linux-stable/fs/xfs/libxfs
Brian Foster 1da0b50ea0 xfs: fix perag reference leak on iteration race with growfs
[ Upstream commit 892a666faf ]

The for_each_perag*() set of macros are hacky in that some (i.e.
those based on sb_agcount) rely on the assumption that perag
iteration terminates naturally with a NULL perag at the specified
end_agno. Others allow for the final AG to have a valid perag and
require the calling function to clean up any potential leftover
xfs_perag reference on termination of the loop.

Aside from providing a subtly inconsistent interface, the former
variant is racy with growfs because growfs can create discoverable
post-eofs perags before the final superblock update that completes
the grow operation and increases sb_agcount. This leads to the
following assert failure (reproduced by xfs/104) in the perag free
path during unmount:

 XFS: Assertion failed: atomic_read(&pag->pag_ref) == 0, file: fs/xfs/libxfs/xfs_ag.c, line: 195

This occurs because one of the many for_each_perag() loops in the
code that is expected to terminate with a NULL pag (and thus has no
post-loop xfs_perag_put() check) raced with a growfs and found a
non-NULL post-EOFS perag, but terminated naturally based on the
end_agno check without releasing the post-EOFS perag.

Rework the iteration logic to lift the agno check from the main for
loop conditional to the iteration helper function. The for loop now
purely terminates on a NULL pag and xfs_perag_next() avoids taking a
reference to any perag beyond end_agno in the first place.

Fixes: f250eedcf7 ("xfs: make for_each_perag... a first class citizen")
Signed-off-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Leah Rumancik <leah.rumancik@gmail.com>
Acked-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-29 17:25:09 +02:00
..
xfs_ag.c xfs: convert bp->b_bn references to xfs_buf_daddr() 2021-08-19 10:07:15 -07:00
xfs_ag.h xfs: fix perag reference leak on iteration race with growfs 2022-07-29 17:25:09 +02:00
xfs_ag_resv.c New code for 5.14: 2021-07-02 14:30:27 -07:00
xfs_ag_resv.h xfs: move perag structure and setup to libxfs/xfs_ag.[ch] 2021-06-02 10:48:24 +10:00
xfs_alloc.c xfs: convert xfs_sb_version_has checks to use mount features 2021-08-19 10:07:14 -07:00
xfs_alloc.h xfs: convert xfs_sb_version_has checks to use mount features 2021-08-19 10:07:14 -07:00
xfs_alloc_btree.c xfs: introduce xfs_buf_daddr() 2021-08-19 10:07:14 -07:00
xfs_alloc_btree.h xfs: replace xfs_sb_version checks with feature flag checks 2021-08-19 10:07:12 -07:00
xfs_attr.c xfs: Fix the free logic of state in xfs_attr_node_hasname 2022-07-02 16:41:13 +02:00
xfs_attr.h xfs: rename xfs_has_attr() 2021-08-19 10:07:11 -07:00
xfs_attr_leaf.c xfs: convert bp->b_bn references to xfs_buf_daddr() 2021-08-19 10:07:15 -07:00
xfs_attr_leaf.h xfs: Make attr name schemes consistent 2021-06-09 09:34:05 -07:00
xfs_attr_remote.c xfs: convert bp->b_bn references to xfs_buf_daddr() 2021-08-19 10:07:15 -07:00
xfs_attr_remote.h xfs: Rename __xfs_attr_rmtval_remove 2021-08-11 09:12:45 -07:00
xfs_attr_sf.h xfs: Convert xfs_attr_sf macros to inline functions 2020-09-15 20:52:42 -07:00
xfs_bit.c
xfs_bit.h
xfs_bmap.c xfs: convert bp->b_bn references to xfs_buf_daddr() 2021-08-19 10:07:15 -07:00
xfs_bmap.h xfs: mark xfs_bmap_set_attrforkoff static 2021-06-02 14:58:59 -07:00
xfs_bmap_btree.c xfs: introduce xfs_buf_daddr() 2021-08-19 10:07:14 -07:00
xfs_bmap_btree.h xfs: replace xfs_sb_version checks with feature flag checks 2021-08-19 10:07:12 -07:00
xfs_btree.c xfs: convert bp->b_bn references to xfs_buf_daddr() 2021-08-19 10:07:15 -07:00
xfs_btree.h xfs: constify btree function parameters that are not modified 2021-08-18 18:46:02 -07:00
xfs_btree_staging.c xfs: fix maxlevels comparisons in the btree staging code 2022-07-29 17:25:08 +02:00
xfs_btree_staging.h
xfs_cksum.h
xfs_da_btree.c xfs: convert bp->b_bn references to xfs_buf_daddr() 2021-08-19 10:07:15 -07:00
xfs_da_btree.h xfs: Refactor xfs_da_state_alloc() helper 2020-07-28 20:24:14 -07:00
xfs_da_format.h xfs: replace xfs_sb_version checks with feature flag checks 2021-08-19 10:07:12 -07:00
xfs_defer.c xfs: only relog deferred intent items if free space in the log gets low 2020-10-07 08:40:29 -07:00
xfs_defer.h xfs: fix an incore inode UAF in xfs_bui_recover 2020-10-07 08:40:28 -07:00
xfs_dir2.c xfs: convert xfs_sb_version_has checks to use mount features 2021-08-19 10:07:14 -07:00
xfs_dir2.h xfs: fix an ABBA deadlock in xfs_rename 2021-01-22 16:54:43 -08:00
xfs_dir2_block.c xfs: convert bp->b_bn references to xfs_buf_daddr() 2021-08-19 10:07:15 -07:00
xfs_dir2_data.c xfs: convert bp->b_bn references to xfs_buf_daddr() 2021-08-19 10:07:15 -07:00
xfs_dir2_leaf.c xfs: convert bp->b_bn references to xfs_buf_daddr() 2021-08-19 10:07:15 -07:00
xfs_dir2_node.c xfs: convert bp->b_bn references to xfs_buf_daddr() 2021-08-19 10:07:15 -07:00
xfs_dir2_priv.h xfs: convert xfs_sb_version_has checks to use mount features 2021-08-19 10:07:14 -07:00
xfs_dir2_sf.c xfs: convert xfs_sb_version_has checks to use mount features 2021-08-19 10:07:14 -07:00
xfs_dquot_buf.c xfs: convert xfs_sb_version_has checks to use mount features 2021-08-19 10:07:14 -07:00
xfs_errortag.h xfs: add error injection for per-AG resv failure 2021-03-25 16:47:53 -07:00
xfs_format.h xfs: kill xfs_sb_version_has_v3inode() 2021-08-19 10:07:14 -07:00
xfs_fs.h xfs: restore old ioctl definitions 2021-05-20 08:31:22 -07:00
xfs_health.h
xfs_ialloc.c xfs: kill xfs_sb_version_has_v3inode() 2021-08-19 10:07:14 -07:00
xfs_ialloc.h xfs: make the record pointer passed to query_range functions const 2021-08-18 18:46:01 -07:00
xfs_ialloc_btree.c xfs: introduce xfs_buf_daddr() 2021-08-19 10:07:14 -07:00
xfs_ialloc_btree.h xfs: replace xfs_sb_version checks with feature flag checks 2021-08-19 10:07:12 -07:00
xfs_iext_tree.c xfs: prevent metadata files from being inactivated 2021-03-25 16:47:50 -07:00
xfs_inode_buf.c xfs: convert bp->b_bn references to xfs_buf_daddr() 2021-08-19 10:07:15 -07:00
xfs_inode_buf.h xfs: kill xfs_sb_version_has_v3inode() 2021-08-19 10:07:14 -07:00
xfs_inode_fork.c xfs: remove XFS_IFEXTENTS 2021-04-15 09:35:51 -07:00
xfs_inode_fork.h xfs: remove XFS_IFEXTENTS 2021-04-15 09:35:51 -07:00
xfs_log_format.h xfs: convert xfs_sb_version_has checks to use mount features 2021-08-19 10:07:14 -07:00
xfs_log_recover.h xfs: refactor xfs_iget calls from log intent recovery 2021-08-09 15:57:59 -07:00
xfs_log_rlimit.c xfs: replace xfs_sb_version checks with feature flag checks 2021-08-19 10:07:12 -07:00
xfs_quota_defs.h xfs: remove the active vs running quota differentiation 2021-08-06 11:05:37 -07:00
xfs_refcount.c xfs: convert xfs_sb_version_has checks to use mount features 2021-08-19 10:07:14 -07:00
xfs_refcount.h xfs: make the record pointer passed to query_range functions const 2021-08-18 18:46:01 -07:00
xfs_refcount_btree.c xfs: introduce xfs_buf_daddr() 2021-08-19 10:07:14 -07:00
xfs_refcount_btree.h xfs: convert refcount btree cursor to use perags 2021-06-02 10:48:24 +10:00
xfs_rmap.c xfs: replace xfs_sb_version checks with feature flag checks 2021-08-19 10:07:12 -07:00
xfs_rmap.h xfs: make the record pointer passed to query_range functions const 2021-08-18 18:46:01 -07:00
xfs_rmap_btree.c xfs: introduce xfs_buf_daddr() 2021-08-19 10:07:14 -07:00
xfs_rmap_btree.h xfs: fix silly whitespace problems with kernel libxfs 2021-08-09 11:13:17 -07:00
xfs_rtbitmap.c xfs: make xfs_rtalloc_query_range input parameters const 2021-08-18 18:46:00 -07:00
xfs_sb.c xfs: convert bp->b_bn references to xfs_buf_daddr() 2021-08-19 10:07:15 -07:00
xfs_sb.h xfs: open code sb verifier feature checks 2021-08-19 10:07:13 -07:00
xfs_shared.h xfs: sort variable alphabetically to avoid repeated declaration 2021-06-02 14:54:09 -07:00
xfs_symlink_remote.c xfs: convert bp->b_bn references to xfs_buf_daddr() 2021-08-19 10:07:15 -07:00
xfs_trans_inode.c xfs: convert xfs_sb_version_has checks to use mount features 2021-08-19 10:07:14 -07:00
xfs_trans_resv.c xfs: convert xfs_sb_version_has checks to use mount features 2021-08-19 10:07:14 -07:00
xfs_trans_resv.h xfs: remove support for disabling quota accounting on a mounted file system 2021-08-06 11:05:36 -07:00
xfs_trans_space.h xfs: convert xfs_sb_version_has checks to use mount features 2021-08-19 10:07:14 -07:00
xfs_types.c xfs: replace xfs_sb_version checks with feature flag checks 2021-08-19 10:07:12 -07:00
xfs_types.h xfs: resolve fork names in trace output 2021-08-19 10:07:10 -07:00