| Message ID | 20240504075526.2254349-2-libaokun@huaweicloud.com |
|---|---|
| State | Awaiting Upstream |
| Headers | show |
| Series | ext4: fix WARNING in mb_cache_destroy | expand |
On Sat 04-05-24 15:55:25, libaokun@huaweicloud.com wrote: > From: Baokun Li <libaokun1@huawei.com> > > Syzbot reports a warning as follows: > > ============================================ > WARNING: CPU: 0 PID: 5075 at fs/mbcache.c:419 mb_cache_destroy+0x224/0x290 > Modules linked in: > CPU: 0 PID: 5075 Comm: syz-executor199 Not tainted 6.9.0-rc6-gb947cc5bf6d7 > RIP: 0010:mb_cache_destroy+0x224/0x290 fs/mbcache.c:419 > Call Trace: > <TASK> > ext4_put_super+0x6d4/0xcd0 fs/ext4/super.c:1375 > generic_shutdown_super+0x136/0x2d0 fs/super.c:641 > kill_block_super+0x44/0x90 fs/super.c:1675 > ext4_kill_sb+0x68/0xa0 fs/ext4/super.c:7327 > [...] > ============================================ > > This is because when finding an entry in ext4_xattr_block_cache_find(), if > ext4_sb_bread() returns -ENOMEM, the ce's e_refcnt, which has already grown > in the __entry_find(), won't be put away, and eventually trigger the above > issue in mb_cache_destroy() due to reference count leakage. > > So call mb_cache_entry_put() on the -ENOMEM error branch as a quick fix. > > Reported-by: syzbot+dd43bd0f7474512edc47@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=dd43bd0f7474512edc47 > Fixes: fb265c9cb49e ("ext4: add ext4_sb_bread() to disambiguate ENOMEM cases") > Cc: stable@kernel.org > Signed-off-by: Baokun Li <libaokun1@huawei.com> Looks good. Feel free to add: Reviewed-by: Jan Kara <jack@suse.cz> Honza > --- > fs/ext4/xattr.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c > index b67a176bfcf9..9fdd13422073 100644 > --- a/fs/ext4/xattr.c > +++ b/fs/ext4/xattr.c > @@ -3113,8 +3113,10 @@ ext4_xattr_block_cache_find(struct inode *inode, > > bh = ext4_sb_bread(inode->i_sb, ce->e_value, REQ_PRIO); > if (IS_ERR(bh)) { > - if (PTR_ERR(bh) == -ENOMEM) > + if (PTR_ERR(bh) == -ENOMEM) { > + mb_cache_entry_put(ea_block_cache, ce); > return NULL; > + } > bh = NULL; > EXT4_ERROR_INODE(inode, "block %lu read error", > (unsigned long)ce->e_value); > -- > 2.39.2 >
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c index b67a176bfcf9..9fdd13422073 100644 --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -3113,8 +3113,10 @@ ext4_xattr_block_cache_find(struct inode *inode, bh = ext4_sb_bread(inode->i_sb, ce->e_value, REQ_PRIO); if (IS_ERR(bh)) { - if (PTR_ERR(bh) == -ENOMEM) + if (PTR_ERR(bh) == -ENOMEM) { + mb_cache_entry_put(ea_block_cache, ce); return NULL; + } bh = NULL; EXT4_ERROR_INODE(inode, "block %lu read error", (unsigned long)ce->e_value);