- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] mm, fs: Add BPF_READAHEAD_OPTIMIZATION option for bpf readhead
by ZhaoLong Wang 03 Apr '24

03 Apr '24

This patch introduces a new configuration option called BPF_READAHEAD_OPTIMIZATION, which is designed to optimize the read performance in Spark SQL scenarios using eBPF to implement a programmable kernel. The changes include: - Add CONFIG_BPF_READAHEAD_OPTIMIZATION to mm/Kconfig, which depends on CONFIG_TRACEPOINTS. - Add conditional compilation directives to fs/ext4/file.c, fs/read_write.c, fs/xfs/xfs_file.c, and include/linux/fs.h to include tracepoint-related headers and functions only when BPF_READAHEAD_OPTIMIZATION is enabled. - Miodify page_cache_sync_ra() in mm/readahead.c to disable forced readahead when BPF_READAHEAD_OPTIMIZATION is not enabled. Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/ext4/file.c | 6 ++++++ fs/read_write.c | 2 +- fs/xfs/xfs_file.c | 7 ++++++- include/linux/fs.h | 8 ++++++++ mm/Kconfig | 9 +++++++++ mm/readahead.c | 10 ++++++++++ 6 files changed, 40 insertions(+), 2 deletions(-) diff --git a/fs/ext4/file.c b/fs/ext4/file.c index 324b45b51d1f..14f1441c3391 100644 --- a/fs/ext4/file.c +++ b/fs/ext4/file.c @@ -30,7 +30,9 @@ #include <linux/uio.h> #include <linux/mman.h> #include <linux/backing-dev.h> +#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION #include <trace/events/fs.h> +#endif #include "ext4.h" #include "ext4_jbd2.h" #include "xattr.h" @@ -145,7 +147,9 @@ static ssize_t ext4_file_read_iter(struct kiocb *iocb, struct iov_iter *to) if (iocb->ki_flags & IOCB_DIRECT) return ext4_dio_read_iter(iocb, to); +#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION fs_file_read_do_trace(iocb); +#endif return generic_file_read_iter(iocb, to); } @@ -167,7 +171,9 @@ static ssize_t ext4_file_splice_read(struct file *in, loff_t *ppos, */ static int ext4_release_file(struct inode *inode, struct file *filp) { +#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION trace_fs_file_release(inode, filp); +#endif if (ext4_test_inode_state(inode, EXT4_STATE_DA_ALLOC_CLOSE)) { ext4_alloc_da_blocks(inode); diff --git a/fs/read_write.c b/fs/read_write.c index 3d69fb284d10..2ee9a07f7208 100644 --- a/fs/read_write.c +++ b/fs/read_write.c @@ -1721,7 +1721,7 @@ int generic_file_rw_checks(struct file *file_in, struct file *file_out) return 0; } -#ifdef CONFIG_TRACEPOINTS +#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION static void fs_file_read_ctx_init(struct fs_file_read_ctx *ctx, struct file *filp, loff_t pos) { diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c index ecf10d3aec17..7a4bd39bc694 100644 --- a/fs/xfs/xfs_file.c +++ b/fs/xfs/xfs_file.c @@ -31,7 +31,9 @@ #include <linux/mman.h> #include <linux/fadvise.h> #include <linux/mount.h> +#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION #include <trace/events/fs.h> +#endif static const struct vm_operations_struct xfs_file_vm_ops; @@ -308,8 +310,9 @@ xfs_file_buffered_read( ssize_t ret; trace_xfs_file_buffered_read(iocb, to); +#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION fs_file_read_do_trace(iocb); - +#endif ret = xfs_ilock_iocb(iocb, XFS_IOLOCK_SHARED); if (ret) return ret; @@ -1266,7 +1269,9 @@ xfs_file_release( struct inode *inode, struct file *filp) { +#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION trace_fs_file_release(inode, filp); +#endif return xfs_release(XFS_I(inode)); } diff --git a/include/linux/fs.h b/include/linux/fs.h index d74314a8fa94..eb50bcbfcc24 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -43,7 +43,9 @@ #include <linux/cred.h> #include <linux/mnt_idmapping.h> #include <linux/slab.h> +#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION #include <linux/tracepoint-defs.h> +#endif #include <linux/kabi.h> #include <asm/byteorder.h> @@ -190,11 +192,13 @@ typedef int (dio_iodone_t)(struct kiocb *iocb, loff_t offset, /* File supports async nowait buffered writes */ #define FMODE_BUF_WASYNC ((__force fmode_t)0x80000000) +#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION /* File mode control flag, expect random access pattern */ #define FMODE_CTL_RANDOM ((__force fmode_t)0x1000) /* File mode control flag, will try to read head of the file into pagecache */ #define FMODE_CTL_WILLNEED ((__force fmode_t)0x400000) +#endif /* * Attribute flags. These should be or-ed together to figure out what @@ -1058,7 +1062,9 @@ struct file { struct address_space *f_mapping; errseq_t f_wb_err; errseq_t f_sb_err; /* for syncfs */ +#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION fmode_t f_ctl_mode; +#endif KABI_RESERVE(1) KABI_RESERVE(2) } __randomize_layout @@ -3524,6 +3530,7 @@ struct fs_file_read_ctx { long long index; }; +#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION #ifdef CONFIG_TRACEPOINTS DECLARE_TRACEPOINT(fs_file_read); extern void fs_file_read_update_args_by_trace(struct kiocb *iocb); @@ -3536,4 +3543,5 @@ static inline void fs_file_read_do_trace(struct kiocb *iocb) if (tracepoint_enabled(fs_file_read)) fs_file_read_update_args_by_trace(iocb); } +#endif #endif /* _LINUX_FS_H */ diff --git a/mm/Kconfig b/mm/Kconfig index cdbb1ceaa554..27c4bd8238c9 100644 --- a/mm/Kconfig +++ b/mm/Kconfig @@ -1424,6 +1424,15 @@ config ETMEM high-performance storage media to release memory space and reduce memory costs. +config BPF_READAHEAD_OPTIMIZATION + bool "Enable bpf readahead optimization" + depends on TRACEPOINTS + default n + help + EBPF is used to implement a programmable kernel. The readahead behavior + of the kernel is adjusted based on the application read mode to optimize + the read performance in the Spark SQL scenario, + source "mm/damon/Kconfig" endmenu diff --git a/mm/readahead.c b/mm/readahead.c index 4d0dbfd62d20..4f8e339e2d6e 100644 --- a/mm/readahead.c +++ b/mm/readahead.c @@ -131,7 +131,9 @@ #include "internal.h" +#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION #define READAHEAD_FIRST_SIZE (2 * 1024 * 1024) +#endif /* * Initialise a struct file's readahead state. Assumes that the caller has * memset *ra to zero. @@ -669,6 +671,7 @@ static void ondemand_readahead(struct readahead_control *ractl, page_cache_ra_order(ractl, ra, order); } +#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION /* * Try to read first @ra_size from head of the file. */ @@ -697,13 +700,18 @@ static bool page_cache_readahead_from_head(struct address_space *mapping, } return true; } +#endif void page_cache_sync_ra(struct readahead_control *ractl, unsigned long req_count) { +#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION bool do_forced_ra = ractl->file && ((ractl->file->f_mode & FMODE_RANDOM) || (ractl->file->f_ctl_mode & FMODE_CTL_RANDOM)); +#else + bool do_forced_ra = ractl->file && (ractl->file->f_mode & FMODE_RANDOM); +#endif /* * Even if readahead is disabled, issue this request as readahead @@ -718,11 +726,13 @@ void page_cache_sync_ra(struct readahead_control *ractl, do_forced_ra = true; } +#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION /* try to read first READAHEAD_FIRST_SIZE into pagecache */ if (ractl->file && (ractl->file->f_ctl_mode & FMODE_CTL_WILLNEED) && page_cache_readahead_from_head(ractl->mapping, ractl->file, readahead_index(ractl), req_count, READAHEAD_FIRST_SIZE)) return; +#endif /* be dumb */ if (do_forced_ra) { -- 2.39.2

2 1

[PATCH OLK-6.6 0/2] arch/mm/fault: accelerate pagefault when badaccess
by Peng Zhang 03 Apr '24

03 Apr '24

From: ZhangPeng <zhangpeng362(a)huawei.com> Backport arch/mm/fault: accelerate pagefault when badaccess. A test from lmbench shows 34% improve after this changes on arm64: lat_sig -P 1 prot lat_sig 0.29194 -> 0.19198 Kefeng Wang (2): arm64: mm: accelerate pagefault when VM_FAULT_BADACCESS x86: mm: accelerate pagefault when badaccess arch/arm64/mm/fault.c | 4 +++- arch/x86/mm/fault.c | 23 ++++++++++++++--------- 2 files changed, 17 insertions(+), 10 deletions(-) -- 2.25.1

2 3

[OLK-6.6 0/2] arch/mm/fault: accelerate pagefault when badaccess
by Peng Zhang 03 Apr '24

03 Apr '24

From: ZhangPeng <zhangpeng362(a)huawei.com> Backport arch/mm/fault: accelerate pagefault when badaccess. A test from lmbench shows 34% improve after this changes on arm64: lat_sig -P 1 prot lat_sig 0.29194 -> 0.19198 Kefeng Wang (2): arm64: mm: accelerate pagefault when VM_FAULT_BADACCESS x86: mm: accelerate pagefault when badaccess arch/arm64/mm/fault.c | 4 +++- arch/x86/mm/fault.c | 23 ++++++++++++++--------- 2 files changed, 17 insertions(+), 10 deletions(-) -- 2.25.1

1 0

【重要】openEuler-22.03-LTS-SP4需求收集
by zhangjialin (F) 03 Apr '24

03 Apr '24

openEuler-22.03-LTS-SP4 kernel 需求收集截止日期： 2024 年 4 月 19 日星期五 openEuler-22.03-LTS-SP4 kernel 需求合入截止日期： 2024 年 5 月 29 日星期三目前是需求收集阶段，如果您有合入 openEuler-22.03-LTS-SP4 kernel 的需求，请您尽快向 openEuler 社区 kernel sig 提交需求 issue 需求 issue 提交链接： https://gitee.com/openeuler/kernel/issues ， issue 类型选择需求， issue 标题以 [openEuler-22.03-LTS-SP4] 开头我们将在 2024 年 4 月 19 日的kernel sig 双周例会上集中讨论，采纳的需求将纳入里程碑规划

1 0

【重要】openEuler-22.03-LTS-SP4需求收集
by zhangjialin (F) 03 Apr '24

03 Apr '24

openEuler-22.03-LTS-SP4 kernel 需求收集截止日期： 2024 年 4 月 19 日星期五 openEuler-22.03-LTS-SP4 kernel 需求合入截止日期： 2024 年 5 月 29 日星期三目前是需求收集阶段，如果您有合入 openEuler-22.03-LTS-SP4 kernel 的需求，请您尽快向 openEuler 社区 kernel sig 提交需求 issue 需求 issue 提交链接： https://gitee.com/openeuler/kernel/issues ， issue 类型选择“需求”， issue 标题以 [openEuler-22.03-LTS-SP4] 开头我们将在 2023 年 4 月 19 日的kernel sig 双周例会上集中讨论，采纳的需求将纳入里程碑规划

1 0

[PATCH OLK-5.10 V1 0/3] fix CVE-2021-47101
by Cheng Yu 03 Apr '24

03 Apr '24

fix CVE-2021-47101 Pavel Skripkin (3): net: asix: fix uninit value bugs asix: fix uninit-value in asix_mdio_read() asix: fix wrong return value in asix_check_host_enable() drivers/net/usb/asix_common.c | 73 ++++++++++++++++------------------- 1 file changed, 33 insertions(+), 40 deletions(-) -- 2.25.1

2 4

[PATCH openEuler-1.0-LTS V1 0/3] fix CVE-2021-47101
by Cheng Yu 03 Apr '24

03 Apr '24

fix CVE-2021-47101 Pavel Skripkin (3): net: asix: fix uninit value bugs asix: fix uninit-value in asix_mdio_read() asix: fix wrong return value in asix_check_host_enable() drivers/net/usb/asix_common.c | 73 ++++++++++++++++------------------- 1 file changed, 33 insertions(+), 40 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6] ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
by liwei 03 Apr '24

03 Apr '24

From: Duoming Zhou <duoming(a)zju.edu.cn> mainline inclusion from mainline-v6.9-rc2 commit 051e0840ffa8ab25554d6b14b62c9ab9e4901457 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DD86 CVE: CVE-2024-26654 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The dreamcastcard->timer could schedule the spu_dma_work and the spu_dma_work could also arm the dreamcastcard->timer. When the snd_pcm_substream is closing, the aica_channel will be deallocated. But it could still be dereferenced in the worker thread. The reason is that del_timer() will return directly regardless of whether the timer handler is running or not and the worker could be rescheduled in the timer handler. As a result, the UAF bug will happen. The racy situation is shown below: (Thread 1) | (Thread 2) snd_aicapcm_pcm_close() | ... | run_spu_dma() //worker | mod_timer() flush_work() | del_timer() | aica_period_elapsed() //timer kfree(dreamcastcard->channel) | schedule_work() | run_spu_dma() //worker ... | dreamcastcard->channel-> //USE In order to mitigate this bug and other possible corner cases, call mod_timer() conditionally in run_spu_dma(), then implement PCM sync_stop op to cancel both the timer and worker. The sync_stop op will be called from PCM core appropriately when needed. Fixes: 198de43d758c ("[ALSA] Add ALSA support for the SEGA Dreamcast PCM device") Suggested-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Message-ID: <20240326094238.95442-1-duoming(a)zju.edu.cn> Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: liwei <liwei728(a)huawei.com> --- sound/sh/aica.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/sound/sh/aica.c b/sound/sh/aica.c index 320ac792c7fe..3182c634464d 100644 --- a/sound/sh/aica.c +++ b/sound/sh/aica.c @@ -278,7 +278,8 @@ static void run_spu_dma(struct work_struct *work) dreamcastcard->clicks++; if (unlikely(dreamcastcard->clicks >= AICA_PERIOD_NUMBER)) dreamcastcard->clicks %= AICA_PERIOD_NUMBER; - mod_timer(&dreamcastcard->timer, jiffies + 1); + if (snd_pcm_running(dreamcastcard->substream)) + mod_timer(&dreamcastcard->timer, jiffies + 1); } } @@ -290,6 +291,8 @@ static void aica_period_elapsed(struct timer_list *t) /*timer function - so cannot sleep */ int play_period; struct snd_pcm_runtime *runtime; + if (!snd_pcm_running(substream)) + return; runtime = substream->runtime; dreamcastcard = substream->pcm->private_data; /* Have we played out an additional period? */ @@ -350,12 +353,19 @@ static int snd_aicapcm_pcm_open(struct snd_pcm_substream return 0; } +static int snd_aicapcm_pcm_sync_stop(struct snd_pcm_substream *substream) +{ + struct snd_card_aica *dreamcastcard = substream->pcm->private_data; + + del_timer_sync(&dreamcastcard->timer); + cancel_work_sync(&dreamcastcard->spu_dma_work); + return 0; +} + static int snd_aicapcm_pcm_close(struct snd_pcm_substream *substream) { struct snd_card_aica *dreamcastcard = substream->pcm->private_data; - flush_work(&(dreamcastcard->spu_dma_work)); - del_timer(&dreamcastcard->timer); dreamcastcard->substream = NULL; kfree(dreamcastcard->channel); spu_disable(); @@ -401,6 +411,7 @@ static const struct snd_pcm_ops snd_aicapcm_playback_ops = { .prepare = snd_aicapcm_pcm_prepare, .trigger = snd_aicapcm_pcm_trigger, .pointer = snd_aicapcm_pcm_pointer, + .sync_stop = snd_aicapcm_pcm_sync_stop, }; /* TO DO: set up to handle more than one pcm instance */ -- 2.25.1

2 1

[PATCH OLK-5.10] ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
by liwei 03 Apr '24

03 Apr '24

From: Duoming Zhou <duoming(a)zju.edu.cn> mainline inclusion from mainline-v6.9-rc2 commit 051e0840ffa8ab25554d6b14b62c9ab9e4901457 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DD86 CVE: CVE-2024-26654 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The dreamcastcard->timer could schedule the spu_dma_work and the spu_dma_work could also arm the dreamcastcard->timer. When the snd_pcm_substream is closing, the aica_channel will be deallocated. But it could still be dereferenced in the worker thread. The reason is that del_timer() will return directly regardless of whether the timer handler is running or not and the worker could be rescheduled in the timer handler. As a result, the UAF bug will happen. The racy situation is shown below: (Thread 1) | (Thread 2) snd_aicapcm_pcm_close() | ... | run_spu_dma() //worker | mod_timer() flush_work() | del_timer() | aica_period_elapsed() //timer kfree(dreamcastcard->channel) | schedule_work() | run_spu_dma() //worker ... | dreamcastcard->channel-> //USE In order to mitigate this bug and other possible corner cases, call mod_timer() conditionally in run_spu_dma(), then implement PCM sync_stop op to cancel both the timer and worker. The sync_stop op will be called from PCM core appropriately when needed. Fixes: 198de43d758c ("[ALSA] Add ALSA support for the SEGA Dreamcast PCM device") Suggested-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Message-ID: <20240326094238.95442-1-duoming(a)zju.edu.cn> Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: liwei <liwei728(a)huawei.com> --- sound/sh/aica.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/sound/sh/aica.c b/sound/sh/aica.c index 8fa68432d3c1..2d59e3907fcf 100644 --- a/sound/sh/aica.c +++ b/sound/sh/aica.c @@ -279,7 +279,8 @@ static void run_spu_dma(struct work_struct *work) dreamcastcard->clicks++; if (unlikely(dreamcastcard->clicks >= AICA_PERIOD_NUMBER)) dreamcastcard->clicks %= AICA_PERIOD_NUMBER; - mod_timer(&dreamcastcard->timer, jiffies + 1); + if (snd_pcm_running(dreamcastcard->substream)) + mod_timer(&dreamcastcard->timer, jiffies + 1); } } @@ -291,6 +292,8 @@ static void aica_period_elapsed(struct timer_list *t) /*timer function - so cannot sleep */ int play_period; struct snd_pcm_runtime *runtime; + if (!snd_pcm_running(substream)) + return; runtime = substream->runtime; dreamcastcard = substream->pcm->private_data; /* Have we played out an additional period? */ @@ -351,12 +354,19 @@ static int snd_aicapcm_pcm_open(struct snd_pcm_substream return 0; } +static int snd_aicapcm_pcm_sync_stop(struct snd_pcm_substream *substream) +{ + struct snd_card_aica *dreamcastcard = substream->pcm->private_data; + + del_timer_sync(&dreamcastcard->timer); + cancel_work_sync(&dreamcastcard->spu_dma_work); + return 0; +} + static int snd_aicapcm_pcm_close(struct snd_pcm_substream *substream) { struct snd_card_aica *dreamcastcard = substream->pcm->private_data; - flush_work(&(dreamcastcard->spu_dma_work)); - del_timer(&dreamcastcard->timer); dreamcastcard->substream = NULL; kfree(dreamcastcard->channel); spu_disable(); @@ -402,6 +412,7 @@ static const struct snd_pcm_ops snd_aicapcm_playback_ops = { .prepare = snd_aicapcm_pcm_prepare, .trigger = snd_aicapcm_pcm_trigger, .pointer = snd_aicapcm_pcm_pointer, + .sync_stop = snd_aicapcm_pcm_sync_stop, }; /* TO DO: set up to handle more than one pcm instance */ -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
by Long Li 03 Apr '24

03 Apr '24

From: Omar Sandoval <osandov(a)fb.com> mainline inclusion from mainline-v6.7-rc5 commit 7081929ab2572920e94d70be3d332e5c9f97095a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BV23 CVE: CVE-2024-26644 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If the source file descriptor to the snapshot ioctl refers to a deleted subvolume, we get the following abort: BTRFS: Transaction aborted (error -2) WARNING: CPU: 0 PID: 833 at fs/btrfs/transaction.c:1875 create_pending_snapshot+0x1040/0x1190 [btrfs] Modules linked in: pata_acpi btrfs ata_piix libata scsi_mod virtio_net blake2b_generic xor net_failover virtio_rng failover scsi_common rng_core raid6_pq libcrc32c CPU: 0 PID: 833 Comm: t_snapshot_dele Not tainted 6.7.0-rc6 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014 RIP: 0010:create_pending_snapshot+0x1040/0x1190 [btrfs] RSP: 0018:ffffa09c01337af8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff9982053e7c78 RCX: 0000000000000027 RDX: ffff99827dc20848 RSI: 0000000000000001 RDI: ffff99827dc20840 RBP: ffffa09c01337c00 R08: 0000000000000000 R09: ffffa09c01337998 R10: 0000000000000003 R11: ffffffffb96da248 R12: fffffffffffffffe R13: ffff99820535bb28 R14: ffff99820b7bd000 R15: ffff99820381ea80 FS: 00007fe20aadabc0(0000) GS:ffff99827dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000559a120b502f CR3: 00000000055b6000 CR4: 00000000000006f0 Call Trace: <TASK> ? create_pending_snapshot+0x1040/0x1190 [btrfs] ? __warn+0x81/0x130 ? create_pending_snapshot+0x1040/0x1190 [btrfs] ? report_bug+0x171/0x1a0 ? handle_bug+0x3a/0x70 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? create_pending_snapshot+0x1040/0x1190 [btrfs] ? create_pending_snapshot+0x1040/0x1190 [btrfs] create_pending_snapshots+0x92/0xc0 [btrfs] btrfs_commit_transaction+0x66b/0xf40 [btrfs] btrfs_mksubvol+0x301/0x4d0 [btrfs] btrfs_mksnapshot+0x80/0xb0 [btrfs] __btrfs_ioctl_snap_create+0x1c2/0x1d0 [btrfs] btrfs_ioctl_snap_create_v2+0xc4/0x150 [btrfs] btrfs_ioctl+0x8a6/0x2650 [btrfs] ? kmem_cache_free+0x22/0x340 ? do_sys_openat2+0x97/0xe0 __x64_sys_ioctl+0x97/0xd0 do_syscall_64+0x46/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 RIP: 0033:0x7fe20abe83af RSP: 002b:00007ffe6eff1360 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007fe20abe83af RDX: 00007ffe6eff23c0 RSI: 0000000050009417 RDI: 0000000000000003 RBP: 0000000000000003 R08: 0000000000000000 R09: 00007fe20ad16cd0 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe6eff13c0 R14: 00007fe20ad45000 R15: 0000559a120b6d58 </TASK> ---[ end trace 0000000000000000 ]--- BTRFS: error (device vdc: state A) in create_pending_snapshot:1875: errno=-2 No such entry BTRFS info (device vdc: state EA): forced readonly BTRFS warning (device vdc: state EA): Skipping commit of aborted transaction. BTRFS: error (device vdc: state EA) in cleanup_transaction:2055: errno=-2 No such entry This happens because create_pending_snapshot() initializes the new root item as a copy of the source root item. This includes the refs field, which is 0 for a deleted subvolume. The call to btrfs_insert_root() therefore inserts a root with refs == 0. btrfs_get_new_fs_root() then finds the root and returns -ENOENT if refs == 0, which causes create_pending_snapshot() to abort. Fix it by checking the source root's refs before attempting the snapshot, but after locking subvol_sem to avoid racing with deletion. CC: stable(a)vger.kernel.org # 4.14+ Reviewed-by: Sweet Tea Dorminy <sweettea-kernel(a)dorminy.me> Reviewed-by: Anand Jain <anand.jain(a)oracle.com> Signed-off-by: Omar Sandoval <osandov(a)fb.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflict: fs/btrfs/ioctl.c Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/btrfs/ioctl.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c index 00424d3f3464..178e49bd0060 100644 --- a/fs/btrfs/ioctl.c +++ b/fs/btrfs/ioctl.c @@ -768,6 +768,9 @@ static int create_snapshot(struct btrfs_root *root, struct inode *dir, int ret; bool snapshot_force_cow = false; + if (btrfs_root_refs(&root->root_item) == 0) + return -ENOENT; + if (!test_bit(BTRFS_ROOT_REF_COWS, &root->state)) return -EINVAL; -- 2.31.1

2 1