• Naohiro Aota's avatar
    btrfs: zoned: sanity check zone type · 784daf2b
    Naohiro Aota authored
    The fstests test case generic/475 creates a dm-linear device that gets
    changed to a dm-error device. This leads to errors in loading the block
    group's zone information when running on a zoned file system, ultimately
    resulting in a list corruption. When running on a kernel with list
    debugging enabled this leads to the following crash.
    
     BTRFS: error (device dm-2) in cleanup_transaction:1953: errno=-5 IO failure
     kernel BUG at lib/list_debug.c:54!
     invalid opcode: 0000 [#1] SMP PTI
     CPU: 1 PID: 2433 Comm: umount Tainted: G        W         5.12.0+ #1018
     RIP: 0010:__list_del_entry_valid.cold+0x1d/0x47
     RSP: 0018:ffffc90001473df0 EFLAGS: 00010296
     RAX: 0000000000000054 RBX: ffff8881038fd000 RCX: ffffc90001473c90
     RDX: 0000000100001a31 RSI: 0000000000000003 RDI: 0000000000000003
     RBP: ffff888308871108 R08: 0000000000000003 R09: 0000000000000001
     R10: 3961373532383838 R11: 6666666620736177 R12: ffff888308871000
     R13: ffff8881038fd088 R14: ffff8881038fdc78 R15: dead000000000100
     FS:  00007f353c9b1540(0000) GS:ffff888627d00000(0000) knlGS:0000000000000000
     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
     CR2: 00007f353cc2c710 CR3: 000000018e13c000 CR4: 00000000000006a0
     DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
     DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
     Call Trace:
      btrfs_free_block_groups+0xc9/0x310 [btrfs]
      close_ctree+0x2ee/0x31a [btrfs]
      ? call_rcu+0x8f/0x270
      ? mutex_lock+0x1c/0x40
      generic_shutdown_super+0x67/0x100
      kill_anon_super+0x14/0x30
      btrfs_kill_super+0x12/0x20 [btrfs]
      deactivate_locked_super+0x31/0x90
      cleanup_mnt+0x13e/0x1b0
      task_work_run+0x63/0xb0
      exit_to_user_mode_loop+0xd9/0xe0
      exit_to_user_mode_prepare+0x3e/0x60
      syscall_exit_to_user_mode+0x1d/0x50
      entry_SYSCALL_64_after_hwframe+0x44/0xae
    
    As dm-error has no support for zones, btrfs will run it's zone emulation
    mode on this device. The zone emulation mode emulates conventional zones,
    so bail out if the zone bitmap that gets populated on mount sees the zone
    as sequential while we're thinking it's a conventional zone when creating
    a block group.
    
    Note: this scenario is unlikely in a real wold application and can only
    happen by this (ab)use of device-mapper targets.
    
    CC: stable@vger.kernel.org # 5.12+
    Signed-off-by: default avatarNaohiro Aota <naohiro.aota@wdc.com>
    Signed-off-by: default avatarJohannes Thumshirn <johannes.thumshirn@wdc.com>
    Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
    784daf2b
zoned.c 37.2 KB