linux-kernel - [PATCH] btrfs: relocation: fix misplaced barrier in reloc_root_is

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20210526060947.26159-1-baptiste.lepers@gmail.com>
Date:   Wed, 26 May 2021 16:09:47 +1000
From:   Baptiste Lepers <baptiste.lepers@...il.com>
To:     unlisted-recipients:; (no To-header on input)
Cc:     Baptiste Lepers <baptiste.lepers@...il.com>,
        Chris Mason <clm@...com>, Josef Bacik <josef@...icpanda.com>,
        David Sterba <dsterba@...e.com>, Qu Wenruo <wqu@...e.com>,
        linux-btrfs@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH] btrfs: relocation: fix misplaced barrier in reloc_root_is_dead

Fix a misplaced barrier in reloc_root_is_dead. The
BTRFS_ROOT_DEAD_RELOC_TREE bit should be checked before accessing
reloc_root.

The fix forces the order documented in the original commit:
"In the cross section C-D, either caller gets the DEAD bit set, avoiding
access reloc_root no matter if it's safe or not.  Or caller get the DEAD
bit cleared, then access reloc_root, which is already NULL, nothing will
be wrong."

static bool reloc_root_is_dead()
    smp_rmb(); <--- misplaced
    if (test_bit(BTRFS_ROOT_DEAD_RELOC_TREE, &root->state))
          return true;
    return false;
}

static bool have_reloc_root(struct btrfs_root *root)
{
       if (reloc_root_is_dead(root))
               return false;
       <--- the barrier should happen here
       if (!root->reloc_root)
               return false;
       return true;
}

Fixes: 6282675e6708e ("btrfs: relocation: fix reloc_root lifespan and access")
Signed-off-by: Baptiste Lepers <baptiste.lepers@...il.com>
---
 fs/btrfs/relocation.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index b70be2ac2e9e..8cddcce56bf4 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -289,15 +289,14 @@ static int update_backref_cache(struct btrfs_trans_handle *trans,
 
 static bool reloc_root_is_dead(struct btrfs_root *root)
 {
+	bool is_dead = test_bit(BTRFS_ROOT_DEAD_RELOC_TREE, &root->state);
 	/*
 	 * Pair with set_bit/clear_bit in clean_dirty_subvols and
 	 * btrfs_update_reloc_root. We need to see the updated bit before
 	 * trying to access reloc_root
 	 */
 	smp_rmb();
-	if (test_bit(BTRFS_ROOT_DEAD_RELOC_TREE, &root->state))
-		return true;
-	return false;
+	return is_dead;
 }
 
 /*
-- 
2.17.1