On Mon, Oct 22, 2018 at 10:43:06AM +0100, fdman...@kernel.org wrote:
> From: Filipe Manana
>
> We were iterating a block group's free space cache rbtree without locking
> first the lock that protects it (the free_space_ctl->free_space_offset
> rbtree is protected by the free_space_ctl->tree_lock spinlock).
>
> KASAN reported an use-after-free problem when iterating such a rbtree due
> to a concurrent rbtree delete:
>
> [ 9520.359168]
> ==
> [ 9520.359656] BUG: KASAN: use-after-free in rb_next+0x13/0x90
> [ 9520.359949] Read of size 8 at addr 8800b7ada500 by task
> btrfs-transacti/1721
> [ 9520.360357]
> [ 9520.360530] CPU: 4 PID: 1721 Comm: btrfs-transacti Tainted: G
> L4.19.0-rc8-nbor #555
> [ 9520.360990] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
> 1.10.2-1ubuntu1 04/01/2014
> [ 9520.362682] Call Trace:
> [ 9520.362887] dump_stack+0xa4/0xf5
> [ 9520.363146] print_address_description+0x78/0x280
> [ 9520.363412] kasan_report+0x263/0x390
> [ 9520.363650] ? rb_next+0x13/0x90
> [ 9520.363873] __asan_load8+0x54/0x90
> [ 9520.364102] rb_next+0x13/0x90
> [ 9520.364380] btrfs_dump_free_space+0x146/0x160 [btrfs]
> [ 9520.364697] dump_space_info+0x2cd/0x310 [btrfs]
> [ 9520.364997] btrfs_reserve_extent+0x1ee/0x1f0 [btrfs]
> [ 9520.365310] __btrfs_prealloc_file_range+0x1cc/0x620 [btrfs]
> [ 9520.365646] ? btrfs_update_time+0x180/0x180 [btrfs]
> [ 9520.365923] ? _raw_spin_unlock+0x27/0x40
> [ 9520.366204] ? btrfs_alloc_data_chunk_ondemand+0x2c0/0x5c0 [btrfs]
> [ 9520.366549] btrfs_prealloc_file_range_trans+0x23/0x30 [btrfs]
> [ 9520.366880] cache_save_setup+0x42e/0x580 [btrfs]
> [ 9520.367220] ? btrfs_check_data_free_space+0xd0/0xd0 [btrfs]
> [ 9520.367518] ? lock_downgrade+0x2f0/0x2f0
> [ 9520.367799] ? btrfs_write_dirty_block_groups+0x11f/0x6e0 [btrfs]
> [ 9520.368104] ? kasan_check_read+0x11/0x20
> [ 9520.368349] ? do_raw_spin_unlock+0xa8/0x140
> [ 9520.368638] btrfs_write_dirty_block_groups+0x2af/0x6e0 [btrfs]
> [ 9520.368978] ? btrfs_start_dirty_block_groups+0x870/0x870 [btrfs]
> [ 9520.369282] ? do_raw_spin_unlock+0xa8/0x140
> [ 9520.369534] ? _raw_spin_unlock+0x27/0x40
> [ 9520.369811] ? btrfs_run_delayed_refs+0x1b8/0x230 [btrfs]
> [ 9520.370137] commit_cowonly_roots+0x4b9/0x610 [btrfs]
> [ 9520.370560] ? commit_fs_roots+0x350/0x350 [btrfs]
> [ 9520.370926] ? btrfs_run_delayed_refs+0x1b8/0x230 [btrfs]
> [ 9520.371285] btrfs_commit_transaction+0x5e5/0x10e0 [btrfs]
> [ 9520.371612] ? btrfs_apply_pending_changes+0x90/0x90 [btrfs]
> [ 9520.371943] ? start_transaction+0x168/0x6c0 [btrfs]
> [ 9520.372257] transaction_kthread+0x21c/0x240 [btrfs]
> [ 9520.372537] kthread+0x1d2/0x1f0
> [ 9520.372793] ? btrfs_cleanup_transaction+0xb50/0xb50 [btrfs]
> [ 9520.373090] ? kthread_park+0xb0/0xb0
> [ 9520.373329] ret_from_fork+0x3a/0x50
> [ 9520.373567]
> [ 9520.373738] Allocated by task 1804:
> [ 9520.373974] kasan_kmalloc+0xff/0x180
> [ 9520.374208] kasan_slab_alloc+0x11/0x20
> [ 9520.374447] kmem_cache_alloc+0xfc/0x2d0
> [ 9520.374731] __btrfs_add_free_space+0x40/0x580 [btrfs]
> [ 9520.375044] unpin_extent_range+0x4f7/0x7a0 [btrfs]
> [ 9520.375383] btrfs_finish_extent_commit+0x15f/0x4d0 [btrfs]
> [ 9520.375707] btrfs_commit_transaction+0xb06/0x10e0 [btrfs]
> [ 9520.376027] btrfs_alloc_data_chunk_ondemand+0x237/0x5c0 [btrfs]
> [ 9520.376365] btrfs_check_data_free_space+0x81/0xd0 [btrfs]
> [ 9520.376689] btrfs_delalloc_reserve_space+0x25/0x80 [btrfs]
> [ 9520.377018] btrfs_direct_IO+0x42e/0x6d0 [btrfs]
> [ 9520.377284] generic_file_direct_write+0x11e/0x220
> [ 9520.377587] btrfs_file_write_iter+0x472/0xac0 [btrfs]
> [ 9520.377875] aio_write+0x25c/0x360
> [ 9520.378106] io_submit_one+0xaa0/0xdc0
> [ 9520.378343] __se_sys_io_submit+0xfa/0x2f0
> [ 9520.378589] __x64_sys_io_submit+0x43/0x50
> [ 9520.378840] do_syscall_64+0x7d/0x240
> [ 9520.379081] entry_SYSCALL_64_after_hwframe+0x49/0xbe
> [ 9520.379387]
> [ 9520.379557] Freed by task 1802:
> [ 9520.379782] __kasan_slab_free+0x173/0x260
> [ 9520.380028] kasan_slab_free+0xe/0x10
> [ 9520.380262] kmem_cache_free+0xc1/0x2c0
> [ 9520.380544] btrfs_find_space_for_alloc+0x4cd/0x4e0 [btrfs]
> [ 9520.380866] find_free_extent+0xa99/0x17e0 [btrfs]
> [ 9520.381166] btrfs_reserve_extent+0xd5/0x1f0 [btrfs]
> [ 9520.381474] btrfs_get_blocks_direct+0x60b/0xbd0 [btrfs]
> [ 9520.381761] __blockdev_direct_IO+0x10ee/0x58a1
> [ 9520.382059] btrfs_direct_IO+0x25a/0x6d0 [btrfs]
> [ 9520.382321] generic_file_direct_write+0x11e/0x220
> [ 9520.382623] btrfs_file_write_iter+0x472/0xac0 [btrfs]
> [ 9520.382904] aio_write+0x25c/0x360
> [ 9520.383172] io_submit_one+0xaa0/0xdc0
> [ 9520.383416] __se_sys_io_submit+0xfa/0x2f0
> [ 9520.383678] __x64_sys_io_submit+0x43/0x50
> [ 9520.383927] do_syscall_64+0x7d/0x240
> [ 9520.384165] entry_SYSCALL_64_after_hwframe+0x49/0xbe
> [ 9520.384439]
> [ 9520.384610] The buggy address belongs
