This is a note to let you know that I've just added the patch titled btrfs: validate device maj:min during open to the 6.8-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: btrfs-validate-device-maj-min-during-open.patch and it can be found in the queue-6.8 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 9f7eb8405dcbc79c5434821e9e3e92abe187ee8e Mon Sep 17 00:00:00 2001 From: Anand Jain <anand.jain@xxxxxxxxxx> Date: Fri, 1 Mar 2024 08:42:13 +0800 Subject: btrfs: validate device maj:min during open From: Anand Jain <anand.jain@xxxxxxxxxx> commit 9f7eb8405dcbc79c5434821e9e3e92abe187ee8e upstream. Boris managed to create a device capable of changing its maj:min without altering its device path. Only multi-devices can be scanned. A device that gets scanned and remains in the btrfs kernel cache might end up with an incorrect maj:min. Despite the temp-fsid feature patch did not introduce this bug, it could lead to issues if the above multi-device is converted to a single device with a stale maj:min. Subsequently, attempting to mount the same device with the correct maj:min might mistake it for another device with the same fsid, potentially resulting in wrongly auto-enabling the temp-fsid feature. To address this, this patch validates the device's maj:min at the time of device open and updates it if it has changed since the last scan. CC: stable@xxxxxxxxxxxxxxx # 6.7+ Fixes: a5b8a5f9f835 ("btrfs: support cloned-device mount capability") Reported-by: Boris Burkov <boris@xxxxxx> Co-developed-by: Boris Burkov <boris@xxxxxx> Reviewed-by: Boris Burkov <boris@xxxxxx># Signed-off-by: Anand Jain <anand.jain@xxxxxxxxxx> Reviewed-by: David Sterba <dsterba@xxxxxxxx> Signed-off-by: David Sterba <dsterba@xxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/btrfs/volumes.c | 10 ++++++++++ 1 file changed, 10 insertions(+) --- a/fs/btrfs/volumes.c +++ b/fs/btrfs/volumes.c @@ -694,6 +694,16 @@ static int btrfs_open_one_device(struct device->bdev = bdev_handle->bdev; clear_bit(BTRFS_DEV_STATE_IN_FS_METADATA, &device->dev_state); + if (device->devt != device->bdev->bd_dev) { + btrfs_warn(NULL, + "device %s maj:min changed from %d:%d to %d:%d", + device->name->str, MAJOR(device->devt), + MINOR(device->devt), MAJOR(device->bdev->bd_dev), + MINOR(device->bdev->bd_dev)); + + device->devt = device->bdev->bd_dev; + } + fs_devices->open_devices++; if (test_bit(BTRFS_DEV_STATE_WRITEABLE, &device->dev_state) && device->devid != BTRFS_DEV_REPLACE_DEVID) { Patches currently in stable-queue which might be from anand.jain@xxxxxxxxxx are queue-6.8/btrfs-add-helpers-to-get-fs_info-from-page-folio-poi.patch queue-6.8/btrfs-add-helper-to-get-fs_info-from-struct-inode-po.patch queue-6.8/btrfs-validate-device-maj-min-during-open.patch queue-6.8/btrfs-add-helpers-to-get-inode-from-page-folio-point.patch queue-6.8/btrfs-replace-sb-s_blocksize-by-fs_info-sectorsize.patch queue-6.8/btrfs-do-not-skip-re-registration-for-the-mounted-device.patch queue-6.8/btrfs-fix-warning-messages-not-printing-interval-at-.patch