Skip to content

Commit 5afe6ce

Browse files
fdmananakdave
authored andcommitted
Btrfs: always copy scrub arguments back to user space
If scrub returns an error we are not copying back the scrub arguments structure to user space. This prevents user space to know how much progress scrub has done if an error happened - this includes -ECANCELED which is returned when users ask for scrub to stop. A particular use case, which is used in btrfs-progs, is to resume scrub after it is canceled, in that case it relies on checking the progress from the scrub arguments structure and then use that progress in a call to resume scrub. So fix this by always copying the scrub arguments structure to user space, overwriting the value returned to user space with -EFAULT only if copying the structure failed to let user space know that either that copying did not happen, and therefore the structure is stale, or it happened partially and the structure is probably not valid and corrupt due to the partial copy. Reported-by: Graham Cobb <g.btrfs@cobb.uk.net> Link: https://lore.kernel.org/linux-btrfs/d0a97688-78be-08de-ca7d-bcb4c7fb397e@cobb.uk.net/ Fixes: 06fe39a ("Btrfs: do not overwrite scrub error with fault error in scrub ioctl") CC: stable@vger.kernel.org # 5.1+ Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com> Reviewed-by: Qu Wenruo <wqu@suse.com> Tested-by: Graham Cobb <g.btrfs@cobb.uk.net> Signed-off-by: Filipe Manana <fdmanana@suse.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>
1 parent 6282675 commit 5afe6ce

1 file changed

Lines changed: 13 additions & 1 deletion

File tree

fs/btrfs/ioctl.c

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4252,7 +4252,19 @@ static long btrfs_ioctl_scrub(struct file *file, void __user *arg)
42524252
&sa->progress, sa->flags & BTRFS_SCRUB_READONLY,
42534253
0);
42544254

4255-
if (ret == 0 && copy_to_user(arg, sa, sizeof(*sa)))
4255+
/*
4256+
* Copy scrub args to user space even if btrfs_scrub_dev() returned an
4257+
* error. This is important as it allows user space to know how much
4258+
* progress scrub has done. For example, if scrub is canceled we get
4259+
* -ECANCELED from btrfs_scrub_dev() and return that error back to user
4260+
* space. Later user space can inspect the progress from the structure
4261+
* btrfs_ioctl_scrub_args and resume scrub from where it left off
4262+
* previously (btrfs-progs does this).
4263+
* If we fail to copy the btrfs_ioctl_scrub_args structure to user space
4264+
* then return -EFAULT to signal the structure was not copied or it may
4265+
* be corrupt and unreliable due to a partial copy.
4266+
*/
4267+
if (copy_to_user(arg, sa, sizeof(*sa)))
42564268
ret = -EFAULT;
42574269

42584270
if (!(sa->flags & BTRFS_SCRUB_READONLY))

0 commit comments

Comments
 (0)