2024-02-07 21:16:29 +01:00
nsfs.c
pidfs: remove config option
2024-03-13 12:53:53 -07:00
open.c
lsm/stable-6.9 PR 20240312
2024-03-12 20:03:34 -07:00
pidfs.c
pidfs: remove config option
2024-03-13 12:53:53 -07:00
pipe.c
fs/pipe: Convert to lockdep_cmp_fn
2024-02-02 13:11:49 +01:00
pnode.c
mounts: keep list of mounts in an rbtree
2023-11-18 14:56:16 +01:00
pnode.h
…
posix_acl.c
lsm/stable-6.9 PR 20240312
2024-03-12 20:03:34 -07:00
proc_namespace.c
namespace: extract show_path() helper
2023-11-18 14:56:16 +01:00
read_write.c
New code for 6.10:
2024-05-20 12:55:12 -07:00
readdir.c
fsnotify: optionally pass access range in file permission hooks
2023-12-12 16:20:02 +01:00
remap_range.c
vfs: export remap and write check helpers
2024-04-15 14:54:13 -07:00
select.c
fs/select: rework stack allocation hack for clang
2024-02-20 09:23:52 +01:00
seq_file.c
seq_file: Simplify __seq_puts()
2024-05-02 16:28:20 +02:00
signalfd.c
signalfd: drop an obsolete comment
2024-05-24 13:34:07 +02:00
splice.c
fs: use splice_copy_file_range() inline helper
2023-12-12 16:20:02 +01:00
stack.c
…
stat.c
statx: stx_subvol
2024-03-26 09:01:18 +01:00
statfs.c
…
super.c
\n
2024-05-20 12:31:43 -07:00
sync.c
…
sysctls.c
fs: Remove the now superfluous sentinel elements from ctl_table array
2023-12-28 04:57:57 -08:00
timerfd.c
timerfd: convert to ->read_iter()
2024-04-10 16:23:02 -06:00
userfaultfd.c
The usual shower of singleton fixes and minor series all over MM,
2024-05-19 09:21:03 -07:00
utimes.c
…
xattr.c
evm: Move to LSM infrastructure
2024-02-15 23:43:47 -05:00