[PATCH v2 1/5] gfs2: protect quota refresh from superblock teardown

["Jiacheng Xu" <stitch@zju.edu.cn>]

The quota_refresh sysfs attributes become visible before fill_super()
has completed, so the quota inode can still be uninitialized when a
userspace write reaches gfs2_quota_refresh(). The same callback can
also race with superblock teardown.

Serialize the callback with the superblock lifetime using a read-side
s_umount lock. Use down_read_trylock() so the mount failure path can
remove the sysfs files while holding the write side of the lock without
deadlocking, and reject accesses before SB_ACTIVE is set.

Return -EAGAIN when the filesystem is not available for the callback.

Tested-by: Jiacheng Xu <stitch@zju.edu.cn>
Signed-off-by: Jiacheng Xu <stitch@zju.edu.cn>
---
 fs/gfs2/quota.c | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index 001c8b39ca55..d065b51950d7 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -1384,19 +1384,36 @@ int gfs2_quota_sync(struct super_block *sb, int type)
 
 int gfs2_quota_refresh(struct gfs2_sbd *sdp, struct kqid qid)
 {
+       struct super_block *sb = sdp->sd_vfs;
        struct gfs2_quota_data *qd;
        struct gfs2_holder q_gh;
        int error;
 
+       /*
+        * The sysfs files are created before fill_super completes. Avoid
+        * blocking on s_umount because the mount failure path removes the
+        * sysfs files while holding it for writing.
+        */
+       if (!down_read_trylock(&sb->s_umount))
+               return -EAGAIN;
+
+       if (!(sb->s_flags & SB_ACTIVE)) {
+               error = -EAGAIN;
+               goto out_unlock;
+       }
+
        error = qd_get(sdp, qid, &qd);
        if (error)
-               return error;
+               goto out_unlock;
 
        error = do_glock(qd, FORCE, &q_gh);
        if (!error)
                gfs2_glock_dq_uninit(&q_gh);
 
        qd_put(qd);
+
+out_unlock:
+       up_read(&sb->s_umount);
        return error;
 }
 
-- 
2.25.1


> -----原始邮件-----
> 发件人: "Jiacheng Xu" <stitch@zju.edu.cn>
> 发送时间:2026-08-21 12:09:21 (星期五)
> 收件人: "Andreas Gruenbacher" <agruenba@redhat.com>
> 抄送: gfs2@lists.linux.dev, linux-kernel@vger.kernel.org
> 主题: [PATCH v2 0/5] gfs2: protect sysfs callbacks from superblock teardown
> 
> The GFS2 sysfs files become visible before fill_super() completes and
> remain present until after filesystem resources have been released.
> Consequently, callbacks that access quota, statfs, glock or journal
> state can race with mount failure rollback or unmount teardown.
> 
> The quota refresh fix was originally sent as a standalone [PATCH]. This
> version folds it into a complete series and adds the corresponding
> lifetime protection for the other affected sysfs callbacks.
> 
> All callbacks use down_read_trylock() on s_umount and verify SB_ACTIVE.
> Returning -EAGAIN avoids deadlock when mount failure or unmount holds
> the write side of s_umount while removing the sysfs files.
> 
> Changes in v2:
> - Folded the original quota refresh fix into a five-patch series.
> - Added statfs_sync, quota_sync, demote_rq and status fixes.
> 
> Jiacheng Xu (5):
>   gfs2: protect quota refresh from superblock teardown
>   gfs2: protect statfs sync sysfs callback
>   gfs2: protect quota sync sysfs callback
>   gfs2: protect demote requests during superblock teardown
>   gfs2: protect status sysfs reads during teardown
> 
>  fs/gfs2/quota.c | 19 ++++++++++++++-
>  fs/gfs2/sys.c   | 65 +++++++++++++++++++++++++++++++++++++++++++------
>  2 files changed, 76 insertions(+), 8 deletions(-)
> 
> 
> base-commit: 0f23d56f17fdfc7db69d51f64c8b91bbab947aa9
> -- 
> 2.25.1
> 
> > -----原始邮件-----
> > 发件人: "Jiacheng Xu" <stitch@zju.edu.cn>
> > 发送时间:2026-08-19 15:01:07 (星期三)
> > 收件人: "Andreas Gruenbacher" <agruenba@redhat.com>
> > 抄送: gfs2@lists.linux.dev, linux-kernel@vger.kernel.org
> > 主题: [PATCH] gfs2: Fix NULL pointer dereference in quota refresh
> > 
> > The GFS2 sysfs files are registered before init_inodes() completes.
> > Consequently, the quota_refresh_user and quota_refresh_group sysfs
> > attributes can be accessed while sdp->sd_quota_inode has not been
> > initialized yet.
> > 
> > A concurrent write to quota_refresh_user may then call do_glock(), which
> > dereferences sdp->sd_quota_inode. This can result in a NULL pointer dereference 
> > in do_glock(). The same callback can also race with superblock
> > teardown and access data after the filesystem has started to shut down.
> > 
> > Moving sysfs registration after init_inodes() would avoid the initialization
> > window, but is not suitable because the lock manager may need the GFS2
> > sysfs files during the remaining mount sequence.
> > 
> > Serialize gfs2_quota_refresh() with the superblock lifetime instead.
> > Acquire s_umount for reading before accessing quota data. Mount failure and
> > unmount paths hold s_umount for writing, so this prevents the callback from
> > running while the superblock is being initialized or destroyed.
> > 
> > Use down_read_trylock() instead of down_read() because the mount failure
> > path may already hold s_umount for writing while removing the sysfs files.
> > Returning -EAGAIN allows the sysfs write to fail without introducing a
> > deadlock.
> > 
> > Also verify SB_ACTIVE after acquiring the read lock, since the sysfs
> > attributes become visible before the superblock is fully active.
> > 
> > The reproducer of the issue is attached. After applying this patch, 
> > the reproducer no longer triggers the kernel crash. 
> > 
> > Signed-off-by: Jiacheng Xu <stitch@zju.edu.cn>
> > Tested-by: Jiacheng Xu <stitch@zju.edu.cn>
> > ---
> > fs/gfs2/quota.c | 19 ++++++++++++++++++-
> > 1 file changed, 18 insertions(+), 1 deletion(-)
> > 
> > diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
> > index 001c8b39ca55..d50534ed9379 100644
> > --- a/fs/gfs2/quota.c
> > +++ b/fs/gfs2/quota.c
> > @@ -1384,19 +1384,36 @@ int gfs2_quota_sync(struct super_block *sb, int type)
> > 
> > int gfs2_quota_refresh(struct gfs2_sbd *sdp, struct kqid qid)
> > {
> > +     struct super_block *sb = sdp->sd_vfs;
> >       struct gfs2_quota_data *qd;
> >       struct gfs2_holder q_gh;
> >       int error;
> > 
> > +     /*
> > +      * The sysfs files are created before fill_super completes. Avoid
> > +      * blocking on s_umount because the mount failure path removes the
> > +      * sysfs files while holding it for writing.
> > +      */
> > +     if (!down_read_trylock(&sb->s_umount))
> > +             return -EAGAIN;
> > +
> > +     if (!(sb->s_flags & SB_ACTIVE)) {
> > +             error = -EAGAIN;
> > +             goto out_unlock;
> > +     }
> > +
> >       error = qd_get(sdp, qid, &qd);
> >       if (error)
> > -             return error;
> > +             goto out_unlock;
> > 
> >       error = do_glock(qd, FORCE, &q_gh);
> >       if (!error)
> >             gfs2_glock_dq_uninit(&q_gh);
> > 
> >       qd_put(qd);
> > 
> > +out_unlock:
> > +     up_read(&sb->s_umount);
> >       return error;
> > }