Andreas Gruenbacher f66af88e33 gfs2: Stop using gfs2_make_fs_ro for withdraw ... [ 81.372851][ T5532] CPU: 1 PID: 5532 Comm: syz-executor.0 Not tainted 6.2.0-rc1-syzkaller-dirty #0 [ 81.382080][ T5532] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 [ 81.392343][ T5532] Call Trace: [ 81.395654][ T5532] <TASK> [ 81.398603][ T5532] dump_stack_lvl+0x1b1/0x290 [ 81.418421][ T5532] gfs2_assert_warn_i+0x19a/0x2e0 [ 81.423480][ T5532] gfs2_quota_cleanup+0x4c6/0x6b0 [ 81.428611][ T5532] gfs2_make_fs_ro+0x517/0x610 [ 81.457802][ T5532] gfs2_withdraw+0x609/0x1540 [ 81.481452][ T5532] gfs2_inode_refresh+0xb2d/0xf60 [ 81.506658][ T5532] gfs2_instantiate+0x15e/0x220 [ 81.511504][ T5532] gfs2_glock_wait+0x1d9/0x2a0 [ 81.516352][ T5532] do_sync+0x485/0xc80 [ 81.554943][ T5532] gfs2_quota_sync+0x3da/0x8b0 [ 81.559738][ T5532] gfs2_sync_fs+0x49/0xb0 [ 81.564063][ T5532] sync_filesystem+0xe8/0x220 [ 81.568740][ T5532] generic_shutdown_super+0x6b/0x310 [ 81.574112][ T5532] kill_block_super+0x79/0xd0 [ 81.578779][ T5532] deactivate_locked_super+0xa7/0xf0 [ 81.584064][ T5532] cleanup_mnt+0x494/0x520 [ 81.593753][ T5532] task_work_run+0x243/0x300 [ 81.608837][ T5532] exit_to_user_mode_loop+0x124/0x150 [ 81.614232][ T5532] exit_to_user_mode_prepare+0xb2/0x140 [ 81.619820][ T5532] syscall_exit_to_user_mode+0x26/0x60 [ 81.625287][ T5532] do_syscall_64+0x49/0xb0 [ 81.629710][ T5532] entry_SYSCALL_64_after_hwframe+0x63/0xcd In this backtrace, gfs2_quota_sync() takes quota data references and then calls do_sync(). Function do_sync() encounters filesystem corruption and withdraws the filesystem, which (among other things) calls gfs2_quota_cleanup(). Function gfs2_quota_cleanup() wrongly assumes that nobody is holding any quota data references anymore, and destroys all quota data objects. When gfs2_quota_sync() then resumes and dereferences the quota data objects it is holding, those objects are no longer there. Function gfs2_quota_cleanup() deals with resource deallocation and can easily be delayed until gfs2_put_super() in the case of a filesystem withdraw. In fact, most of the other work gfs2_make_fs_ro() does is unnecessary during a withdraw as well, so change signal_our_withdraw() to skip gfs2_make_fs_ro() and perform the necessary steps directly instead. Thanks to Edward Adam Davis <eadavis@sina.com> for the initial patches. Link: https://lore.kernel.org/all/0000000000002b5e2405f14e860f@google.com Reported-by: syzbot+3f6a670108ce43356017@syzkaller.appspotmail.com Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>		2023-09-05 15:58:17 +02:00
..
acl.c	fs: port acl to mnt_idmap	2023-01-19 09:24:28 +01:00
acl.h	fs: port ->set_acl() to pass mnt_idmap	2023-01-19 09:24:27 +01:00
aops.c	gfs2: low-memory forced flush fixes	2023-09-05 15:58:16 +02:00
aops.h	gfs2: support ludicrously large folios in gfs2_trans_add_databufs()	2023-06-19 16:19:30 -07:00
bmap.c	gfs: Don't use GFP_NOFS in gfs2_unstuff_dinode	2023-09-05 15:58:16 +02:00
bmap.h	gfs2: Eliminate gfs2_trim_blocks	2023-04-18 14:40:12 +02:00
dentry.c	Reinstate "GFS2: free disk inode which is deleted by remote node -V2"	2023-03-23 19:37:56 +01:00
dir.c	gfs2 fixes	2022-08-06 14:44:49 -07:00
dir.h	gfs2: Delete an unnecessary check before brelse()	2019-09-04 20:22:17 +02:00
export.c	Change calling conventions for filldir_t	2022-08-17 17:25:04 -04:00
file.c	gfs2: Don't use filemap_splice_read	2023-08-07 18:42:04 +02:00
gfs2.h
glock.c	gfs2: Rename SDF_DEACTIVATING to SDF_KILL	2023-09-05 15:58:16 +02:00
glock.h	gfs2: Remove LM_FLAG_PRIORITY flag	2023-09-05 15:58:16 +02:00
glops.c	gfs2: Rename SDF_DEACTIVATING to SDF_KILL	2023-09-05 15:58:16 +02:00
glops.h	gfs2: Split up gfs2_meta_sync into inode and rgrp versions	2020-10-29 22:16:46 +01:00
incore.h	gfs2: Rename SDF_DEACTIVATING to SDF_KILL	2023-09-05 15:58:16 +02:00
inode.c	gfs2: Use mapping->gfp_mask for metadata inodes	2023-09-05 15:58:15 +02:00
inode.h	fs: port ->permission() to pass mnt_idmap	2023-01-19 09:24:28 +01:00
Kconfig
lock_dlm.c	gfs2: Remove LM_FLAG_PRIORITY flag	2023-09-05 15:58:16 +02:00
log.c	gfs2: journal flush threshold fixes and cleanup	2023-09-05 15:58:16 +02:00
log.h	fs/gfs2: Use the enum req_op and blk_opf_t types	2022-07-14 12:14:32 -06:00
lops.c	gfs2: Use mapping->gfp_mask for metadata inodes	2023-09-05 15:58:15 +02:00
lops.h	fs/gfs2: Use the enum req_op and blk_opf_t types	2022-07-14 12:14:32 -06:00
main.c	gfs2: Register fs after creating workqueues	2022-09-20 17:53:54 +02:00
Makefile
meta_io.c	gfs2: replace obvious uses of b_page with b_folio	2023-01-18 17:12:40 -08:00
meta_io.h	gfs2: Use container_of() for gfs2_glock(aspace)	2022-05-24 21:29:14 +02:00
ops_fstype.c	gfs2: Rename SDF_DEACTIVATING to SDF_KILL	2023-09-05 15:58:16 +02:00
quota.c	gfs2: Free quota data objects synchronously	2023-09-05 15:58:17 +02:00
quota.h	gfs2: move privileged user check to gfs2_quota_lock_check	2020-05-08 18:47:58 +02:00
recovery.c	gfs2: Replace sd_freeze_state with SDF_FROZEN flag	2023-07-03 22:30:23 +02:00
recovery.h
rgrp.c	gfs2: Update rl_unlinked before releasing rgrp lock	2023-06-06 18:35:06 +02:00
rgrp.h	Merge part of branch 'for-next.instantiate' into for-next	2022-08-05 18:37:03 +02:00
super.c	gfs2: Stop using gfs2_make_fs_ro for withdraw	2023-09-05 15:58:17 +02:00
super.h	gfs2: Rework freeze / thaw logic	2023-07-03 22:25:02 +02:00
sys.c	gfs2: Rename SDF_DEACTIVATING to SDF_KILL	2023-09-05 15:58:16 +02:00
sys.h
trace_gfs2.h	gfs2: Remove 'first' trace_gfs2_promote argument	2021-10-25 08:42:19 +02:00
trans.c	gfs2: Fix freeze consistency check in gfs2_trans_add_meta	2023-08-07 18:40:51 +02:00
trans.h	Merge branches 'rgrp-glock-sharing' and 'gfs2-revoke' from https://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2.git	2021-02-23 18:54:22 +01:00
util.c	gfs2: Stop using gfs2_make_fs_ro for withdraw	2023-09-05 15:58:17 +02:00
util.h	gfs2: gfs2_freeze_lock_shared cleanup	2023-07-03 22:30:26 +02:00
xattr.c	fs: drop unused posix acl handlers	2023-03-06 09:57:12 +01:00
xattr.h