Re: [syzbot] [erofs?] [fat?] WARNING in erofs_kill_sb

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 





On 2023/7/31 20:43, Christian Brauner wrote:
On Mon, Jul 31, 2023 at 01:16:22PM +0200, Christoph Hellwig wrote:
On Mon, Jul 31, 2023 at 06:58:14PM +0800, Gao Xiang wrote:
Previously, deactivate_locked_super() or .kill_sb() will only be
called after fill_super is called, and .s_magic will be set at
the very beginning of erofs_fc_fill_super().

After ("fs: open block device after superblock creation"), such
convension is changed now.  Yet at a quick glance,

WARN_ON(sb->s_magic != EROFS_SUPER_MAGIC);

in erofs_kill_sb() can be removed since deactivate_locked_super()
will also be called if setup_bdev_super() is falled.  I'd suggest
that removing this WARN_ON() in the related commit, or as
a following commit of the related branch of the pull request if
possible.

Agreed.  I wonder if we should really call into ->kill_sb before
calling into fill_super, but I need to carefull look into the
details.

I think checking for s_magic in erofs kill sb is wrong as it introduces
a dependency on both fill_super() having been called and that s_magic is
initialized first. If someone reorders erofs_kill_sb() such that s_magic
is only filled in once everything else succeeded it would cause the same
bug. That doesn't sound nice to me.

Many many years ago, strange .kill_sb called on our smartphone products
without proper call chain.  That was why it was added and s_magic was
initialized first and at least it reminds a slight behavior change for
us (this time).

Anyway, I also think it's almost useless upstream so I'm fine to drop
this WARN_ON().

Thanks,
Gao Xiang


I think ->fill_super() should only be called after successfull
superblock allocation and after the device has been successfully opened.
Just as this code does now. So ->kill_sb() should only be called after
we're guaranteed that ->fill_super() has been called.

We already mostly express that logic through the fs_context object.
Anything that's allocated in fs_context->init_fs_context() is freed in
fs_context->free() before fill_super() is called. After ->fill_super()
is called fs_context->s_fs_info will have been transferred to
sb->s_fs_info and will have to be killed via ->kill_sb().

Does that make sense?



[Index of Archives]     [Linux Ext4 Filesystem]     [Union Filesystem]     [Filesystem Testing]     [Ceph Users]     [Ecryptfs]     [NTFS 3]     [AutoFS]     [Kernel Newbies]     [Share Photos]     [Security]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux Cachefs]     [Reiser Filesystem]     [Linux RAID]     [NTFS 3]     [Samba]     [Device Mapper]     [CEPH Development]

  Powered by Linux