Re: [syzbot] [erofs?] [fat?] WARNING in erofs_kill_sb

[Christian Brauner <brauner@kernel.org>]

On Mon, Jul 31, 2023 at 02:43:39PM +0200, Christian Brauner wrote:
> On Mon, Jul 31, 2023 at 01:16:22PM +0200, Christoph Hellwig wrote:
> > On Mon, Jul 31, 2023 at 06:58:14PM +0800, Gao Xiang wrote:
> > > Previously, deactivate_locked_super() or .kill_sb() will only be
> > > called after fill_super is called, and .s_magic will be set at
> > > the very beginning of erofs_fc_fill_super().
> > >
> > > After ("fs: open block device after superblock creation"), such
> > > convension is changed now.  Yet at a quick glance,
> > >
> > > WARN_ON(sb->s_magic != EROFS_SUPER_MAGIC);
> > >
> > > in erofs_kill_sb() can be removed since deactivate_locked_super()
> > > will also be called if setup_bdev_super() is falled.  I'd suggest
> > > that removing this WARN_ON() in the related commit, or as
> > > a following commit of the related branch of the pull request if
> > > possible.
> > 
> > Agreed.  I wonder if we should really call into ->kill_sb before
> > calling into fill_super, but I need to carefull look into the
> > details.
> 
> I think checking for s_magic in erofs kill sb is wrong as it introduces
> a dependency on both fill_super() having been called and that s_magic is
> initialized first. If someone reorders erofs_kill_sb() such that s_magic
> is only filled in once everything else succeeded it would cause the same
> bug. That doesn't sound nice to me.
> 
> I think ->fill_super() should only be called after successfull
> superblock allocation and after the device has been successfully opened.
> Just as this code does now. So ->kill_sb() should only be called after
> we're guaranteed that ->fill_super() has been called.
> 
> We already mostly express that logic through the fs_context object.
> Anything that's allocated in fs_context->init_fs_context() is freed in
> fs_context->free() before fill_super() is called. After ->fill_super()
> is called fs_context->s_fs_info will have been transferred to
> sb->s_fs_info and will have to be killed via ->kill_sb().
> 
> Does that make sense?

Uh, no. I vasty underestimated how sensitive that change would be. Plus
arguably ->kill_sb() really should be callable once the sb is visible.

Are you looking into this or do you want me to, Christoph?