--- /dev/null
+From 6eeaf88fd586f05aaf1d48cb3a139d2a5c6eb055 Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Wed, 5 Jan 2022 23:59:56 -0500
+Subject: ext4: don't use the orphan list when migrating an inode
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+commit 6eeaf88fd586f05aaf1d48cb3a139d2a5c6eb055 upstream.
+
+We probably want to remove the indirect block to extents migration
+feature after a deprecation window, but until then, let's fix a
+potential data loss problem caused by the fact that we put the
+tmp_inode on the orphan list. In the unlikely case where we crash and
+do a journal recovery, the data blocks belonging to the inode being
+migrated are also represented in the tmp_inode on the orphan list ---
+and so its data blocks will get marked unallocated, and available for
+reuse.
+
+Instead, stop putting the tmp_inode on the oprhan list. So in the
+case where we crash while migrating the inode, we'll leak an inode,
+which is not a disaster. It will be easily fixed the next time we run
+fsck, and it's better than potentially having blocks getting claimed
+by two different files, and losing data as a result.
+
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Reviewed-by: Lukas Czerner <lczerner@redhat.com>
+Cc: stable@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/migrate.c | 19 ++++---------------
+ 1 file changed, 4 insertions(+), 15 deletions(-)
+
+--- a/fs/ext4/migrate.c
++++ b/fs/ext4/migrate.c
+@@ -462,12 +462,12 @@ int ext4_ext_migrate(struct inode *inode
+ percpu_down_write(&sbi->s_writepages_rwsem);
+
+ /*
+- * Worst case we can touch the allocation bitmaps, a bgd
+- * block, and a block to link in the orphan list. We do need
+- * need to worry about credits for modifying the quota inode.
++ * Worst case we can touch the allocation bitmaps and a block
++ * group descriptor block. We do need need to worry about
++ * credits for modifying the quota inode.
+ */
+ handle = ext4_journal_start(inode, EXT4_HT_MIGRATE,
+- 4 + EXT4_MAXQUOTAS_TRANS_BLOCKS(inode->i_sb));
++ 3 + EXT4_MAXQUOTAS_TRANS_BLOCKS(inode->i_sb));
+
+ if (IS_ERR(handle)) {
+ retval = PTR_ERR(handle);
+@@ -488,10 +488,6 @@ int ext4_ext_migrate(struct inode *inode
+ * Use the correct seed for checksum (i.e. the seed from 'inode'). This
+ * is so that the metadata blocks will have the correct checksum after
+ * the migration.
+- *
+- * Note however that, if a crash occurs during the migration process,
+- * the recovery process is broken because the tmp_inode checksums will
+- * be wrong and the orphans cleanup will fail.
+ */
+ ei = EXT4_I(inode);
+ EXT4_I(tmp_inode)->i_csum_seed = ei->i_csum_seed;
+@@ -503,7 +499,6 @@ int ext4_ext_migrate(struct inode *inode
+ clear_nlink(tmp_inode);
+
+ ext4_ext_tree_init(handle, tmp_inode);
+- ext4_orphan_add(handle, tmp_inode);
+ ext4_journal_stop(handle);
+
+ /*
+@@ -528,12 +523,6 @@ int ext4_ext_migrate(struct inode *inode
+
+ handle = ext4_journal_start(inode, EXT4_HT_MIGRATE, 1);
+ if (IS_ERR(handle)) {
+- /*
+- * It is impossible to update on-disk structures without
+- * a handle, so just rollback in-core changes and live other
+- * work to orphan_list_cleanup()
+- */
+- ext4_orphan_del(NULL, tmp_inode);
+ retval = PTR_ERR(handle);
+ goto out_tmp_inode;
+ }
--- /dev/null
+From 380a0091cab482489e9b19e07f2a166ad2b76d5c Mon Sep 17 00:00:00 2001
+From: Ye Bin <yebin10@huawei.com>
+Date: Thu, 23 Dec 2021 09:55:06 +0800
+Subject: ext4: Fix BUG_ON in ext4_bread when write quota data
+
+From: Ye Bin <yebin10@huawei.com>
+
+commit 380a0091cab482489e9b19e07f2a166ad2b76d5c upstream.
+
+We got issue as follows when run syzkaller:
+[ 167.936972] EXT4-fs error (device loop0): __ext4_remount:6314: comm rep: Abort forced by user
+[ 167.938306] EXT4-fs (loop0): Remounting filesystem read-only
+[ 167.981637] Assertion failure in ext4_getblk() at fs/ext4/inode.c:847: '(EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY) || handle != NULL || create == 0'
+[ 167.983601] ------------[ cut here ]------------
+[ 167.984245] kernel BUG at fs/ext4/inode.c:847!
+[ 167.984882] invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
+[ 167.985624] CPU: 7 PID: 2290 Comm: rep Tainted: G B 5.16.0-rc5-next-20211217+ #123
+[ 167.986823] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014
+[ 167.988590] RIP: 0010:ext4_getblk+0x17e/0x504
+[ 167.989189] Code: c6 01 74 28 49 c7 c0 a0 a3 5c 9b b9 4f 03 00 00 48 c7 c2 80 9c 5c 9b 48 c7 c6 40 b6 5c 9b 48 c7 c7 20 a4 5c 9b e8 77 e3 fd ff <0f> 0b 8b 04 244
+[ 167.991679] RSP: 0018:ffff8881736f7398 EFLAGS: 00010282
+[ 167.992385] RAX: 0000000000000094 RBX: 1ffff1102e6dee75 RCX: 0000000000000000
+[ 167.993337] RDX: 0000000000000001 RSI: ffffffff9b6e29e0 RDI: ffffed102e6dee66
+[ 167.994292] RBP: ffff88816a076210 R08: 0000000000000094 R09: ffffed107363fa09
+[ 167.995252] R10: ffff88839b1fd047 R11: ffffed107363fa08 R12: ffff88816a0761e8
+[ 167.996205] R13: 0000000000000000 R14: 0000000000000021 R15: 0000000000000001
+[ 167.997158] FS: 00007f6a1428c740(0000) GS:ffff88839b000000(0000) knlGS:0000000000000000
+[ 167.998238] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 167.999025] CR2: 00007f6a140716c8 CR3: 0000000133216000 CR4: 00000000000006e0
+[ 167.999987] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 168.000944] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 168.001899] Call Trace:
+[ 168.002235] <TASK>
+[ 168.007167] ext4_bread+0xd/0x53
+[ 168.007612] ext4_quota_write+0x20c/0x5c0
+[ 168.010457] write_blk+0x100/0x220
+[ 168.010944] remove_free_dqentry+0x1c6/0x440
+[ 168.011525] free_dqentry.isra.0+0x565/0x830
+[ 168.012133] remove_tree+0x318/0x6d0
+[ 168.014744] remove_tree+0x1eb/0x6d0
+[ 168.017346] remove_tree+0x1eb/0x6d0
+[ 168.019969] remove_tree+0x1eb/0x6d0
+[ 168.022128] qtree_release_dquot+0x291/0x340
+[ 168.023297] v2_release_dquot+0xce/0x120
+[ 168.023847] dquot_release+0x197/0x3e0
+[ 168.024358] ext4_release_dquot+0x22a/0x2d0
+[ 168.024932] dqput.part.0+0x1c9/0x900
+[ 168.025430] __dquot_drop+0x120/0x190
+[ 168.025942] ext4_clear_inode+0x86/0x220
+[ 168.026472] ext4_evict_inode+0x9e8/0xa22
+[ 168.028200] evict+0x29e/0x4f0
+[ 168.028625] dispose_list+0x102/0x1f0
+[ 168.029148] evict_inodes+0x2c1/0x3e0
+[ 168.030188] generic_shutdown_super+0xa4/0x3b0
+[ 168.030817] kill_block_super+0x95/0xd0
+[ 168.031360] deactivate_locked_super+0x85/0xd0
+[ 168.031977] cleanup_mnt+0x2bc/0x480
+[ 168.033062] task_work_run+0xd1/0x170
+[ 168.033565] do_exit+0xa4f/0x2b50
+[ 168.037155] do_group_exit+0xef/0x2d0
+[ 168.037666] __x64_sys_exit_group+0x3a/0x50
+[ 168.038237] do_syscall_64+0x3b/0x90
+[ 168.038751] entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+In order to reproduce this problem, the following conditions need to be met:
+1. Ext4 filesystem with no journal;
+2. Filesystem image with incorrect quota data;
+3. Abort filesystem forced by user;
+4. umount filesystem;
+
+As in ext4_quota_write:
+...
+ if (EXT4_SB(sb)->s_journal && !handle) {
+ ext4_msg(sb, KERN_WARNING, "Quota write (off=%llu, len=%llu)"
+ " cancelled because transaction is not started",
+ (unsigned long long)off, (unsigned long long)len);
+ return -EIO;
+ }
+...
+We only check handle if NULL when filesystem has journal. There is need
+check handle if NULL even when filesystem has no journal.
+
+Signed-off-by: Ye Bin <yebin10@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20211223015506.297766-1-yebin10@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/super.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -5602,7 +5602,7 @@ static ssize_t ext4_quota_write(struct s
+ struct buffer_head *bh;
+ handle_t *handle = journal_current_handle();
+
+- if (EXT4_SB(sb)->s_journal && !handle) {
++ if (!handle) {
+ ext4_msg(sb, KERN_WARNING, "Quota write (off=%llu, len=%llu)"
+ " cancelled because transaction is not started",
+ (unsigned long long)off, (unsigned long long)len);
--- /dev/null
+From e81c9302a6c3c008f5c30beb73b38adb0170ff2d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Lu=C3=ADs=20Henriques?= <lhenriques@suse.de>
+Date: Tue, 14 Dec 2021 17:50:58 +0000
+Subject: ext4: set csum seed in tmp inode while migrating to extents
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Luís Henriques <lhenriques@suse.de>
+
+commit e81c9302a6c3c008f5c30beb73b38adb0170ff2d upstream.
+
+When migrating to extents, the temporary inode will have it's own checksum
+seed. This means that, when swapping the inodes data, the inode checksums
+will be incorrect.
+
+This can be fixed by recalculating the extents checksums again. Or simply
+by copying the seed into the temporary inode.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=213357
+Reported-by: Jeroen van Wolffelaar <jeroen@wolffelaar.nl>
+Signed-off-by: Luís Henriques <lhenriques@suse.de>
+Link: https://lore.kernel.org/r/20211214175058.19511-1-lhenriques@suse.de
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/migrate.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/fs/ext4/migrate.c
++++ b/fs/ext4/migrate.c
+@@ -484,6 +484,17 @@ int ext4_ext_migrate(struct inode *inode
+ ext4_journal_stop(handle);
+ goto out_unlock;
+ }
++ /*
++ * Use the correct seed for checksum (i.e. the seed from 'inode'). This
++ * is so that the metadata blocks will have the correct checksum after
++ * the migration.
++ *
++ * Note however that, if a crash occurs during the migration process,
++ * the recovery process is broken because the tmp_inode checksums will
++ * be wrong and the orphans cleanup will fail.
++ */
++ ei = EXT4_I(inode);
++ EXT4_I(tmp_inode)->i_csum_seed = ei->i_csum_seed;
+ i_size_write(tmp_inode, i_size_read(inode));
+ /*
+ * Set the i_nlink to zero so it will be deleted later
+@@ -527,7 +538,6 @@ int ext4_ext_migrate(struct inode *inode
+ goto out_tmp_inode;
+ }
+
+- ei = EXT4_I(inode);
+ i_data = ei->i_data;
+ memset(&lb, 0, sizeof(lb));
+
ubifs-error-path-in-ubifs_remount_rw-seems-to-wrongly-free-write-buffers.patch
iwlwifi-mvm-increase-the-scan-timeout-guard-to-30-seconds.patch
drm-etnaviv-limit-submit-sizes.patch
+ext4-set-csum-seed-in-tmp-inode-while-migrating-to-extents.patch
+ext4-fix-bug_on-in-ext4_bread-when-write-quota-data.patch
+ext4-don-t-use-the-orphan-list-when-migrating-an-inode.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
