[PATCH] ocfs2: uncache inode which has failed entering the group

[PATCH] ocfs2: uncache inode which has failed entering the group

[Dmitry Antipov]

Syzbot has reported the following BUG:

kernel BUG at fs/ocfs2/uptodate.c:509!
...
Call Trace:
 <TASK>
 ? __die_body+0x5f/0xb0
 ? die+0x9e/0xc0
 ? do_trap+0x15a/0x3a0
 ? ocfs2_set_new_buffer_uptodate+0x145/0x160
 ? do_error_trap+0x1dc/0x2c0
 ? ocfs2_set_new_buffer_uptodate+0x145/0x160
 ? __pfx_do_error_trap+0x10/0x10
 ? handle_invalid_op+0x34/0x40
 ? ocfs2_set_new_buffer_uptodate+0x145/0x160
 ? exc_invalid_op+0x38/0x50
 ? asm_exc_invalid_op+0x1a/0x20
 ? ocfs2_set_new_buffer_uptodate+0x2e/0x160
 ? ocfs2_set_new_buffer_uptodate+0x144/0x160
 ? ocfs2_set_new_buffer_uptodate+0x145/0x160
 ocfs2_group_add+0x39f/0x15a0
 ? __pfx_ocfs2_group_add+0x10/0x10
 ? __pfx_lock_acquire+0x10/0x10
 ? mnt_get_write_access+0x68/0x2b0
 ? __pfx_lock_release+0x10/0x10
 ? rcu_read_lock_any_held+0xb7/0x160
 ? __pfx_rcu_read_lock_any_held+0x10/0x10
 ? smack_log+0x123/0x540
 ? mnt_get_write_access+0x68/0x2b0
 ? mnt_get_write_access+0x68/0x2b0
 ? mnt_get_write_access+0x226/0x2b0
 ocfs2_ioctl+0x65e/0x7d0
 ? __pfx_ocfs2_ioctl+0x10/0x10
 ? smack_file_ioctl+0x29e/0x3a0
 ? __pfx_smack_file_ioctl+0x10/0x10
 ? lockdep_hardirqs_on_prepare+0x43d/0x780
 ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
 ? __pfx_ocfs2_ioctl+0x10/0x10
 __se_sys_ioctl+0xfb/0x170
 do_syscall_64+0xf3/0x230
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
...
 </TASK>

When 'ioctl(OCFS2_IOC_GROUP_ADD, ...)' has failed for the particular
inode in 'ocfs2_verify_group_and_input()', corresponding buffer head
remains cached and subsequent call to the same 'ioctl()' for the same
inode issues the BUG() in 'ocfs2_set_new_buffer_uptodate()' (trying
to cache the same buffer head of that inode). Fix this by uncaching
the buffer head with 'ocfs2_remove_from_cache()' on error path in
'ocfs2_group_add()'.

Reported-by: syzbot+453873f1588c2d75b447@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=453873f1588c2d75b447
Fixes: ccd979bdbce9 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
---
 fs/ocfs2/resize.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/ocfs2/resize.c b/fs/ocfs2/resize.c
index c4a4016d3866..b0733c08ed13 100644
--- a/fs/ocfs2/resize.c
+++ b/fs/ocfs2/resize.c
@@ -574,6 +574,8 @@ int ocfs2_group_add(struct inode *inode, struct ocfs2_new_group_input *input)
 	ocfs2_commit_trans(osb, handle);
 
 out_free_group_bh:
+	if (ret < 0)
+		ocfs2_remove_from_cache(INODE_CACHE(inode), group_bh);
 	brelse(group_bh);
 
 out_unlock:
-- 
2.47.0

Re: [PATCH] ocfs2: uncache inode which has failed entering the group

[Joseph Qi]

On 11/14/24 12:38 PM, Dmitry Antipov wrote:
> Syzbot has reported the following BUG:
> 
> kernel BUG at fs/ocfs2/uptodate.c:509!
> ...
> Call Trace:
>  <TASK>
>  ? __die_body+0x5f/0xb0
>  ? die+0x9e/0xc0
>  ? do_trap+0x15a/0x3a0
>  ? ocfs2_set_new_buffer_uptodate+0x145/0x160
>  ? do_error_trap+0x1dc/0x2c0
>  ? ocfs2_set_new_buffer_uptodate+0x145/0x160
>  ? __pfx_do_error_trap+0x10/0x10
>  ? handle_invalid_op+0x34/0x40
>  ? ocfs2_set_new_buffer_uptodate+0x145/0x160
>  ? exc_invalid_op+0x38/0x50
>  ? asm_exc_invalid_op+0x1a/0x20
>  ? ocfs2_set_new_buffer_uptodate+0x2e/0x160
>  ? ocfs2_set_new_buffer_uptodate+0x144/0x160
>  ? ocfs2_set_new_buffer_uptodate+0x145/0x160
>  ocfs2_group_add+0x39f/0x15a0
>  ? __pfx_ocfs2_group_add+0x10/0x10
>  ? __pfx_lock_acquire+0x10/0x10
>  ? mnt_get_write_access+0x68/0x2b0
>  ? __pfx_lock_release+0x10/0x10
>  ? rcu_read_lock_any_held+0xb7/0x160
>  ? __pfx_rcu_read_lock_any_held+0x10/0x10
>  ? smack_log+0x123/0x540
>  ? mnt_get_write_access+0x68/0x2b0
>  ? mnt_get_write_access+0x68/0x2b0
>  ? mnt_get_write_access+0x226/0x2b0
>  ocfs2_ioctl+0x65e/0x7d0
>  ? __pfx_ocfs2_ioctl+0x10/0x10
>  ? smack_file_ioctl+0x29e/0x3a0
>  ? __pfx_smack_file_ioctl+0x10/0x10
>  ? lockdep_hardirqs_on_prepare+0x43d/0x780
>  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
>  ? __pfx_ocfs2_ioctl+0x10/0x10
>  __se_sys_ioctl+0xfb/0x170
>  do_syscall_64+0xf3/0x230
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> ...
>  </TASK>
> 
> When 'ioctl(OCFS2_IOC_GROUP_ADD, ...)' has failed for the particular
> inode in 'ocfs2_verify_group_and_input()', corresponding buffer head
> remains cached and subsequent call to the same 'ioctl()' for the same
> inode issues the BUG() in 'ocfs2_set_new_buffer_uptodate()' (trying
> to cache the same buffer head of that inode). Fix this by uncaching
> the buffer head with 'ocfs2_remove_from_cache()' on error path in
> 'ocfs2_group_add()'.
> 
> Reported-by: syzbot+453873f1588c2d75b447@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=453873f1588c2d75b447
> Fixes: ccd979bdbce9 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")

Seems the blame commit id should be:
7909f2bf8353 ("[PATCH 2/2] ocfs2: Implement group add for online resize")

Cc: stable@vger.kernel.org
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>

> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
> ---
>  fs/ocfs2/resize.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/fs/ocfs2/resize.c b/fs/ocfs2/resize.c
> index c4a4016d3866..b0733c08ed13 100644
> --- a/fs/ocfs2/resize.c
> +++ b/fs/ocfs2/resize.c
> @@ -574,6 +574,8 @@ int ocfs2_group_add(struct inode *inode, struct ocfs2_new_group_input *input)
>  	ocfs2_commit_trans(osb, handle);
>  
>  out_free_group_bh:
> +	if (ret < 0)
> +		ocfs2_remove_from_cache(INODE_CACHE(inode), group_bh);
>  	brelse(group_bh);
>  
>  out_unlock: