linux-kernel - Re: [PATCH] gfs2: fix kernel BUG in gfs2_quota

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAHc6FU4XREidNxwtW8m2YnsBGfANdH4W8b56KOeMNLjEEU_WGQ@mail.gmail.com>
Date:   Tue, 5 Dec 2023 14:51:34 +0100
From:   Andreas Gruenbacher <agruenba@...hat.com>
To:     Edward Adam Davis <eadavis@...com>
Cc:     syzbot+3b6e67ac2b646da57862@...kaller.appspotmail.com,
        gfs2@...ts.linux.dev, linux-fsdevel@...r.kernel.org,
        linux-kernel@...r.kernel.org, rpeterso@...hat.com,
        syzkaller-bugs@...glegroups.com
Subject: Re: [PATCH] gfs2: fix kernel BUG in gfs2_quota_cleanup

On Sat, Dec 2, 2023 at 10:34 AM Edward Adam Davis <eadavis@...com> wrote:
> [Analysis]
> When the task exits, it will execute cleanup_mnt() to recycle the mounted gfs2
> file system, but it performs a system call fsconfig(4, FSCONFIG_CMD_RECONFIGURE,
> NULL, NULL, 0) before executing the task exit operation.
>
> This will execute the following kernel path to complete the setting of
> SDF_JOURNAL_LIVE for sd_flags:
>
> SYSCALL_DEFINE5(fsconfig, ..)->
>         vfs_fsconfig_locked()->
>                 vfs_cmd_reconfigure()->
>                         gfs2_reconfigure()->
>                                 gfs2_make_fs_rw()->
>                                         set_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags);
>
> [Fix]
> Add SDF_NORECOVERY check in gfs2_quota_cleanup() to avoid checking
> SDF_JOURNAL_LIVE on the path where gfs2 is being unmounted.

Thanks for this fix, I've applied it and added the following tag:

Fixes: f66af88e3321 ("gfs2: Stop using gfs2_make_fs_ro for withdraw")

>
> Reported-and-tested-by: syzbot+3b6e67ac2b646da57862@...kaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <eadavis@...com>
> ---
>  fs/gfs2/quota.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
> index 95dae7838b4e..af32dd8a72fa 100644
> --- a/fs/gfs2/quota.c
> +++ b/fs/gfs2/quota.c
> @@ -1505,7 +1505,8 @@ void gfs2_quota_cleanup(struct gfs2_sbd *sdp)
>         LIST_HEAD(dispose);
>         int count;
>
> -       BUG_ON(test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags));
> +       BUG_ON(!test_bit(SDF_NORECOVERY, &sdp->sd_flags) &&
> +               test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags));
>
>         spin_lock(&qd_lock);
>         list_for_each_entry(qd, &sdp->sd_quota_list, qd_list) {
> --
> 2.43.0

Thanks,
Andreas