summaryrefslogtreecommitdiffstats
path: root/fs/btrfs/super.c
diff options
context:
space:
mode:
authorDavid Sterba <dsterba@suse.com>2018-06-19 18:04:07 +0200
committerDavid Sterba <dsterba@suse.com>2018-08-06 13:12:48 +0200
commit81ffd56b5745355b70d54ca4e1bdd0d64a66ff9f (patch)
tree94ad21e055495b21b17e8c8937057b13ea034cbc /fs/btrfs/super.c
parent399f7f4c42e8a58c8456264d5112287aefe44cf4 (diff)
downloadlinux-81ffd56b5745355b70d54ca4e1bdd0d64a66ff9f.tar.bz2
btrfs: fix mount and ioctl device scan ioctl race
Technically this extends the critical section covered by uuid_mutex to: - parse early mount options -- here we can call device scan on paths that can be passed as 'device=/dev/...' - scan the device passed to mount - open the devices related to the fs_devices -- this increases fs_devices::opened The race can happen when mount calls one of the scans and there's another one called eg. by mkfs or 'btrfs dev scan': Mount Scan ----- ---- scan_one_device (dev1, fsid1) scan_one_device (dev2, fsid1) add the device free stale devices fsid1 fs_devices::opened == 0 find fsid1:dev1 free fsid1:dev1 if it's the last one, free fs_devices of fsid1 too open_devices (dev1, fsid1) dev1 not found When fixed, the uuid mutex will make sure that mount will increase fs_devices::opened and this will not be touched by the racing scan ioctl. Reported-and-tested-by: syzbot+909a5177749d7990ffa4@syzkaller.appspotmail.com Reported-and-tested-by: syzbot+ceb2606025ec1cc3479c@syzkaller.appspotmail.com Reviewed-by: Anand Jain <anand.jain@oracle.com> Signed-off-by: David Sterba <dsterba@suse.com>
Diffstat (limited to 'fs/btrfs/super.c')
-rw-r--r--fs/btrfs/super.c12
1 files changed, 6 insertions, 6 deletions
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index d33fc1fc4285..28ab75ebb983 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -1555,19 +1555,19 @@ static struct dentry *btrfs_mount_root(struct file_system_type *fs_type,
mutex_lock(&uuid_mutex);
error = btrfs_parse_early_options(data, mode, fs_type, &fs_devices);
- mutex_unlock(&uuid_mutex);
- if (error)
+ if (error) {
+ mutex_unlock(&uuid_mutex);
goto error_fs_info;
+ }
- mutex_lock(&uuid_mutex);
error = btrfs_scan_one_device(device_name, mode, fs_type, &fs_devices);
- mutex_unlock(&uuid_mutex);
- if (error)
+ if (error) {
+ mutex_unlock(&uuid_mutex);
goto error_fs_info;
+ }
fs_info->fs_devices = fs_devices;
- mutex_lock(&uuid_mutex);
error = btrfs_open_devices(fs_devices, mode, fs_type);
mutex_unlock(&uuid_mutex);
if (error)