linux-kernel - [RESEND PATCH] Fix sysrq emergency thaw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <5823da614460b8c40809e6e0a6de172a9c4f4611.1468965479.git.cggong@fb.com>
Date:   Fri, 2 Sep 2016 15:29:51 -0700
From:   Charles Gong <cggong@...com>
To:     Alexander Viro <viro@...iv.linux.org.uk>
CC:     <linux-fsdevel@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        Pavel Machek <pavel@....cz>, <kernel-team@...com>,
        Christoph Hellwig <hch@....de>, Charles Gong <cggong@...com>
Subject: [RESEND PATCH] Fix sysrq emergency thaw

"SYSRQ + J" triggers a call to emergency_thaw_all(). Currently, this
is an infinite loop. Once we trigger it, we'll need to do a hard
power-cycle. There are users reporting this bug from 2012 to 2016, for
example, at https://bugzilla.kernel.org/show_bug.cgi?id=47741.

This happens because thaw_bdev() fails to return -EINVAL in the
non-frozen case, so fix it so that do_one_thaw() can recognize this case
and quit from looping. I checked that none of the other thaw_bdev()
callers check the return value.

The regression was introduced in commit 4504230a7156 ("freeze_bdev: grab
active reference to frozen superblocks").

Reviewed-by: Chris Mason <clm@...com>
Acked-by: Pavel Machek <pavel@....cz>
Signed-off-by: Charles Gong <cggong@...com>
---
 fs/block_dev.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/fs/block_dev.c b/fs/block_dev.c
index 71ccab1..14f015e 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -301,14 +301,12 @@ int thaw_bdev(struct block_device *bdev, struct super_block *sb)
 		error = sb->s_op->thaw_super(sb);
 	else
 		error = thaw_super(sb);
-	if (error) {
+	if (error)
 		bdev->bd_fsfreeze_count++;
-		mutex_unlock(&bdev->bd_fsfreeze_mutex);
-		return error;
-	}
+
 out:
 	mutex_unlock(&bdev->bd_fsfreeze_mutex);
-	return 0;
+	return error;
 }
 EXPORT_SYMBOL(thaw_bdev);

-- 
2.8.0.rc2