Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4

Pull ext4 fixes from Ted Ts'o:
"Fix some syzbot-detected bugs, as well as other bugs found by I/O
injection testing.

Change ext4's fallocate to consistently drop set[ug]id bits when an
fallocate operation might possibly change the user-visible contents of
a file.

Also, improve handling of potentially invalid values in the the
s_overhead_cluster superblock field to avoid ext4 returning a negative
number of free blocks"

* tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
jbd2: fix a potential race while discarding reserved buffers after an abort
ext4: update the cached overhead value in the superblock
ext4: force overhead calculation if the s_overhead_cluster makes no sense
ext4: fix overhead calculation to account for the reserved gdt blocks
ext4, doc: fix incorrect h_reserved size
ext4: limit length to bitmap_maxbytes - blocksize in punch_hole
ext4: fix use-after-free in ext4_search_dir
ext4: fix bug_on in start_this_handle during umount filesystem
ext4: fix symlink file size not match to file content
ext4: fix fallocate to use file_modified to update permissions consistently

+101 -26
+1 -1
Documentation/filesystems/ext4/attributes.rst
··· 76 76 - Checksum of the extended attribute block. 77 77 * - 0x14 78 78 - \_\_u32 79 - - h\_reserved[2] 79 + - h\_reserved[3] 80 80 - Zero. 81 81 82 82 The checksum is calculated against the FS UUID, the 64-bit block number
+6 -1
fs/ext4/ext4.h
··· 2273 2273 * Structure of a directory entry 2274 2274 */ 2275 2275 #define EXT4_NAME_LEN 255 2276 + /* 2277 + * Base length of the ext4 directory entry excluding the name length 2278 + */ 2279 + #define EXT4_BASE_DIR_LEN (sizeof(struct ext4_dir_entry_2) - EXT4_NAME_LEN) 2276 2280 2277 2281 struct ext4_dir_entry { 2278 2282 __le32 inode; /* Inode number */ ··· 3036 3032 extern int ext4_can_truncate(struct inode *inode); 3037 3033 extern int ext4_truncate(struct inode *); 3038 3034 extern int ext4_break_layouts(struct inode *); 3039 - extern int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length); 3035 + extern int ext4_punch_hole(struct file *file, loff_t offset, loff_t length); 3040 3036 extern void ext4_set_inode_flags(struct inode *, bool init); 3041 3037 extern int ext4_alloc_da_blocks(struct inode *inode); 3042 3038 extern void ext4_set_aops(struct inode *inode); ··· 3068 3064 struct dentry *dentry, struct fileattr *fa); 3069 3065 int ext4_fileattr_get(struct dentry *dentry, struct fileattr *fa); 3070 3066 extern void ext4_reset_inode_seed(struct inode *inode); 3067 + int ext4_update_overhead(struct super_block *sb); 3071 3068 3072 3069 /* migrate.c */ 3073 3070 extern int ext4_ext_migrate(struct inode *);
+25 -7
fs/ext4/extents.c
··· 4500 4500 return ret > 0 ? ret2 : ret; 4501 4501 } 4502 4502 4503 - static int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len); 4503 + static int ext4_collapse_range(struct file *file, loff_t offset, loff_t len); 4504 4504 4505 - static int ext4_insert_range(struct inode *inode, loff_t offset, loff_t len); 4505 + static int ext4_insert_range(struct file *file, loff_t offset, loff_t len); 4506 4506 4507 4507 static long ext4_zero_range(struct file *file, loff_t offset, 4508 4508 loff_t len, int mode) ··· 4573 4573 4574 4574 /* Wait all existing dio workers, newcomers will block on i_rwsem */ 4575 4575 inode_dio_wait(inode); 4576 + 4577 + ret = file_modified(file); 4578 + if (ret) 4579 + goto out_mutex; 4576 4580 4577 4581 /* Preallocate the range including the unaligned edges */ 4578 4582 if (partial_begin || partial_end) { ··· 4694 4690 return -EOPNOTSUPP; 4695 4691 4696 4692 if (mode & FALLOC_FL_PUNCH_HOLE) { 4697 - ret = ext4_punch_hole(inode, offset, len); 4693 + ret = ext4_punch_hole(file, offset, len); 4698 4694 goto exit; 4699 4695 } 4700 4696 ··· 4703 4699 goto exit; 4704 4700 4705 4701 if (mode & FALLOC_FL_COLLAPSE_RANGE) { 4706 - ret = ext4_collapse_range(inode, offset, len); 4702 + ret = ext4_collapse_range(file, offset, len); 4707 4703 goto exit; 4708 4704 } 4709 4705 4710 4706 if (mode & FALLOC_FL_INSERT_RANGE) { 4711 - ret = ext4_insert_range(inode, offset, len); 4707 + ret = ext4_insert_range(file, offset, len); 4712 4708 goto exit; 4713 4709 } 4714 4710 ··· 4743 4739 4744 4740 /* Wait all existing dio workers, newcomers will block on i_rwsem */ 4745 4741 inode_dio_wait(inode); 4742 + 4743 + ret = file_modified(file); 4744 + if (ret) 4745 + goto out; 4746 4746 4747 4747 ret = ext4_alloc_file_blocks(file, lblk, max_blocks, new_size, flags); 4748 4748 if (ret) ··· 5249 5241 * This implements the fallocate's collapse range functionality for ext4 5250 5242 * Returns: 0 and non-zero on error. 5251 5243 */ 5252 - static int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len) 5244 + static int ext4_collapse_range(struct file *file, loff_t offset, loff_t len) 5253 5245 { 5246 + struct inode *inode = file_inode(file); 5254 5247 struct super_block *sb = inode->i_sb; 5255 5248 struct address_space *mapping = inode->i_mapping; 5256 5249 ext4_lblk_t punch_start, punch_stop; ··· 5302 5293 5303 5294 /* Wait for existing dio to complete */ 5304 5295 inode_dio_wait(inode); 5296 + 5297 + ret = file_modified(file); 5298 + if (ret) 5299 + goto out_mutex; 5305 5300 5306 5301 /* 5307 5302 * Prevent page faults from reinstantiating pages we have released from ··· 5400 5387 * by len bytes. 5401 5388 * Returns 0 on success, error otherwise. 5402 5389 */ 5403 - static int ext4_insert_range(struct inode *inode, loff_t offset, loff_t len) 5390 + static int ext4_insert_range(struct file *file, loff_t offset, loff_t len) 5404 5391 { 5392 + struct inode *inode = file_inode(file); 5405 5393 struct super_block *sb = inode->i_sb; 5406 5394 struct address_space *mapping = inode->i_mapping; 5407 5395 handle_t *handle; ··· 5458 5444 5459 5445 /* Wait for existing dio to complete */ 5460 5446 inode_dio_wait(inode); 5447 + 5448 + ret = file_modified(file); 5449 + if (ret) 5450 + goto out_mutex; 5461 5451 5462 5452 /* 5463 5453 * Prevent page faults from reinstantiating pages we have released from
+16 -2
fs/ext4/inode.c
··· 3953 3953 * Returns: 0 on success or negative on failure 3954 3954 */ 3955 3955 3956 - int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length) 3956 + int ext4_punch_hole(struct file *file, loff_t offset, loff_t length) 3957 3957 { 3958 + struct inode *inode = file_inode(file); 3958 3959 struct super_block *sb = inode->i_sb; 3959 3960 ext4_lblk_t first_block, stop_block; 3960 3961 struct address_space *mapping = inode->i_mapping; 3961 - loff_t first_block_offset, last_block_offset; 3962 + loff_t first_block_offset, last_block_offset, max_length; 3963 + struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb); 3962 3964 handle_t *handle; 3963 3965 unsigned int credits; 3964 3966 int ret = 0, ret2 = 0; ··· 4003 4001 offset; 4004 4002 } 4005 4003 4004 + /* 4005 + * For punch hole the length + offset needs to be within one block 4006 + * before last range. Adjust the length if it goes beyond that limit. 4007 + */ 4008 + max_length = sbi->s_bitmap_maxbytes - inode->i_sb->s_blocksize; 4009 + if (offset + length > max_length) 4010 + length = max_length - offset; 4011 + 4006 4012 if (offset & (sb->s_blocksize - 1) || 4007 4013 (offset + length) & (sb->s_blocksize - 1)) { 4008 4014 /* ··· 4025 4015 4026 4016 /* Wait all existing dio workers, newcomers will block on i_rwsem */ 4027 4017 inode_dio_wait(inode); 4018 + 4019 + ret = file_modified(file); 4020 + if (ret) 4021 + goto out_mutex; 4028 4022 4029 4023 /* 4030 4024 * Prevent page faults from reinstantiating pages we have released from
+16
fs/ext4/ioctl.c
··· 1652 1652 return ext4_ioctl(file, cmd, (unsigned long) compat_ptr(arg)); 1653 1653 } 1654 1654 #endif 1655 + 1656 + static void set_overhead(struct ext4_super_block *es, const void *arg) 1657 + { 1658 + es->s_overhead_clusters = cpu_to_le32(*((unsigned long *) arg)); 1659 + } 1660 + 1661 + int ext4_update_overhead(struct super_block *sb) 1662 + { 1663 + struct ext4_sb_info *sbi = EXT4_SB(sb); 1664 + 1665 + if (sb_rdonly(sb) || sbi->s_overhead == 0 || 1666 + sbi->s_overhead == le32_to_cpu(sbi->s_es->s_overhead_clusters)) 1667 + return 0; 1668 + 1669 + return ext4_update_superblocks_fn(sb, set_overhead, &sbi->s_overhead); 1670 + }
+2 -2
fs/ext4/namei.c
··· 1466 1466 1467 1467 de = (struct ext4_dir_entry_2 *)search_buf; 1468 1468 dlimit = search_buf + buf_size; 1469 - while ((char *) de < dlimit) { 1469 + while ((char *) de < dlimit - EXT4_BASE_DIR_LEN) { 1470 1470 /* this code is executed quadratically often */ 1471 1471 /* do minimal checking `by hand' */ 1472 - if ((char *) de + de->name_len <= dlimit && 1472 + if (de->name + de->name_len <= dlimit && 1473 1473 ext4_match(dir, fname, de)) { 1474 1474 /* found a match - just to be sure, do 1475 1475 * a full check */
+3 -1
fs/ext4/page-io.c
··· 134 134 continue; 135 135 } 136 136 clear_buffer_async_write(bh); 137 - if (bio->bi_status) 137 + if (bio->bi_status) { 138 + set_buffer_write_io_error(bh); 138 139 buffer_io_error(bh); 140 + } 139 141 } while ((bh = bh->b_this_page) != head); 140 142 spin_unlock_irqrestore(&head->b_uptodate_lock, flags); 141 143 if (!under_io) {
+29 -11
fs/ext4/super.c
··· 1199 1199 int aborted = 0; 1200 1200 int i, err; 1201 1201 1202 + /* 1203 + * Unregister sysfs before destroying jbd2 journal. 1204 + * Since we could still access attr_journal_task attribute via sysfs 1205 + * path which could have sbi->s_journal->j_task as NULL 1206 + * Unregister sysfs before flush sbi->s_error_work. 1207 + * Since user may read /proc/fs/ext4/xx/mb_groups during umount, If 1208 + * read metadata verify failed then will queue error work. 1209 + * flush_stashed_error_work will call start_this_handle may trigger 1210 + * BUG_ON. 1211 + */ 1212 + ext4_unregister_sysfs(sb); 1213 + 1202 1214 ext4_unregister_li_request(sb); 1203 1215 ext4_quota_off_umount(sb); 1204 1216 1205 1217 flush_work(&sbi->s_error_work); 1206 1218 destroy_workqueue(sbi->rsv_conversion_wq); 1207 1219 ext4_release_orphan_info(sb); 1208 - 1209 - /* 1210 - * Unregister sysfs before destroying jbd2 journal. 1211 - * Since we could still access attr_journal_task attribute via sysfs 1212 - * path which could have sbi->s_journal->j_task as NULL 1213 - */ 1214 - ext4_unregister_sysfs(sb); 1215 1220 1216 1221 if (sbi->s_journal) { 1217 1222 aborted = is_journal_aborted(sbi->s_journal); ··· 4177 4172 ext4_fsblk_t first_block, last_block, b; 4178 4173 ext4_group_t i, ngroups = ext4_get_groups_count(sb); 4179 4174 int s, j, count = 0; 4175 + int has_super = ext4_bg_has_super(sb, grp); 4180 4176 4181 4177 if (!ext4_has_feature_bigalloc(sb)) 4182 - return (ext4_bg_has_super(sb, grp) + ext4_bg_num_gdb(sb, grp) + 4178 + return (has_super + ext4_bg_num_gdb(sb, grp) + 4179 + (has_super ? le16_to_cpu(sbi->s_es->s_reserved_gdt_blocks) : 0) + 4183 4180 sbi->s_itb_per_group + 2); 4184 4181 4185 4182 first_block = le32_to_cpu(sbi->s_es->s_first_data_block) + ··· 5289 5282 * Get the # of file system overhead blocks from the 5290 5283 * superblock if present. 5291 5284 */ 5292 - if (es->s_overhead_clusters) 5293 - sbi->s_overhead = le32_to_cpu(es->s_overhead_clusters); 5294 - else { 5285 + sbi->s_overhead = le32_to_cpu(es->s_overhead_clusters); 5286 + /* ignore the precalculated value if it is ridiculous */ 5287 + if (sbi->s_overhead > ext4_blocks_count(es)) 5288 + sbi->s_overhead = 0; 5289 + /* 5290 + * If the bigalloc feature is not enabled recalculating the 5291 + * overhead doesn't take long, so we might as well just redo 5292 + * it to make sure we are using the correct value. 5293 + */ 5294 + if (!ext4_has_feature_bigalloc(sb)) 5295 + sbi->s_overhead = 0; 5296 + if (sbi->s_overhead == 0) { 5295 5297 err = ext4_calculate_overhead(sb); 5296 5298 if (err) 5297 5299 goto failed_mount_wq; ··· 5618 5602 ext4_msg(sb, KERN_INFO, "mounted filesystem with%s. " 5619 5603 "Quota mode: %s.", descr, ext4_quota_mode(sb)); 5620 5604 5605 + /* Update the s_overhead_clusters if necessary */ 5606 + ext4_update_overhead(sb); 5621 5607 return 0; 5622 5608 5623 5609 free_sbi:
+3 -1
fs/jbd2/commit.c
··· 488 488 jbd2_journal_wait_updates(journal); 489 489 490 490 commit_transaction->t_state = T_SWITCH; 491 - write_unlock(&journal->j_state_lock); 492 491 493 492 J_ASSERT (atomic_read(&commit_transaction->t_outstanding_credits) <= 494 493 journal->j_max_transaction_buffers); ··· 507 508 * has reserved. This is consistent with the existing behaviour 508 509 * that multiple jbd2_journal_get_write_access() calls to the same 509 510 * buffer are perfectly permissible. 511 + * We use journal->j_state_lock here to serialize processing of 512 + * t_reserved_list with eviction of buffers from journal_unmap_buffer(). 510 513 */ 511 514 while (commit_transaction->t_reserved_list) { 512 515 jh = commit_transaction->t_reserved_list; ··· 528 527 jbd2_journal_refile_buffer(journal, jh); 529 528 } 530 529 530 + write_unlock(&journal->j_state_lock); 531 531 /* 532 532 * Now try to drop any written-back buffers from the journal's 533 533 * checkpoint lists. We do this *before* commit because it potentially