Received: by 2002:a05:6a10:af89:0:0:0:0 with SMTP id iu9csp3555360pxb; Mon, 24 Jan 2022 12:07:20 -0800 (PST) X-Google-Smtp-Source: ABdhPJwERC/il98WX5PcTJcv7yfk1yBnBrA6OAJ7ScBPgc7byK5z6QDay3Yzg4IbwmJgUE2xcGbm X-Received: by 2002:a17:90b:4b45:: with SMTP id mi5mr1674585pjb.99.1643054839943; Mon, 24 Jan 2022 12:07:19 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1643054839; cv=none; d=google.com; s=arc-20160816; b=bd9+LB5VWSKl34aLr7U0oUSkOa8LbU7k6HDM9R+0/RWGT79iOgBCdRT0PFngrv35Ub KikPnq2TxUgLaVoJjqNh2b+o7x4dRFUeV5I4zpTnGCRG3pxgyLqXPbAoIjgGUBeL3rNu gqtGzndC6JAO77q+9V3+JfUwnz1k7qdJmQO43raayfs/dh7nMU37DtbNY/KvhDHAu35X Jv2IqRKgAzW754kPjfUvSuQTdbRzSb4fuo6vANeT04Lp9AB0AEecczoQTLPwbCFIPHzY wjXSjcOX+oTlj0T2xH/w/9h8MZSu5kkcjFWikXUagFJ34GtTaM41sse/eezdTE1TR+me dM5A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=Ru0Kk8ipm5MfbzNXD4Yli/XH4FtGwKgnVDlqjyUeDCE=; b=BvEiIw2iYG+JgwaUKLKjhwdj36DkwbIy4Oy3cSyDj0m/m4oaZc48rGwwIqBkPDOOqt ccrWWh+Sfy4NyBmbnVbEUUbyDOSDBOGDZFZhfkLAWqzeQrHW32KLtroC+HYHzuwlM3qD T0VKLIuVpwRsEnge2+ZsYEDnrpxQHpmX169V0tIV6I85RwUDH3fiisj6puGwbipnNa1P EkgRHIaAr99vcjD8ccHFTZPRagev2V9m7T8ZukH/pbNlPIY46no9Y+VqUbMV0dmYCozF ZwF2ikKH/e12Fa8nV5r8QEHZ1IqFuj6I+fVtmWbFbVKklN1aP6geVnoE3j33TheZ/cB0 mhUQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=iGsG7OmR; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id s138si14674369pgs.50.2022.01.24.12.07.06; Mon, 24 Jan 2022 12:07:19 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=iGsG7OmR; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346404AbiAXTFa (ORCPT + 99 others); Mon, 24 Jan 2022 14:05:30 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:57490 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345493AbiAXTAW (ORCPT ); Mon, 24 Jan 2022 14:00:22 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 32722B8121F; Mon, 24 Jan 2022 19:00:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5D2D5C340EA; Mon, 24 Jan 2022 19:00:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050820; bh=Z845udqUw2rjUiaPdUgkj+7y6/B6zzKwPohCDuK4TyE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iGsG7OmRp3gvFtjJpUUOOQqyALY0JbkJWcFrPvQTwT2myob/RIOnqtZ5suV30y0IX BuX/gaxcnASuDnDFKex4x4pQ1la6/HcyTb9DNkdrKWjthJwUEKZ3OofvXeegLUhm+v gugSkbxrX7Emxsks9G7df5aoZG1wb57O7yRrQ4fY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ye Bin , Jan Kara , Theodore Tso , stable@kernel.org Subject: [PATCH 4.9 123/157] ext4: Fix BUG_ON in ext4_bread when write quota data Date: Mon, 24 Jan 2022 19:43:33 +0100 Message-Id: <20220124183936.676801278@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Ye Bin commit 380a0091cab482489e9b19e07f2a166ad2b76d5c upstream. We got issue as follows when run syzkaller: [ 167.936972] EXT4-fs error (device loop0): __ext4_remount:6314: comm rep: Abort forced by user [ 167.938306] EXT4-fs (loop0): Remounting filesystem read-only [ 167.981637] Assertion failure in ext4_getblk() at fs/ext4/inode.c:847: '(EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY) || handle != NULL || create == 0' [ 167.983601] ------------[ cut here ]------------ [ 167.984245] kernel BUG at fs/ext4/inode.c:847! [ 167.984882] invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI [ 167.985624] CPU: 7 PID: 2290 Comm: rep Tainted: G B 5.16.0-rc5-next-20211217+ #123 [ 167.986823] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014 [ 167.988590] RIP: 0010:ext4_getblk+0x17e/0x504 [ 167.989189] Code: c6 01 74 28 49 c7 c0 a0 a3 5c 9b b9 4f 03 00 00 48 c7 c2 80 9c 5c 9b 48 c7 c6 40 b6 5c 9b 48 c7 c7 20 a4 5c 9b e8 77 e3 fd ff <0f> 0b 8b 04 244 [ 167.991679] RSP: 0018:ffff8881736f7398 EFLAGS: 00010282 [ 167.992385] RAX: 0000000000000094 RBX: 1ffff1102e6dee75 RCX: 0000000000000000 [ 167.993337] RDX: 0000000000000001 RSI: ffffffff9b6e29e0 RDI: ffffed102e6dee66 [ 167.994292] RBP: ffff88816a076210 R08: 0000000000000094 R09: ffffed107363fa09 [ 167.995252] R10: ffff88839b1fd047 R11: ffffed107363fa08 R12: ffff88816a0761e8 [ 167.996205] R13: 0000000000000000 R14: 0000000000000021 R15: 0000000000000001 [ 167.997158] FS: 00007f6a1428c740(0000) GS:ffff88839b000000(0000) knlGS:0000000000000000 [ 167.998238] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 167.999025] CR2: 00007f6a140716c8 CR3: 0000000133216000 CR4: 00000000000006e0 [ 167.999987] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 168.000944] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 168.001899] Call Trace: [ 168.002235] [ 168.007167] ext4_bread+0xd/0x53 [ 168.007612] ext4_quota_write+0x20c/0x5c0 [ 168.010457] write_blk+0x100/0x220 [ 168.010944] remove_free_dqentry+0x1c6/0x440 [ 168.011525] free_dqentry.isra.0+0x565/0x830 [ 168.012133] remove_tree+0x318/0x6d0 [ 168.014744] remove_tree+0x1eb/0x6d0 [ 168.017346] remove_tree+0x1eb/0x6d0 [ 168.019969] remove_tree+0x1eb/0x6d0 [ 168.022128] qtree_release_dquot+0x291/0x340 [ 168.023297] v2_release_dquot+0xce/0x120 [ 168.023847] dquot_release+0x197/0x3e0 [ 168.024358] ext4_release_dquot+0x22a/0x2d0 [ 168.024932] dqput.part.0+0x1c9/0x900 [ 168.025430] __dquot_drop+0x120/0x190 [ 168.025942] ext4_clear_inode+0x86/0x220 [ 168.026472] ext4_evict_inode+0x9e8/0xa22 [ 168.028200] evict+0x29e/0x4f0 [ 168.028625] dispose_list+0x102/0x1f0 [ 168.029148] evict_inodes+0x2c1/0x3e0 [ 168.030188] generic_shutdown_super+0xa4/0x3b0 [ 168.030817] kill_block_super+0x95/0xd0 [ 168.031360] deactivate_locked_super+0x85/0xd0 [ 168.031977] cleanup_mnt+0x2bc/0x480 [ 168.033062] task_work_run+0xd1/0x170 [ 168.033565] do_exit+0xa4f/0x2b50 [ 168.037155] do_group_exit+0xef/0x2d0 [ 168.037666] __x64_sys_exit_group+0x3a/0x50 [ 168.038237] do_syscall_64+0x3b/0x90 [ 168.038751] entry_SYSCALL_64_after_hwframe+0x44/0xae In order to reproduce this problem, the following conditions need to be met: 1. Ext4 filesystem with no journal; 2. Filesystem image with incorrect quota data; 3. Abort filesystem forced by user; 4. umount filesystem; As in ext4_quota_write: ... if (EXT4_SB(sb)->s_journal && !handle) { ext4_msg(sb, KERN_WARNING, "Quota write (off=%llu, len=%llu)" " cancelled because transaction is not started", (unsigned long long)off, (unsigned long long)len); return -EIO; } ... We only check handle if NULL when filesystem has journal. There is need check handle if NULL even when filesystem has no journal. Signed-off-by: Ye Bin Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20211223015506.297766-1-yebin10@huawei.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org Signed-off-by: Greg Kroah-Hartman --- fs/ext4/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -5602,7 +5602,7 @@ static ssize_t ext4_quota_write(struct s struct buffer_head *bh; handle_t *handle = journal_current_handle(); - if (EXT4_SB(sb)->s_journal && !handle) { + if (!handle) { ext4_msg(sb, KERN_WARNING, "Quota write (off=%llu, len=%llu)" " cancelled because transaction is not started", (unsigned long long)off, (unsigned long long)len);