search for: oinfo

...+#include <linux/jiffies.h> +#include <linux/timer.h> +#include <linux/writeback.h> #define MLOG_MASK_PREFIX ML_QUOTA #include <cluster/masklog.h> @@ -19,6 +23,8 @@ #include "dlmglue.h" #include "quota.h" +static void qsync_timer_fn(unsigned long oinfo_ptr); + static void ocfs2_global_disk2memdqb(struct dquot *dquot, void *dp) { struct ocfs2_global_disk_dqblk *d = dp; @@ -236,11 +242,17 @@ int ocfs2_global_read_info(struct super_block *sb, int type) info->dqi_bgrace = le32_to_cpu(dinfo.dqi_bgrace); info->dqi_igrace = le32_to_cpu(din...

Hi, here is the second version of OCFS2 quota fixes with Joel's comments fixed. Also I've added a patch defining counts of credits for quota operations as Joel asked. Honza

Hi, I did some more in-depth testing of OCFS2 quota code, especially with ECC feature enabled and spotted some problems. First four patches fix them. I need the fifth patch to be able to mount OCFS2 filesystem with 2.6.31-rc3. The sixth patch fixes a potential problem when quota syncing interval is updated while the cluster is running (which is not possible currently). Joel, could you please

Hi, All, When mount ocfs2 with option usrquota and grpquota, we will see below message: (mount.ocfs2,9434,1):ocfs2_global_read_info:403 ERROR: status = 24 (mount.ocfs2,9434,3):ocfs2_global_read_info:403 ERROR: status = 24 But actually this should not be a error. In ocfs2_global_read_info, if read_quota() succeed, status is the size of the struct ocfs2_global_disk_dqinfo, only when it is not

It's trivial to trigger a use-after-free bug in the ocfs2 quotas code using fstest generic/452. After a read-only remount, quotas are suspended and ocfs2_mem_dqinfo is freed through ->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access to the oinfo will eventually cause a crash. BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 Read of size 8 at addr ffff8880389a8208 by task umount/669 ... Call Trace: <TASK> ... timer_delete+0x54/0xc0 try_to_grab_pending+0x31/0x230 __cancel_work_timer+0x6c/0x270 ocfs2_disable_quotas.isra....

...:21:12 +0100 It's trivial to trigger a use-after-free bug in the ocfs2 quotas code using fstest generic/452. After mounting a filesystem as read-only, quotas are suspended and ocfs2_mem_dqinfo is freed through ->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access to the oinfo will eventually cause a crash. Link: https://lkml.kernel.org/r/20230522102112.9031-1-lhenriques at suse.de Signed-off-by: Lu??s Henriques <lhenriques at suse.de> Reviewed-by: Joseph Qi <joseph.qi at linux.alibaba.com> Tested-by: Joseph Qi <joseph.qi at linux.alibaba.com> Cc: Mark...

...412 100644 --- a/fs/ocfs2/quota_local.c +++ b/fs/ocfs2/quota_local.c @@ -811,7 +811,7 @@ static int ocfs2_local_free_info(struct super_block *sb, int type) struct ocfs2_quota_chunk *chunk; struct ocfs2_local_disk_chunk *dchunk; int mark_clean = 1, len; - int status; + int status = 0; iput(oinfo->dqi_gqinode); ocfs2_simple_drop_lockres(OCFS2_SB(sb), &oinfo->dqi_gqlock); @@ -853,17 +853,14 @@ static int ocfs2_local_free_info(struct super_block *sb, int type) oinfo->dqi_libh, olq_update_info, info); - if (status < 0) { + if (status < 0) mlog_errno(st...

Hi, This is the second batch of Ocfs2 patches intended for the merge window. The 1st batch were sent out previously: http://lkml.org/lkml/2008/12/19/280 The bulk of this set is comprised of Jan Kara's patches to add quota support to Ocfs2. Many of the quota patches are to generic code, which I carried to make merging of the Ocfs2 support easier. All of the non-ocfs2 patches should have

...s wrote: > It's trivial to trigger a use-after-free bug in the ocfs2 quotas code using > fstest generic/452. After a read-only remount, quotas are suspended and > ocfs2_mem_dqinfo is freed through ->ocfs2_local_free_info(). When unmounting > the filesystem, an UAF access to the oinfo will eventually cause a crash. > > BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 > Read of size 8 at addr ffff8880389a8208 by task umount/669 > ... > Call Trace: > <TASK> > ... > timer_delete+0x54/0xc0 > try_to_grab_pending+0x31/0x230 > __cancel...

...7e9d03e5edacc79a8 upstream. It's trivial to trigger a use-after-free bug in the ocfs2 quotas code using fstest generic/452. After a read-only remount, quotas are suspended and ocfs2_mem_dqinfo is freed through ->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access to the oinfo will eventually cause a crash. BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 Read of size 8 at addr ffff8880389a8208 by task umount/669 ... Call Trace: <TASK> ... timer_delete+0x54/0xc0 try_to_grab_pending+0x31/0x230 __cancel_work_timer+0x6c/0x270 ocfs2_disable_quotas.isra....

...7e9d03e5edacc79a8 upstream. It's trivial to trigger a use-after-free bug in the ocfs2 quotas code using fstest generic/452. After a read-only remount, quotas are suspended and ocfs2_mem_dqinfo is freed through ->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access to the oinfo will eventually cause a crash. BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 Read of size 8 at addr ffff8880389a8208 by task umount/669 ... Call Trace: <TASK> ... timer_delete+0x54/0xc0 try_to_grab_pending+0x31/0x230 __cancel_work_timer+0x6c/0x270 ocfs2_disable_quotas.isra....

...7e9d03e5edacc79a8 upstream. It's trivial to trigger a use-after-free bug in the ocfs2 quotas code using fstest generic/452. After a read-only remount, quotas are suspended and ocfs2_mem_dqinfo is freed through ->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access to the oinfo will eventually cause a crash. BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 Read of size 8 at addr ffff8880389a8208 by task umount/669 ... Call Trace: <TASK> ... timer_delete+0x54/0xc0 try_to_grab_pending+0x31/0x230 __cancel_work_timer+0x6c/0x270 ocfs2_disable_quotas.isra....

...7e9d03e5edacc79a8 upstream. It's trivial to trigger a use-after-free bug in the ocfs2 quotas code using fstest generic/452. After a read-only remount, quotas are suspended and ocfs2_mem_dqinfo is freed through ->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access to the oinfo will eventually cause a crash. BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 Read of size 8 at addr ffff8880389a8208 by task umount/669 ... Call Trace: <TASK> ... timer_delete+0x54/0xc0 try_to_grab_pending+0x31/0x230 __cancel_work_timer+0x6c/0x270 ocfs2_disable_quotas.isra....

...7e9d03e5edacc79a8 upstream. It's trivial to trigger a use-after-free bug in the ocfs2 quotas code using fstest generic/452. After a read-only remount, quotas are suspended and ocfs2_mem_dqinfo is freed through ->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access to the oinfo will eventually cause a crash. BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 Read of size 8 at addr ffff8880389a8208 by task umount/669 ... Call Trace: <TASK> ... timer_delete+0x54/0xc0 try_to_grab_pending+0x31/0x230 __cancel_work_timer+0x6c/0x270 ocfs2_disable_quotas.isra....

...7e9d03e5edacc79a8 upstream. It's trivial to trigger a use-after-free bug in the ocfs2 quotas code using fstest generic/452. After a read-only remount, quotas are suspended and ocfs2_mem_dqinfo is freed through ->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access to the oinfo will eventually cause a crash. BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 Read of size 8 at addr ffff8880389a8208 by task umount/669 ... Call Trace: <TASK> ... timer_delete+0x54/0xc0 try_to_grab_pending+0x31/0x230 __cancel_work_timer+0x6c/0x270 ocfs2_disable_quotas.isra....

...7e9d03e5edacc79a8 upstream. It's trivial to trigger a use-after-free bug in the ocfs2 quotas code using fstest generic/452. After a read-only remount, quotas are suspended and ocfs2_mem_dqinfo is freed through ->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access to the oinfo will eventually cause a crash. BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 Read of size 8 at addr ffff8880389a8208 by task umount/669 ... Call Trace: <TASK> ... timer_delete+0x54/0xc0 try_to_grab_pending+0x31/0x230 __cancel_work_timer+0x6c/0x270 ocfs2_disable_quotas.isra....

...;s trivial to trigger a use-after-free bug in the ocfs2 quotas code > using fstest generic/452. After mounting a filesystem as read-only, > quotas are suspended and ocfs2_mem_dqinfo is freed through > ->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access > to the oinfo will eventually cause a crash. > > Link: https://lkml.kernel.org/r/20230522102112.9031-1-lhenriques at suse.de > Signed-off-by: Lu?s Henriques <lhenriques at suse.de> > Reviewed-by: Joseph Qi <joseph.qi at linux.alibaba.com> > Tested-by: Joseph Qi <joseph.qi at linux....

Hello, the following series of patches fixes some issues with OCFS2 quotas. The first patch modifies VFS quota locking, the next patch uses the fact to simplify OCFS2 quota locking and solves a few deadlock issues. The third and the fourth patches fix another possible deadlocks in OCFS2 quota code and the last patch is a minor cleanup. Honza

Hi, the first four patches in this series fix locking problems in OCFS2 quota code (three of them can lead to potential deadlocks). The fifth patch reorders ip_alloc_sem for directories to be acquired before localalloc locks. Mark would you please merge these? The last two patches implement lockdep annotations for OCFS2 cluster locks. We annotate all the cluster locks except for special ones

Hi, I'm resending this patch series. It's rediffed against linux-next branch of Joel's git tree. The first four patches are obvious fixes of deadlocks in quota code and should go in as soon as possible. The other three patches implement lockdep support for OCFS2 cluster locks. So you can have a look whether the code make sence to you and possibly merge them. They should be NOP when