Skip to content

Commit

Permalink
btrfs: fix mount and ioctl device scan ioctl race
Browse files Browse the repository at this point in the history
Technically this extends the critical section covered by uuid_mutex to:

- parse early mount options -- here we can call device scan on paths
  that can be passed as 'device=/dev/...'

- scan the device passed to mount

- open the devices related to the fs_devices -- this increases
  fs_devices::opened

The race can happen when mount calls one of the scans and there's
another one called eg. by mkfs or 'btrfs dev scan':

Mount                                  Scan
-----                                  ----
scan_one_device (dev1, fsid1)
                                       scan_one_device (dev2, fsid2)
				           add the device
					   free stale devices
					       fsid1 fs_devices::opened == 0
					           find fsid1:dev1
					           free fsid1:dev1
					           if it's the last one,
					            free fs_devices of fsid1
						    too

open_devices (dev1, fsid1)
   dev1 not found

When fixed, the uuid mutex will make sure that mount will increase
fs_devices::opened and this will not be touched by the racing scan
ioctl.

Reported-and-tested-by: [email protected]
Reported-and-tested-by: [email protected]
Signed-off-by: David Sterba <[email protected]>
Reviewed-by: Anand Jain <[email protected]>
  • Loading branch information
kdave authored and asj committed Jul 11, 2018
1 parent e9f25a7 commit 6fa6985
Showing 1 changed file with 6 additions and 6 deletions.
12 changes: 6 additions & 6 deletions fs/btrfs/super.c
Original file line number Diff line number Diff line change
Expand Up @@ -1555,19 +1555,19 @@ static struct dentry *btrfs_mount_root(struct file_system_type *fs_type,

mutex_lock(&uuid_mutex);
error = btrfs_parse_early_options(data, mode, fs_type, &fs_devices);
mutex_unlock(&uuid_mutex);
if (error)
if (error) {
mutex_unlock(&uuid_mutex);
goto error_fs_info;
}

mutex_lock(&uuid_mutex);
error = btrfs_scan_one_device(device_name, mode, fs_type, &fs_devices);
mutex_unlock(&uuid_mutex);
if (error)
if (error) {
mutex_unlock(&uuid_mutex);
goto error_fs_info;
}

fs_info->fs_devices = fs_devices;

mutex_lock(&uuid_mutex);
error = btrfs_open_devices(fs_devices, mode, fs_type);
mutex_unlock(&uuid_mutex);
if (error)
Expand Down

0 comments on commit 6fa6985

Please sign in to comment.