btrfs: fix assertion of exclop condition when starting balance

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix assertion of exclop condition when starting balance

Balance as exclusive state is compatible with paused balance and device

add, which makes some things more complicated. The assertion of valid

states when starting from paused balance needs to take into account two

more states, the combinations can be hit when there are several threads

racing to start balance and device add. This won't typically happen when

the commands are started from command line.

Scenario 1: With exclusive_operation state == BTRFS_EXCLOP_NONE.

Concurrently adding multiple devices to the same mount point and

btrfs_exclop_finish executed finishes before assertion in

btrfs_exclop_balance, exclusive_operation will changed to

BTRFS_EXCLOP_NONE state which lead to assertion failed:

fs_info->exclusive_operation == BTRFS_EXCLOP_BALANCE ||

fs_info->exclusive_operation == BTRFS_EXCLOP_DEV_ADD,

in fs/btrfs/ioctl.c:456

Call Trace:

<TASK>

btrfs_exclop_balance+0x13c/0x310

? memdup_user+0xab/0xc0

? PTR_ERR+0x17/0x20

btrfs_ioctl_add_dev+0x2ee/0x320

btrfs_ioctl+0x9d5/0x10d0

? btrfs_ioctl_encoded_write+0xb80/0xb80

__x64_sys_ioctl+0x197/0x210

do_syscall_64+0x3c/0xb0

entry_SYSCALL_64_after_hwframe+0x63/0xcd

Scenario 2: With exclusive_operation state == BTRFS_EXCLOP_BALANCE_PAUSED.

Concurrently adding multiple devices to the same mount point and

btrfs_exclop_balance executed finish before the latter thread execute

assertion in btrfs_exclop_balance, exclusive_operation will changed to

BTRFS_EXCLOP_BALANCE_PAUSED state which lead to assertion failed:

fs_info->exclusive_operation == BTRFS_EXCLOP_BALANCE ||

fs_info->exclusive_operation == BTRFS_EXCLOP_DEV_ADD ||

fs_info->exclusive_operation == BTRFS_EXCLOP_NONE,

fs/btrfs/ioctl.c:458

Call Trace:

<TASK>

btrfs_exclop_balance+0x240/0x410

? memdup_user+0xab/0xc0

? PTR_ERR+0x17/0x20

btrfs_ioctl_add_dev+0x2ee/0x320

btrfs_ioctl+0x9d5/0x10d0

? btrfs_ioctl_encoded_write+0xb80/0xb80

__x64_sys_ioctl+0x197/0x210

do_syscall_64+0x3c/0xb0

entry_SYSCALL_64_after_hwframe+0x63/0xcd

An example of the failed assertion is below, which shows that the

paused balance is also needed to be checked.

root@syzkaller:/home/xsk# ./repro

Failed to add device /dev/vda, errno 14

Failed to add device /dev/vda, errno 14

Failed to add device /dev/vda, errno 14

Failed to add device /dev/vda, errno 14

Failed to add device /dev/vda, errno 14

Failed to add device /dev/vda, errno 14

Failed to add device /dev/vda, errno 14

Failed to add device /dev/vda, errno 14

Failed to add device /dev/vda, errno 14

[ 416.611428][ T7970] BTRFS info (device loop0): fs_info exclusive_operation: 0

Failed to add device /dev/vda, errno 14

[ 416.613973][ T7971] BTRFS info (device loop0): fs_info exclusive_operation: 3

Failed to add device /dev/vda, errno 14

[ 416.615456][ T7972] BTRFS info (device loop0): fs_info exclusive_operation: 3

Failed to add device /dev/vda, errno 14

[ 416.617528][ T7973] BTRFS info (device loop0): fs_info exclusive_operation: 3

Failed to add device /dev/vda, errno 14

[ 416.618359][ T7974] BTRFS info (device loop0): fs_info exclusive_operation: 3

Failed to add device /dev/vda, errno 14

[ 416.622589][ T7975] BTRFS info (device loop0): fs_info exclusive_operation: 3

Failed to add device /dev/vda, errno 14

[ 416.624034][ T7976] BTRFS info (device loop0): fs_info exclusive_operation: 3

Failed to add device /dev/vda, errno 14

[ 416.626420][ T7977] BTRFS info (device loop0): fs_info exclusive_operation: 3

Failed to add device /dev/vda, errno 14

[ 416.627643][ T7978] BTRFS info (device loop0): fs_info exclusive_operation: 3

Failed to add device /dev/vda, errno 14

[ 416.629006][ T7979] BTRFS info (device loop0): fs_info exclusive_operation: 3

[ 416.630298][ T7980] BTRFS info (device loop0): fs_info exclusive_operation: 3

Fai

---truncated---