4.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Sterba dsterba@suse.com
[ Upstream commit 81ffd56b5745355b70d54ca4e1bdd0d64a66ff9f ]
Technically this extends the critical section covered by uuid_mutex to:
- parse early mount options -- here we can call device scan on paths that can be passed as 'device=/dev/...'
- scan the device passed to mount
- open the devices related to the fs_devices -- this increases fs_devices::opened
The race can happen when mount calls one of the scans and there's another one called eg. by mkfs or 'btrfs dev scan':
Mount Scan ----- ---- scan_one_device (dev1, fsid1) scan_one_device (dev2, fsid1) add the device free stale devices fsid1 fs_devices::opened == 0 find fsid1:dev1 free fsid1:dev1 if it's the last one, free fs_devices of fsid1 too
open_devices (dev1, fsid1) dev1 not found
When fixed, the uuid mutex will make sure that mount will increase fs_devices::opened and this will not be touched by the racing scan ioctl.
Reported-and-tested-by: syzbot+909a5177749d7990ffa4@syzkaller.appspotmail.com Reported-and-tested-by: syzbot+ceb2606025ec1cc3479c@syzkaller.appspotmail.com Reviewed-by: Anand Jain anand.jain@oracle.com Signed-off-by: David Sterba dsterba@suse.com
Signed-off-by: Sasha Levin alexander.levin@microsoft.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/btrfs/super.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
--- a/fs/btrfs/super.c +++ b/fs/btrfs/super.c @@ -1557,19 +1557,19 @@ static struct dentry *btrfs_mount_root(s
mutex_lock(&uuid_mutex); error = btrfs_parse_early_options(data, mode, fs_type, &fs_devices); - mutex_unlock(&uuid_mutex); - if (error) + if (error) { + mutex_unlock(&uuid_mutex); goto error_fs_info; + }
- mutex_lock(&uuid_mutex); error = btrfs_scan_one_device(device_name, mode, fs_type, &fs_devices); - mutex_unlock(&uuid_mutex); - if (error) + if (error) { + mutex_unlock(&uuid_mutex); goto error_fs_info; + }
fs_info->fs_devices = fs_devices;
- mutex_lock(&uuid_mutex); error = btrfs_open_devices(fs_devices, mode, fs_type); mutex_unlock(&uuid_mutex); if (error)