Skip to content

Commit c4d36b6

Browse files
torvaldstorvalds
committed
Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4
Pull ext4 fixes from Ted Ts'o: "Some bug fixes, and an update to the URL's for the final version of Unicode 12.1.0" * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: avoid panic during forced reboot due to aborted journal ext4: fix block validity checks for journal inodes using indirect blocks unicode: update to Unicode 12.1.0 final unicode: add missing check for an error return from utf8lookup() ext4: fix miscellaneous sparse warnings ext4: unsigned int compared against zero ext4: fix use-after-free in dx_release() ext4: fix data corruption caused by overlapping unaligned and aligned IO jbd2: fix potential double free ext4: zero out the unused memory region in the extent tree block
2 parents d8848ee + 2c1d0e3 commit c4d36b6

File tree

13 files changed

+107
-65
lines changed

13 files changed

+107
-65
lines changed

‎fs/ext4/block_validity.c‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,8 @@ static int ext4_protect_reserved_inode(struct super_block *sb, u32 ino)
142142
struct inode *inode;
143143
struct ext4_sb_info *sbi = EXT4_SB(sb);
144144
struct ext4_map_blocks map;
145-
u32 i = 0, err = 0, num, n;
145+
u32 i = 0, num;
146+
int err = 0, n;
146147

147148
if ((ino < EXT4_ROOT_INO) ||
148149
(ino > le32_to_cpu(sbi->s_es->s_inodes_count)))
@@ -276,6 +277,11 @@ int ext4_check_blockref(const char *function, unsigned int line,
276277
__le32 *bref = p;
277278
unsigned int blk;
278279

280+
if (ext4_has_feature_journal(inode->i_sb) &&
281+
(inode->i_ino ==
282+
le32_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_journal_inum)))
283+
return 0;
284+
279285
while (bref < p+max) {
280286
blk = le32_to_cpu(*bref++);
281287
if (blk &&

‎fs/ext4/extents.c‎

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1035,6 +1035,7 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
10351035
__le32 border;
10361036
ext4_fsblk_t *ablocks = NULL; /* array of allocated blocks */
10371037
int err = 0;
1038+
size_t ext_size = 0;
10381039

10391040
/* make decision: where to split? */
10401041
/* FIXME: now decision is simplest: at current extent */
@@ -1126,6 +1127,10 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
11261127
le16_add_cpu(&neh->eh_entries, m);
11271128
}
11281129

1130+
/* zero out unused area in the extent block */
1131+
ext_size = sizeof(struct ext4_extent_header) +
1132+
sizeof(struct ext4_extent) * le16_to_cpu(neh->eh_entries);
1133+
memset(bh->b_data + ext_size, 0, inode->i_sb->s_blocksize - ext_size);
11291134
ext4_extent_block_csum_set(inode, neh);
11301135
set_buffer_uptodate(bh);
11311136
unlock_buffer(bh);
@@ -1205,6 +1210,11 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
12051210
sizeof(struct ext4_extent_idx) * m);
12061211
le16_add_cpu(&neh->eh_entries, m);
12071212
}
1213+
/* zero out unused area in the extent block */
1214+
ext_size = sizeof(struct ext4_extent_header) +
1215+
(sizeof(struct ext4_extent) * le16_to_cpu(neh->eh_entries));
1216+
memset(bh->b_data + ext_size, 0,
1217+
inode->i_sb->s_blocksize - ext_size);
12081218
ext4_extent_block_csum_set(inode, neh);
12091219
set_buffer_uptodate(bh);
12101220
unlock_buffer(bh);
@@ -1270,6 +1280,7 @@ static int ext4_ext_grow_indepth(handle_t *handle, struct inode *inode,
12701280
ext4_fsblk_t newblock, goal = 0;
12711281
struct ext4_super_block *es = EXT4_SB(inode->i_sb)->s_es;
12721282
int err = 0;
1283+
size_t ext_size = 0;
12731284

12741285
/* Try to prepend new index to old one */
12751286
if (ext_depth(inode))
@@ -1295,9 +1306,11 @@ static int ext4_ext_grow_indepth(handle_t *handle, struct inode *inode,
12951306
goto out;
12961307
}
12971308

1309+
ext_size = sizeof(EXT4_I(inode)->i_data);
12981310
/* move top-level index/leaf into new block */
1299-
memmove(bh->b_data, EXT4_I(inode)->i_data,
1300-
sizeof(EXT4_I(inode)->i_data));
1311+
memmove(bh->b_data, EXT4_I(inode)->i_data, ext_size);
1312+
/* zero out unused area in the extent block */
1313+
memset(bh->b_data + ext_size, 0, inode->i_sb->s_blocksize - ext_size);
13011314

13021315
/* set size of new block */
13031316
neh = ext_block_hdr(bh);

‎fs/ext4/file.c‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -264,6 +264,13 @@ ext4_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
264264
}
265265

266266
ret = __generic_file_write_iter(iocb, from);
267+
/*
268+
* Unaligned direct AIO must be the only IO in flight. Otherwise
269+
* overlapping aligned IO after unaligned might result in data
270+
* corruption.
271+
*/
272+
if (ret == -EIOCBQUEUED && unaligned_aio)
273+
ext4_unwritten_wait(inode);
267274
inode_unlock(inode);
268275

269276
if (ret > 0)

‎fs/ext4/fsmap.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -626,7 +626,7 @@ int ext4_getfsmap(struct super_block *sb, struct ext4_fsmap_head *head,
626626
{
627627
struct ext4_fsmap dkeys[2]; /* per-dev keys */
628628
struct ext4_getfsmap_dev handlers[EXT4_GETFSMAP_DEVS];
629-
struct ext4_getfsmap_info info = {0};
629+
struct ext4_getfsmap_info info = { NULL };
630630
int i;
631631
int error = 0;
632632

‎fs/ext4/ioctl.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -608,7 +608,7 @@ static int ext4_getfsmap_format(struct ext4_fsmap *xfm, void *priv)
608608
static int ext4_ioc_getfsmap(struct super_block *sb,
609609
struct fsmap_head __user *arg)
610610
{
611-
struct getfsmap_info info = {0};
611+
struct getfsmap_info info = { NULL };
612612
struct ext4_fsmap_head xhead = {0};
613613
struct fsmap_head head;
614614
bool aborted = false;

‎fs/ext4/namei.c‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -872,12 +872,15 @@ static void dx_release(struct dx_frame *frames)
872872
{
873873
struct dx_root_info *info;
874874
int i;
875+
unsigned int indirect_levels;
875876

876877
if (frames[0].bh == NULL)
877878
return;
878879

879880
info = &((struct dx_root *)frames[0].bh->b_data)->info;
880-
for (i = 0; i <= info->indirect_levels; i++) {
881+
/* save local copy, "info" may be freed after brelse() */
882+
indirect_levels = info->indirect_levels;
883+
for (i = 0; i <= indirect_levels; i++) {
881884
if (frames[i].bh == NULL)
882885
break;
883886
brelse(frames[i].bh);

‎fs/ext4/super.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -699,7 +699,7 @@ void __ext4_abort(struct super_block *sb, const char *function,
699699
jbd2_journal_abort(EXT4_SB(sb)->s_journal, -EIO);
700700
save_error_info(sb, function, line);
701701
}
702-
if (test_opt(sb, ERRORS_PANIC)) {
702+
if (test_opt(sb, ERRORS_PANIC) && !system_going_down()) {
703703
if (EXT4_SB(sb)->s_journal &&
704704
!(EXT4_SB(sb)->s_journal->j_flags & JBD2_REC_ERR))
705705
return;
@@ -4661,7 +4661,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
46614661

46624662
#ifdef CONFIG_QUOTA
46634663
for (i = 0; i < EXT4_MAXQUOTAS; i++)
4664-
kfree(sbi->s_qf_names[i]);
4664+
kfree(get_qf_name(sb, sbi, i));
46654665
#endif
46664666
ext4_blkdev_remove(sbi);
46674667
brelse(bh);

‎fs/jbd2/journal.c‎

Lines changed: 31 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -2375,22 +2375,19 @@ static struct kmem_cache *jbd2_journal_head_cache;
23752375
static atomic_t nr_journal_heads = ATOMIC_INIT(0);
23762376
#endif
23772377

2378-
static int jbd2_journal_init_journal_head_cache(void)
2378+
static int __init jbd2_journal_init_journal_head_cache(void)
23792379
{
2380-
int retval;
2381-
2382-
J_ASSERT(jbd2_journal_head_cache == NULL);
2380+
J_ASSERT(!jbd2_journal_head_cache);
23832381
jbd2_journal_head_cache = kmem_cache_create("jbd2_journal_head",
23842382
sizeof(struct journal_head),
23852383
0, /* offset */
23862384
SLAB_TEMPORARY | SLAB_TYPESAFE_BY_RCU,
23872385
NULL); /* ctor */
2388-
retval = 0;
23892386
if (!jbd2_journal_head_cache) {
2390-
retval = -ENOMEM;
23912387
printk(KERN_EMERG "JBD2: no memory for journal_head cache\n");
2388+
return -ENOMEM;
23922389
}
2393-
return retval;
2390+
return 0;
23942391
}
23952392

23962393
static void jbd2_journal_destroy_journal_head_cache(void)
@@ -2636,28 +2633,38 @@ static void __exit jbd2_remove_jbd_stats_proc_entry(void)
26362633

26372634
struct kmem_cache *jbd2_handle_cache, *jbd2_inode_cache;
26382635

2636+
static int __init jbd2_journal_init_inode_cache(void)
2637+
{
2638+
J_ASSERT(!jbd2_inode_cache);
2639+
jbd2_inode_cache = KMEM_CACHE(jbd2_inode, 0);
2640+
if (!jbd2_inode_cache) {
2641+
pr_emerg("JBD2: failed to create inode cache\n");
2642+
return -ENOMEM;
2643+
}
2644+
return 0;
2645+
}
2646+
26392647
static int __init jbd2_journal_init_handle_cache(void)
26402648
{
2649+
J_ASSERT(!jbd2_handle_cache);
26412650
jbd2_handle_cache = KMEM_CACHE(jbd2_journal_handle, SLAB_TEMPORARY);
2642-
if (jbd2_handle_cache == NULL) {
2651+
if (!jbd2_handle_cache) {
26432652
printk(KERN_EMERG "JBD2: failed to create handle cache\n");
26442653
return -ENOMEM;
26452654
}
2646-
jbd2_inode_cache = KMEM_CACHE(jbd2_inode, 0);
2647-
if (jbd2_inode_cache == NULL) {
2648-
printk(KERN_EMERG "JBD2: failed to create inode cache\n");
2649-
kmem_cache_destroy(jbd2_handle_cache);
2650-
return -ENOMEM;
2651-
}
26522655
return 0;
26532656
}
26542657

2658+
static void jbd2_journal_destroy_inode_cache(void)
2659+
{
2660+
kmem_cache_destroy(jbd2_inode_cache);
2661+
jbd2_inode_cache = NULL;
2662+
}
2663+
26552664
static void jbd2_journal_destroy_handle_cache(void)
26562665
{
26572666
kmem_cache_destroy(jbd2_handle_cache);
26582667
jbd2_handle_cache = NULL;
2659-
kmem_cache_destroy(jbd2_inode_cache);
2660-
jbd2_inode_cache = NULL;
26612668
}
26622669

26632670
/*
@@ -2668,21 +2675,27 @@ static int __init journal_init_caches(void)
26682675
{
26692676
int ret;
26702677

2671-
ret = jbd2_journal_init_revoke_caches();
2678+
ret = jbd2_journal_init_revoke_record_cache();
2679+
if (ret == 0)
2680+
ret = jbd2_journal_init_revoke_table_cache();
26722681
if (ret == 0)
26732682
ret = jbd2_journal_init_journal_head_cache();
26742683
if (ret == 0)
26752684
ret = jbd2_journal_init_handle_cache();
2685+
if (ret == 0)
2686+
ret = jbd2_journal_init_inode_cache();
26762687
if (ret == 0)
26772688
ret = jbd2_journal_init_transaction_cache();
26782689
return ret;
26792690
}
26802691

26812692
static void jbd2_journal_destroy_caches(void)
26822693
{
2683-
jbd2_journal_destroy_revoke_caches();
2694+
jbd2_journal_destroy_revoke_record_cache();
2695+
jbd2_journal_destroy_revoke_table_cache();
26842696
jbd2_journal_destroy_journal_head_cache();
26852697
jbd2_journal_destroy_handle_cache();
2698+
jbd2_journal_destroy_inode_cache();
26862699
jbd2_journal_destroy_transaction_cache();
26872700
jbd2_journal_destroy_slabs();
26882701
}

‎fs/jbd2/revoke.c‎

Lines changed: 20 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -178,33 +178,41 @@ static struct jbd2_revoke_record_s *find_revoke_record(journal_t *journal,
178178
return NULL;
179179
}
180180

181-
void jbd2_journal_destroy_revoke_caches(void)
181+
void jbd2_journal_destroy_revoke_record_cache(void)
182182
{
183183
kmem_cache_destroy(jbd2_revoke_record_cache);
184184
jbd2_revoke_record_cache = NULL;
185+
}
186+
187+
void jbd2_journal_destroy_revoke_table_cache(void)
188+
{
185189
kmem_cache_destroy(jbd2_revoke_table_cache);
186190
jbd2_revoke_table_cache = NULL;
187191
}
188192

189-
int __init jbd2_journal_init_revoke_caches(void)
193+
int __init jbd2_journal_init_revoke_record_cache(void)
190194
{
191195
J_ASSERT(!jbd2_revoke_record_cache);
192-
J_ASSERT(!jbd2_revoke_table_cache);
193-
194196
jbd2_revoke_record_cache = KMEM_CACHE(jbd2_revoke_record_s,
195197
SLAB_HWCACHE_ALIGN|SLAB_TEMPORARY);
196-
if (!jbd2_revoke_record_cache)
197-
goto record_cache_failure;
198198

199+
if (!jbd2_revoke_record_cache) {
200+
pr_emerg("JBD2: failed to create revoke_record cache\n");
201+
return -ENOMEM;
202+
}
203+
return 0;
204+
}
205+
206+
int __init jbd2_journal_init_revoke_table_cache(void)
207+
{
208+
J_ASSERT(!jbd2_revoke_table_cache);
199209
jbd2_revoke_table_cache = KMEM_CACHE(jbd2_revoke_table_s,
200210
SLAB_TEMPORARY);
201-
if (!jbd2_revoke_table_cache)
202-
goto table_cache_failure;
203-
return 0;
204-
table_cache_failure:
205-
jbd2_journal_destroy_revoke_caches();
206-
record_cache_failure:
211+
if (!jbd2_revoke_table_cache) {
212+
pr_emerg("JBD2: failed to create revoke_table cache\n");
207213
return -ENOMEM;
214+
}
215+
return 0;
208216
}
209217

210218
static struct jbd2_revoke_table_s *jbd2_journal_init_revoke_table(int hash_size)

‎fs/jbd2/transaction.c‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,9 +42,11 @@ int __init jbd2_journal_init_transaction_cache(void)
4242
0,
4343
SLAB_HWCACHE_ALIGN|SLAB_TEMPORARY,
4444
NULL);
45-
if (transaction_cache)
46-
return 0;
47-
return -ENOMEM;
45+
if (!transaction_cache) {
46+
pr_emerg("JBD2: failed to create transaction cache\n");
47+
return -ENOMEM;
48+
}
49+
return 0;
4850
}
4951

5052
void jbd2_journal_destroy_transaction_cache(void)

0 commit comments

Comments
 (0)