linux-kernel - Re: [PATCH -next] fs/btrfs: Fix unlocking in btrfs_ref_tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 15 May 2020 09:36:49 +0000
From:   Johannes Thumshirn <Johannes.Thumshirn@....com>
To:     Bo YU <tsu.yubo@...il.com>
CC:     "clm@...com" <clm@...com>,
        "josef@...icpanda.com" <josef@...icpanda.com>,
        "sterba@...e.com" <sterba@...e.com>,
        "linux-btrfs@...r.kernel.org" <linux-btrfs@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH -next] fs/btrfs: Fix unlocking in btrfs_ref_tree_mod

On 15/05/2020 11:24, Bo YU wrote:
> Hi,
> On Fri, May 15, 2020 at 5:03 PM Johannes Thumshirn
> <Johannes.Thumshirn@....com> wrote:
>>
>> On 15/05/2020 04:17, Bo YU wrote:
>>> It adds spin_lock() in add_block_entry() but out path does not unlock
>>> it.
>>
>> Which call path doesn't unlock it? There is an out_unlock label with a
>> spin_unlock() right above your insert. So either coverity messed something
>> up or the call path that needs the unlock has to jump to out_unlock instead
>> of out.
> This is out label without unlocking it. It will be offered spin_lock
> in add_block_entry()
> for be. But here I was worried about that unlock it in if() whether it
> is right or not.
> 

No add_block_entry() returns with the ref_verify_lock held on success only:
static struct block_entry *add_block_entry(struct btrfs_fs_info *fs_info,
                                           u64 bytenr, u64 len,                                                                                                                      
                                           u64 root_objectid)
{               
        struct block_entry *be = NULL, *exist;                                                                                                                                       
        struct root_entry *re = NULL;                                                                                                                                                
                        
        re = kzalloc(sizeof(struct root_entry), GFP_KERNEL);                                                                                                                         
        be = kzalloc(sizeof(struct block_entry), GFP_KERNEL);                                                                                                                        
        if (!be || !re) {
                kfree(re);
                kfree(be);
                return ERR_PTR(-ENOMEM);                                                                                                                                        
        }       
        be->bytenr = bytenr;
        be->len = len;  
                        
        re->root_objectid = root_objectid;
        re->num_refs = 0;
                        
        spin_lock(&fs_info->ref_verify_lock);                          
[...]


While the code caller checks for an error:

if (action == BTRFS_ADD_DELAYED_EXTENT) {
                /*
                 * For subvol_create we'll just pass in whatever the parent root
                 * is and the new root objectid, so let's not treat the passed
                 * in root as if it really has a ref for this bytenr.
                 */
                be = add_block_entry(fs_info, bytenr, num_bytes, ref_root);
                if (IS_ERR(be)) {
                        kfree(ref);
                        kfree(ra);
                        ret = PTR_ERR(be);
                        goto out;
                }

So if add_block_entry returns -ENOMEM it didn't take the lock and thus no unlock
is needed.

Or did I miss something?