--- /dev/null
+From ab047d516dea72f011c15c04a929851e4d053109 Mon Sep 17 00:00:00 2001
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Thu, 23 Dec 2021 17:44:36 +0100
+Subject: ext4: destroy ext4_fc_dentry_cachep kmemcache on module removal
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+commit ab047d516dea72f011c15c04a929851e4d053109 upstream.
+
+The kmemcache for ext4_fc_dentry_cachep remains registered after module
+removal.
+
+Destroy ext4_fc_dentry_cachep kmemcache on module removal.
+
+Fixes: aa75f4d3daaeb ("ext4: main fast-commit commit path")
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Reviewed-by: Lukas Czerner <lczerner@redhat.com>
+Reviewed-by: Harshad Shirwadkar <harshadshirwadkar@gmail.com>
+Link: https://lore.kernel.org/r/20211110134640.lyku5vklvdndw6uk@linutronix.de
+Link: https://lore.kernel.org/r/YbiK3JetFFl08bd7@linutronix.de
+Link: https://lore.kernel.org/r/20211223164436.2628390-1-bigeasy@linutronix.de
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/ext4.h | 1 +
+ fs/ext4/fast_commit.c | 5 +++++
+ fs/ext4/super.c | 2 ++
+ 3 files changed, 8 insertions(+)
+
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -2935,6 +2935,7 @@ bool ext4_fc_replay_check_excluded(struc
+ void ext4_fc_replay_cleanup(struct super_block *sb);
+ int ext4_fc_commit(journal_t *journal, tid_t commit_tid);
+ int __init ext4_fc_init_dentry_cache(void);
++void ext4_fc_destroy_dentry_cache(void);
+
+ /* mballoc.c */
+ extern const struct seq_operations ext4_mb_seq_groups_ops;
+--- a/fs/ext4/fast_commit.c
++++ b/fs/ext4/fast_commit.c
+@@ -2195,3 +2195,8 @@ int __init ext4_fc_init_dentry_cache(voi
+
+ return 0;
+ }
++
++void ext4_fc_destroy_dentry_cache(void)
++{
++ kmem_cache_destroy(ext4_fc_dentry_cachep);
++}
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -6662,6 +6662,7 @@ static int __init ext4_init_fs(void)
+ out:
+ unregister_as_ext2();
+ unregister_as_ext3();
++ ext4_fc_destroy_dentry_cache();
+ out05:
+ destroy_inodecache();
+ out1:
+@@ -6688,6 +6689,7 @@ static void __exit ext4_exit_fs(void)
+ unregister_as_ext2();
+ unregister_as_ext3();
+ unregister_filesystem(&ext4_fs_type);
++ ext4_fc_destroy_dentry_cache();
+ destroy_inodecache();
+ ext4_exit_mballoc();
+ ext4_exit_sysfs();
--- /dev/null
+From 6eeaf88fd586f05aaf1d48cb3a139d2a5c6eb055 Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Wed, 5 Jan 2022 23:59:56 -0500
+Subject: ext4: don't use the orphan list when migrating an inode
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+commit 6eeaf88fd586f05aaf1d48cb3a139d2a5c6eb055 upstream.
+
+We probably want to remove the indirect block to extents migration
+feature after a deprecation window, but until then, let's fix a
+potential data loss problem caused by the fact that we put the
+tmp_inode on the orphan list. In the unlikely case where we crash and
+do a journal recovery, the data blocks belonging to the inode being
+migrated are also represented in the tmp_inode on the orphan list ---
+and so its data blocks will get marked unallocated, and available for
+reuse.
+
+Instead, stop putting the tmp_inode on the oprhan list. So in the
+case where we crash while migrating the inode, we'll leak an inode,
+which is not a disaster. It will be easily fixed the next time we run
+fsck, and it's better than potentially having blocks getting claimed
+by two different files, and losing data as a result.
+
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Reviewed-by: Lukas Czerner <lczerner@redhat.com>
+Cc: stable@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/migrate.c | 19 ++++---------------
+ 1 file changed, 4 insertions(+), 15 deletions(-)
+
+--- a/fs/ext4/migrate.c
++++ b/fs/ext4/migrate.c
+@@ -437,12 +437,12 @@ int ext4_ext_migrate(struct inode *inode
+ percpu_down_write(&sbi->s_writepages_rwsem);
+
+ /*
+- * Worst case we can touch the allocation bitmaps, a bgd
+- * block, and a block to link in the orphan list. We do need
+- * need to worry about credits for modifying the quota inode.
++ * Worst case we can touch the allocation bitmaps and a block
++ * group descriptor block. We do need need to worry about
++ * credits for modifying the quota inode.
+ */
+ handle = ext4_journal_start(inode, EXT4_HT_MIGRATE,
+- 4 + EXT4_MAXQUOTAS_TRANS_BLOCKS(inode->i_sb));
++ 3 + EXT4_MAXQUOTAS_TRANS_BLOCKS(inode->i_sb));
+
+ if (IS_ERR(handle)) {
+ retval = PTR_ERR(handle);
+@@ -463,10 +463,6 @@ int ext4_ext_migrate(struct inode *inode
+ * Use the correct seed for checksum (i.e. the seed from 'inode'). This
+ * is so that the metadata blocks will have the correct checksum after
+ * the migration.
+- *
+- * Note however that, if a crash occurs during the migration process,
+- * the recovery process is broken because the tmp_inode checksums will
+- * be wrong and the orphans cleanup will fail.
+ */
+ ei = EXT4_I(inode);
+ EXT4_I(tmp_inode)->i_csum_seed = ei->i_csum_seed;
+@@ -478,7 +474,6 @@ int ext4_ext_migrate(struct inode *inode
+ clear_nlink(tmp_inode);
+
+ ext4_ext_tree_init(handle, tmp_inode);
+- ext4_orphan_add(handle, tmp_inode);
+ ext4_journal_stop(handle);
+
+ /*
+@@ -503,12 +498,6 @@ int ext4_ext_migrate(struct inode *inode
+
+ handle = ext4_journal_start(inode, EXT4_HT_MIGRATE, 1);
+ if (IS_ERR(handle)) {
+- /*
+- * It is impossible to update on-disk structures without
+- * a handle, so just rollback in-core changes and live other
+- * work to orphan_list_cleanup()
+- */
+- ext4_orphan_del(NULL, tmp_inode);
+ retval = PTR_ERR(handle);
+ goto out_tmp_inode;
+ }
--- /dev/null
+From 9725958bb75cdfa10f2ec11526fdb23e7485e8e4 Mon Sep 17 00:00:00 2001
+From: Xin Yin <yinxin.x@bytedance.com>
+Date: Thu, 23 Dec 2021 11:23:37 +0800
+Subject: ext4: fast commit may miss tracking unwritten range during ftruncate
+
+From: Xin Yin <yinxin.x@bytedance.com>
+
+commit 9725958bb75cdfa10f2ec11526fdb23e7485e8e4 upstream.
+
+If use FALLOC_FL_KEEP_SIZE to alloc unwritten range at bottom, the
+inode->i_size will not include the unwritten range. When call
+ftruncate with fast commit enabled, it will miss to track the
+unwritten range.
+
+Change to trace the full range during ftruncate.
+
+Signed-off-by: Xin Yin <yinxin.x@bytedance.com>
+Reviewed-by: Harshad Shirwadkar <harshadshirwadkar@gmail.com>
+Link: https://lore.kernel.org/r/20211223032337.5198-3-yinxin.x@bytedance.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/inode.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -5428,8 +5428,7 @@ int ext4_setattr(struct user_namespace *
+ ext4_fc_track_range(handle, inode,
+ (attr->ia_size > 0 ? attr->ia_size - 1 : 0) >>
+ inode->i_sb->s_blocksize_bits,
+- (oldsize > 0 ? oldsize - 1 : 0) >>
+- inode->i_sb->s_blocksize_bits);
++ EXT_MAX_BLOCKS - 1);
+ else
+ ext4_fc_track_range(
+ handle, inode,
--- /dev/null
+From 5c48a7df91499e371ef725895b2e2d21a126e227 Mon Sep 17 00:00:00 2001
+From: Zhang Yi <yi.zhang@huawei.com>
+Date: Sat, 25 Dec 2021 17:09:37 +0800
+Subject: ext4: fix an use-after-free issue about data=journal writeback mode
+
+From: Zhang Yi <yi.zhang@huawei.com>
+
+commit 5c48a7df91499e371ef725895b2e2d21a126e227 upstream.
+
+Our syzkaller report an use-after-free issue that accessing the freed
+buffer_head on the writeback page in __ext4_journalled_writepage(). The
+problem is that if there was a truncate racing with the data=journalled
+writeback procedure, the writeback length could become zero and
+bget_one() refuse to get buffer_head's refcount, then the truncate
+procedure release buffer once we drop page lock, finally, the last
+ext4_walk_page_buffers() trigger the use-after-free problem.
+
+sync truncate
+ext4_sync_file()
+ file_write_and_wait_range()
+ ext4_setattr(0)
+ inode->i_size = 0
+ ext4_writepage()
+ len = 0
+ __ext4_journalled_writepage()
+ page_bufs = page_buffers(page)
+ ext4_walk_page_buffers(bget_one) <- does not get refcount
+ do_invalidatepage()
+ free_buffer_head()
+ ext4_walk_page_buffers(page_bufs) <- trigger use-after-free
+
+After commit bdf96838aea6 ("ext4: fix race between truncate and
+__ext4_journalled_writepage()"), we have already handled the racing
+case, so the bget_one() and bput_one() are not needed. So this patch
+simply remove these hunk, and recheck the i_size to make it safe.
+
+Fixes: bdf96838aea6 ("ext4: fix race between truncate and __ext4_journalled_writepage()")
+Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20211225090937.712867-1-yi.zhang@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/inode.c | 37 ++++++++++---------------------------
+ 1 file changed, 10 insertions(+), 27 deletions(-)
+
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -1845,30 +1845,16 @@ int ext4_da_get_block_prep(struct inode
+ return 0;
+ }
+
+-static int bget_one(handle_t *handle, struct inode *inode,
+- struct buffer_head *bh)
+-{
+- get_bh(bh);
+- return 0;
+-}
+-
+-static int bput_one(handle_t *handle, struct inode *inode,
+- struct buffer_head *bh)
+-{
+- put_bh(bh);
+- return 0;
+-}
+-
+ static int __ext4_journalled_writepage(struct page *page,
+ unsigned int len)
+ {
+ struct address_space *mapping = page->mapping;
+ struct inode *inode = mapping->host;
+- struct buffer_head *page_bufs = NULL;
+ handle_t *handle = NULL;
+ int ret = 0, err = 0;
+ int inline_data = ext4_has_inline_data(inode);
+ struct buffer_head *inode_bh = NULL;
++ loff_t size;
+
+ ClearPageChecked(page);
+
+@@ -1878,14 +1864,6 @@ static int __ext4_journalled_writepage(s
+ inode_bh = ext4_journalled_write_inline_data(inode, len, page);
+ if (inode_bh == NULL)
+ goto out;
+- } else {
+- page_bufs = page_buffers(page);
+- if (!page_bufs) {
+- BUG();
+- goto out;
+- }
+- ext4_walk_page_buffers(handle, inode, page_bufs, 0, len,
+- NULL, bget_one);
+ }
+ /*
+ * We need to release the page lock before we start the
+@@ -1906,7 +1884,8 @@ static int __ext4_journalled_writepage(s
+
+ lock_page(page);
+ put_page(page);
+- if (page->mapping != mapping) {
++ size = i_size_read(inode);
++ if (page->mapping != mapping || page_offset(page) > size) {
+ /* The page got truncated from under us */
+ ext4_journal_stop(handle);
+ ret = 0;
+@@ -1916,6 +1895,13 @@ static int __ext4_journalled_writepage(s
+ if (inline_data) {
+ ret = ext4_mark_inode_dirty(handle, inode);
+ } else {
++ struct buffer_head *page_bufs = page_buffers(page);
++
++ if (page->index == size >> PAGE_SHIFT)
++ len = size & ~PAGE_MASK;
++ else
++ len = PAGE_SIZE;
++
+ ret = ext4_walk_page_buffers(handle, inode, page_bufs, 0, len,
+ NULL, do_journal_get_write_access);
+
+@@ -1936,9 +1922,6 @@ static int __ext4_journalled_writepage(s
+ out:
+ unlock_page(page);
+ out_no_pagelock:
+- if (!inline_data && page_bufs)
+- ext4_walk_page_buffers(NULL, inode, page_bufs, 0, len,
+- NULL, bput_one);
+ brelse(inode_bh);
+ return ret;
+ }
--- /dev/null
+From 380a0091cab482489e9b19e07f2a166ad2b76d5c Mon Sep 17 00:00:00 2001
+From: Ye Bin <yebin10@huawei.com>
+Date: Thu, 23 Dec 2021 09:55:06 +0800
+Subject: ext4: Fix BUG_ON in ext4_bread when write quota data
+
+From: Ye Bin <yebin10@huawei.com>
+
+commit 380a0091cab482489e9b19e07f2a166ad2b76d5c upstream.
+
+We got issue as follows when run syzkaller:
+[ 167.936972] EXT4-fs error (device loop0): __ext4_remount:6314: comm rep: Abort forced by user
+[ 167.938306] EXT4-fs (loop0): Remounting filesystem read-only
+[ 167.981637] Assertion failure in ext4_getblk() at fs/ext4/inode.c:847: '(EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY) || handle != NULL || create == 0'
+[ 167.983601] ------------[ cut here ]------------
+[ 167.984245] kernel BUG at fs/ext4/inode.c:847!
+[ 167.984882] invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
+[ 167.985624] CPU: 7 PID: 2290 Comm: rep Tainted: G B 5.16.0-rc5-next-20211217+ #123
+[ 167.986823] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014
+[ 167.988590] RIP: 0010:ext4_getblk+0x17e/0x504
+[ 167.989189] Code: c6 01 74 28 49 c7 c0 a0 a3 5c 9b b9 4f 03 00 00 48 c7 c2 80 9c 5c 9b 48 c7 c6 40 b6 5c 9b 48 c7 c7 20 a4 5c 9b e8 77 e3 fd ff <0f> 0b 8b 04 244
+[ 167.991679] RSP: 0018:ffff8881736f7398 EFLAGS: 00010282
+[ 167.992385] RAX: 0000000000000094 RBX: 1ffff1102e6dee75 RCX: 0000000000000000
+[ 167.993337] RDX: 0000000000000001 RSI: ffffffff9b6e29e0 RDI: ffffed102e6dee66
+[ 167.994292] RBP: ffff88816a076210 R08: 0000000000000094 R09: ffffed107363fa09
+[ 167.995252] R10: ffff88839b1fd047 R11: ffffed107363fa08 R12: ffff88816a0761e8
+[ 167.996205] R13: 0000000000000000 R14: 0000000000000021 R15: 0000000000000001
+[ 167.997158] FS: 00007f6a1428c740(0000) GS:ffff88839b000000(0000) knlGS:0000000000000000
+[ 167.998238] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 167.999025] CR2: 00007f6a140716c8 CR3: 0000000133216000 CR4: 00000000000006e0
+[ 167.999987] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 168.000944] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 168.001899] Call Trace:
+[ 168.002235] <TASK>
+[ 168.007167] ext4_bread+0xd/0x53
+[ 168.007612] ext4_quota_write+0x20c/0x5c0
+[ 168.010457] write_blk+0x100/0x220
+[ 168.010944] remove_free_dqentry+0x1c6/0x440
+[ 168.011525] free_dqentry.isra.0+0x565/0x830
+[ 168.012133] remove_tree+0x318/0x6d0
+[ 168.014744] remove_tree+0x1eb/0x6d0
+[ 168.017346] remove_tree+0x1eb/0x6d0
+[ 168.019969] remove_tree+0x1eb/0x6d0
+[ 168.022128] qtree_release_dquot+0x291/0x340
+[ 168.023297] v2_release_dquot+0xce/0x120
+[ 168.023847] dquot_release+0x197/0x3e0
+[ 168.024358] ext4_release_dquot+0x22a/0x2d0
+[ 168.024932] dqput.part.0+0x1c9/0x900
+[ 168.025430] __dquot_drop+0x120/0x190
+[ 168.025942] ext4_clear_inode+0x86/0x220
+[ 168.026472] ext4_evict_inode+0x9e8/0xa22
+[ 168.028200] evict+0x29e/0x4f0
+[ 168.028625] dispose_list+0x102/0x1f0
+[ 168.029148] evict_inodes+0x2c1/0x3e0
+[ 168.030188] generic_shutdown_super+0xa4/0x3b0
+[ 168.030817] kill_block_super+0x95/0xd0
+[ 168.031360] deactivate_locked_super+0x85/0xd0
+[ 168.031977] cleanup_mnt+0x2bc/0x480
+[ 168.033062] task_work_run+0xd1/0x170
+[ 168.033565] do_exit+0xa4f/0x2b50
+[ 168.037155] do_group_exit+0xef/0x2d0
+[ 168.037666] __x64_sys_exit_group+0x3a/0x50
+[ 168.038237] do_syscall_64+0x3b/0x90
+[ 168.038751] entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+In order to reproduce this problem, the following conditions need to be met:
+1. Ext4 filesystem with no journal;
+2. Filesystem image with incorrect quota data;
+3. Abort filesystem forced by user;
+4. umount filesystem;
+
+As in ext4_quota_write:
+...
+ if (EXT4_SB(sb)->s_journal && !handle) {
+ ext4_msg(sb, KERN_WARNING, "Quota write (off=%llu, len=%llu)"
+ " cancelled because transaction is not started",
+ (unsigned long long)off, (unsigned long long)len);
+ return -EIO;
+ }
+...
+We only check handle if NULL when filesystem has journal. There is need
+check handle if NULL even when filesystem has no journal.
+
+Signed-off-by: Ye Bin <yebin10@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20211223015506.297766-1-yebin10@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/super.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -6479,7 +6479,7 @@ static ssize_t ext4_quota_write(struct s
+ struct buffer_head *bh;
+ handle_t *handle = journal_current_handle();
+
+- if (EXT4_SB(sb)->s_journal && !handle) {
++ if (!handle) {
+ ext4_msg(sb, KERN_WARNING, "Quota write (off=%llu, len=%llu)"
+ " cancelled because transaction is not started",
+ (unsigned long long)off, (unsigned long long)len);
--- /dev/null
+From 298b5c521746d69c07beb2757292fb5ccc1b0f85 Mon Sep 17 00:00:00 2001
+From: Ye Bin <yebin10@huawei.com>
+Date: Fri, 24 Dec 2021 18:03:41 +0800
+Subject: ext4: fix null-ptr-deref in '__ext4_journal_ensure_credits'
+
+From: Ye Bin <yebin10@huawei.com>
+
+commit 298b5c521746d69c07beb2757292fb5ccc1b0f85 upstream.
+
+We got issue as follows when run syzkaller test:
+[ 1901.130043] EXT4-fs error (device vda): ext4_remount:5624: comm syz-executor.5: Abort forced by user
+[ 1901.130901] Aborting journal on device vda-8.
+[ 1901.131437] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.16: Detected aborted journal
+[ 1901.131566] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.11: Detected aborted journal
+[ 1901.132586] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.18: Detected aborted journal
+[ 1901.132751] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.9: Detected aborted journal
+[ 1901.136149] EXT4-fs error (device vda) in ext4_reserve_inode_write:6035: Journal has aborted
+[ 1901.136837] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-fuzzer: Detected aborted journal
+[ 1901.136915] ==================================================================
+[ 1901.138175] BUG: KASAN: null-ptr-deref in __ext4_journal_ensure_credits+0x74/0x140 [ext4]
+[ 1901.138343] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.13: Detected aborted journal
+[ 1901.138398] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.1: Detected aborted journal
+[ 1901.138808] Read of size 8 at addr 0000000000000000 by task syz-executor.17/968
+[ 1901.138817]
+[ 1901.138852] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.30: Detected aborted journal
+[ 1901.144779] CPU: 1 PID: 968 Comm: syz-executor.17 Not tainted 4.19.90-vhulk2111.1.0.h893.eulerosv2r10.aarch64+ #1
+[ 1901.146479] Hardware name: linux,dummy-virt (DT)
+[ 1901.147317] Call trace:
+[ 1901.147552] dump_backtrace+0x0/0x2d8
+[ 1901.147898] show_stack+0x28/0x38
+[ 1901.148215] dump_stack+0xec/0x15c
+[ 1901.148746] kasan_report+0x108/0x338
+[ 1901.149207] __asan_load8+0x58/0xb0
+[ 1901.149753] __ext4_journal_ensure_credits+0x74/0x140 [ext4]
+[ 1901.150579] ext4_xattr_delete_inode+0xe4/0x700 [ext4]
+[ 1901.151316] ext4_evict_inode+0x524/0xba8 [ext4]
+[ 1901.151985] evict+0x1a4/0x378
+[ 1901.152353] iput+0x310/0x428
+[ 1901.152733] do_unlinkat+0x260/0x428
+[ 1901.153056] __arm64_sys_unlinkat+0x6c/0xc0
+[ 1901.153455] el0_svc_common+0xc8/0x320
+[ 1901.153799] el0_svc_handler+0xf8/0x160
+[ 1901.154265] el0_svc+0x10/0x218
+[ 1901.154682] ==================================================================
+
+This issue may happens like this:
+ Process1 Process2
+ext4_evict_inode
+ ext4_journal_start
+ ext4_truncate
+ ext4_ind_truncate
+ ext4_free_branches
+ ext4_ind_truncate_ensure_credits
+ ext4_journal_ensure_credits_fn
+ ext4_journal_restart
+ handle->h_transaction = NULL;
+ mount -o remount,abort /mnt
+ -> trigger JBD abort
+ start_this_handle -> will return failed
+ ext4_xattr_delete_inode
+ ext4_journal_ensure_credits
+ ext4_journal_ensure_credits_fn
+ __ext4_journal_ensure_credits
+ jbd2_handle_buffer_credits
+ journal = handle->h_transaction->t_journal; ->null-ptr-deref
+
+Now, indirect truncate process didn't handle error. To solve this issue
+maybe simply add check handle is abort in '__ext4_journal_ensure_credits'
+is enough, and i also think this is necessary.
+
+Cc: stable@kernel.org
+Signed-off-by: Ye Bin <yebin10@huawei.com>
+Link: https://lore.kernel.org/r/20211224100341.3299128-1-yebin10@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/ext4_jbd2.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/ext4/ext4_jbd2.c
++++ b/fs/ext4/ext4_jbd2.c
+@@ -162,6 +162,8 @@ int __ext4_journal_ensure_credits(handle
+ {
+ if (!ext4_handle_valid(handle))
+ return 0;
++ if (is_handle_aborted(handle))
++ return -EROFS;
+ if (jbd2_handle_buffer_credits(handle) >= check_cred &&
+ handle->h_revoke_credits >= revoke_cred)
+ return 0;
--- /dev/null
+From e81c9302a6c3c008f5c30beb73b38adb0170ff2d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Lu=C3=ADs=20Henriques?= <lhenriques@suse.de>
+Date: Tue, 14 Dec 2021 17:50:58 +0000
+Subject: ext4: set csum seed in tmp inode while migrating to extents
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Luís Henriques <lhenriques@suse.de>
+
+commit e81c9302a6c3c008f5c30beb73b38adb0170ff2d upstream.
+
+When migrating to extents, the temporary inode will have it's own checksum
+seed. This means that, when swapping the inodes data, the inode checksums
+will be incorrect.
+
+This can be fixed by recalculating the extents checksums again. Or simply
+by copying the seed into the temporary inode.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=213357
+Reported-by: Jeroen van Wolffelaar <jeroen@wolffelaar.nl>
+Signed-off-by: Luís Henriques <lhenriques@suse.de>
+Link: https://lore.kernel.org/r/20211214175058.19511-1-lhenriques@suse.de
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/migrate.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/fs/ext4/migrate.c
++++ b/fs/ext4/migrate.c
+@@ -459,6 +459,17 @@ int ext4_ext_migrate(struct inode *inode
+ ext4_journal_stop(handle);
+ goto out_unlock;
+ }
++ /*
++ * Use the correct seed for checksum (i.e. the seed from 'inode'). This
++ * is so that the metadata blocks will have the correct checksum after
++ * the migration.
++ *
++ * Note however that, if a crash occurs during the migration process,
++ * the recovery process is broken because the tmp_inode checksums will
++ * be wrong and the orphans cleanup will fail.
++ */
++ ei = EXT4_I(inode);
++ EXT4_I(tmp_inode)->i_csum_seed = ei->i_csum_seed;
+ i_size_write(tmp_inode, i_size_read(inode));
+ /*
+ * Set the i_nlink to zero so it will be deleted later
+@@ -502,7 +513,6 @@ int ext4_ext_migrate(struct inode *inode
+ goto out_tmp_inode;
+ }
+
+- ei = EXT4_I(inode);
+ i_data = ei->i_data;
+ memset(&lb, 0, sizeof(lb));
+
--- /dev/null
+From 0b5b5a62b945a141e64011b2f90ee7e46f14be98 Mon Sep 17 00:00:00 2001
+From: Xin Yin <yinxin.x@bytedance.com>
+Date: Thu, 23 Dec 2021 11:23:36 +0800
+Subject: ext4: use ext4_ext_remove_space() for fast commit replay delete range
+
+From: Xin Yin <yinxin.x@bytedance.com>
+
+commit 0b5b5a62b945a141e64011b2f90ee7e46f14be98 upstream.
+
+For now ,we use ext4_punch_hole() during fast commit replay delete range
+procedure. But it will be affected by inode->i_size, which may not
+correct during fast commit replay procedure. The following test will
+failed.
+
+-create & write foo (len 1000K)
+-falloc FALLOC_FL_ZERO_RANGE foo (range 400K - 600K)
+-create & fsync bar
+-falloc FALLOC_FL_PUNCH_HOLE foo (range 300K-500K)
+-fsync foo
+-crash before a full commit
+
+After the fast_commit reply procedure, the range 400K-500K will not be
+removed. Because in this case, when calling ext4_punch_hole() the
+inode->i_size is 0, and it just retruns with doing nothing.
+
+Change to use ext4_ext_remove_space() instead of ext4_punch_hole()
+to remove blocks of inode directly.
+
+Signed-off-by: Xin Yin <yinxin.x@bytedance.com>
+Reviewed-by: Harshad Shirwadkar <harshadshirwadkar@gmail.com>
+Link: https://lore.kernel.org/r/20211223032337.5198-2-yinxin.x@bytedance.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/fast_commit.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/fs/ext4/fast_commit.c
++++ b/fs/ext4/fast_commit.c
+@@ -1812,11 +1812,14 @@ ext4_fc_replay_del_range(struct super_bl
+ }
+ }
+
+- ret = ext4_punch_hole(inode,
+- le32_to_cpu(lrange.fc_lblk) << sb->s_blocksize_bits,
+- le32_to_cpu(lrange.fc_len) << sb->s_blocksize_bits);
+- if (ret)
+- jbd_debug(1, "ext4_punch_hole returned %d", ret);
++ down_write(&EXT4_I(inode)->i_data_sem);
++ ret = ext4_ext_remove_space(inode, lrange.fc_lblk,
++ lrange.fc_lblk + lrange.fc_len - 1);
++ up_write(&EXT4_I(inode)->i_data_sem);
++ if (ret) {
++ iput(inode);
++ return 0;
++ }
+ ext4_ext_replay_shrink_inode(inode,
+ i_size_read(inode) >> sb->s_blocksize_bits);
+ ext4_mark_inode_dirty(NULL, inode);
ext4-fix-a-possible-abba-deadlock-due-to-busy-pa.patch
ext4-initialize-err_blk-before-calling-__ext4_get_inode_loc.patch
ext4-fix-fast-commit-may-miss-tracking-range-for-falloc_fl_zero_range.patch
+ext4-set-csum-seed-in-tmp-inode-while-migrating-to-extents.patch
+ext4-fix-bug_on-in-ext4_bread-when-write-quota-data.patch
+ext4-use-ext4_ext_remove_space-for-fast-commit-replay-delete-range.patch
+ext4-fast-commit-may-miss-tracking-unwritten-range-during-ftruncate.patch
+ext4-destroy-ext4_fc_dentry_cachep-kmemcache-on-module-removal.patch
+ext4-fix-null-ptr-deref-in-__ext4_journal_ensure_credits.patch
+ext4-fix-an-use-after-free-issue-about-data-journal-writeback-mode.patch
+ext4-don-t-use-the-orphan-list-when-migrating-an-inode.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
