summaryrefslogtreecommitdiff
path: root/fs
diff options
context:
space:
mode:
authorZhang Yi <yi.zhang@huawei.com>2021-05-07 10:19:04 +0300
committerTheodore Ts'o <tytso@mit.edu>2021-06-17 17:53:19 +0300
commitb9a037b7f3c401d3c63e0423e56aef606b1ffaaf (patch)
treeb1280529a1506c7c80f61694582581708d9e3bfb /fs
parentce3aba43599f0b50adbebff133df8d08a3d5fffe (diff)
downloadlinux-b9a037b7f3c401d3c63e0423e56aef606b1ffaaf.tar.xz
ext4: cleanup in-core orphan list if ext4_truncate() failed to get a transaction handle
In ext4_orphan_cleanup(), if ext4_truncate() failed to get a transaction handle, it didn't remove the inode from the in-core orphan list, which may probably trigger below error dump in ext4_destroy_inode() during the final iput() and could lead to memory corruption on the later orphan list changes. EXT4-fs (sda): Inode 6291467 (00000000b8247c67): orphan list check failed! 00000000b8247c67: 0001f30a 00000004 00000000 00000023 ............#... 00000000e24cde71: 00000006 014082a3 00000000 00000000 ......@......... 0000000072c6a5ee: 00000000 00000000 00000000 00000000 ................ ... This patch fix this by cleanup in-core orphan list manually if ext4_truncate() return error. Cc: stable@kernel.org Signed-off-by: Zhang Yi <yi.zhang@huawei.com> Reviewed-by: Jan Kara <jack@suse.cz> Link: https://lore.kernel.org/r/20210507071904.160808-1-yi.zhang@huawei.com Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Diffstat (limited to 'fs')
-rw-r--r--fs/ext4/super.c9
1 files changed, 8 insertions, 1 deletions
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index b6fe1a027c78..7e05973d410a 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3101,8 +3101,15 @@ static void ext4_orphan_cleanup(struct super_block *sb,
inode_lock(inode);
truncate_inode_pages(inode->i_mapping, inode->i_size);
ret = ext4_truncate(inode);
- if (ret)
+ if (ret) {
+ /*
+ * We need to clean up the in-core orphan list
+ * manually if ext4_truncate() failed to get a
+ * transaction handle.
+ */
+ ext4_orphan_del(NULL, inode);
ext4_std_error(inode->i_sb, ret);
+ }
inode_unlock(inode);
nr_truncates++;
} else {