Syzbot found the following issue:
Unable to handle kernel paging request at virtual address dfff800000000005
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
Mem abort info:
ESR = 0x0000000096000006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
[dfff800000000005] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 6080 Comm: syz-executor747 Not tainted 6.3.0-rc7-syzkaller-g14f8db1c0f9a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : ext4_acquire_dquot+0x1d4/0x398 fs/ext4/super.c:6766
lr : dquot_to_inode fs/ext4/super.c:6740 [inline]
lr : ext4_acquire_dquot+0x1ac/0x398 fs/ext4/super.c:6766
sp : ffff80001eb27280
x29: ffff80001eb27280 x28: 1fffe0001c3c01fc x27: ffff800015d705b0
x26: ffff0000dd93c000 x25: ffff0000dd93e000 x24: 1fffe0001c3c021c
x23: dfff800000000000 x22: 0000000000000049 x21: 0000000000000028
x20: 0000000000000000 x19: ffff0000e1e00fc0 x18: ffff0001b426cca8
x17: 0000000000000000 x16: ffff8000089669b0 x15: 0000000000000001
x14: 1ffff00002bae0b0 x13: dfff800000000000 x12: 0000000000000001
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : 0000000000000005 x7 : ffff800008c11f68 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800012441b4c
x2 : 0000000000000001 x1 : 0000000000000001 x0 : 0000000000000003
Call trace:
ext4_acquire_dquot+0x1d4/0x398 fs/ext4/super.c:6766
dqget+0x844/0xc48 fs/quota/dquot.c:914
__dquot_initialize+0x2cc/0xb54 fs/quota/dquot.c:1492
dquot_initialize fs/quota/dquot.c:1550 [inline]
dquot_file_open+0x90/0xc8 fs/quota/dquot.c:2181
ext4_file_open+0x230/0x590 fs/ext4/file.c:903
do_dentry_open+0x724/0xf90 fs/open.c:920
vfs_open+0x7c/0x90 fs/open.c:1051
do_open fs/namei.c:3560 [inline]
path_openat+0x1f2c/0x27f8 fs/namei.c:3715
do_filp_open+0x1bc/0x3cc fs/namei.c:3742
do_sys_openat2+0x128/0x3d8 fs/open.c:1348
do_sys_open fs/open.c:1364 [inline]
__do_sys_openat fs/open.c:1380 [inline]
__se_sys_openat fs/open.c:1375 [inline]
__arm64_sys_openat+0x1f0/0x240 fs/open.c:1375
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:193
el0_svc+0x4c/0x15c arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
Code: 97e8a7df f94002a8 9100a115 d343fea8 (38776908)
---[ end trace 0000000000000000 ]---
Above issue may happens as follows:
ProcessA ProcessB ProcessC
sys_fsconfig
vfs_fsconfig_locked
reconfigure_super
ext4_remount
dquot_suspend -> suspend all type quota
sys_fsconfig
vfs_fsconfig_locked
reconfigure_super
ext4_remount
dquot_resume
ret = dquot_load_quota_sb
add_dquot_ref
do_open -> open file O_RDWR
vfs_open
do_dentry_open
get_write_access
atomic_inc_unless_negative(&inode->i_writecount)
ext4_file_open
dquot_file_open
dquot_initialize
__dquot_initialize
dqget
if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
__dquot_initialize
__dquot_initialize
dqget
if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
ext4_acquire_dquot -> Return error
if (ret < 0)
vfs_cleanup_quota_inode
dqopt->files[type] = NULL;
ext4_acquire_dquot
-->dquot_to_inode(dquot) is NULL
To solve above issue, if quota has been loaded, there's unneed to cleaup quota
inode if dquot_load_quota_sb() return failed when do dquot_resume();
Reported-by: [email protected]
Signed-off-by: Ye Bin <[email protected]>
---
fs/quota/dquot.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index ffd40dc3e4e9..4b913faa48ec 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -2476,7 +2476,7 @@ int dquot_resume(struct super_block *sb, int type)
flags = dquot_generic_flag(flags, cnt);
ret = dquot_load_quota_sb(sb, cnt, dqopt->info[cnt].dqi_fmt_id,
flags);
- if (ret < 0)
+ if (ret < 0 && !sb_has_quota_loaded(sb, cnt))
vfs_cleanup_quota_inode(sb, cnt);
}
--
2.31.1
On Sat 27-05-23 09:40:17, Ye Bin wrote:
> Syzbot found the following issue:
> Unable to handle kernel paging request at virtual address dfff800000000005
> KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
...
> CPU: 0 PID: 6080 Comm: syz-executor747 Not tainted 6.3.0-rc7-syzkaller-g14f8db1c0f9a #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
> pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> pc : ext4_acquire_dquot+0x1d4/0x398 fs/ext4/super.c:6766
> lr : dquot_to_inode fs/ext4/super.c:6740 [inline]
> lr : ext4_acquire_dquot+0x1ac/0x398 fs/ext4/super.c:6766
OK, this is bad...
> Above issue may happens as follows:
> ProcessA ProcessB ProcessC
> sys_fsconfig
> vfs_fsconfig_locked
> reconfigure_super
> ext4_remount
> dquot_suspend -> suspend all type quota
>
> sys_fsconfig
> vfs_fsconfig_locked
> reconfigure_super
> ext4_remount
> dquot_resume
> ret = dquot_load_quota_sb
> add_dquot_ref
> do_open -> open file O_RDWR
> vfs_open
> do_dentry_open
> get_write_access
> atomic_inc_unless_negative(&inode->i_writecount)
> ext4_file_open
> dquot_file_open
> dquot_initialize
> __dquot_initialize
> dqget
> if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
>
> __dquot_initialize
> __dquot_initialize
> dqget
> if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
> ext4_acquire_dquot -> Return error
> if (ret < 0)
> vfs_cleanup_quota_inode
> dqopt->files[type] = NULL;
But I don't see how this can happen. The code in dquot_load_quota_sb()
looks like:
error = add_dquot_ref(sb, type);
if (error)
dquot_disable(sb, type, flags);
So if an error happens in add_dquot_ref(), we'll call dquot_disable().
dquot_disable() then does:
drop_dquot_ref(sb, cnt);
invalidate_dquots(sb, cnt);
and invalidate_dquots() waits for reference count of all dquots to drop to
0. Hence if dqget() returned a dquot pointer to ProcessC, then ProcessB
should wait until ProcessC drops the dquot reference (hence
ext4_acquire_dquot() is done).
What am I missing?
Honza
>
> ext4_acquire_dquot
> -->dquot_to_inode(dquot) is NULL
>
> To solve above issue, if quota has been loaded, there's unneed to cleaup quota
> inode if dquot_load_quota_sb() return failed when do dquot_resume();
>
> Reported-by: [email protected]
> Signed-off-by: Ye Bin <[email protected]>
> ---
> fs/quota/dquot.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
> index ffd40dc3e4e9..4b913faa48ec 100644
> --- a/fs/quota/dquot.c
> +++ b/fs/quota/dquot.c
> @@ -2476,7 +2476,7 @@ int dquot_resume(struct super_block *sb, int type)
> flags = dquot_generic_flag(flags, cnt);
> ret = dquot_load_quota_sb(sb, cnt, dqopt->info[cnt].dqi_fmt_id,
> flags);
> - if (ret < 0)
> + if (ret < 0 && !sb_has_quota_loaded(sb, cnt))
> vfs_cleanup_quota_inode(sb, cnt);
> }
>
> --
> 2.31.1
>
--
Jan Kara <[email protected]>
SUSE Labs, CR
On 2023/5/30 17:57, Jan Kara wrote:
> On Sat 27-05-23 09:40:17, Ye Bin wrote:
>> Syzbot found the following issue:
>> Unable to handle kernel paging request at virtual address dfff800000000005
>> KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
> ...
>> CPU: 0 PID: 6080 Comm: syz-executor747 Not tainted 6.3.0-rc7-syzkaller-g14f8db1c0f9a #0
>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
>> pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
>> pc : ext4_acquire_dquot+0x1d4/0x398 fs/ext4/super.c:6766
>> lr : dquot_to_inode fs/ext4/super.c:6740 [inline]
>> lr : ext4_acquire_dquot+0x1ac/0x398 fs/ext4/super.c:6766
> OK, this is bad...
>
>> Above issue may happens as follows:
>> ProcessA ProcessB ProcessC
>> sys_fsconfig
>> vfs_fsconfig_locked
>> reconfigure_super
>> ext4_remount
>> dquot_suspend -> suspend all type quota
>>
>> sys_fsconfig
>> vfs_fsconfig_locked
>> reconfigure_super
>> ext4_remount
>> dquot_resume
>> ret = dquot_load_quota_sb
>> add_dquot_ref
>> do_open -> open file O_RDWR
>> vfs_open
>> do_dentry_open
>> get_write_access
>> atomic_inc_unless_negative(&inode->i_writecount)
>> ext4_file_open
>> dquot_file_open
>> dquot_initialize
>> __dquot_initialize
>> dqget
>> if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
>>
>> __dquot_initialize
>> __dquot_initialize
>> dqget
>> if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
>> ext4_acquire_dquot -> Return error
>> if (ret < 0)
>> vfs_cleanup_quota_inode
>> dqopt->files[type] = NULL;
> But I don't see how this can happen. The code in dquot_load_quota_sb()
> looks like:
>
> error = add_dquot_ref(sb, type);
> if (error)
> dquot_disable(sb, type, flags);
>
> So if an error happens in add_dquot_ref(), we'll call dquot_disable().
> dquot_disable() then does:
>
> drop_dquot_ref(sb, cnt);
> invalidate_dquots(sb, cnt);
>
> and invalidate_dquots() waits for reference count of all dquots to drop to
> 0. Hence if dqget() returned a dquot pointer to ProcessC, then ProcessB
> should wait until ProcessC drops the dquot reference (hence
> ext4_acquire_dquot() is done).
>
> What am I missing?
>
> Honza
My reproduction condition is:
mkfs.ext4 -F /dev/sda
tune2fs -Q usrquota /dev/sda
dquot_disable
...
if ((flags & DQUOT_USAGE_ENABLED && !(flags &
DQUOT_LIMITS_ENABLED))
|| (flags & DQUOT_SUSPENDED && flags & (DQUOT_LIMITS_ENABLED |
DQUOT_USAGE_ENABLED)))
return -EINVAL;
...
If without enable DQUOT_LIMITS_ENABLED dquot_disable() will just return
-EINVAL.
>> ext4_acquire_dquot
>> -->dquot_to_inode(dquot) is NULL
>>
>> To solve above issue, if quota has been loaded, there's unneed to cleaup quota
>> inode if dquot_load_quota_sb() return failed when do dquot_resume();
>>
>> Reported-by: [email protected]
>> Signed-off-by: Ye Bin <[email protected]>
>> ---
>> fs/quota/dquot.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
>> index ffd40dc3e4e9..4b913faa48ec 100644
>> --- a/fs/quota/dquot.c
>> +++ b/fs/quota/dquot.c
>> @@ -2476,7 +2476,7 @@ int dquot_resume(struct super_block *sb, int type)
>> flags = dquot_generic_flag(flags, cnt);
>> ret = dquot_load_quota_sb(sb, cnt, dqopt->info[cnt].dqi_fmt_id,
>> flags);
>> - if (ret < 0)
>> + if (ret < 0 && !sb_has_quota_loaded(sb, cnt))
>> vfs_cleanup_quota_inode(sb, cnt);
>> }
>>
>> --
>> 2.31.1
>>
On Sat 03-06-23 14:14:11, yebin (H) wrote:
>
>
> On 2023/5/30 17:57, Jan Kara wrote:
> > On Sat 27-05-23 09:40:17, Ye Bin wrote:
> > > Syzbot found the following issue:
> > > Unable to handle kernel paging request at virtual address dfff800000000005
> > > KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
> > ...
> > > CPU: 0 PID: 6080 Comm: syz-executor747 Not tainted 6.3.0-rc7-syzkaller-g14f8db1c0f9a #0
> > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
> > > pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> > > pc : ext4_acquire_dquot+0x1d4/0x398 fs/ext4/super.c:6766
> > > lr : dquot_to_inode fs/ext4/super.c:6740 [inline]
> > > lr : ext4_acquire_dquot+0x1ac/0x398 fs/ext4/super.c:6766
> > OK, this is bad...
> >
> > > Above issue may happens as follows:
> > > ProcessA ProcessB ProcessC
> > > sys_fsconfig
> > > vfs_fsconfig_locked
> > > reconfigure_super
> > > ext4_remount
> > > dquot_suspend -> suspend all type quota
> > >
> > > sys_fsconfig
> > > vfs_fsconfig_locked
> > > reconfigure_super
> > > ext4_remount
> > > dquot_resume
> > > ret = dquot_load_quota_sb
> > > add_dquot_ref
> > > do_open -> open file O_RDWR
> > > vfs_open
> > > do_dentry_open
> > > get_write_access
> > > atomic_inc_unless_negative(&inode->i_writecount)
> > > ext4_file_open
> > > dquot_file_open
> > > dquot_initialize
> > > __dquot_initialize
> > > dqget
> > > if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
> > >
> > > __dquot_initialize
> > > __dquot_initialize
> > > dqget
> > > if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
> > > ext4_acquire_dquot -> Return error
> > > if (ret < 0)
> > > vfs_cleanup_quota_inode
> > > dqopt->files[type] = NULL;
> > But I don't see how this can happen. The code in dquot_load_quota_sb()
> > looks like:
> >
> > error = add_dquot_ref(sb, type);
> > if (error)
> > dquot_disable(sb, type, flags);
> >
> > So if an error happens in add_dquot_ref(), we'll call dquot_disable().
> > dquot_disable() then does:
> >
> > drop_dquot_ref(sb, cnt);
> > invalidate_dquots(sb, cnt);
> >
> > and invalidate_dquots() waits for reference count of all dquots to drop to
> > 0. Hence if dqget() returned a dquot pointer to ProcessC, then ProcessB
> > should wait until ProcessC drops the dquot reference (hence
> > ext4_acquire_dquot() is done).
> >
> > What am I missing?
> >
> > Honza
> My reproduction condition is:
> mkfs.ext4 -F /dev/sda
> tune2fs -Q usrquota /dev/sda
>
> dquot_disable
> ...
> if ((flags & DQUOT_USAGE_ENABLED && !(flags &
> DQUOT_LIMITS_ENABLED))
> || (flags & DQUOT_SUSPENDED && flags & (DQUOT_LIMITS_ENABLED |
> DQUOT_USAGE_ENABLED)))
> return -EINVAL;
> ...
> If without enable DQUOT_LIMITS_ENABLED dquot_disable() will just return
> -EINVAL.
Aha, that is the bug! Does attached patch fix your problem?
Honza
--
Jan Kara <[email protected]>
SUSE Labs, CR
On 2023/6/5 19:51, Jan Kara wrote:
> On Sat 03-06-23 14:14:11, yebin (H) wrote:
>>
>> On 2023/5/30 17:57, Jan Kara wrote:
>>> On Sat 27-05-23 09:40:17, Ye Bin wrote:
>>>> Syzbot found the following issue:
>>>> Unable to handle kernel paging request at virtual address dfff800000000005
>>>> KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
>>> ...
>>>> CPU: 0 PID: 6080 Comm: syz-executor747 Not tainted 6.3.0-rc7-syzkaller-g14f8db1c0f9a #0
>>>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
>>>> pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
>>>> pc : ext4_acquire_dquot+0x1d4/0x398 fs/ext4/super.c:6766
>>>> lr : dquot_to_inode fs/ext4/super.c:6740 [inline]
>>>> lr : ext4_acquire_dquot+0x1ac/0x398 fs/ext4/super.c:6766
>>> OK, this is bad...
>>>
>>>> Above issue may happens as follows:
>>>> ProcessA ProcessB ProcessC
>>>> sys_fsconfig
>>>> vfs_fsconfig_locked
>>>> reconfigure_super
>>>> ext4_remount
>>>> dquot_suspend -> suspend all type quota
>>>>
>>>> sys_fsconfig
>>>> vfs_fsconfig_locked
>>>> reconfigure_super
>>>> ext4_remount
>>>> dquot_resume
>>>> ret = dquot_load_quota_sb
>>>> add_dquot_ref
>>>> do_open -> open file O_RDWR
>>>> vfs_open
>>>> do_dentry_open
>>>> get_write_access
>>>> atomic_inc_unless_negative(&inode->i_writecount)
>>>> ext4_file_open
>>>> dquot_file_open
>>>> dquot_initialize
>>>> __dquot_initialize
>>>> dqget
>>>> if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
>>>>
>>>> __dquot_initialize
>>>> __dquot_initialize
>>>> dqget
>>>> if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
>>>> ext4_acquire_dquot -> Return error
>>>> if (ret < 0)
>>>> vfs_cleanup_quota_inode
>>>> dqopt->files[type] = NULL;
>>> But I don't see how this can happen. The code in dquot_load_quota_sb()
>>> looks like:
>>>
>>> error = add_dquot_ref(sb, type);
>>> if (error)
>>> dquot_disable(sb, type, flags);
>>>
>>> So if an error happens in add_dquot_ref(), we'll call dquot_disable().
>>> dquot_disable() then does:
>>>
>>> drop_dquot_ref(sb, cnt);
>>> invalidate_dquots(sb, cnt);
>>>
>>> and invalidate_dquots() waits for reference count of all dquots to drop to
>>> 0. Hence if dqget() returned a dquot pointer to ProcessC, then ProcessB
>>> should wait until ProcessC drops the dquot reference (hence
>>> ext4_acquire_dquot() is done).
>>>
>>> What am I missing?
>>>
>>> Honza
>> My reproduction condition is:
>> mkfs.ext4 -F /dev/sda
>> tune2fs -Q usrquota /dev/sda
>>
>> dquot_disable
>> ...
>> if ((flags & DQUOT_USAGE_ENABLED && !(flags &
>> DQUOT_LIMITS_ENABLED))
>> || (flags & DQUOT_SUSPENDED && flags & (DQUOT_LIMITS_ENABLED |
>> DQUOT_USAGE_ENABLED)))
>> return -EINVAL;
>> ...
>> If without enable DQUOT_LIMITS_ENABLED dquot_disable() will just return
>> -EINVAL.
> Aha, that is the bug! Does attached patch fix your problem?
>
> Honza
Yes , it's works.