Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATCH] btrfs: fix rw device counting in
 __btrfs_free_extra_devids
To:     Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>, clm@fb.com,
        josef@toxicpanda.com, dsterba@suse.com
Cc:     linux-btrfs@vger.kernel.org, linux-kernel@vger.kernel.org,
        skhan@linuxfoundation.org, gregkh@linuxfoundation.org,
        linux-kernel-mentees@lists.linuxfoundation.org,
        syzbot+a70e2ad0879f160b9217@syzkaller.appspotmail.com
References: <20210715103403.176695-1-desmondcheongzx@gmail.com>
From:   Anand Jain <anand.jain@oracle.com>
Message-ID: <283a54bd-8f46-f615-0568-a375a121c2f0@oracle.com>
Date:   Thu, 15 Jul 2021 19:23:01 +0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101
 Thunderbird/78.11.0
In-Reply-To: <20210715103403.176695-1-desmondcheongzx@gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
Received: from [192.168.10.109] (39.109.186.25) by SG2PR06CA0224.apcprd06.prod.outlook.com (2603:1096:4:68::32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4331.21 via Frontend Transport; Thu, 15 Jul 2021 11:23:05 +0000
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 274d8410-657e-4c8c-7e7c-08d94782ec5a
X-MS-TrafficTypeDiagnostic: BLAPR10MB5169:
X-Microsoft-Antispam-PRVS: <BLAPR10MB516927B0D6B49C3558C11D7EE5129@BLAPR10MB5169.namprd10.prod.outlook.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:8882;
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: coOiPg0cfOpIblgqF6z9UBtnKzN7aegLH2mTgXAMM1LGq2LmaWDGBXV6LA8FAz9+mmu/PizRXZMqbm5g+nQbYhRDiUN/UwTh8LJjpIW7E/0wI3RFeneYh4mJhKkDJUkZW2IwfgZWKxen11E+3ubPGaWSh8wF4oxtnveoZR7MdAW3XWZyGiLtYwNIbXnH6mSWXPkpHcO9ypJD3O5+UdW7d98Z5zU9xTUxgXzR9kHKfD9okB2D2kEHt/meBJnvicflpAH49EuTLRIbfTl0UjDP0/6tIQaxCpAxhlszoh7X7VOuYdibcKLmAaBgrYdFPpYLhoykRL57hgwbNhNlJZ+IZbZdAz0J6KbsK7zHA/6/Sa2ygMUhs6fiuqy2XKd4CfWu583ShpYfBicIa6WzTW68Fg0B/w5R9yx2FmqCHXYpwefUW27Mxy43znTnk0zQM4x1U8Z2JT8s5jCmzM7rp7J9JoC2RPGG2F6m15TVjRy+XeND/jLoSuS5iIwHfP0X+WI1O6Tq2bJ/npr/3pLuJbgc2NtVsQKWtM9hNl9xq4v8XdWw9PzD/s5b61SV1GUzRtMey01o8rIaNtwocLOBDK5MsDU4jmCuIqGq2hhRNlxzPiWCyksnCstq/AwwgTY+4mF+EXN/vRq6rd8bEGgwpVpgRO+A9cTbthPVsi65Df1zULD4pGfr3oaKxQtZyX8IbjZB6rrPpnXBKUdVI5sv/sUOV9Ea0PxeReQhJTpeOfApPVw=
X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:MN2PR10MB4128.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(376002)(136003)(39860400002)(396003)(346002)(366004)(53546011)(7416002)(16576012)(186003)(5660300002)(44832011)(26005)(478600001)(31696002)(2616005)(956004)(316002)(66556008)(66476007)(66946007)(8936002)(36756003)(8676002)(2906002)(38100700002)(6666004)(83380400001)(31686004)(6486002)(4326008)(86362001)(45980500001)(43740500002);DIR:OUT;SFP:1101;
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?VXNIYXllNDdvSy9NV2YrbEZodGNMd3E3MkJwbFZWL202b3pyRDk5S2ZnOG1L?=
 =?utf-8?B?eWpCTmI4STFxZEgyZHNOcUxqYmJWQzJyRzljV3UrOUY5NzNpUGJRT2pqVS80?=
 =?utf-8?B?TlZ3QitzTThIY2gxa1VRczlKemlYN0hFWEw4MFROdlhoZC9tOUNGNFdySXJZ?=
 =?utf-8?B?YmFRR29VQWlvSE5XRFZ5b2ZNRGdQS0Vva0xhWUJRRHltbnVZRzI4bmRtQ00z?=
 =?utf-8?B?UkZwazF4anhXaDNDTERNN1RONEE2OGdPZVNQdHdkUWlFblJNV1RkMUlDZVQ2?=
 =?utf-8?B?WXJKOEp2YVJwRHdGQlQ3UkRQeVVQVk4ydVd6b3g5RUNZTk42VzFLZ0tKWGxk?=
 =?utf-8?B?alE1RmFMZk9vVzcrSXAzdG5UaDQwMkliQkhWanpIUjZNTExVdXpSS1FNTHIv?=
 =?utf-8?B?aFMzcU5JakZNWjc2cTJtcUVSaG1jV1AzOUdQSy8rdDY5UEFVV2N0WU5KakZ4?=
 =?utf-8?B?bEtNRnBaaGRqM3Q2KzZCeHNVU3BPdmczaXVpWjNSNjlGRkpHbDRGYjFvaEhq?=
 =?utf-8?B?Y3o1cHFEenFzdkdNWXZDenVMdWg3UWNmNTI5WTBCMFhxOStTaVVKU2JqWnNB?=
 =?utf-8?B?cEJuR1dYVTNObUh0Uk9PV2hjaWpvK3JNelRJT2NRVzB3MVZOanZrZ3BFSWE5?=
 =?utf-8?B?WEVQZzVCTk43UnFjQlBteENJUGJIRWpsMzIvZmlWMGlyTUpjUnBJUUlldHc0?=
 =?utf-8?B?VVVXTUtvcm5qejVkczJ0a1lDNWN5SU9YMjJZOStXam5ib1RBQ3BlRUJWV2Jr?=
 =?utf-8?B?TzIzSXNZRUpJdFU0ZE9LajY3NFRRNklyYmVmMElTemNyT09hSDErU0ZxdlRC?=
 =?utf-8?B?WjViTWZYV2huVTd4NkFIK0hpZmc5KzVveFZOUXl0U2NINFF0QXQzNXVEV2hr?=
 =?utf-8?B?cnViaFRvS1cycTdoaTBMNTIxU3pEeHRFTE42STNtaTVZalhzWG5waVRhSnZV?=
 =?utf-8?B?RzU0aC9VeGJoVndhdmxKRlBkU2huQ1Q0Q3piODdrQnlYSEQ4b2w4VDB2ZGh4?=
 =?utf-8?B?LytsbFBuc0tpaldNeU9meVV5d0d2anoxRFRTbU9PazlETHR2Nk5CNGR0RmxZ?=
 =?utf-8?B?bmdva2RJKy9QOE5IUE5PTHRxaXlhNERXS3doWmZBYkRTUFZZcmRMREozb214?=
 =?utf-8?B?N0tEVFkzaUhpbG9JNEVsYkt0Y0JWcm5WVDhmVktpSDZoVFJNTW9pQkxTbm9x?=
 =?utf-8?B?bDdJa2VEYjRINGRaZUhwYm8zMnBCRU1vMEJCU2FEZHdlcVhHNEhnMkt6c1o0?=
 =?utf-8?B?U3JjQ3RtcEVucU4rclpDMGVYWU1UVlFVTlJiNVBib2NSR3NnL0ZRdFBBazI4?=
 =?utf-8?B?ZzIwQ21HdzluZVpaQUFRZTRscUcybWQrYWdrYjhpL3ZNMVNuV2NWVjE5WUVy?=
 =?utf-8?B?MG5JNFlrYUhoUlp0dFFoakF6NzZXL2Y5K2ZndUZXUVIrVk1TU29ubUpHWEcv?=
 =?utf-8?B?ZDlSVmR6Nkp4UW9ZR2ZPUm5PK2dhYmFYcU9VdTh1QUdDR1dLYmJhcXVGcTJM?=
 =?utf-8?B?b2tTODI0YjZFZGNQYXFGNTB4a3lOQ05vNlNzaExrUkRUVWtDTUtmT1c0UTR2?=
 =?utf-8?B?SzNPS1Bucyt2Qm1oWVlSUHowMGdEQW4rTExjY0cyQm5KMFRiSlJzMVVrVWJC?=
 =?utf-8?B?QVcvY2JITnBSelQ3WW02ajJCTTBrdUhiV3hhdHdoTllSalF3R2tVUE5mbE1G?=
 =?utf-8?B?ZEZ5VlgvOU0za0JONFVuM3hvclBLNFFCR1VOdW9XeVhNRlBBc1I4WnVoaEVJ?=
 =?utf-8?Q?LKDEPVEq8V0jPmDbEDQBruuQBSuOKhiZv8wI00T?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 274d8410-657e-4c8c-7e7c-08d94782ec5a
X-MS-Exchange-CrossTenant-AuthSource: MN2PR10MB4128.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Jul 2021 11:23:08.8032
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: +Hnj68osZgf/bJbw6yADWaAA6l+p1UiHKRJbYO3awBOJUvDSWf/QNbAPPZhDIRAHJ3YvwG2HIFjKacXp00XmVQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BLAPR10MB5169
X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=10045 signatures=668682
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 adultscore=0
 phishscore=0 spamscore=0 bulkscore=0 mlxlogscore=999 mlxscore=0
 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2104190000 definitions=main-2107150082
X-Proofpoint-GUID: IP5wYrDjDwMxS8QT-65-2nmibCe-N81k
X-Proofpoint-ORIG-GUID: IP5wYrDjDwMxS8QT-65-2nmibCe-N81k
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


On 15/07/2021 18:34, Desmond Cheong Zhi Xi wrote:
> Syzbot reports a warning in close_fs_devices that happens because
> fs_devices->rw_devices is not 0 after calling btrfs_close_one_device
> on each device.
> 
> This happens when a writeable device is removed in
> __btrfs_free_extra_devids, but the rw device count is not decremented
> accordingly. So when close_fs_devices is called, the removed device is
> still counted and we get an off by 1 error.
> 
> Here is one call trace that was observed:
>    btrfs_mount_root():
>      btrfs_scan_one_device():
>        device_list_add();   <---------------- device added
>      btrfs_open_devices():
>        open_fs_devices():
>          btrfs_open_one_device();   <-------- rw device count ++
>      btrfs_fill_super():
>        open_ctree():
>          btrfs_free_extra_devids():
> 	  __btrfs_free_extra_devids();  <--- device removed
> 	  fail_tree_roots:
> 	    btrfs_close_devices():
> 	      close_fs_devices();   <------- rw device count off by 1
> 
> Fixes: cf89af146b7e ("btrfs: dev-replace: fail mount if we don't have replace item with target device")
> Reported-by: syzbot+a70e2ad0879f160b9217@syzkaller.appspotmail.com
> Tested-by: syzbot+a70e2ad0879f160b9217@syzkaller.appspotmail.com
> Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
> ---
>   fs/btrfs/volumes.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
> index 807502cd6510..916c25371658 100644
> --- a/fs/btrfs/volumes.c
> +++ b/fs/btrfs/volumes.c
> @@ -1078,6 +1078,7 @@ static void __btrfs_free_extra_devids(struct btrfs_fs_devices *fs_devices,
>   		if (test_bit(BTRFS_DEV_STATE_WRITEABLE, &device->dev_state)) {
>   			list_del_init(&device->dev_alloc_list);
>   			clear_bit(BTRFS_DEV_STATE_WRITEABLE, &device->dev_state);
> +			fs_devices->rw_devices--;
>   		}
>   		list_del_init(&device->dev_list);
>   		fs_devices->num_devices--;
> 

Thanks for the fix.

Looks good.

Reviewed-by: Anand Jain <anand.jain@oracle.com>