[Backport] ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()

INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 2 PID: 71092 Comm: mount Not tainted 5.10.0-10226-g7cdc83ff6fdc #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:82 [inline]
 dump_stack+0x107/0x167 lib/dump_stack.c:123
 assign_lock_key kernel/locking/lockdep.c:936 [inline]
 register_lock_class+0x11c6/0x13c0 kernel/locking/lockdep.c:1249
 __lock_acquire+0x90/0x1070 kernel/locking/lockdep.c:4833
 lock_acquire+0x197/0x470 kernel/locking/lockdep.c:5565
 __raw_spin_trylock include/linux/spinlock_api_smp.h:90 [inline]
 _raw_spin_trylock+0x45/0x60 kernel/locking/spinlock.c:140
 ___ratelimit+0x224/0x440 lib/ratelimit.c:47
 __ext4_msg+0x111/0x1a0 fs/ext4/super.c:969
 ext4_fill_super+0x81cf/0xa9f0 fs/ext4/super.c:5135
 mount_bdev+0x357/0x420 fs/super.c:1435
 legacy_get_tree+0x108/0x230 fs/fs_context.c:611
 vfs_get_tree+0x90/0x300 fs/super.c:1565
 do_new_mount+0x275/0x300 fs/namespace.c:2915
 path_mount+0x4a7/0x710 fs/namespace.c:3245
 do_mount fs/namespace.c:3258 [inline]
 __do_sys_mount fs/namespace.c:3469 [inline]
 __se_sys_mount+0x330/0x3e0 fs/namespace.c:3443
 do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x62/0xc7
RIP: 0033:0x7f5ebd7472be
Code: 48 8b 0d cd 5b 38 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 9a 5b 38 00 f7 d8 64 89 01 48
RSP: 002b:00007fff694f7508 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 000055eb4a5ff9c0 RCX: 00007f5ebd7472be
RDX: 000055eb4a608230 RSI: 000055eb4a5ffbc0 RDI: 000055eb4a5ffbe0
RBP: 00007f5ebe5b9184 R08: 000055eb4a5ffc40 R09: 0000000000000002
R10: 00000000c0ed0000 R11: 0000000000000246 R12: 0000000000000000
R13: 00000000c0ed0000 R14: 000055eb4a5ffbe0 R15: 000055eb4a608230
ext4 filesystem being mounted at /mnt/test supports timestamps until 2038 (0x7fffffff)

正常情况下 interval 一直 0 直到 s_msg_ratelimit_state 被初始化，因此 ___ratelimit() 什么都不会做。但是注册 sysfs 比 初始化 rs->lock 更早，因此可以在 rs->lock 未被初始化时通过 sysfs 的 msg_ratelimit_interval_ms 接口将 rs->interval 修改为非零值，此时调用 ext4_msg 就会因为访问未初始化的 rs->lock 而触发该问题。并发时序如下：
```
ext4_fill_super
  ext4_register_sysfs
   // sysfs registered msg_ratelimit_interval_ms
                             // Other processes modify rs->interval to
                             // non-zero via msg_ratelimit_interval_ms
  ext4_orphan_cleanup
    ext4_msg(sb, KERN_INFO, "Errors on filesystem, "
      __ext4_msg
        ___ratelimit(&(EXT4_SB(sb)->s_msg_ratelimit_state)
          if (!rs->interval)  // do nothing if interval is 0
            return 1;
          raw_spin_trylock_irqsave(&rs->lock, flags)
            raw_spin_trylock(lock)
              _raw_spin_trylock
                __raw_spin_trylock
                  spin_acquire(&lock->dep_map, 0, 1, _RET_IP_)
                    lock_acquire
                      __lock_acquire
                        register_lock_class
                          assign_lock_key
                            dump_stack();
  ratelimit_state_init(&sbi->s_msg_ratelimit_state, 5 * HZ, 10);
    raw_spin_lock_init(&rs->lock);
    // init rs->lock here
```

GVP openEuler/kernel

内容风险标识

评论 (3)

GVPopenEuler/kernel

内容风险标识