github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 01:32:21 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
master
linux/fs/ceph
History
Max Kellermann 5b602344a4 ceph: avoid fs reclaim while using current->journal_info 
handle_reply() stores a `ceph_mds_request` pointer in
`current->journal_info` while filling the inode and dentry cache from
an MDS reply.

An allocation in this section can enter direct reclaim and prune
dentries from another filesystem.  If this dirties an ext4 inode, ext4
starts a JBD2 transaction.  JBD2 interprets the Ceph request in
`current->journal_info` as a journal handle and dereferences the
request's `r_tid` as `h_transaction`, causing a kernel crash, e.g.:

 Unable to handle kernel paging request at virtual address 00000000077b4818
 [...]
 Internal error: Oops: 0000000096000004 [#1]  SMP
 Modules linked in:
 CPU: 6 UID: 0 PID: 2699135 Comm: kworker/6:3 Tainted: G        W           6.18.38-i3 #1113 NONE
 [...]
 Workqueue: ceph-msgr ceph_con_workfn
 pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
 pc : jbd2__journal_start+0x2c/0x208
 lr : __ext4_journal_start_sb+0x100/0x178
 [...]
 Call trace:
  jbd2__journal_start+0x2c/0x208 (P)
  __ext4_journal_start_sb+0x100/0x178
  ext4_dirty_inode+0x3c/0x90
  __mark_inode_dirty+0x58/0x400
  iput.part.0+0x2b0/0x370
  iput+0x18/0x30
  dentry_unlink_inode+0xc0/0x158
  __dentry_kill+0x80/0x250
  shrink_dentry_list+0x90/0x130
  prune_dcache_sb+0x60/0x98
  super_cache_scan+0xe8/0x190
  do_shrink_slab+0x174/0x388
  shrink_slab+0xd8/0x4c0
  shrink_node+0x31c/0x908
  do_try_to_free_pages+0xd0/0x508
  try_to_free_pages+0x11c/0x238
  __alloc_frozen_pages_noprof+0x4d0/0xdd0
  __folio_alloc_noprof+0x18/0x70
  __filemap_get_folio+0x248/0x440
  ceph_readdir_prepopulate+0x570/0x9e8
  mds_dispatch+0x1424/0x1ba0
  ceph_con_process_message+0x74/0xa0
  ceph_con_v1_try_read+0x3a0/0x1510
  ceph_con_workfn+0x260/0x460

Enter a scoped NOFS allocation context and leave it after clearing
`journal_info`.  This prevents filesystem reclaim from recursing into
another filesystem while the field contains Ceph-private data.

Cc: stable@vger.kernel.org
Fixes: 315f240880 ("ceph: fix security xattr deadlock")
Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Reviewed-by: Xiubo Li <xiubo.li@clyso.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
2026-07-23 20:29:42 +02:00
..
acl.c posix_acl: make posix_acl_to_xattr() alloc the buffer 2026-01-16 10:51:12 +01:00
addr.c ceph: fix writeback_count leak in write_folio_nounlock() 2026-07-23 20:29:41 +02:00
cache.c ceph: use the new ->i_state accessors 2025-10-20 20:22:27 +02:00
cache.h netfs: Provide invalidate_folio and release_folio calls 2023-12-24 15:08:51 +00:00
caps.c ceph: fix hanging __ceph_get_caps() with stale mds_wanted 2026-07-23 20:29:42 +02:00
ceph_frag.c
crypto.c treewide: change inode->i_ino from unsigned long to u64 2026-03-06 14:31:28 +01:00
crypto.h ceph: replace local base64 helpers with lib/base64 2025-11-20 14:03:44 -08:00
debugfs.c ceph: add manual reset debugfs control and tracepoints 2026-06-22 22:45:05 +02:00
dir.c ceph: fix refcount leak in ceph_readdir() 2026-07-23 20:29:41 +02:00
export.c ceph: cleanup hardcoded constants of file handle size 2025-06-01 17:53:16 +02:00
file.c ceph: fix hanging __ceph_get_caps() with stale mds_wanted 2026-07-23 20:29:42 +02:00
inode.c ceph: add diagnostic timeout loop to wait_caps_flush() 2026-06-22 22:44:56 +02:00
io.c ceph: fix potential race condition on operations with CEPH_I_ODIRECT flag 2025-10-08 23:30:46 +02:00
io.h ceph: make ceph_start_io_*() killable 2025-10-08 23:30:46 +02:00
ioctl.c ceph: add owner/capability checks for CEPH_IOC_SET_LAYOUT* 2026-07-23 20:29:42 +02:00
ioctl.h
Kconfig ceph: stop selecting CRC32, CRYPTO, and CRYPTO_AES 2025-12-10 11:50:54 +01:00
locks.c ceph: add client reset state machine and session teardown 2026-06-22 22:45:00 +02:00
Makefile ceph: add subvolume metrics collection and reporting 2026-04-22 01:40:23 +02:00
mds_client.c ceph: avoid fs reclaim while using current->journal_info 2026-07-23 20:29:42 +02:00
mds_client.h ceph: fix hanging __ceph_get_caps() with stale mds_wanted 2026-07-23 20:29:42 +02:00
mdsmap.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
mdsmap.h ceph: fix NULL pointer dereference in ceph_mds_auth_match() 2026-02-04 22:00:42 +01:00
metric.c ceph: add subvolume metrics collection and reporting 2026-04-22 01:40:23 +02:00
metric.h ceph: add subvolume metrics collection and reporting 2026-04-22 01:40:23 +02:00
quota.c ceph: add ceph_has_realms_with_quotas() check to ceph_quota_update_statfs() 2026-05-11 10:39:22 +02:00
snap.c ceph: convert inode flags to named bit positions and atomic bitops 2026-06-22 22:44:42 +02:00
strings.c
subvolume_metrics.c ceph: add subvolume metrics collection and reporting 2026-04-22 01:40:23 +02:00
subvolume_metrics.h ceph: add subvolume metrics collection and reporting 2026-04-22 01:40:23 +02:00
super.c ceph: add subvolume metrics collection and reporting 2026-04-22 01:40:23 +02:00
super.h ceph: add manual reset debugfs control and tracepoints 2026-06-22 22:45:05 +02:00
util.c
xattr.c ceph: convert inode flags to named bit positions and atomic bitops 2026-06-22 22:44:42 +02:00