linux-kernel - Re: #syz test: bcache: Fix device removal failure when filesystem is read-only

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <67faaabf.050a0220.379d84.0012.GAE@google.com>
Date: Sat, 12 Apr 2025 11:02:39 -0700
From: syzbot <syzbot+aec9606169fbc3a12ca6@...kaller.appspotmail.com>
To: gshahrouzi@...il.com
Cc: gshahrouzi@...il.com, linux-kernel@...r.kernel.org, 
	syzkaller-bugs@...glegroups.com
Subject: Re: #syz test: bcache: Fix device removal failure when filesystem is read-only

> Try to remove device but fails
> Reinitialize reference counting for write operations for device
> Shut down the filesystem
> Make the filesystem read only
> 	Read-write bit is not set so it skips trying to make the filesystem read-only, implying that the filesystem is already in read-only mode.
> Encounter error because write operations are still assigned to a device
> When the filesystem is starting up, it tries setting it to set the filesystem to read-only but it’s already set.
> When failing to remove a device, it tries giving back write permissions to a device when the filesystem is read-only (not sure if this is nonsensical or not).
> Since a device has write permissions, it tries to remove them but fails because the filesystem is in read-only mode.
> So the fix here is to prevent it from giving the device write permissions if the filesystem is in read-only mode.
>
> Signed-off-by: Gabriel Shahrouzi <gshahrouzi@...il.com>
> ---
>  fs/bcachefs/super.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/fs/bcachefs/super.c b/fs/bcachefs/super.c
> index b79e80a435e09..788e870bfef6a 100644
> --- a/fs/bcachefs/super.c
> +++ b/fs/bcachefs/super.c
> @@ -1757,7 +1757,8 @@ int bch2_dev_remove(struct bch_fs *c, struct bch_dev *ca, int flags)
>  	up_write(&c->state_lock);
>  	return 0;
>  err:
> -	if (ca->mi.state == BCH_MEMBER_STATE_rw &&
> +	if (test_bit(BCH_FS_rw, &c->flags) &&
> +	    ca->mi.state == BCH_MEMBER_STATE_rw &&
>  	    !percpu_ref_is_zero(&ca->io_ref[READ]))
>  		__bch2_dev_read_write(c, ca);
>  	up_write(&c->state_lock);
> -- 
> 2.43.0
>

want either no args or 2 args (repo, branch), got 9