public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
From: xiaoshoukui <xiaoshoukui@gmail.com>
To: dsterba@suse.cz
Cc: clm@fb.com, josef@toxicpanda.com, dsterba@suse.com,
	linux-btrfs@vger.kernel.org, linux-kernel@vger.kernel.org,
	xiaoshoukui@ruijie.com.cn, xiaoshoukui <xiaoshoukui@gmail.com>
Subject: [PATCH] btrfs: ioctl: fix assertion compatible sets when cocurrently adding multiple devices
Date: Thu,  6 Apr 2023 02:32:55 -0400	[thread overview]
Message-ID: <20230406063255.126375-1-xiaoshoukui@gmail.com> (raw)

ASSERT in btrfs_exclop_balance should also check for NONE and
BALANCE_PAUSED status.

Scenario 1: With exclusive_operation state == BTRFS_EXCLOP_NONE.
Cocurrently adding multiple devices to the same mount point and
btrfs_exclop_finish executed finish before assertion in
btrfs_exclop_balance, exclusive_operation will changed to
BTRFS_EXCLOP_NONE state which lead to assertion failed:
fs_info->exclusive_operation == BTRFS_EXCLOP_BALANCE ||
fs_info->exclusive_operation == BTRFS_EXCLOP_DEV_ADD,
in fs/btrfs/ioctl.c:456
Call Trace:
 <TASK>
 btrfs_exclop_balance+0x13c/0x310
 ? memdup_user+0xab/0xc0
 ? PTR_ERR+0x17/0x20
 btrfs_ioctl_add_dev+0x2ee/0x320
 btrfs_ioctl+0x9d5/0x10d0
 ? btrfs_ioctl_encoded_write+0xb80/0xb80
 __x64_sys_ioctl+0x197/0x210
 do_syscall_64+0x3c/0xb0
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Scenario 2: With exclusive_operation state == BTRFS_EXCLOP_BALANCE_PAUSED.
Cocurrently adding multiple devices to the same mount point and
btrfs_exclop_balance executed finish before the latter thread execute
assertion in btrfs_exclop_balance, exclusive_operation will changed to
BTRFS_EXCLOP_BALANCE_PAUSED state which lead to assertion failed:
fs_info->exclusive_operation == BTRFS_EXCLOP_BALANCE ||
fs_info->exclusive_operation == BTRFS_EXCLOP_DEV_ADD ||
fs_info->exclusive_operation == BTRFS_EXCLOP_NONE,
fs/btrfs/ioctl.c:458
Call Trace:
 <TASK>
 btrfs_exclop_balance+0x240/0x410
 ? memdup_user+0xab/0xc0
 ? PTR_ERR+0x17/0x20
 btrfs_ioctl_add_dev+0x2ee/0x320
 btrfs_ioctl+0x9d5/0x10d0
 ? btrfs_ioctl_encoded_write+0xb80/0xb80
 __x64_sys_ioctl+0x197/0x210
 do_syscall_64+0x3c/0xb0
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Analyzed-by: xiaoshoukui <xiaoshoukui@ruijie.com.cn>
Link: https://lore.kernel.org/linux-btrfs/20230404191042.GE19619@suse.cz/T/#t
Signed-off-by: xiaoshoukui <xiaoshoukui@ruijie.com.cn>
---
 fs/btrfs/ioctl.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index a0ef1a1784c7..7df80b37bc44 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -454,7 +454,9 @@ void btrfs_exclop_balance(struct btrfs_fs_info *fs_info,
 	case BTRFS_EXCLOP_BALANCE_PAUSED:
 		spin_lock(&fs_info->super_lock);
 		ASSERT(fs_info->exclusive_operation == BTRFS_EXCLOP_BALANCE ||
-		       fs_info->exclusive_operation == BTRFS_EXCLOP_DEV_ADD);
+		       fs_info->exclusive_operation == BTRFS_EXCLOP_DEV_ADD ||
+		       fs_info->exclusive_operation == BTRFS_EXCLOP_NONE ||
+		       fs_info->exclusive_operation == BTRFS_EXCLOP_BALANCE_PAUSED);
 		fs_info->exclusive_operation = BTRFS_EXCLOP_BALANCE_PAUSED;
 		spin_unlock(&fs_info->super_lock);
 		break;
-- 
2.20.1


                 reply	other threads:[~2023-04-06  6:34 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20230406063255.126375-1-xiaoshoukui@gmail.com \
    --to=xiaoshoukui@gmail.com \
    --cc=clm@fb.com \
    --cc=dsterba@suse.com \
    --cc=dsterba@suse.cz \
    --cc=josef@toxicpanda.com \
    --cc=linux-btrfs@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=xiaoshoukui@ruijie.com.cn \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox