• Theodore Ts'o's avatar
    ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled · a44be64b
    Theodore Ts'o authored
    When a file system currently mounted read/only is remounted
    read/write, if we clear the SB_RDONLY flag too early, before the quota
    is initialized, and there is another process/thread constantly
    attempting to create a directory, it's possible to trigger the
    
    	WARN_ON_ONCE(dquot_initialize_needed(inode));
    
    in ext4_xattr_block_set(), with the following stack trace:
    
       WARNING: CPU: 0 PID: 5338 at fs/ext4/xattr.c:2141 ext4_xattr_block_set+0x2ef2/0x3680
       RIP: 0010:ext4_xattr_block_set+0x2ef2/0x3680 fs/ext4/xattr.c:2141
       Call Trace:
        ext4_xattr_set_handle+0xcd4/0x15c0 fs/ext4/xattr.c:2458
        ext4_initxattrs+0xa3/0x110 fs/ext4/xattr_security.c:44
        security_inode_init_security+0x2df/0x3f0 security/security.c:1147
        __ext4_new_inode+0x347e/0x43d0 fs/ext4/ialloc.c:1324
        ext4_mkdir+0x425/0xce0 fs/ext4/namei.c:2992
        vfs_mkdir+0x29d/0x450 fs/namei.c:4038
        do_mkdirat+0x264/0x520 fs/namei.c:4061
        __do_sys_mkdirat fs/namei.c:4076 [inline]
        __se_sys_mkdirat fs/namei.c:4074 [inline]
        __x64_sys_mkdirat+0x89/0xa0 fs/namei.c:4074
    
    Cc: stable@kernel.org
    Link: https://lore.kernel.org/r/20230506142419.984260-1-tytso@mit.edu
    Reported-by: syzbot+6385d7d3065524c5ca6d@syzkaller.appspotmail.com
    Link: https://syzkaller.appspot.com/bug?id=6513f6cb5cd6b5fc9f37e3bb70d273b94be9c34cSigned-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
    a44be64b
super.c 203 KB