26 Jan, 2019

1 commit

  • [ Upstream commit 41c4f85cdac280d356df1f483000ecec4a8868be ]

    Commit 1fa5efe3622db58cb8c7b9a50665e9eb9a6c7e97 (ext4: Use generic helpers for quotaon
    and quotaoff) made possible to call quotactl(Q_XQUOTAON/OFF) on ext4 filesystems
    with sysfile quota support. This leads to calling dquot_enable/disable without s_umount
    held in excl. mode, because quotactl_cmd_onoff checks only for Q_QUOTAON/OFF.

    The following WARN_ON_ONCE triggers (in this case for dquot_enable, ext4, latest Linus' tree):

    [ 117.807056] EXT4-fs (dm-0): mounted filesystem with ordered data mode. Opts: quota,prjquota

    [...]

    [ 155.036847] WARNING: CPU: 0 PID: 2343 at fs/quota/dquot.c:2469 dquot_enable+0x34/0xb9
    [ 155.036851] Modules linked in: quota_v2 quota_tree ipv6 af_packet joydev mousedev psmouse serio_raw pcspkr i2c_piix4 intel_agp intel_gtt e1000 ttm drm_kms_helper drm agpgart fb_sys_fops syscopyarea sysfillrect sysimgblt i2c_core input_leds kvm_intel kvm irqbypass qemu_fw_cfg floppy evdev parport_pc parport button crc32c_generic dm_mod ata_generic pata_acpi ata_piix libata loop ext4 crc16 mbcache jbd2 usb_storage usbcore sd_mod scsi_mod
    [ 155.036901] CPU: 0 PID: 2343 Comm: qctl Not tainted 4.20.0-rc6-00025-gf5d582777bcb #9
    [ 155.036903] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
    [ 155.036911] RIP: 0010:dquot_enable+0x34/0xb9
    [ 155.036915] Code: 41 56 41 55 41 54 55 53 4c 8b 6f 28 74 02 0f 0b 4d 8d 7d 70 49 89 fc 89 cb 41 89 d6 89 f5 4c 89 ff e8 23 09 ea ff 85 c0 74 0a 0b 4c 89 ff e8 8b 09 ea ff 85 db 74 6a 41 8b b5 f8 00 00 00 0f
    [ 155.036918] RSP: 0018:ffffb09b00493e08 EFLAGS: 00010202
    [ 155.036922] RAX: 0000000000000001 RBX: 0000000000000008 RCX: 0000000000000008
    [ 155.036924] RDX: 0000000000000001 RSI: 0000000000000002 RDI: ffff9781b67cd870
    [ 155.036926] RBP: 0000000000000002 R08: 0000000000000000 R09: 61c8864680b583eb
    [ 155.036929] R10: ffffb09b00493e48 R11: ffffffffff7ce7d4 R12: ffff9781b7ee8d78
    [ 155.036932] R13: ffff9781b67cd800 R14: 0000000000000004 R15: ffff9781b67cd870
    [ 155.036936] FS: 00007fd813250b88(0000) GS:ffff9781ba000000(0000) knlGS:0000000000000000
    [ 155.036939] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [ 155.036942] CR2: 00007fd812ff61d6 CR3: 000000007c882000 CR4: 00000000000006b0
    [ 155.036951] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    [ 155.036953] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    [ 155.036955] Call Trace:
    [ 155.037004] dquot_quota_enable+0x8b/0xd0
    [ 155.037011] kernel_quotactl+0x628/0x74e
    [ 155.037027] ? do_mprotect_pkey+0x2a6/0x2cd
    [ 155.037034] __x64_sys_quotactl+0x1a/0x1d
    [ 155.037041] do_syscall_64+0x55/0xe4
    [ 155.037078] entry_SYSCALL_64_after_hwframe+0x44/0xa9
    [ 155.037105] RIP: 0033:0x7fd812fe1198
    [ 155.037109] Code: 02 77 0d 48 89 c1 48 c1 e9 3f 75 04 48 8b 04 24 48 83 c4 50 5b c3 48 83 ec 08 49 89 ca 48 63 d2 48 63 ff b8 b3 00 00 00 0f 05 89 c7 e8 c1 eb ff ff 5a c3 48 63 ff b8 bb 00 00 00 0f 05 48 89
    [ 155.037112] RSP: 002b:00007ffe8cd7b050 EFLAGS: 00000206 ORIG_RAX: 00000000000000b3
    [ 155.037116] RAX: ffffffffffffffda RBX: 00007ffe8cd7b148 RCX: 00007fd812fe1198
    [ 155.037119] RDX: 0000000000000000 RSI: 00007ffe8cd7cea9 RDI: 0000000000580102
    [ 155.037121] RBP: 00007ffe8cd7b0f0 R08: 000055fc8eba8a9d R09: 0000000000000000
    [ 155.037124] R10: 00007ffe8cd7b074 R11: 0000000000000206 R12: 00007ffe8cd7b168
    [ 155.037126] R13: 000055fc8eba8897 R14: 0000000000000000 R15: 0000000000000000
    [ 155.037131] ---[ end trace 210f864257175c51 ]---

    and then the syscall proceeds without s_umount locking.

    This patch locks the superblock ->s_umount sem. in exclusive mode for all Q_XQUOTAON/OFF
    quotactls too in addition to Q_QUOTAON/OFF.

    AFAICT, other than ext4, only xfs and ocfs2 are affected by this change.
    The VFS will now call in xfs_quota_* functions with s_umount held, which wasn't the case
    before. This looks good to me but I can not say for sure. Ext4 and ocfs2 where already
    beeing called with s_umount exclusive via quota_quotaon/off which is basically the same.

    Signed-off-by: Javier Barrio
    Signed-off-by: Jan Kara
    Signed-off-by: Sasha Levin

    Javier Barrio
     

10 Sep, 2018

1 commit

  • commit 7b6924d94a60c6b8c1279ca003e8744e6cd9e8b1 upstream.

    'type' is user-controlled, so sanitize it after the bounds check to
    avoid using it in speculative execution. This covers the following
    potential gadgets detected with the help of smatch:

    * fs/ext4/super.c:5741 ext4_quota_read() warn: potential spectre issue
    'sb_dqopt(sb)->files' [r]
    * fs/ext4/super.c:5778 ext4_quota_write() warn: potential spectre issue
    'sb_dqopt(sb)->files' [r]
    * fs/f2fs/super.c:1552 f2fs_quota_read() warn: potential spectre issue
    'sb_dqopt(sb)->files' [r]
    * fs/f2fs/super.c:1608 f2fs_quota_write() warn: potential spectre issue
    'sb_dqopt(sb)->files' [r]
    * fs/quota/dquot.c:412 mark_info_dirty() warn: potential spectre issue
    'sb_dqopt(sb)->info' [w]
    * fs/quota/dquot.c:933 dqinit_needed() warn: potential spectre issue
    'dquots' [r]
    * fs/quota/dquot.c:2112 dquot_commit_info() warn: potential spectre
    issue 'dqopt->ops' [r]
    * fs/quota/dquot.c:2362 vfs_load_quota_inode() warn: potential spectre
    issue 'dqopt->files' [w] (local cap)
    * fs/quota/dquot.c:2369 vfs_load_quota_inode() warn: potential spectre
    issue 'dqopt->ops' [w] (local cap)
    * fs/quota/dquot.c:2370 vfs_load_quota_inode() warn: potential spectre
    issue 'dqopt->info' [w] (local cap)
    * fs/quota/quota.c:110 quota_getfmt() warn: potential spectre issue
    'sb_dqopt(sb)->info' [r]
    * fs/quota/quota_v2.c:84 v2_check_quota_file() warn: potential spectre
    issue 'quota_magics' [w]
    * fs/quota/quota_v2.c:85 v2_check_quota_file() warn: potential spectre
    issue 'quota_versions' [w]
    * fs/quota/quota_v2.c:96 v2_read_file_info() warn: potential spectre
    issue 'dqopt->info' [r]
    * fs/quota/quota_v2.c:172 v2_write_file_info() warn: potential spectre
    issue 'dqopt->info' [r]

    Additionally, a quick inspection indicates there are array accesses with
    'type' in quota_on() and quota_off() functions which are also addressed
    by this.

    Cc: Josh Poimboeuf
    Cc: stable@vger.kernel.org
    Signed-off-by: Jeremy Cline
    Signed-off-by: Jan Kara
    Signed-off-by: Greg Kroah-Hartman

    Jeremy Cline
     

04 Feb, 2018

2 commits

  • [ Upstream commit 88bc0ede8d35edc969350852894dc864a2dc1859 ]

    register_shrinker() might return -ENOMEM error since Linux 3.12.
    Call panic() as with other failure checks in this function if
    register_shrinker() failed.

    Fixes: 1d3d4437eae1 ("vmscan: per-node deferred work")
    Signed-off-by: Tetsuo Handa
    Cc: Jan Kara
    Cc: Michal Hocko
    Reviewed-by: Michal Hocko
    Signed-off-by: Jan Kara
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Tetsuo Handa
     
  • [ Upstream commit 1a6152d36dee08da2be2a3030dceb45ef680460a ]

    In commit 6184fc0b8dd7 ("quota: Propagate error from ->acquire_dquot()"),
    we have propagated error from __dquot_initialize to caller, but we forgot
    to handle such error in add_dquot_ref(), so, currently, during quota
    accounting information initialization flow, if we failed for some of
    inodes, we just ignore such error, and do account for others, which is
    not a good implementation.

    In this patch, we choose to let user be aware of such error, so after
    turning on quota successfully, we can make sure all inodes disk usage
    can be accounted, which will be more reasonable.

    Suggested-by: Jan Kara
    Signed-off-by: Chao Yu
    Signed-off-by: Jan Kara
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Chao Yu
     

02 Nov, 2017

1 commit

  • Many source files in the tree are missing licensing information, which
    makes it harder for compliance tools to determine the correct license.

    By default all files without license information are under the default
    license of the kernel, which is GPL version 2.

    Update the files which contain no license information with the 'GPL-2.0'
    SPDX license identifier. The SPDX identifier is a legally binding
    shorthand, which can be used instead of the full boiler plate text.

    This patch is based on work done by Thomas Gleixner and Kate Stewart and
    Philippe Ombredanne.

    How this work was done:

    Patches were generated and checked against linux-4.14-rc6 for a subset of
    the use cases:
    - file had no licensing information it it.
    - file was a */uapi/* one with no licensing information in it,
    - file was a */uapi/* one with existing licensing information,

    Further patches will be generated in subsequent months to fix up cases
    where non-standard license headers were used, and references to license
    had to be inferred by heuristics based on keywords.

    The analysis to determine which SPDX License Identifier to be applied to
    a file was done in a spreadsheet of side by side results from of the
    output of two independent scanners (ScanCode & Windriver) producing SPDX
    tag:value files created by Philippe Ombredanne. Philippe prepared the
    base worksheet, and did an initial spot review of a few 1000 files.

    The 4.13 kernel was the starting point of the analysis with 60,537 files
    assessed. Kate Stewart did a file by file comparison of the scanner
    results in the spreadsheet to determine which SPDX license identifier(s)
    to be applied to the file. She confirmed any determination that was not
    immediately clear with lawyers working with the Linux Foundation.

    Criteria used to select files for SPDX license identifier tagging was:
    - Files considered eligible had to be source code files.
    - Make and config files were included as candidates if they contained >5
    lines of source
    - File already had some variant of a license header in it (even if
    Reviewed-by: Philippe Ombredanne
    Reviewed-by: Thomas Gleixner
    Signed-off-by: Greg Kroah-Hartman

    Greg Kroah-Hartman
     

10 Oct, 2017

1 commit

  • Eryu has reported that since commit 7b9ca4c61bc2 "quota: Reduce
    contention on dq_data_lock" test generic/233 occasionally fails. This is
    caused by the fact that since that commit we don't generate warning and
    set grace time for quota allocations that have DQUOT_SPACE_NOFAIL set
    (these are for example some metadata allocations in ext4). We need these
    allocations to behave regularly wrt warning generation and grace time
    setting so fix the code to return to the original behavior.

    Reported-and-tested-by: Eryu Guan
    CC: stable@vger.kernel.org
    Fixes: 7b9ca4c61bc278b771fb57d6290a31ab1fc7fdac
    Signed-off-by: Jan Kara

    Jan Kara
     

27 Sep, 2017

1 commit

  • Eric has reported that since commit d2faa415166b "quota: Do not acquire
    dqio_sem for dquot overwrites in v2 format" test generic/232
    occasionally fails due to quota information being incorrect. Indeed that
    commit was too eager to remove dqio_sem completely from the path that
    just overwrites quota structure with updated information. Although that
    is innocent on its own, another process that inserts new quota structure
    to the same block can perform read-modify-write cycle of that block thus
    effectively discarding quota information update if they race in a wrong
    way.

    Fix the problem by acquiring dqio_sem for reading for overwrites of
    quota structure. Note that it *is* possible to completely avoid taking
    dqio_sem in the overwrite path however that will require modifying path
    inserting / deleting quota structures to avoid RMW cycles of the full
    block and for now it is not clear whether it is worth the hassle.

    Fixes: d2faa415166b2883428efa92f451774ef44373ac
    Reported-and-tested-by: Eric Whitney
    Signed-off-by: Jan Kara

    Jan Kara
     

18 Sep, 2017

1 commit


15 Sep, 2017

1 commit

  • Pull mount flag updates from Al Viro:
    "Another chunk of fmount preparations from dhowells; only trivial
    conflicts for that part. It separates MS_... bits (very grotty
    mount(2) ABI) from the struct super_block ->s_flags (kernel-internal,
    only a small subset of MS_... stuff).

    This does *not* convert the filesystems to new constants; only the
    infrastructure is done here. The next step in that series is where the
    conflicts would be; that's the conversion of filesystems. It's purely
    mechanical and it's better done after the merge, so if you could run
    something like

    list=$(for i in MS_RDONLY MS_NOSUID MS_NODEV MS_NOEXEC MS_SYNCHRONOUS MS_MANDLOCK MS_DIRSYNC MS_NOATIME MS_NODIRATIME MS_SILENT MS_POSIXACL MS_KERNMOUNT MS_I_VERSION MS_LAZYTIME; do git grep -l $i fs drivers/staging/lustre drivers/mtd ipc mm include/linux; done|sort|uniq|grep -v '^fs/namespace.c$')

    sed -i -e 's/\/SB_RDONLY/g' \
    -e 's/\/SB_NOSUID/g' \
    -e 's/\/SB_NODEV/g' \
    -e 's/\/SB_NOEXEC/g' \
    -e 's/\/SB_SYNCHRONOUS/g' \
    -e 's/\/SB_MANDLOCK/g' \
    -e 's/\/SB_DIRSYNC/g' \
    -e 's/\/SB_NOATIME/g' \
    -e 's/\/SB_NODIRATIME/g' \
    -e 's/\/SB_SILENT/g' \
    -e 's/\/SB_POSIXACL/g' \
    -e 's/\/SB_KERNMOUNT/g' \
    -e 's/\/SB_I_VERSION/g' \
    -e 's/\/SB_LAZYTIME/g' \
    $list

    and commit it with something along the lines of 'convert filesystems
    away from use of MS_... constants' as commit message, it would save a
    quite a bit of headache next cycle"

    * 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
    VFS: Differentiate mount flags (MS_*) from internal superblock flags
    VFS: Convert sb->s_flags & MS_RDONLY to sb_rdonly(sb)
    vfs: Add sb_rdonly(sb) to query the MS_RDONLY flag on s_flags

    Linus Torvalds
     

08 Sep, 2017

1 commit

  • Pull quota scaling updates from Jan Kara:
    "This contains changes to make the quota subsystem more scalable.

    Reportedly it improves number of files created per second on ext4
    filesystem on fast storage by about a factor of 2x"

    * 'quota_scaling' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: (28 commits)
    quota: Add lock annotations to struct members
    quota: Reduce contention on dq_data_lock
    fs: Provide __inode_get_bytes()
    quota: Inline dquot_[re]claim_reserved_space() into callsite
    quota: Inline inode_{incr,decr}_space() into callsites
    quota: Inline functions into their callsites
    ext4: Disable dirty list tracking of dquots when journalling quotas
    quota: Allow disabling tracking of dirty dquots in a list
    quota: Remove dq_wait_unused from dquot
    quota: Move locking into clear_dquot_dirty()
    quota: Do not dirty bad dquots
    quota: Fix possible corruption of dqi_flags
    quota: Propagate ->quota_read errors from v2_read_file_info()
    quota: Fix error codes in v2_read_file_info()
    quota: Push dqio_sem down to ->read_file_info()
    quota: Push dqio_sem down to ->write_file_info()
    quota: Push dqio_sem down to ->get_next_id()
    quota: Push dqio_sem down to ->release_dqblk()
    quota: Remove locking for writing to the old quota format
    quota: Do not acquire dqio_sem for dquot overwrites in v2 format
    ...

    Linus Torvalds
     

21 Aug, 2017

1 commit


18 Aug, 2017

25 commits


07 Aug, 2017

1 commit

  • Currently we compare total space (curspace + rsvspace)
    with space limit in quota-tools when setting grace time
    and also in check_bdq(), but we missing rsvspace in
    somewhere else, correct them. This patch also fix incorrect
    zero dqb_btime and grace time updating failure when we use
    rsvspace(e.g. ext4 dalloc feature).

    Signed-off-by: zhangyi (F)
    Signed-off-by: Jan Kara

    zhangyi (F)
     

17 Jul, 2017

1 commit

  • Firstly by applying the following with coccinelle's spatch:

    @@ expression SB; @@
    -SB->s_flags & MS_RDONLY
    +sb_rdonly(SB)

    to effect the conversion to sb_rdonly(sb), then by applying:

    @@ expression A, SB; @@
    (
    -(!sb_rdonly(SB)) && A
    +!sb_rdonly(SB) && A
    |
    -A != (sb_rdonly(SB))
    +A != sb_rdonly(SB)
    |
    -A == (sb_rdonly(SB))
    +A == sb_rdonly(SB)
    |
    -!(sb_rdonly(SB))
    +!sb_rdonly(SB)
    |
    -A && (sb_rdonly(SB))
    +A && sb_rdonly(SB)
    |
    -A || (sb_rdonly(SB))
    +A || sb_rdonly(SB)
    |
    -(sb_rdonly(SB)) != A
    +sb_rdonly(SB) != A
    |
    -(sb_rdonly(SB)) == A
    +sb_rdonly(SB) == A
    |
    -(sb_rdonly(SB)) && A
    +sb_rdonly(SB) && A
    |
    -(sb_rdonly(SB)) || A
    +sb_rdonly(SB) || A
    )

    @@ expression A, B, SB; @@
    (
    -(sb_rdonly(SB)) ? 1 : 0
    +sb_rdonly(SB)
    |
    -(sb_rdonly(SB)) ? A : B
    +sb_rdonly(SB) ? A : B
    )

    to remove left over excess bracketage and finally by applying:

    @@ expression A, SB; @@
    (
    -(A & MS_RDONLY) != sb_rdonly(SB)
    +(bool)(A & MS_RDONLY) != sb_rdonly(SB)
    |
    -(A & MS_RDONLY) == sb_rdonly(SB)
    +(bool)(A & MS_RDONLY) == sb_rdonly(SB)
    )

    to make comparisons against the result of sb_rdonly() (which is a bool)
    work correctly.

    Signed-off-by: David Howells

    David Howells
     

22 Jun, 2017

1 commit

  • Ext4 ea_inode feature allows storing xattr values in external inodes to
    be able to store values that are bigger than a block in size. Ext4 also
    has deduplication support for these type of inodes. With deduplication,
    the actual storage waste is eliminated but the users of such inodes are
    still charged full quota for the inodes as if there was no sharing
    happening in the background.

    This design requires ext4 to manually charge the users because the
    inodes are shared.

    An implication of this is that, if someone calls chown on a file that
    has such references we need to transfer the quota for the file and xattr
    inodes. Current dquot_transfer() function implicitly transfers one inode
    charge. With ea_inode feature, we would like to transfer multiple inode
    charges.

    Add get_inode_usage callback which can interrogate the total number of
    inodes that were charged for a given inode.

    [ Applied fix from Colin King to make sure the 'ret' variable is
    initialized on the successful return path. Detected by
    CoverityScan, CID#1446616 ("Uninitialized scalar variable") --tytso]

    Signed-off-by: Tahsin Erdogan
    Signed-off-by: Theodore Ts'o
    Signed-off-by: Colin Ian King
    Acked-by: Jan Kara

    Tahsin Erdogan
     

25 May, 2017

1 commit

  • ext4_xattr_block_set() calls dquot_alloc_block() to charge for an xattr
    block when new references are made. However if dquot_initialize() hasn't
    been called on an inode, request for charging is effectively ignored
    because ext4_inode_info->i_dquot is not initialized yet.

    Add dquot_initialize() to call paths that lead to ext4_xattr_block_set().

    Signed-off-by: Tahsin Erdogan
    Signed-off-by: Theodore Ts'o
    Reviewed-by: Jan Kara

    Tahsin Erdogan