From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3AEB8C433EF for ; Mon, 28 Mar 2022 19:45:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343802AbiC1TrC (ORCPT ); Mon, 28 Mar 2022 15:47:02 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50816 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343753AbiC1Tpt (ORCPT ); Mon, 28 Mar 2022 15:45:49 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C06D26833E; Mon, 28 Mar 2022 12:42:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 255CE612C4; Mon, 28 Mar 2022 19:42:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 68C2EC36AE5; Mon, 28 Mar 2022 19:42:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1648496572; bh=amzJB50dVxraXg7zTXq9Qb/7GQINKbmuz1Zvr+omPIY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Lx4eFnQMCm/C81xcExCNRDz60DuVWnXJiZIY5efotFGRekmNL9d2HgFcCwUzLzf+E ahT9yIJwWPMOqCd7bKaEEt1zV4fBXzOw+1FRDP6jOYYrzsCpaXjG3qorFiWOLGrNHR h3mCpq+W7ZQ08MwwGPDN8wl+bV2XHbiz2hIfZy0vefWkkDvCZp//gs5R5FlpJaZthv SOjDJ9+cSf7s74CwkidzbvfS/4nNbniV6Lz0bt+AIKRQ5xti+Ech+2QsiyrQ49Zihr Qo/HQKk62csiYgRkBoyXFD57BszzBhH4M4AnC0PYRBqSxpWMOe237wnQWB6qJusgEX 5kDMSlBXf3hAg== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Josef Bacik , Boris Burkov , David Sterba , Sasha Levin , clm@fb.com, jbacik@fb.com, linux-btrfs@vger.kernel.org Subject: [PATCH AUTOSEL 5.16 16/20] btrfs: do not clean up repair bio if submit fails Date: Mon, 28 Mar 2022 15:42:22 -0400 Message-Id: <20220328194226.1585920-16-sashal@kernel.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220328194226.1585920-1-sashal@kernel.org> References: <20220328194226.1585920-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Josef Bacik [ Upstream commit 8cbc3001a3264d998d6b6db3e23f935c158abd4d ] The submit helper will always run bio_endio() on the bio if it fails to submit, so cleaning up the bio just leads to a variety of use-after-free and NULL pointer dereference bugs because we race with the endio function that is cleaning up the bio. Instead just return BLK_STS_OK as the repair function has to continue to process the rest of the pages, and the endio for the repair bio will do the appropriate cleanup for the page that it was given. Reviewed-by: Boris Burkov Signed-off-by: Josef Bacik Signed-off-by: David Sterba Signed-off-by: Sasha Levin --- fs/btrfs/extent_io.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c index 5512d7028091..a57838311c7d 100644 --- a/fs/btrfs/extent_io.c +++ b/fs/btrfs/extent_io.c @@ -2640,7 +2640,6 @@ int btrfs_repair_one_sector(struct inode *inode, const int icsum = bio_offset >> fs_info->sectorsize_bits; struct bio *repair_bio; struct btrfs_bio *repair_bbio; - blk_status_t status; btrfs_debug(fs_info, "repair read error: read error at %llu", start); @@ -2679,13 +2678,13 @@ int btrfs_repair_one_sector(struct inode *inode, "repair read error: submitting new read to mirror %d", failrec->this_mirror); - status = submit_bio_hook(inode, repair_bio, failrec->this_mirror, - failrec->bio_flags); - if (status) { - free_io_failure(failure_tree, tree, failrec); - bio_put(repair_bio); - } - return blk_status_to_errno(status); + /* + * At this point we have a bio, so any errors from submit_bio_hook() + * will be handled by the endio on the repair_bio, so we can't return an + * error here. + */ + submit_bio_hook(inode, repair_bio, failrec->this_mirror, failrec->bio_flags); + return BLK_STS_OK; } static void end_page_read(struct page *page, bool uptodate, u64 start, u32 len) -- 2.34.1