linux-kernel - Re: [PATCH] writeback: Avoid grabbing the wb if the we don't add it to dirty list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 14 Jun 2022 17:40:39 +0100
From:   Suzuki K Poulose <suzuki.poulose@....com>
To:     Jan Kara <jack@...e.cz>
Cc:     Alexander Viro <viro@...iv.linux.org.uk>,
        linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-arm-kernel@...ts.infradead.org, stable@...r.kernel.org,
        Jchao Sun <sunjunchao2870@...il.com>
Subject: Re: [PATCH] writeback: Avoid grabbing the wb if the we don't add it
 to dirty list

On 14/06/2022 15:29, Jan Kara wrote:
> On Tue 14-06-22 13:46:18, Suzuki K Poulose wrote:
>> Commit 10e14073107d moved grabbing the wb for an inode early enough,
>> skipping the checks whether if this inode needs to be really added
>> to the dirty list (backed by blockdev or unhashed inode). This causes
>> a crash with kdevtmpfs as below, on an arm64 Juno board, as below:
>>
>> [    1.446493] printk: console [ttyAMA0] printing thread started
>> [    1.447195] printk: bootconsole [pl11] printing thread stopped
>> [    1.467193] Unable to handle kernel paging request at virtual address ffff800871242000
>> [    1.467793] Mem abort info:
>> [    1.468093]   ESR = 0x0000000096000005
>> [    1.468413]   EC = 0x25: DABT (current EL), IL = 32 bits
>> [    1.468741]   SET = 0, FnV = 0
>> [    1.469093]   EA = 0, S1PTW = 0
>> [    1.469396]   FSC = 0x05: level 1 translation fault
>> [    1.470493] Data abort info:
>> [    1.470793]   ISV = 0, ISS = 0x00000005
>> [    1.471093]   CM = 0, WnR = 0
>> [    1.471444] swapper pgtable: 4k pages, 48-bit VAs, 	pgdp=0000000081c10000
>> [    1.471798] [ffff800871242000] pgd=10000008fffff003,
>> p4d=10000008fffff003, pud=0000000000000000
>> [    1.472836] Internal error: Oops: 96000005 [#1] PREEMPT SMP
>> [    1.472918] Modules linked in:
>> [    1.473085] CPU: 1 PID: 35 Comm: kdevtmpfs Tainted: G T 5.19.0-rc1+ #49
>> [    1.473246] Hardware name: Foundation-v8A (DT)
>> [    1.473345] pstate: 40400009 (nZcv daif +PAN -UAO -TCO -DIT 	-SSBS BTYPE=--)
>> [    1.473493] pc : locked_inode_to_wb_and_lock_list+0xbc/0x2a4
>> [    1.473656] lr : locked_inode_to_wb_and_lock_list+0x8c/0x2a4
>> [    1.473820] sp : ffff80000b77bc10
>> [    1.473901] x29: ffff80000b77bc10 x28: 0000000000000001 x27: 0000000000000004
>> [    1.474193] x26: 0000000000000000 x25: ffff000800888600 x24: ffff0008008885e8
>> [    1.474393] x23: ffff80000848ddd4 x22: ffff80000a754f30 x21: ffff80000a7eaaf0
>> [    1.474693] x20: ffff000800888150 x19: ffff80000b6a4150 x18: ffff80000ac3ac00
>> [    1.474917] x17: 0000000070526bee x16: 000000003ac581ee x15: ffff80000ac42660
>> [    1.475195] x14: 0000000000000000 x13: 0000000000007a60 x12: 0000000000000002
>> [    1.475428] x11: ffff80000a7eaaf0 x10: 0000000000000004 x9 : 000000008845fe88
>> [    1.475622] x8 : ffff000800868000 x7 : ffff80000ab98000 x6 : 00000000114514e2
>> [    1.475893] x5 : 0000000000000000 x4 : 0000000000020019 x3 : 0000000000000001
>> [    1.476113] x2 : ffff800871242000 x1 : ffff800871242000 x0 : ffff000800868000
>> [    1.476393] Call trace:
>> [    1.476493]  locked_inode_to_wb_and_lock_list+0xbc/0x2a4
>> [    1.476605]  __mark_inode_dirty+0x3d8/0x6e0
>> [    1.476793]  simple_setattr+0x5c/0x84
>> [    1.476933]  notify_change+0x3ec/0x470
>> [    1.477096]  handle_create+0x1b8/0x224
>> [    1.477193]  devtmpfsd+0x98/0xf8
>> [    1.477342]  kthread+0x124/0x130
>> [    1.477512]  ret_from_fork+0x10/0x20
>> [    1.477670] Code: b9000802 d2800023 d53cd042 8b020021 (f823003f)
>> [    1.477793] ---[ end trace 0000000000000000 ]---
>> [    1.478093] note: kdevtmpfs[35] exited with preempt_count 2
>>
>> The problem was bisected to the above commit and moving the bail check
>> early solves the problem for me.
>>
>> Fixes: 10e14073107d ("writeback: Fix inode->i_io_list not be protected by inode->i_lock error")
>> CC: stable@...r.kernel.org
>> Cc: Jchao Sun <sunjunchao2870@...il.com>
>> Cc: Jan Kara <jack@...e.cz>
>> Signed-off-by: Suzuki K Poulose <suzuki.poulose@....com>
> 
> Thanks for debugging this! The problem actually is not that we cannot call
> locked_inode_to_wb_and_lock_list() for devtmpfs inode. The problem is that
> we get called so early during boot that noop_backing_dev_info is not
> initialized yet and that breaks the code. But I agree the quick fix for
> this breakage is to exclude unhashed inodes early in __mark_inode_dirty().
> I'll update the changelog and code comment (and cleanup the condition when
> moving it) and push the result to my tree.

Thanks for the clarification. Btw, here is another report, that is fixed 
with the same patch [0].

[0] 
https://lore.kernel.org/linux-arm-kernel/YqiJH1phG%2FLWu9bs@monolith.localdoman/

Suzuki