Josef Bacik bc42c4f338 btrfs: wait on ordered extents on abort cleanup ... commit 74d5d229b1bf60f93bff244b2dfc0eb21ec32a07 upstream. If we flip read-only before we initiate writeback on all dirty pages for ordered extents we've created then we'll have ordered extents left over on umount, which results in all sorts of bad things happening. Fix this by making sure we wait on ordered extents if we have to do the aborted transaction cleanup stuff. generic/475 can produce this warning: [ 8531.177332] WARNING: CPU: 2 PID: 11997 at fs/btrfs/disk-io.c:3856 btrfs_free_fs_root+0x95/0xa0 [btrfs] [ 8531.183282] CPU: 2 PID: 11997 Comm: umount Tainted: G W 5.0.0-rc1-default+ #394 [ 8531.185164] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),BIOS rel-1.11.2-0-gf9626cc-prebuilt.qemu-project.org 04/01/2014 [ 8531.187851] RIP: 0010:btrfs_free_fs_root+0x95/0xa0 [btrfs] [ 8531.193082] RSP: 0018:ffffb1ab86163d98 EFLAGS: 00010286 [ 8531.194198] RAX: ffff9f3449494d18 RBX: ffff9f34a2695000 RCX:0000000000000000 [ 8531.195629] RDX: 0000000000000002 RSI: 0000000000000001 RDI:0000000000000000 [ 8531.197315] RBP: ffff9f344e930000 R08: 0000000000000001 R09:0000000000000000 [ 8531.199095] R10: 0000000000000000 R11: ffff9f34494d4ff8 R12:ffffb1ab86163dc0 [ 8531.200870] R13: ffff9f344e9300b0 R14: ffffb1ab86163db8 R15:0000000000000000 [ 8531.202707] FS: 00007fc68e949fc0(0000) GS:ffff9f34bd800000(0000)knlGS:0000000000000000 [ 8531.204851] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8531.205942] CR2: 00007ffde8114dd8 CR3: 000000002dfbd000 CR4:00000000000006e0 [ 8531.207516] Call Trace: [ 8531.208175] btrfs_free_fs_roots+0xdb/0x170 [btrfs] [ 8531.210209] ? wait_for_completion+0x5b/0x190 [ 8531.211303] close_ctree+0x157/0x350 [btrfs] [ 8531.212412] generic_shutdown_super+0x64/0x100 [ 8531.213485] kill_anon_super+0x14/0x30 [ 8531.214430] btrfs_kill_super+0x12/0xa0 [btrfs] [ 8531.215539] deactivate_locked_super+0x29/0x60 [ 8531.216633] cleanup_mnt+0x3b/0x70 [ 8531.217497] task_work_run+0x98/0xc0 [ 8531.218397] exit_to_usermode_loop+0x83/0x90 [ 8531.219324] do_syscall_64+0x15b/0x180 [ 8531.220192] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 8531.221286] RIP: 0033:0x7fc68e5e4d07 [ 8531.225621] RSP: 002b:00007ffde8116608 EFLAGS: 00000246 ORIG_RAX:00000000000000a6 [ 8531.227512] RAX: 0000000000000000 RBX: 00005580c2175970 RCX:00007fc68e5e4d07 [ 8531.229098] RDX: 0000000000000001 RSI: 0000000000000000 RDI:00005580c2175b80 [ 8531.230730] RBP: 0000000000000000 R08: 00005580c2175ba0 R09:00007ffde8114e80 [ 8531.232269] R10: 0000000000000000 R11: 0000000000000246 R12:00005580c2175b80 [ 8531.233839] R13: 00007fc68eac61c4 R14: 00005580c2175a68 R15:0000000000000000 Leaving a tree in the rb-tree: 3853 void btrfs_free_fs_root(struct btrfs_root *root) 3854 { 3855 iput(root->ino_cache_inode); 3856 WARN_ON(!RB_EMPTY_ROOT(&root->inode_tree)); CC: stable@vger.kernel.org Reviewed-by: Nikolay Borisov <nborisov@suse.com> Signed-off-by: Josef Bacik <josef@toxicpanda.com> [ add stacktrace ] Signed-off-by: David Sterba <dsterba@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-01-26 09:42:50 +01:00
..
9p	v9fs_dir_readdir: fix double-free on p9stat_read error	2018-12-01 09:46:33 +01:00
adfs
affs	affs_lookup(): close a race with affs_remove_link()	2018-05-30 07:48:51 +02:00
afs	afs: Fix afs_kill_pages()	2017-12-20 10:04:56 +01:00
autofs4	autofs: fix autofs_sbi() does not check super block type	2018-09-19 22:49:00 +02:00
befs
bfs	bfs: add sanity check at bfs_fill_super()	2018-12-01 09:46:33 +01:00
btrfs	btrfs: wait on ordered extents on abort cleanup	2019-01-26 09:42:50 +01:00
cachefiles	fscache, cachefiles: remove redundant variable 'cache'	2018-12-17 21:55:12 +01:00
ceph	ceph: don't update importing cap's mseq when handing cap export	2019-01-13 10:05:33 +01:00
cifs	cifs: Fix potential OOB access of lock element array	2019-01-16 22:16:10 +01:00
coda	coda: fix 'kernel memory exposure attempt' in fsync	2017-11-24 08:32:25 +01:00
configfs	configfs: replace strncpy with memcpy	2018-11-21 09:27:44 +01:00
cramfs	Cramfs: fix abad comparison when wrap-arounds occur	2018-11-21 09:27:37 +01:00
debugfs	dentry name snapshots	2017-08-06 19:19:42 -07:00
devpts	devpts: clean up interface to pty drivers	2016-08-16 09:30:49 +02:00
dlm	dlm: memory leaks on error path in dlm_user_request()	2019-01-13 10:05:33 +01:00
ecryptfs	do d_instantiate/unlock_new_inode combinations safely	2018-05-30 07:48:52 +02:00
efivarfs	efi: Make efivarfs entries immutable by default	2016-03-03 15:07:09 -08:00
efs
exofs	fs/exofs: fix potential memory leak in mount option parsing	2018-11-27 16:08:00 +01:00
exportfs	exportfs: do not read dentry after free	2018-12-17 21:55:10 +01:00
ext2	ext2: fix potential use after free	2018-12-13 09:21:27 +01:00
ext4	ext4: fix a potential fiemap/page fault deadlock w/ inline_data	2019-01-16 22:16:12 +01:00
f2fs	f2fs: fix validation of the block count in sanity_check_raw_super	2019-01-26 09:42:49 +01:00
fat	fs/fat/fatent.c: add cond_resched() to fat_count_free_clusters()	2018-11-10 07:41:40 -08:00
freevxfs
fscache	fscache: fix race between enablement and dropping of object	2018-12-17 21:55:11 +01:00
fuse	fuse: fix leaked notify reply	2018-11-21 09:27:44 +01:00
gfs2	gfs2: Fix loop in gfs2_rbm_find	2019-01-13 10:05:33 +01:00
hfs	hfs: do not free node before using	2018-12-17 21:55:12 +01:00
hfsplus	hfsplus: do not free node before using	2018-12-17 21:55:12 +01:00
hostfs	hostfs: Freeing an ERR_PTR in hostfs_fill_sb_common()	2016-09-30 10:18:39 +02:00
hpfs	hpfs: implement the show_options method	2016-06-01 12:15:54 -07:00
hugetlbfs	hugetlbfs: fix bug in pgoff overflow checking	2018-12-17 21:55:15 +01:00
isofs	isofs: fix timestamps beyond 2027	2017-11-30 08:37:20 +00:00
jbd2	jbd2: fix use after free in jbd2_log_do_checkpoint()	2018-11-21 09:27:34 +01:00
jffs2	jffs2: free jffs2_sb_info through jffs2_kill_sb()	2018-11-21 09:27:30 +01:00
jfs	jfs: Fix inconsistency between memory allocation and ea_buf->max_size	2018-08-09 12:19:28 +02:00
kernfs	kernfs: Replace strncpy with memcpy	2018-12-13 09:21:29 +01:00
lockd	lockd: fix access beyond unterminated strings in prints	2018-11-21 09:27:36 +01:00
logfs
minix
ncpfs	staging: ncpfs: memory corruption in ncp_read_kernel()	2018-03-28 18:40:15 +02:00
nfs	NFSv4.1: Fix the r/wsize checking	2018-11-21 09:27:35 +01:00
nfs_common	lockd: fix "list_add double add" caused by legacy signal interface	2018-02-03 17:04:28 +01:00
nfsd	nfsd: fix corrupted reply to badly ordered compound	2018-10-10 08:52:07 +02:00
nilfs2	do d_instantiate/unlock_new_inode combinations safely	2018-05-30 07:48:52 +02:00
nls
notify	fanotify: fix logic of events on child	2018-04-24 09:32:11 +02:00
ntfs
ocfs2	ocfs2: fix potential use after free	2018-12-17 21:55:12 +01:00
omfs
openpromfs
overlayfs	ovl: proper cleanup of workdir	2018-09-15 09:40:41 +02:00
proc	proc: Remove empty line in /proc/self/status	2019-01-26 09:42:49 +01:00
pstore	pstore: Convert console write to use ->write_buf	2018-12-17 21:55:12 +01:00
qnx4
qnx6
quota	fs/quota: Fix spectre gadget in do_quotactl	2018-09-09 20:04:36 +02:00
ramfs
reiserfs	reiserfs: propagate errors from fill_with_dentries() properly	2018-11-27 16:08:00 +01:00
romfs	romfs: use different way to generate fsid for BLOCK or MTD	2017-06-17 06:39:38 +02:00
squashfs	squashfs: more metadata hardenings	2018-08-06 16:24:42 +02:00
sysfs	scsi: sysfs: Introduce sysfs_{un,}break_active_protection()	2018-09-05 09:18:40 +02:00
sysv	sysv: return 'err' instead of 0 in __sysv_write_inode	2018-12-17 21:55:09 +01:00
tracefs
ubifs	ubifs: Check for name being NULL while mounting	2018-10-13 09:11:34 +02:00
udf	udf: Detect incorrect directory size	2018-07-03 11:21:34 +02:00
ufs	do d_instantiate/unlock_new_inode combinations safely	2018-05-30 07:48:52 +02:00
xfs	xfs: fix incorrect log_flushed on fsync	2018-06-13 16:15:27 +02:00
aio.c	aio: fix spectre gadget in lookup_ioctx	2018-12-21 14:09:50 +01:00
anon_inodes.c
attr.c	vfs: move permission checking into notify_change() for utimes(NULL)	2016-10-22 12:26:56 +02:00
bad_inode.c
binfmt_aout.c
binfmt_elf.c	fs, elf: make sure to page align bss in load_elf_library	2018-11-21 09:27:41 +01:00
binfmt_elf_fdpic.c
binfmt_em86.c
binfmt_flat.c
binfmt_misc.c	fs/binfmt_misc.c: do not allow offset overflow	2018-07-03 11:21:26 +02:00
binfmt_script.c
block_dev.c	fs/block_dev: always invalidate cleancache in invalidate_bdev()	2017-05-20 14:27:01 +02:00
buffer.c	fs: add i_blocksize()	2017-06-14 13:16:24 +02:00
char_dev.c
compat.c
compat_binfmt_elf.c	binfmt_elf: compat: avoid unused function warning	2018-02-25 11:03:51 +01:00
compat_ioctl.c	fs: compat: Remove warning from COMPATIBLE_IOCTL	2018-04-08 11:51:57 +02:00
coredump.c	coredump: Ensure proper size of sparse core files	2017-07-05 14:37:20 +02:00
dax.c
dcache.c	fs/dcache.c: fix kmemcheck splat at take_dentry_name_snapshot()	2018-09-15 09:40:38 +02:00
dcookies.c
direct-io.c	direct-io: Prevent NULL pointer access in submit_page_section	2017-10-18 09:20:42 +02:00
drop_caches.c
eventfd.c
eventpoll.c	epoll: fix race between ep_poll_callback(POLLFREE) and ep_free()/ep_remove()	2017-09-07 08:34:10 +02:00
exec.c	mm: replace get_user_pages() write/force parameters with gup_flags	2018-12-17 21:55:16 +01:00
fcntl.c	fs/fcntl: f_setown, avoid undefined behaviour	2018-01-31 12:06:11 +01:00
fhandle.c	fs/coredump: prevent fsuid=0 dumps into user-controlled directories	2016-04-12 09:08:58 -07:00
file.c
file_table.c
filesystems.c
fs-writeback.c	bdi: Fix oops in wb_workfn()	2018-05-16 10:06:51 +02:00
fs_pin.c
fs_struct.c
inode.c	Fix up non-directory creation in SGID directories	2018-07-17 11:31:43 +02:00
internal.h
ioctl.c
Kconfig
Kconfig.binfmt
libfs.c
locks.c	locks: don't check for race with close when setting OFD lock	2018-01-17 09:35:27 +01:00
Makefile
mbcache.c
mount.h	mnt: In propgate_umount handle visiting mounts in any order	2017-07-21 07:44:57 +02:00
mpage.c	fs: add i_blocksize()	2017-06-14 13:16:24 +02:00
namei.c	namei: allow restricted O_CREAT of FIFOs and regular files	2018-12-01 09:46:41 +01:00
namespace.c	mount: Prevent MNT_DETACH from disconnecting locked mounts	2018-11-21 09:27:44 +01:00
no-block.c
nsfs.c	nsfs: mark dentry with DCACHE_RCUACCESS	2018-02-16 20:09:43 +01:00
open.c	fs: completely ignore unknown open flags	2017-07-15 11:57:44 +02:00
pipe.c	pipe: cap initial pipe capacity according to pipe-max-size limit	2018-05-26 08:48:51 +02:00
pnode.c	mnt: Make propagate_umount less slow for overlapping mount propagation trees	2017-07-21 07:44:58 +02:00
pnode.h	mnt: Add a per mount namespace limit on the number of mounts	2017-04-30 05:49:28 +02:00
posix_acl.c	tmpfs: clear S_ISGID when setting posix ACLs	2017-01-26 08:23:47 +01:00
proc_namespace.c	vfs: show_vfsstat: do not ignore errors from show_devname method	2016-04-12 09:08:55 -07:00
read_write.c	vfs: Return -ENXIO for negative SEEK_HOLE / SEEK_DATA offsets	2017-10-05 09:41:45 +02:00
readdir.c
select.c	fs/select: add vmalloc fallback for select(2)	2018-01-31 12:06:09 +01:00
seq_file.c	Make file credentials available to the seqfile interfaces	2017-08-06 19:19:42 -07:00
signalfd.c
splice.c	vfs: fix uninitialized flags in splice_to_pipe()	2017-02-23 17:43:09 +01:00
stack.c
stat.c	ufs: restore maintaining ->i_blocks	2017-06-14 13:16:24 +02:00
statfs.c
super.c	sget(): handle failures of register_shrinker()	2018-03-03 10:19:41 +01:00
sync.c
timerfd.c	timerfd: Protect the might cancel mechanism proper	2017-05-08 07:46:01 +02:00
userfaultfd.c	userfaultfd: shmem: __do_fault requires VM_FAULT_NOPAGE	2017-12-20 10:04:53 +01:00
utimes.c	vfs: move permission checking into notify_change() for utimes(NULL)	2016-10-22 12:26:56 +02:00
xattr.c	getxattr: use correct xattr length	2018-09-09 20:04:36 +02:00