Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 82e54229 authored by Dmitry Monakhov's avatar Dmitry Monakhov Committed by Theodore Ts'o
Browse files

ext4: fix unwritten counter leakage 



ext4_set_io_unwritten_flag() will increment i_unwritten counter, so
once we mark end_io with EXT4_END_IO_UNWRITTEN we have to revert it back
on error path.

 - add missed error checks to prevent counter leakage
 - ext4_end_io_nolock() will clear EXT4_END_IO_UNWRITTEN flag to signal
   that conversion finished.
 - add BUG_ON to ext4_free_end_io() to prevent similar leakage in future.

Visible effect of this bug is that unaligned aio_stress may deadlock

Reviewed-by: default avatarJan Kara <jack@suse.cz>
Signed-off-by: default avatarDmitry Monakhov <dmonakhov@openvz.org>
Signed-off-by: default avatar"Theodore Ts'o" <tytso@mit.edu>
parent e27f41e1

fs/ext4/extents.c

+14 −7
Original line number Diff line number Diff line
@@ -3633,6 +3633,8 @@ ext4_ext_handle_uninitialized_extents(handle_t *handle, struct inode *inode, 
	if ((flags & EXT4_GET_BLOCKS_PRE_IO)) {

		ret = ext4_split_unwritten_extents(handle, inode, map,

						   path, flags);

		if (ret <= 0)

			goto out;

		/*

		 * Flag the inode(non aio case) or end_io struct (aio case)

		 * that this IO needs to conversion to written when IO is
@@ -3878,6 +3880,7 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode, 
	struct ext4_allocation_request ar;

	ext4_io_end_t *io = ext4_inode_aio(inode);

	ext4_lblk_t cluster_offset;

	int set_unwritten = 0;



	ext_debug("blocks %u/%u requested for inode %lu\n",

		  map->m_lblk, map->m_len, inode->i_ino);
@@ -4100,13 +4103,8 @@ got_allocated_blocks: 
		 * For non asycn direct IO case, flag the inode state

		 * that we need to perform conversion when IO is done.

		 */

		if ((flags & EXT4_GET_BLOCKS_PRE_IO)) {

			if (io)

				ext4_set_io_unwritten_flag(inode, io);

			else

				ext4_set_inode_state(inode,

						     EXT4_STATE_DIO_UNWRITTEN);

		}

		if ((flags & EXT4_GET_BLOCKS_PRE_IO))

			set_unwritten = 1;

		if (ext4_should_dioread_nolock(inode))

			map->m_flags |= EXT4_MAP_UNINIT;

	}
@@ -4118,6 +4116,15 @@ got_allocated_blocks: 
	if (!err)

		err = ext4_ext_insert_extent(handle, inode, path,

					     &newex, flags);



	if (!err && set_unwritten) {

		if (io)

			ext4_set_io_unwritten_flag(inode, io);

		else

			ext4_set_inode_state(inode,

					     EXT4_STATE_DIO_UNWRITTEN);

	}



	if (err && free_on_err) {

		int fb_flags = flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE ?

			EXT4_FREE_BLOCKS_NO_QUOT_UPDATE : 0;

fs/ext4/page-io.c

+5 −1
Original line number Diff line number Diff line
@@ -71,6 +71,8 @@ void ext4_free_io_end(ext4_io_end_t *io) 
	int i;



	BUG_ON(!io);

	BUG_ON(io->flag & EXT4_IO_END_UNWRITTEN);



	if (io->page)

		put_page(io->page);

	for (i = 0; i < io->num_io_pages; i++)
@@ -94,6 +96,8 @@ int ext4_end_io_nolock(ext4_io_end_t *io) 
	ssize_t size = io->size;

	int ret = 0;



	BUG_ON(!(io->flag & EXT4_IO_END_UNWRITTEN));



	ext4_debug("ext4_end_io_nolock: io 0x%p from inode %lu,list->next 0x%p,"

		   "list->prev 0x%p\n",

		   io, inode->i_ino, io->list.next, io->list.prev);
@@ -106,7 +110,7 @@ int ext4_end_io_nolock(ext4_io_end_t *io) 
			 "(inode %lu, offset %llu, size %zd, error %d)",

			 inode->i_ino, offset, size, ret);

	}



	io->flag &= ~EXT4_IO_END_UNWRITTEN;

	if (io->iocb)

		aio_complete(io->iocb, io->result, 0);