diff options
author | David Sterba <dsterba@suse.com> | 2018-06-19 18:04:07 +0200 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-09-15 09:46:57 +0200 |
commit | 760d0077abc1d7730639767e712908c12f511741 (patch) | |
tree | 62aa8e1659740b71b66f1bee8d4dde74bc4c88ab /fs | |
parent | 49db06e7f366c26a71dd3589617b43c3110be649 (diff) |
btrfs: fix mount and ioctl device scan ioctl race
[ Upstream commit 81ffd56b5745355b70d54ca4e1bdd0d64a66ff9f ]
Technically this extends the critical section covered by uuid_mutex to:
- parse early mount options -- here we can call device scan on paths
that can be passed as 'device=/dev/...'
- scan the device passed to mount
- open the devices related to the fs_devices -- this increases
fs_devices::opened
The race can happen when mount calls one of the scans and there's
another one called eg. by mkfs or 'btrfs dev scan':
Mount Scan
----- ----
scan_one_device (dev1, fsid1)
scan_one_device (dev2, fsid1)
add the device
free stale devices
fsid1 fs_devices::opened == 0
find fsid1:dev1
free fsid1:dev1
if it's the last one,
free fs_devices of fsid1
too
open_devices (dev1, fsid1)
dev1 not found
When fixed, the uuid mutex will make sure that mount will increase
fs_devices::opened and this will not be touched by the racing scan
ioctl.
Reported-and-tested-by: syzbot+909a5177749d7990ffa4@syzkaller.appspotmail.com
Reported-and-tested-by: syzbot+ceb2606025ec1cc3479c@syzkaller.appspotmail.com
Reviewed-by: Anand Jain <anand.jain@oracle.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs')
-rw-r--r-- | fs/btrfs/super.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c index a8f2950b9200..9b25f29d0e73 100644 --- a/fs/btrfs/super.c +++ b/fs/btrfs/super.c @@ -1557,19 +1557,19 @@ static struct dentry *btrfs_mount_root(struct file_system_type *fs_type, mutex_lock(&uuid_mutex); error = btrfs_parse_early_options(data, mode, fs_type, &fs_devices); - mutex_unlock(&uuid_mutex); - if (error) + if (error) { + mutex_unlock(&uuid_mutex); goto error_fs_info; + } - mutex_lock(&uuid_mutex); error = btrfs_scan_one_device(device_name, mode, fs_type, &fs_devices); - mutex_unlock(&uuid_mutex); - if (error) + if (error) { + mutex_unlock(&uuid_mutex); goto error_fs_info; + } fs_info->fs_devices = fs_devices; - mutex_lock(&uuid_mutex); error = btrfs_open_devices(fs_devices, mode, fs_type); mutex_unlock(&uuid_mutex); if (error) |