linux-kernel - [PATCH] Fix WARNING: suspicious RCU usage in bch2_bucket_ref

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20240710-bug10-v1-1-f1f8cf98f7c0@gmail.com>
Date: Wed, 10 Jul 2024 08:33:24 -0700
From: Pei Li <peili.dev@...il.com>
To: Kent Overstreet <kent.overstreet@...ux.dev>, 
 Brian Foster <bfoster@...hat.com>
Cc: linux-bcachefs@...r.kernel.org, linux-kernel@...r.kernel.org, 
 skhan@...uxfoundation.org, syzkaller-bugs@...glegroups.com, 
 linux-kernel-mentees@...ts.linuxfoundation.org, 
 syzbot+e74fea078710bbca6f4b@...kaller.appspotmail.com, 
 Pei Li <peili.dev@...il.com>
Subject: [PATCH] Fix WARNING: suspicious RCU usage in
 bch2_bucket_ref_update

When dereference ca->bucket_gens, we are expecting one of the three
locks to be hold if ca->fs is not NULL.

This patch acquires mark_lock before entering __mark_pointer()

Note: testing is done by a robot and is best-effort only.

To: Kent Overstreet <kent.overstreet@...ux.dev>
To: Brian Foster <bfoster@...hat.com>
Cc: linux-bcachefs@...r.kernel.org
Cc: linux-kernel@...r.kernel.org
Cc: skhan@...uxfoundation.org
Cc: syzkaller-bugs@...glegroups.com
Cc: linux-kernel-mentees@...ts.linuxfoundation.org
Reported-by: syzbot+e74fea078710bbca6f4b@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e74fea078710bbca6f4b
Tested-by: syzbot+e74fea078710bbca6f4b@...kaller.appspotmail.com
Signed-off-by: Pei Li <peili.dev@...il.com>
---
Syzbot reported the following warning:

fs/bcachefs/buckets.h:107 suspicious rcu_dereference_check() usage!

When dereference ca->bucket_gens, we are expecting one of the three
locks to be hold if ca->fs is not NULL.

This patch acquires mark_lock before entering __mark_pointer()

Tested on:

commit:         34afb82a Merge tag '6.10-rc6-smb3-server-fixes' of git..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1492e87e980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=42a432cfd0e579e0
dashboard link: https://syzkaller.appspot.com/bug?extid=e74fea078710bbca6f4b
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=15e2e87e980000

Note: testing is done by a robot and is best-effort only.
---
 fs/bcachefs/buckets.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/bcachefs/buckets.c b/fs/bcachefs/buckets.c
index 743d57eba760..03147e46dc47 100644
--- a/fs/bcachefs/buckets.c
+++ b/fs/bcachefs/buckets.c
@@ -1033,8 +1033,14 @@ static int bch2_trigger_pointer(struct btree_trans *trans,
 
 	if (flags & BTREE_TRIGGER_transactional) {
 		struct bkey_i_alloc_v4 *a = bch2_trans_start_alloc_update(trans, bucket);
+
+		percpu_down_read(&c->mark_lock);
+
 		ret = PTR_ERR_OR_ZERO(a) ?:
 			__mark_pointer(trans, ca, k, &p.ptr, *sectors, bp.data_type, &a->v);
+
+		percpu_up_read(&c->mark_lock);
+
 		if (ret)
 			goto err;
 

---
base-commit: 256abd8e550ce977b728be79a74e1729438b4948
change-id: 20240709-bug10-6b354d193f20

Best regards,
-- 
Pei Li <peili.dev@...il.com>