Received-SPF: pass (google.com: domain of linux-ext4+bounces-1046-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.48.161 as permitted sender) client-ip=147.75.48.161;
Date: Wed, 31 Jan 2024 16:41:53 +0100
From: Jan Kara <jack@suse.cz>
To: Edward Adam Davis <eadavis@qq.com>
Cc: syzbot+cdee56dbcdf0096ef605@syzkaller.appspotmail.com,
	adilger.kernel@dilger.ca, chandan.babu@oracle.com, jack@suse.com,
	linux-ext4@vger.kernel.org, linux-fsdevel@vger.kernel.org,
	linux-kernel@vger.kernel.org, linux-xfs@vger.kernel.org,
	syzkaller-bugs@googlegroups.com, tytso@mit.edu
Subject: Re: [PATCH] jbd2: user-memory-access in jbd2__journal_start
Message-ID: <20240131154153.domdzkkbqgpkplp2@quack3>
References: <000000000000d6e06d06102ae80b@google.com>
 <tencent_7F29369E974036964A3E742F778567CC3C09@qq.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <tencent_7F29369E974036964A3E742F778567CC3C09@qq.com>

On Wed 31-01-24 20:04:27, Edward Adam Davis wrote:
> Before reusing the handle, it is necessary to confirm that the transaction is 
> ready.
> 
> Reported-and-tested-by: syzbot+cdee56dbcdf0096ef605@syzkaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <eadavis@qq.com>

Sorry but no. Dave found a way to fix this particular problem in XFS and
your patch would not really improve anything because we'd just crash
when dereferencing handle->saved_alloc_context.

								Honza


> diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
> index cb0b8d6fc0c6..702312cd5392 100644
> --- a/fs/jbd2/transaction.c
> +++ b/fs/jbd2/transaction.c
> @@ -493,6 +493,9 @@ handle_t *jbd2__journal_start(journal_t *journal, int nblocks, int rsv_blocks,
>  		return ERR_PTR(-EROFS);
>  
>  	if (handle) {
> +		if (handle->saved_alloc_context & ~PF_MEMALLOC_NOFS)
> +			return ERR_PTR(-EBUSY);
> +
>  		J_ASSERT(handle->h_transaction->t_journal == journal);
>  		handle->h_ref++;
>  		return handle;
> -- 
> 2.43.0
> 
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR