linux-kernel - Re: mnt_list corruption triggered during btrfs/326

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAPjX3FcbhvB=qzeJjNkW+XdS3_Xrxn_K6e7vyzMqS0WLbXFgNg@mail.gmail.com>
Date: Tue, 7 Jan 2025 16:04:07 +0100
From: Daniel Vacek <neelx@...e.com>
To: Qu Wenruo <wqu@...e.com>
Cc: Christian Brauner <brauner@...nel.org>, Qu Wenruo <quwenruo.btrfs@....com>, 
	linux-fsdevel@...r.kernel.org, linux-btrfs <linux-btrfs@...r.kernel.org>, 
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: mnt_list corruption triggered during btrfs/326

On Mon, 6 Jan 2025 at 23:00, Qu Wenruo <wqu@...e.com> wrote:
> 在 2025/1/7 08:20, Daniel Vacek 写道:
> > On Sat, 4 Jan 2025 at 23:26, Qu Wenruo <wqu@...e.com> wrote:
> >> 在 2025/1/4 21:56, Christian Brauner 写道:
> >>> Can you please try and reproduce this with
> >>> commit 211364bef4301838b2e1 ("fs: kill MNT_ONRB")
> >>> from the vfs-6.14.mount branch in
> >>> https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git ?
> >>>
> >>
> >> After the initial 1000 runs (with 951a3f59d268 ("btrfs: fix mount
> >> failure due to remount races") cherry picked, or it won't pass that test
> >> case), there is no crash nor warning so far.
> >>
> >> It's already the best run so far, but I'll keep it running for another
> >> day or so just to be extra safe.
> >>
> >> So I guess the offending commit is 2eea9ce4310d ("mounts: keep list of
> >> mounts in an rbtree")?
> >
> > This one was merged in v6.8 - why would it cause crashes only now?
>
> Because in v6.8 btrfs also migrated to the new mount API, which caused
> the ro/rw mount race which can fail the mount.
>
> That's exactly why the test case is introduced.
>
> Before the recent ro/rw mount fix, the test case won't go that far but
> error out early so we don't have enough loops to trigger the bug.

So the bug has been there since v6.8, IIUC. In that case I think
211364bef430 ("fs: kill MNT_ONRB") should add Fixes: 2eea9ce4310d
("mounts: keep list of mounts in an rbtree") and CC stable?

--nX