Linux kernel stable tree (mirror) https://git.radix-linux.su/kernel/linux.git/atom?h=v4.9.331 2021-10-09T11:25:59+00:00 2021-10-09T11:25:59+00:00 Dan Carpenter dan.carpenter@oracle.com 2021-09-21T20:32:33+00:00 urn:sha1:aae02f819c3a9c66ce01648d68050481c9ce5877 [ Upstream commit 372d1f3e1bfede719864d0d1fbf3146b1e638c88 ] The ext2_error() function syncs the filesystem so it sleeps. The caller is holding a spinlock so it's not allowed to sleep. ext2_statfs() <- disables preempt -> ext2_count_free_blocks() -> ext2_get_group_desc() Fix this by using WARN() to print an error message and a stack trace instead of using ext2_error(). Link: https://lore.kernel.org/r/20210921203233.GA16529@kili Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org> 2016-07-06T02:02:41+00:00 Carlos Maiolino cmaiolino@redhat.com 2016-07-06T02:02:41+00:00 urn:sha1:ff0031d848a0cd7002606f9feef958de8d5edf19 This bug can be reproducible with fsfuzzer, although, I couldn't reproduce it 100% of my tries, it is quite easily reproducible. During the deletion of an inode, ext2_xattr_delete_inode() does not check if the block pointed by EXT2_I(inode)->i_file_acl is a valid data block, this might lead to a deadlock, when i_file_acl == 1, and the filesystem block size is 1024. In that situation, ext2_xattr_delete_inode, will load the superblock's buffer head (instead of a valid i_file_acl block), and then lock that buffer head, which, ext2_sync_super will also try to lock, making the filesystem deadlock in the following stack trace: root 17180 0.0 0.0 113660 660 pts/0 D+ 07:08 0:00 rmdir /media/test/dir1 [<ffffffff8125da9f>] __sync_dirty_buffer+0xaf/0x100 [<ffffffff8125db03>] sync_dirty_buffer+0x13/0x20 [<ffffffffa03f0d57>] ext2_sync_super+0xb7/0xc0 [ext2] [<ffffffffa03f10b9>] ext2_error+0x119/0x130 [ext2] [<ffffffffa03e9d93>] ext2_free_blocks+0x83/0x350 [ext2] [<ffffffffa03f3d03>] ext2_xattr_delete_inode+0x173/0x190 [ext2] [<ffffffffa03ee9e9>] ext2_evict_inode+0xc9/0x130 [ext2] [<ffffffff8123fd23>] evict+0xb3/0x180 [<ffffffff81240008>] iput+0x1b8/0x240 [<ffffffff8123c4ac>] d_delete+0x11c/0x150 [<ffffffff8122fa7e>] vfs_rmdir+0xfe/0x120 [<ffffffff812340ee>] do_rmdir+0x17e/0x1f0 [<ffffffff81234dd6>] SyS_rmdir+0x16/0x20 [<ffffffff81838cf2>] entry_SYSCALL_64_fastpath+0x1a/0xa4 [<ffffffffffffffff>] 0xffffffffffffffff Fix this by using the same approach ext4 uses to test data blocks validity, implementing ext2_data_block_valid. An another possibility when the superblock is very corrupted, is that i_file_acl is 1, block_count is 1 and first_data_block is 0. For such situations, we might have i_file_acl pointing to a 'valid' block, but still step over the superblock. The approach I used was to also test if the superblock is not in the range described by ext2_data_block_valid() arguments Signed-off-by: Carlos Maiolino <cmaiolino@redhat.com> Signed-off-by: Theodore Ts'o <tytso@mit.edu> 2013-02-07T15:44:56+00:00 Wang Shilong wangsl-fnst@cn.fujitsu.com 2013-02-07T14:57:54+00:00 urn:sha1:712ddc52ffa1f5324cd8f682d9e5b047b91f34d3 Because the static function 'release_blocks' is only called when releasing blocks,it will be more simple and efficient to call the function 'percpu_counter_add' directly. Signed-off-by: Wang Shilong <wangsl-fnst@cn.fujitsu.com> Signed-off-by: Jan Kara <jack@suse.cz> 2013-02-07T15:44:55+00:00 Wang Shilong wangsl-fnst@cn.fujitsu.com 2013-02-07T14:57:53+00:00 urn:sha1:8e3dffc651cb668e1ff4d8b89cc1c3dde7540d3b We should mark inode dirty after the function dquot_free_block_nodirty is called.Besides,add a check whether it is necessary to call dquot_free_block_nodirty functon. Signed-off-by: Wang Shilong <wangsl-fnst@cn.fujitsu.com> Signed-off-by: Jan Kara <jack@suse.cz> 2013-02-06T12:47:02+00:00 Wang Shilong wangsl-fnst@cn.fujitsu.com 2013-02-06T06:14:26+00:00 urn:sha1:98783e453c1084527388ec1a7f6367cd6aabbe63 It can be guranteed that inode->i_sb should not be null in vfs. So here the check about it is overhead. Signed-off-by: Wang Shilong <wangsl-fnst@cn.fujitsu.com> Signed-off-by: Jan Kara <jack@suse.cz> 2012-10-01T16:06:36+00:00 Linus Torvalds torvalds@linux-foundation.org 2012-10-01T16:06:36+00:00 urn:sha1:99dbb1632f1165c2726056ebfce6edde0e5a0208 Pull the trivial tree from Jiri Kosina: "Tiny usual fixes all over the place" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial: (34 commits) doc: fix old config name of kprobetrace fs/fs-writeback.c: cleanup riteback_sb_inodes kerneldoc btrfs: fix the commment for the action flags in delayed-ref.h btrfs: fix trivial typo for the comment of BTRFS_FREE_INO_OBJECTID vfs: fix kerneldoc for generic_fh_to_parent() treewide: fix comment/printk/variable typos ipr: fix small coding style issues doc: fix broken utf8 encoding nfs: comment fix platform/x86: fix asus_laptop.wled_type module parameter mfd: printk/comment fixes doc: getdelays.c: remember to close() socket on error in create_nl_socket() doc: aliasing-test: close fd on write error mmc: fix comment typos dma: fix comments spi: fix comment/printk typos in spi Coccinelle: fix typo in memdup_user.cocci tmiofb: missing NULL pointer checks tools: perf: Fix typo in tools/perf tools/testing: fix comment / output typos ... 2012-09-01T17:33:05+00:00 Anatol Pomozov anatol.pomozov@gmail.com 2012-09-01T17:31:09+00:00 urn:sha1:4907cb7b193a4f91c1fd30cf679c035e3644c64d Signed-off-by: Anatol Pomozov <anatol.pomozov@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> 2012-07-31T00:25:16+00:00 Akinobu Mita akinobu.mita@gmail.com 2012-07-30T21:41:05+00:00 urn:sha1:ecd0afa3ced0ebf36901b53fd9ee431f8a34a161 Convert ext2_count_free() to use memweight() instead of table lookup based counting clear bits implementation. This change only affects the code segments enabled by EXT2FS_DEBUG. Note that this memweight() call can't be replaced with a single bitmap_weight() call, although the pointer to the memory area is aligned to long-word boundary. Because the size of the memory area may not be a multiple of BITS_PER_LONG, then it returns wrong value on big-endian architecture. This also includes the following changes. - Remove unnecessary map == NULL check in ext2_count_free() which always takes non-null pointer as the memory area. - Fix printk format warning that only reveals with EXT2FS_DEBUG. Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com> Acked-by: Jan Kara <jack@suse.cz> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 2012-05-25T15:14:59+00:00 Linus Torvalds torvalds@linux-foundation.org 2012-05-25T15:14:59+00:00 urn:sha1:ece78b7df734726e790dcab207f463401ff80440 Pull ext2, ext3 and quota fixes from Jan Kara: "Interesting bits are: - removal of a special i_mutex locking subclass (I_MUTEX_QUOTA) since quota code does not need i_mutex anymore in any unusual way. - backport (from ext4) of a fix of a checkpointing bug (missing cache flush) that could lead to fs corruption on power failure The rest are just random small fixes & cleanups." * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: ext2: trivial fix to comment for ext2_free_blocks ext2: remove the redundant comment for ext2_export_ops ext3: return 32/64-bit dir name hash according to usage type quota: Get rid of nested I_MUTEX_QUOTA locking subclass quota: Use precomputed value of sb_dqopt in dquot_quota_sync ext2: Remove i_mutex use from ext2_quota_write() reiserfs: Remove i_mutex use from reiserfs_quota_write() ext4: Remove i_mutex use from ext4_quota_write() ext3: Remove i_mutex use from ext3_quota_write() quota: Fix double lock in add_dquot_ref() with CONFIG_QUOTA_DEBUG jbd: Write journal superblock with WRITE_FUA after checkpointing jbd: protect all log tail updates with j_checkpoint_mutex jbd: Split updating of journal superblock and marking journal empty ext2: do not register write_super within VFS ext2: Remove s_dirt handling ext2: write superblock only once on unmount ext3: update documentation with barrier=1 default ext3: remove max_debt in find_group_orlov() jbd: Refine commit writeout logic 2012-05-18T13:23:08+00:00 Wang Sheng-Hui shhuiw@gmail.com 2012-05-18T07:04:45+00:00 urn:sha1:0324876628a9c7faf8127e20af29373dc6dec876 The function is ext2_free_blocks(), not ext2_free_blocks_sb(). Signed-off-by: Wang Sheng-Hui <shhuiw@gmail.com> Signed-off-by: Jan Kara <jack@suse.cz>