btrfs: fix crash in remount(thread_pool=) case

PATCH In review Sergei Trofimovich 2 participants 2 messages Apr 7, 2014 – Apr 8, 2014 Btrfs file system

lore

Share & tools

lore

Sergei Trofimovich

author

2014-04-07 07:56 UTC #0 lore raw

PATCH 1/1 btrfs: fix crash in remount(thread_pool=) case

From: Sergei Trofimovich <[email protected]>

Reproducer:
mount /dev/ubda /mnt
mount -oremount,thread_pool=42 /mnt

Gives a crash:

    ? btrfs_workqueue_set_max+0x0/0x70
    btrfs_resize_thread_pool+0xe3/0xf0
    ? sync_filesystem+0x0/0xc0
    ? btrfs_resize_thread_pool+0x0/0xf0
    btrfs_remount+0x1d2/0x570
    ? kern_path+0x0/0x80
    do_remount_sb+0xd9/0x1c0
    do_mount+0x26a/0xbf0
    ? kfree+0x0/0x1b0
    SyS_mount+0xc4/0x110

It's a call

    btrfs_workqueue_set_max(fs_info->scrub_wr_completion_workers, new_pool_size);
with
    fs_info->scrub_wr_completion_workers = NULL;

as scrub wqs get created only on user's demand.

Patch skips not-created-yet workqueues.

Signed-off-by Sergei Trofimovich <[email protected]>

CC Qu Wenruo <[email protected]>

CC Chris Mason <[email protected]>

CC Josef Bacik <[email protected]>

CC [email protected]

---
 fs/btrfs/async-thread.c | 2 ++
 1 file changed, 2 insertions(+)

fs/btrfs/async-thread.c +2 -0

index ecb5832..5a201d8 100644
@@ -323,6 +323,8 @@ void btrfs_destroy_workqueue(struct btrfs_workqueue *wq)
 
 void btrfs_workqueue_set_max(struct btrfs_workqueue *wq, int max)
 {
+	if (!wq)
+		return;
 	wq->normal->max_active = max;
 	if (wq->high)
 		wq->high->max_active = max;

Signature · 1 line

1.9.0

Qu Wenruo

2014-04-08 01:27 UTC #1 lore raw

Quoted 42 lines · Sergei Trofimovich

From: Sergei Trofimovich <[email protected]>
Reproducer:
mount /dev/ubda /mnt
mount -oremount,thread_pool=42 /mnt
Gives a crash:
     ? btrfs_workqueue_set_max+0x0/0x70
     btrfs_resize_thread_pool+0xe3/0xf0
     ? sync_filesystem+0x0/0xc0
     ? btrfs_resize_thread_pool+0x0/0xf0
     btrfs_remount+0x1d2/0x570
     ? kern_path+0x0/0x80
     do_remount_sb+0xd9/0x1c0
     do_mount+0x26a/0xbf0
     ? kfree+0x0/0x1b0
     SyS_mount+0xc4/0x110
It's a call
     btrfs_workqueue_set_max(fs_info->scrub_wr_completion_workers, new_pool_size);
with
     fs_info->scrub_wr_completion_workers = NULL;
as scrub wqs get created only on user's demand.
Patch skips not-created-yet workqueues.
Signed-off-by Sergei Trofimovich <[email protected]>
CC Qu Wenruo <[email protected]>
CC Chris Mason <[email protected]>
CC Josef Bacik <[email protected]>
CC [email protected]
---
  fs/btrfs/async-thread.c | 2 ++
  1 file changed, 2 insertions(+)
fs/btrfs/async-thread.c +0 -0
index ecb5832..5a201d8 100644

fs/btrfs/async-thread.c void btrfs_destroy_workqueue(struct btrfs_workqueue *wq) · line 330

Quoted 8 lines

fs/btrfs/async-thread.c +2 -0

@@ -323,6 +323,8 @@ void btrfs_destroy_workqueue(struct btrfs_workqueue *wq)
 
  void btrfs_workqueue_set_max(struct btrfs_workqueue *wq, int max)
  {
+	if (!wq)
+		return;
  	wq->normal->max_active = max;
  	if (wq->high)
  		wq->high->max_active = max;

Oh, that's my fault. You got me.

Thanks for the patch.
Qu.