Ye Bin 380a0091ca ext4: Fix BUG_ON in ext4_bread when write quota data ... We got issue as follows when run syzkaller: [ 167.936972] EXT4-fs error (device loop0): __ext4_remount:6314: comm rep: Abort forced by user [ 167.938306] EXT4-fs (loop0): Remounting filesystem read-only [ 167.981637] Assertion failure in ext4_getblk() at fs/ext4/inode.c:847: '(EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY) || handle != NULL || create == 0' [ 167.983601] ------------[ cut here ]------------ [ 167.984245] kernel BUG at fs/ext4/inode.c:847! [ 167.984882] invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI [ 167.985624] CPU: 7 PID: 2290 Comm: rep Tainted: G B 5.16.0-rc5-next-20211217+ #123 [ 167.986823] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014 [ 167.988590] RIP: 0010:ext4_getblk+0x17e/0x504 [ 167.989189] Code: c6 01 74 28 49 c7 c0 a0 a3 5c 9b b9 4f 03 00 00 48 c7 c2 80 9c 5c 9b 48 c7 c6 40 b6 5c 9b 48 c7 c7 20 a4 5c 9b e8 77 e3 fd ff <0f> 0b 8b 04 244 [ 167.991679] RSP: 0018:ffff8881736f7398 EFLAGS: 00010282 [ 167.992385] RAX: 0000000000000094 RBX: 1ffff1102e6dee75 RCX: 0000000000000000 [ 167.993337] RDX: 0000000000000001 RSI: ffffffff9b6e29e0 RDI: ffffed102e6dee66 [ 167.994292] RBP: ffff88816a076210 R08: 0000000000000094 R09: ffffed107363fa09 [ 167.995252] R10: ffff88839b1fd047 R11: ffffed107363fa08 R12: ffff88816a0761e8 [ 167.996205] R13: 0000000000000000 R14: 0000000000000021 R15: 0000000000000001 [ 167.997158] FS: 00007f6a1428c740(0000) GS:ffff88839b000000(0000) knlGS:0000000000000000 [ 167.998238] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 167.999025] CR2: 00007f6a140716c8 CR3: 0000000133216000 CR4: 00000000000006e0 [ 167.999987] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 168.000944] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 168.001899] Call Trace: [ 168.002235] <TASK> [ 168.007167] ext4_bread+0xd/0x53 [ 168.007612] ext4_quota_write+0x20c/0x5c0 [ 168.010457] write_blk+0x100/0x220 [ 168.010944] remove_free_dqentry+0x1c6/0x440 [ 168.011525] free_dqentry.isra.0+0x565/0x830 [ 168.012133] remove_tree+0x318/0x6d0 [ 168.014744] remove_tree+0x1eb/0x6d0 [ 168.017346] remove_tree+0x1eb/0x6d0 [ 168.019969] remove_tree+0x1eb/0x6d0 [ 168.022128] qtree_release_dquot+0x291/0x340 [ 168.023297] v2_release_dquot+0xce/0x120 [ 168.023847] dquot_release+0x197/0x3e0 [ 168.024358] ext4_release_dquot+0x22a/0x2d0 [ 168.024932] dqput.part.0+0x1c9/0x900 [ 168.025430] __dquot_drop+0x120/0x190 [ 168.025942] ext4_clear_inode+0x86/0x220 [ 168.026472] ext4_evict_inode+0x9e8/0xa22 [ 168.028200] evict+0x29e/0x4f0 [ 168.028625] dispose_list+0x102/0x1f0 [ 168.029148] evict_inodes+0x2c1/0x3e0 [ 168.030188] generic_shutdown_super+0xa4/0x3b0 [ 168.030817] kill_block_super+0x95/0xd0 [ 168.031360] deactivate_locked_super+0x85/0xd0 [ 168.031977] cleanup_mnt+0x2bc/0x480 [ 168.033062] task_work_run+0xd1/0x170 [ 168.033565] do_exit+0xa4f/0x2b50 [ 168.037155] do_group_exit+0xef/0x2d0 [ 168.037666] __x64_sys_exit_group+0x3a/0x50 [ 168.038237] do_syscall_64+0x3b/0x90 [ 168.038751] entry_SYSCALL_64_after_hwframe+0x44/0xae In order to reproduce this problem, the following conditions need to be met: 1. Ext4 filesystem with no journal; 2. Filesystem image with incorrect quota data; 3. Abort filesystem forced by user; 4. umount filesystem; As in ext4_quota_write: ... if (EXT4_SB(sb)->s_journal && !handle) { ext4_msg(sb, KERN_WARNING, "Quota write (off=%llu, len=%llu)" " cancelled because transaction is not started", (unsigned long long)off, (unsigned long long)len); return -EIO; } ... We only check handle if NULL when filesystem has journal. There is need check handle if NULL even when filesystem has no journal. Signed-off-by: Ye Bin <yebin10@huawei.com> Reviewed-by: Jan Kara <jack@suse.cz> Link: https://lore.kernel.org/r/20211223015506.297766-1-yebin10@huawei.com Signed-off-by: Theodore Ts'o <tytso@mit.edu> Cc: stable@kernel.org		2022-01-10 13:25:54 -05:00
..
9p	netfs, 9p, afs, ceph: Use folios	2021-11-10 21:16:56 +00:00
adfs	mm: require ->set_page_dirty to be explicitly wired up	2021-06-29 10:53:48 -07:00
affs	affs: use bdev_nr_sectors instead of open coding it	2021-10-18 14:43:22 -06:00
afs	afs: Use folios in directory handling	2021-11-10 21:17:09 +00:00
autofs	autofs: fix wait name hash calculation in autofs_wait()	2021-10-20 21:09:02 -04:00
befs	isystem: ship and use stdarg.h	2021-08-19 09:02:55 +09:00
bfs	mm: require ->set_page_dirty to be explicitly wired up	2021-06-29 10:53:48 -07:00
btrfs	for-5.16-rc2-tag	2021-11-26 11:24:32 -08:00
cachefiles	for-5.16/ki_complete-2021-10-29	2021-11-01 10:17:11 -07:00
ceph	One notable change here is that async creates and unlinks introduced	2021-11-13 11:31:07 -08:00
cifs	cifs: avoid use of dstaddr as key for fscache client cookie	2021-12-03 12:38:25 -06:00
coda	coda: bump module version to 7.2	2021-11-09 10:02:51 -08:00
configfs	configfs: fix a race in configfs_lookup()	2021-08-25 07:58:49 +02:00
cramfs	cramfs: use bdev_nr_bytes instead of open coding it	2021-10-18 14:43:22 -06:00
crypto	fscrypt: improve a few comments	2021-10-25 19:11:50 -07:00
debugfs	debugfs: debugfs_create_file_size(): use IS_ERR to check for error	2021-09-21 09:09:06 +02:00
devpts
dlm	fs: dlm: avoid comms shutdown delay in release_lockspace	2021-09-01 11:29:14 -05:00
ecryptfs	mm: require ->set_page_dirty to be explicitly wired up	2021-06-29 10:53:48 -07:00
efivarfs	efivars: convert to fileattr	2021-04-12 15:04:29 +02:00
efs
erofs	erofs: fix deadlock when shrink erofs slab	2021-11-23 14:58:16 +08:00
exfat	exfat: fix incorrect loading of i_blocks for large files	2021-11-01 07:49:21 +09:00
exportfs
ext2	ext2: fix sleeping in atomic bugs on error	2021-09-22 13:05:23 +02:00
ext4	ext4: Fix BUG_ON in ext4_bread when write quota data	2022-01-10 13:25:54 -05:00
f2fs	Update to zstd-1.4.10	2021-11-13 15:32:30 -08:00
fat	for-5.16/inode-sync-2021-10-29	2021-11-01 10:25:27 -07:00
freevxfs
fscache	fscache: Remove an unused static variable	2021-10-04 22:13:12 +01:00
fuse	fuse: release pipe buf after last use	2021-11-25 14:05:18 +01:00
gfs2	gfs2: gfs2_create_inode rework	2021-12-02 12:41:10 +01:00
hfs	Merge branch 'akpm' (patches from Andrew)	2021-11-09 10:11:53 -08:00
hfsplus	Merge branch 'akpm' (patches from Andrew)	2021-11-09 10:11:53 -08:00
hostfs	hostfs: support splice_write	2021-08-26 22:28:02 +02:00
hpfs	treewide: Replace open-coded flex arrays in unions	2021-10-18 12:28:53 -07:00
hugetlbfs	mm,hugetlb: remove mlock ulimit for SHM_HUGETLB	2021-11-09 10:02:48 -08:00
iomap	iomap: iomap_read_inline_data cleanup	2021-11-24 10:15:47 -08:00
isofs	isofs: Fix out of bound access for corrupted isofs image	2021-10-19 12:51:02 +02:00
jbd2	ext4: use ext4_journal_start/stop for fast commit transactions	2021-12-23 18:13:25 -05:00
jffs2	vfs: add rcu argument to ->get_acl() callback	2021-08-18 22:08:24 +02:00
jfs	Just one JFS patch	2021-11-03 09:23:25 -07:00
kernfs	Merge 5.15-rc6 into driver-core-next	2021-10-18 09:43:37 +02:00
ksmbd	ksmbd: fix memleak in get_file_stream_info()	2021-11-25 00:09:26 -06:00
lockd	A slow cycle for nfsd: mainly cleanup, including Neil's patch dropping	2021-11-10 16:45:54 -08:00
minix	mm: require ->set_page_dirty to be explicitly wired up	2021-06-29 10:53:48 -07:00
netfs	netfs: Adjust docs after foliation	2021-11-29 10:10:26 -08:00
nfs	NFS client bugfixes for Linux 5.16	2021-11-27 10:33:55 -08:00
nfs_common	nfs: Fix kerneldoc warning shown up by W=1	2021-10-04 22:02:17 +01:00
nfsd	This is just one bugfix for a bufferflow in knfsd's xdr decoding.	2021-11-17 08:38:00 -08:00
nilfs2	Merge branch 'akpm' (patches from Andrew)	2021-11-09 10:11:53 -08:00
nls
notify	fanotify: Allow users to request FAN_FS_ERROR events	2021-10-27 12:53:45 +02:00
ntfs	fs: ntfs: Limit NTFS_RW to page sizes smaller than 64k	2021-11-27 14:34:41 -08:00
ntfs3	gfs2: Fix mmap + page fault deadlocks	2021-11-02 12:25:03 -07:00
ocfs2	Merge branch 'exit-cleanups-for-v5.16' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2021-11-10 16:15:54 -08:00
omfs	mm: require ->set_page_dirty to be explicitly wired up	2021-06-29 10:53:48 -07:00
openpromfs
orangefs	orangefs: three fixes from other folks...	2021-11-09 10:34:06 -08:00
overlayfs	overlayfs update for 5.16	2021-11-09 10:51:12 -08:00
proc	proc/vmcore: fix clearing user buffer by properly using clear_user()	2021-11-20 10:35:55 -08:00
pstore	pstore/blk: Use "%lu" to format unsigned long	2021-11-21 09:44:19 -08:00
qnx4	qnx4: work around gcc false positive warning bug	2021-09-21 08:36:48 -07:00
qnx6
quota	\n	2021-11-06 16:40:48 -07:00
ramfs	Merge branch 'akpm' (patches from Andrew)	2021-11-09 10:11:53 -08:00
reiserfs	\n	2021-11-06 16:40:48 -07:00
romfs
smbfs_common	cifs: Move SMB2_Create definitions to the shared area	2021-11-05 09:55:36 -05:00
squashfs	lib: zstd: Add kernel-specific API	2021-11-08 16:55:21 -08:00
sysfs	fs/sysfs/dir.c: replace S_IRWXU|S_IRUGO|S_IXUGO with 0755 sysfs_create_dir_ns()	2021-10-05 16:35:05 +02:00
sysv	sysv: use BUILD_BUG_ON instead of runtime check	2021-11-09 10:02:52 -08:00
tracefs	tracefs: Have tracefs directories not set OTH permission bits by default	2021-10-08 18:08:43 -04:00
ubifs	fscrypt: remove fscrypt_operations::max_namelen	2021-09-20 19:32:33 -07:00
udf	udf: Fix crash after seekdir	2021-11-09 12:53:58 +01:00
ufs	isystem: ship and use stdarg.h	2021-08-19 09:02:55 +09:00
unicode	.gitignore: prefix local generated files with a slash	2021-05-02 00:43:35 +09:00
vboxsf	vboxfs: fix broken legacy mount signature checking	2021-09-27 11:26:21 -07:00
verity	fs-verity: fix signed integer overflow with i_size near S64_MAX	2021-09-22 10:56:34 -07:00
xfs	xfs: remove incorrect ASSERT in xfs_rename	2021-12-01 17:27:48 -08:00
zonefs	gfs2: Fix mmap + page fault deadlocks	2021-11-02 12:25:03 -07:00
aio.c	Various hardening fixes and cleanups for 5.16-rc1	2021-11-01 17:29:10 -07:00
anon_inodes.c	fs: add anon_inode_getfile_secure() similar to anon_inode_getfd_secure()	2021-09-19 22:35:37 -04:00
attr.c	fs: handle circular mappings correctly	2021-11-17 09:26:09 +01:00
bad_inode.c	vfs: add rcu argument to ->get_acl() callback	2021-08-18 22:08:24 +02:00
binfmt_aout.c	binfmt: a.out: Fix bogus semicolon	2021-09-05 10:15:05 -07:00
binfmt_elf_fdpic.c	coredump: Limit coredumps to a single thread group	2021-10-08 12:06:02 -05:00
binfmt_elf.c	Merge branch 'akpm' (patches from Andrew)	2021-11-09 10:11:53 -08:00
binfmt_flat.c	binfmt: remove in-tree usage of MAP_EXECUTABLE	2021-06-29 10:53:50 -07:00
binfmt_misc.c
binfmt_script.c
buffer.c	fs: simplify init_page_buffers	2021-10-18 14:43:22 -06:00
char_dev.c
compat_binfmt_elf.c
coredump.c	coredump: Limit coredumps to a single thread group	2021-10-08 12:06:02 -05:00
d_path.c	d_path: fix Kernel doc validator complaining	2021-11-06 13:30:32 -07:00
dax.c	New code for 5.15:	2021-08-31 11:13:35 -07:00
dcache.c	useful constants: struct qstr for ".."	2021-04-15 22:36:45 -04:00
direct-io.c	fs: get rid of the res2 iocb->ki_complete argument	2021-10-25 10:36:24 -06:00
drop_caches.c	fs: drop_caches: fix skipping over shadow cache inodes	2021-09-03 09:58:10 -07:00
eventfd.c	eventfd: Export eventfd_wake_count to modules	2021-09-06 07:20:56 -04:00
eventpoll.c	ARM development updates for 5.15:	2021-09-09 13:25:49 -07:00
exec.c	Merge branch 'exit-cleanups-for-v5.16' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2021-11-10 16:15:54 -08:00
fcntl.c	Merge branch 'akpm' (patches from Andrew)	2021-09-03 10:08:28 -07:00
fhandle.c
file_table.c
file.c	fget: check that the fd still exists after getting a ref to it	2021-12-03 10:06:58 -08:00
filesystems.c	fs: simplify get_filesystem_list / get_all_fs_names	2021-08-23 01:25:40 -04:00
fs_context.c	memcg: charge fs_context and legacy_fs_context	2021-09-03 09:58:12 -07:00
fs_parser.c	fs_parse: allow parameter value to be empty	2021-12-09 14:09:36 -05:00
fs_pin.c
fs_struct.c
fs_types.c
fs-writeback.c	Various hardening fixes and cleanups for 5.16-rc1	2021-11-01 17:29:10 -07:00
fsopen.c
init.c
inode.c	fs: Remove FS_THP_SUPPORT	2021-11-17 10:36:35 -05:00
internal.h	Merge branch 'akpm' (patches from Andrew)	2021-11-09 10:11:53 -08:00
io_uring.c	io_uring: Fix undefined-behaviour in io_issue_sqe	2021-11-27 06:41:38 -07:00
io-wq.c	io-wq: don't retry task_work creation failure on fatal conditions	2021-12-03 06:27:32 -07:00
io-wq.h	io_uring: optimise INIT_WQ_LIST	2021-10-19 05:49:54 -06:00
ioctl.c	New code for 5.15:	2021-08-31 11:06:32 -07:00
Kconfig	4 cifs/smb3 fixes, one for DFS reconnect, and one to begin creating common headers for server and client and the other two to rename the cifs_common directory to smbfs_common to be more consistent ie change use of the name cifs to smb which is more accurate	2021-09-12 10:10:21 -07:00
Kconfig.binfmt	binfmt: remove support for em86 (alpha only)	2021-07-25 22:33:03 -07:00
kernel_read_file.c	vfs: check fd has read access in kernel_read_file_from_fd()	2021-10-18 20:22:03 -10:00
libfs.c	libfs: Support RENAME_EXCHANGE in simple_rename()	2021-11-03 15:43:08 +01:00
locks.c	locks: remove changelog comments	2021-10-19 14:11:39 -04:00
Makefile	4 cifs/smb3 fixes, one for DFS reconnect, and one to begin creating common headers for server and client and the other two to rename the cifs_common directory to smbfs_common to be more consistent ie change use of the name cifs to smb which is more accurate	2021-09-12 10:10:21 -07:00
mbcache.c
mount.h
mpage.c
namei.c	File locking changes for v5.16	2021-11-01 09:06:53 -07:00
namespace.c	Merge branch 'akpm' (patches from Andrew)	2021-09-03 10:08:28 -07:00
no-block.c
nsfs.c
open.c	Merge branch 'akpm' (patches from Andrew)	2021-11-06 14:08:17 -07:00
pipe.c	Revert "mm/gup: remove try_get_page(), call try_get_compound_head() directly"	2021-09-07 11:03:45 -07:00
pnode.c
pnode.h
posix_acl.c	fs/posix_acl.c: avoid -Wempty-body warning	2021-11-06 13:30:32 -07:00
proc_namespace.c
read_write.c	fs: remove leftover comments from mandatory locking removal	2021-10-26 12:20:50 -04:00
readdir.c	readdir: make sure to verify directory entry for legacy interfaces too	2021-04-17 11:39:49 -07:00
remap_range.c	fs: remove mandatory file locking support	2021-08-23 06:15:36 -04:00
select.c	Revert "memcg: enable accounting for pollfd and select bits arrays"	2021-09-07 11:26:23 -07:00
seq_file.c	seq_file: move seq_escape() to a header	2021-11-09 10:02:52 -08:00
signalfd.c	signal: Rename SIL_PERF_EVENT SIL_FAULT_PERF_EVENT for consistency	2021-07-23 13:16:43 -05:00
splice.c
stack.c
stat.c	fs: add generic helper for filling statx attribute flags	2021-08-17 11:47:43 +02:00
statfs.c
super.c	fs: explicitly unregister per-superblock BDIs	2021-11-06 13:30:34 -07:00
sync.c	block: simplify the block device syncing code	2021-10-22 08:36:55 -06:00
timerfd.c	timerfd: Provide timerfd_resume()	2021-08-10 17:57:22 +02:00
userfaultfd.c	userfaultfd: fix a race between writeprotect and exit_mmap()	2021-10-18 20:22:02 -10:00
utimes.c
xattr.c