search for: ocfs2_mem_dqinfo

...ocfs2/quota.h index 33b47eb..f837265 100644 --- a/fs/ocfs2/quota.h +++ b/fs/ocfs2/quota.h @@ -14,6 +14,7 @@ #include <linux/quota.h> #include <linux/list.h> #include <linux/dqblk_qtree.h> +#include <linux/timer.h> #include "ocfs2.h" @@ -67,6 +68,7 @@ struct ocfs2_mem_dqinfo { unsigned int dqi_chunks; /* Number of chunks in local quota file */ unsigned int dqi_blocks; /* Number of blocks allocated for local quota file */ unsigned int dqi_syncms; /* How often should we sync with other nodes */ + unsigned int dqi_syncjiff; /* Precomputed dqi_syncms in jiffies */...

It's trivial to trigger a use-after-free bug in the ocfs2 quotas code using fstest generic/452. After a read-only remount, quotas are suspended and ocfs2_mem_dqinfo is freed through ->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access to the oinfo will eventually cause a crash. BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 Read of size 8 at addr ffff8880389a8208 by task umount/669 ... Call Trace: <TASK> ... timer_d...

Hi, This is the second batch of Ocfs2 patches intended for the merge window. The 1st batch were sent out previously: http://lkml.org/lkml/2008/12/19/280 The bulk of this set is comprised of Jan Kara's patches to add quota support to Ocfs2. Many of the quota patches are to generic code, which I carried to make merging of the Ocfs2 support easier. All of the non-ocfs2 patches should have

...t oss.oracle.com> Subject: ocfs2: fix use-after-free when unmounting read-only filesystem Date: Mon, 22 May 2023 11:21:12 +0100 It's trivial to trigger a use-after-free bug in the ocfs2 quotas code using fstest generic/452. After mounting a filesystem as read-only, quotas are suspended and ocfs2_mem_dqinfo is freed through ->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access to the oinfo will eventually cause a crash. Link: https://lkml.kernel.org/r/20230522102112.9031-1-lhenriques at suse.de Signed-off-by: Lu??s Henriques <lhenriques at suse.de> Reviewed-by: Joseph Qi...

On 5/23/23 5:33 PM, Lu?s Henriques wrote: > It's trivial to trigger a use-after-free bug in the ocfs2 quotas code using > fstest generic/452. After a read-only remount, quotas are suspended and > ocfs2_mem_dqinfo is freed through ->ocfs2_local_free_info(). When unmounting > the filesystem, an UAF access to the oinfo will eventually cause a crash. > > BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 > Read of size 8 at addr ffff8880389a8208 by task umount/669 > ... > Call Trac...

On Fri, 26 May 2023 09:36:25 +0800 Joseph Qi <joseph.qi at linux.alibaba.com> wrote: > Hi Andrew, > > There is an updated version v2, which describe more clearly about the > case: > https://lore.kernel.org/ocfs2-devel/e9fc4b2f-1fcc-7c31-f346-59eccff50f9b at linux.alibaba.com/T/#u Sigh. Thanks. As you can see from the above link, the email never hit ocfs2-devel and never

...nt-Transfer-Encoding: 8bit From: Lu?s Henriques <ocfs2-devel at oss.oracle.com> commit 50d927880e0f90d5cb25e897e9d03e5edacc79a8 upstream. It's trivial to trigger a use-after-free bug in the ocfs2 quotas code using fstest generic/452. After a read-only remount, quotas are suspended and ocfs2_mem_dqinfo is freed through ->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access to the oinfo will eventually cause a crash. BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 Read of size 8 at addr ffff8880389a8208 by task umount/669 ... Call Trace: <TASK> ... timer_d...

...nt-Transfer-Encoding: 8bit From: Lu?s Henriques <ocfs2-devel at oss.oracle.com> commit 50d927880e0f90d5cb25e897e9d03e5edacc79a8 upstream. It's trivial to trigger a use-after-free bug in the ocfs2 quotas code using fstest generic/452. After a read-only remount, quotas are suspended and ocfs2_mem_dqinfo is freed through ->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access to the oinfo will eventually cause a crash. BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 Read of size 8 at addr ffff8880389a8208 by task umount/669 ... Call Trace: <TASK> ... timer_d...

...nt-Transfer-Encoding: 8bit From: Lu?s Henriques <ocfs2-devel at oss.oracle.com> commit 50d927880e0f90d5cb25e897e9d03e5edacc79a8 upstream. It's trivial to trigger a use-after-free bug in the ocfs2 quotas code using fstest generic/452. After a read-only remount, quotas are suspended and ocfs2_mem_dqinfo is freed through ->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access to the oinfo will eventually cause a crash. BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 Read of size 8 at addr ffff8880389a8208 by task umount/669 ... Call Trace: <TASK> ... timer_d...

...nt-Transfer-Encoding: 8bit From: Lu?s Henriques <ocfs2-devel at oss.oracle.com> commit 50d927880e0f90d5cb25e897e9d03e5edacc79a8 upstream. It's trivial to trigger a use-after-free bug in the ocfs2 quotas code using fstest generic/452. After a read-only remount, quotas are suspended and ocfs2_mem_dqinfo is freed through ->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access to the oinfo will eventually cause a crash. BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 Read of size 8 at addr ffff8880389a8208 by task umount/669 ... Call Trace: <TASK> ... timer_d...

...nt-Transfer-Encoding: 8bit From: Lu?s Henriques <ocfs2-devel at oss.oracle.com> commit 50d927880e0f90d5cb25e897e9d03e5edacc79a8 upstream. It's trivial to trigger a use-after-free bug in the ocfs2 quotas code using fstest generic/452. After a read-only remount, quotas are suspended and ocfs2_mem_dqinfo is freed through ->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access to the oinfo will eventually cause a crash. BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 Read of size 8 at addr ffff8880389a8208 by task umount/669 ... Call Trace: <TASK> ... timer_d...

...nt-Transfer-Encoding: 8bit From: Lu?s Henriques <ocfs2-devel at oss.oracle.com> commit 50d927880e0f90d5cb25e897e9d03e5edacc79a8 upstream. It's trivial to trigger a use-after-free bug in the ocfs2 quotas code using fstest generic/452. After a read-only remount, quotas are suspended and ocfs2_mem_dqinfo is freed through ->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access to the oinfo will eventually cause a crash. BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 Read of size 8 at addr ffff8880389a8208 by task umount/669 ... Call Trace: <TASK> ... timer_d...

...nt-Transfer-Encoding: 8bit From: Lu?s Henriques <ocfs2-devel at oss.oracle.com> commit 50d927880e0f90d5cb25e897e9d03e5edacc79a8 upstream. It's trivial to trigger a use-after-free bug in the ocfs2 quotas code using fstest generic/452. After a read-only remount, quotas are suspended and ocfs2_mem_dqinfo is freed through ->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access to the oinfo will eventually cause a crash. BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 Read of size 8 at addr ffff8880389a8208 by task umount/669 ... Call Trace: <TASK> ... timer_d...

...ect: ocfs2: fix use-after-free when unmounting read-only filesystem > Date: Mon, 22 May 2023 11:21:12 +0100 > > It's trivial to trigger a use-after-free bug in the ocfs2 quotas code > using fstest generic/452. After mounting a filesystem as read-only, > quotas are suspended and ocfs2_mem_dqinfo is freed through > ->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access > to the oinfo will eventually cause a crash. > > Link: https://lkml.kernel.org/r/20230522102112.9031-1-lhenriques at suse.de > Signed-off-by: Lu?s Henriques <lhenriques at suse.de>...

The Lock Value Block (LVB) of a DLM lock can be lost when nodes die and the DLM cannot reconstruct its state. Clients of the DLM need to know this. ocfs2's internal DLM, o2dlm, explicitly zeroes out the LVB when it loses track of the state. This is not a standard behavior, but ocfs2 has always relied on it. Thus, an o2dlm LVB is always "valid". ocfs2 now supports both o2dlm and

Hello, the following series of patches fixes some issues with OCFS2 quotas. The first patch modifies VFS quota locking, the next patch uses the fact to simplify OCFS2 quota locking and solves a few deadlock issues. The third and the fourth patches fix another possible deadlocks in OCFS2 quota code and the last patch is a minor cleanup. Honza

Hi, the first four patches in this series fix locking problems in OCFS2 quota code (three of them can lead to potential deadlocks). The fifth patch reorders ip_alloc_sem for directories to be acquired before localalloc locks. Mark would you please merge these? The last two patches implement lockdep annotations for OCFS2 cluster locks. We annotate all the cluster locks except for special ones

Hi, here is the second version of OCFS2 quota fixes with Joel's comments fixed. Also I've added a patch defining counts of credits for quota operations as Joel asked. Honza

Hi, I did some more in-depth testing of OCFS2 quota code, especially with ECC feature enabled and spotted some problems. First four patches fix them. I need the fifth patch to be able to mount OCFS2 filesystem with 2.6.31-rc3. The sixth patch fixes a potential problem when quota syncing interval is updated while the cluster is running (which is not possible currently). Joel, could you please

Hi, I'm resending this patch series. It's rediffed against linux-next branch of Joel's git tree. The first four patches are obvious fixes of deadlocks in quota code and should go in as soon as possible. The other three patches implement lockdep support for OCFS2 cluster locks. So you can have a look whether the code make sence to you and possibly merge them. They should be NOP when