Syzbot reported task hung bug in ext4_fill_super(). The problem was in
too huge mmp update interval.
Syzkaller reproducer setted s_mmp_update_interval to 39785 seconds. This
update interaval is unreasonable huge and it can cause tasks to hung on
kthread_stop() call, since it will wait until timeout timer expires.
To avoid this sutiation, I've added MIN and MAX constants for kmmp
interval and clamped s_mmp_update_interval within the boundaries
Reported-and-tested-by: syzbot+c9ff4822a62eee994ea3@xxxxxxxxxxxxxxxxxxxxxxxxx
Fixes: c5e06d101aaf ("ext4: add support for multiple mount protection")
Signed-off-by: Pavel Skripkin <paskripkin@xxxxxxxxx>
---
Hi, Ted and ext4 maintainers!
I am not sure about min/max values for interval, so I look forward to
receiving your views on these values and patch in general!
With regards,
Pavel Skripkin
---
fs/ext4/mmp.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c
index bc364c119af6..160abee66dce 100644
--- a/fs/ext4/mmp.c
+++ b/fs/ext4/mmp.c
@@ -7,6 +7,9 @@
#include "ext4.h"
+#define EXT4_KMMP_MAX_INTERVAL 100
+#define EXT4_KMMP_MIN_INTERVAL 5
+
/* Checksumming functions */
static __le32 ext4_mmp_csum(struct super_block *sb, struct mmp_struct *mmp)
{
@@ -140,6 +143,12 @@ static int kmmpd(void *data)
unsigned long diff;
int retval;
+ /* We should avoid unreasonable huge update interval, since it can cause
+ * task hung bug on umount or on error handling path in ext4_fill_super()
+ */
+ mmp_update_interval = clamp(mmp_update_interval, EXT4_KMMP_MIN_INTERVAL,
+ EXT4_KMMP_MAX_INTERVAL);
+
mmp_block = le64_to_cpu(es->s_mmp_block);
mmp = (struct mmp_struct *)(bh->b_data);
mmp->mmp_time = cpu_to_le64(ktime_get_real_seconds());
@@ -156,6 +165,9 @@ static int kmmpd(void *data)
memcpy(mmp->mmp_nodename, init_utsname()->nodename,
sizeof(mmp->mmp_nodename));
+ ext4_msg(sb, KERN_INFO, "Started kmmp thread with update interval = %u\n",
+ mmp_update_interval);
+
while (!kthread_should_stop() && !sb_rdonly(sb)) {
if (!ext4_has_feature_mmp(sb)) {
ext4_warning(sb, "kmmpd being stopped since MMP feature"
--
2.32.0
