Qu Wenruo e0956dd95d btrfs: unlock newly allocated extent buffer after error ... commit 19ea40dddf upstream. [BUG] There is a bug report that injected ENOMEM error could leave a tree block locked while we return to user-space: BTRFS info (device loop0): enabling ssd optimizations FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 7579 Comm: syz-executor Not tainted 5.15.0-rc1 #16 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x8d/0xcf lib/dump_stack.c:106 fail_dump lib/fault-inject.c:52 [inline] should_fail+0x13c/0x160 lib/fault-inject.c:146 should_failslab+0x5/0x10 mm/slab_common.c:1328 slab_pre_alloc_hook.constprop.99+0x4e/0xc0 mm/slab.h:494 slab_alloc_node mm/slub.c:3120 [inline] slab_alloc mm/slub.c:3214 [inline] kmem_cache_alloc+0x44/0x280 mm/slub.c:3219 btrfs_alloc_delayed_extent_op fs/btrfs/delayed-ref.h:299 [inline] btrfs_alloc_tree_block+0x38c/0x670 fs/btrfs/extent-tree.c:4833 __btrfs_cow_block+0x16f/0x7d0 fs/btrfs/ctree.c:415 btrfs_cow_block+0x12a/0x300 fs/btrfs/ctree.c:570 btrfs_search_slot+0x6b0/0xee0 fs/btrfs/ctree.c:1768 btrfs_insert_empty_items+0x80/0xf0 fs/btrfs/ctree.c:3905 btrfs_new_inode+0x311/0xa60 fs/btrfs/inode.c:6530 btrfs_create+0x12b/0x270 fs/btrfs/inode.c:6783 lookup_open+0x660/0x780 fs/namei.c:3282 open_last_lookups fs/namei.c:3352 [inline] path_openat+0x465/0xe20 fs/namei.c:3557 do_filp_open+0xe3/0x170 fs/namei.c:3588 do_sys_openat2+0x357/0x4a0 fs/open.c:1200 do_sys_open+0x87/0xd0 fs/open.c:1216 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x34/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x46ae99 Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f46711b9c48 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 RAX: ffffffffffffffda RBX: 000000000078c0a0 RCX: 000000000046ae99 RDX: 0000000000000000 RSI: 00000000000000a1 RDI: 0000000020005800 RBP: 00007f46711b9c80 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000017 R13: 0000000000000000 R14: 000000000078c0a0 R15: 00007ffc129da6e0 ================================================ WARNING: lock held when returning to user space! 5.15.0-rc1 #16 Not tainted ------------------------------------------------ syz-executor/7579 is leaving the kernel with locks still held! 1 lock held by syz-executor/7579: #0: ffff888104b73da8 (btrfs-tree-01/1){+.+.}-{3:3}, at: __btrfs_tree_lock+0x2e/0x1a0 fs/btrfs/locking.c:112 [CAUSE] In btrfs_alloc_tree_block(), after btrfs_init_new_buffer(), the new extent buffer @buf is locked, but if later operations like adding delayed tree ref fail, we just free @buf without unlocking it, resulting above warning. [FIX] Unlock @buf in out_free_buf: label. Reported-by: Hao Sun <sunhao.th@gmail.com> Link: https://lore.kernel.org/linux-btrfs/CACkBjsZ9O6Zr0KK1yGn=1rQi6Crh1yeCRdTSBxx9R99L4xdn-Q@mail.gmail.com/ CC: stable@vger.kernel.org # 5.4+ Signed-off-by: Qu Wenruo <wqu@suse.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com> Signed-off-by: Denis Efremov <denis.e.efremov@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-03-16 12:57:09 +01:00
..
tests	Btrfs: fix selftests failure due to uninitialized i_mode in test inodes	2020-12-29 13:47:07 +01:00
acl.c	Btrfs: setup a nofs context for memory allocation at __btrfs_set_acl	2019-03-23 14:35:21 +01:00
async-thread.c	btrfs: fix memory ordering between normal and ordered work functions	2021-11-26 11:40:40 +01:00
async-thread.h	Btrfs: fix crash during unmount due to race with delayed inode workers	2020-04-24 08:00:48 +02:00
backref.c	btrfs: remove BUG_ON(!eie) in find_parent_nodes	2022-01-27 09:00:56 +01:00
backref.h	btrfs: backref, add tracepoints for prelim_ref insertion and merging	2017-08-16 16:12:01 +02:00
btrfs_inode.h	Btrfs: fix fsync of files with multiple hard links in new directories	2019-01-09 17:14:50 +01:00
check-integrity.c	btrfs: fix possible NULL-pointer dereference in integrity checks	2020-02-28 16:36:05 +01:00
check-integrity.h
compression.c	btrfs: mark compressed range uptodate only if all bio succeed	2021-08-08 08:53:29 +02:00
compression.h	btrfs: correctly validate compression type	2019-09-19 09:08:03 +02:00
ctree.c	btrfs: fix race when picking most recent mod log operation for an old root	2021-05-22 10:57:20 +02:00
ctree.h	Btrfs: fix unexpected failure of nocow buffered writes after snapshotting when low on space	2020-10-14 09:51:11 +02:00
dedupe.h
delayed-inode.c	btrfs: abort transaction if we fail to update the delayed inode	2021-07-20 16:17:32 +02:00
delayed-inode.h
delayed-ref.c	Btrfs: fix race between adding and putting tree mod seq elements and nodes	2020-02-14 16:32:19 -05:00
delayed-ref.h	Btrfs: return old and new total ref mods when adding delayed refs	2017-06-29 20:17:01 +02:00
dev-replace.c	btrfs: Ensure replaced device doesn't have pending chunk allocation	2019-07-10 09:54:41 +02:00
dev-replace.h
dir-item.c	btrfs: fix validation of XATTR_ITEM dir items	2017-06-29 20:06:11 +02:00
disk-io.c	btrfs: check-integrity: fix a warning on write caching disabled disk	2021-12-08 08:46:54 +01:00
disk-io.h	btrfs: use named constant for bdev blocksize	2017-08-16 16:12:04 +02:00
export.c	btrfs: export helpers for subvolume name/id resolution	2020-08-26 10:29:54 +02:00
export.h	btrfs: export helpers for subvolume name/id resolution	2020-08-26 10:29:54 +02:00
extent-tree.c	btrfs: unlock newly allocated extent buffer after error	2022-03-16 12:57:09 +01:00
extent_io.c	Btrfs: fix missing error return if writeback for extent buffer never started	2020-11-18 18:27:54 +01:00
extent_io.h	btrfs: fix potential deadlock in the search ioctl	2020-09-09 19:03:11 +02:00
extent_map.c	Btrfs: fix race between using extent maps and merging them	2020-02-28 16:35:53 +01:00
extent_map.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
file-item.c	btrfs: fix error handling in btrfs_del_csums	2021-06-10 12:43:51 +02:00
file.c	btrfs: always wait on ordered extents at fsync time	2021-10-27 09:51:39 +02:00
free-space-cache.c	btrfs: clarify error returns values in __load_free_space_cache	2021-03-03 18:22:43 +01:00
free-space-cache.h
free-space-tree.c	btrfs: pass fs_info to btrfs_del_root instead of tree_root	2017-08-21 17:49:54 +02:00
free-space-tree.h	btrfs: expose internal free space tree routine only if sanity tests are enabled	2017-08-18 16:36:29 +02:00
hash.c
hash.h
inode-item.c
inode-map.c	Btrfs: fix inode cache waiters hanging on path allocation failure	2020-01-27 14:46:46 +01:00
inode-map.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
inode.c	Revert "btrfs: compression: don't try to compress if we don't have enough pages"	2021-09-22 11:45:16 +02:00
ioctl.c	btrfs: fix metadata extent leak after failure to create subvolume	2021-05-22 10:57:15 +02:00
Kconfig	btrfs: disable build on platforms having page size 256K	2021-07-20 16:17:32 +02:00
locking.c
locking.h
lzo.c	btrfs: switch to kvmalloc and GFP_KERNEL in lzo/zlib alloc_workspace	2017-06-19 18:26:02 +02:00
Makefile	btrfs: Move leaf and node validation checker to tree-checker.c	2018-12-05 19:41:12 +01:00
math.h
ordered-data.c	Btrfs: fix btrfs_wait_ordered_range() so that it waits for all ordered extents	2020-02-28 16:36:14 +01:00
ordered-data.h	btrfs: fix integer overflow in calc_reclaim_items_nr	2017-06-29 20:17:02 +02:00
orphan.c
print-tree.c	btrfs: require only sector size alignment for parent eb bytenr	2020-09-23 10:46:30 +02:00
print-tree.h	btrfs: get fs_info from eb in btrfs_print_tree, remove argument	2017-08-16 16:12:03 +02:00
props.c	btrfs: correctly validate compression type	2019-09-19 09:08:03 +02:00
props.h
qgroup.c	btrfs: fix transaction leak and crash after RO remount caused by qgroup rescan	2021-01-23 15:48:42 +01:00
qgroup.h	btrfs: qgroup: Avoid calling qgroup functions if qgroup is not enabled	2018-11-13 11:15:13 -08:00
raid56.c	btrfs: fix raid6 qstripe kmap	2021-03-11 13:51:04 +01:00
raid56.h
rcu-string.h
reada.c	btrfs: fix use-after-free on readahead extent after failure to create it	2020-11-05 11:07:00 +01:00
relocation.c	btrfs: convert logic BUG_ON()'s in replace_path to ASSERT()'s	2021-05-22 10:57:17 +02:00
root-tree.c	btrfs: Don't panic when we can't find a root key	2019-05-31 06:47:20 -07:00
scrub.c	btrfs: don't prematurely free work in scrub_missing_raid56_worker()	2019-12-31 12:37:53 +01:00
send.c	btrfs: send: in case of IO error log it	2022-02-23 11:57:33 +01:00
send.h
struct-funcs.c	btrfs: struct-funcs, constify readers	2017-08-16 14:19:53 +02:00
super.c	btrfs: fix transaction leak and crash after RO remount caused by qgroup rescan	2021-01-23 15:48:42 +01:00
sysfs.c	btrfs: sysfs: use NOFS for device creation	2020-08-26 10:29:54 +02:00
sysfs.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
transaction.c	btrfs: clear defrag status of a root if starting transaction fails	2021-07-20 16:17:28 +02:00
transaction.h
tree-checker.c	btrfs: tree-checker: Don't check max block group size as current max chunk size limit is unreliable	2018-12-08 13:03:39 +01:00
tree-checker.h	btrfs: tree-checker: Fix false panic for sanity test	2018-12-05 19:41:12 +01:00
tree-defrag.c
tree-log.c	btrfs: fix lost error handling when replaying directory deletes	2021-11-26 11:40:22 +01:00
tree-log.h
ulist.c
ulist.h
uuid-tree.c	btrfs: handle ENOENT in btrfs_uuid_tree_iterate	2019-12-31 12:36:44 +01:00
volumes.c	btrfs: tree-checker: Enhance chunk checker to validate chunk profile	2020-12-02 08:34:40 +01:00
volumes.h	btrfs: Remove btrfs_bio::flags member	2019-12-17 20:39:16 +01:00
xattr.c	btrfs: Check name_len with boundary in verify dir_item	2017-06-21 19:16:04 +02:00
xattr.h
zlib.c	btrfs: switch to kvmalloc and GFP_KERNEL in lzo/zlib alloc_workspace	2017-06-19 18:26:02 +02:00
zstd.c	btrfs: Add zstd support	2017-08-15 09:02:09 -07:00