From: Greg Kroah-Hartman Date: Mon, 24 Jan 2022 08:03:41 +0000 (+0100) Subject: 5.16-stable patches X-Git-Tag: v4.4.300~95 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e3b930092d526629fd41e6d279e85b6ba0556288;p=thirdparty%2Fkernel%2Fstable-queue.git 5.16-stable patches added patches: ext4-destroy-ext4_fc_dentry_cachep-kmemcache-on-module-removal.patch ext4-don-t-use-the-orphan-list-when-migrating-an-inode.patch ext4-fast-commit-may-miss-tracking-unwritten-range-during-ftruncate.patch ext4-fix-an-use-after-free-issue-about-data-journal-writeback-mode.patch ext4-fix-bug_on-in-ext4_bread-when-write-quota-data.patch ext4-fix-null-ptr-deref-in-__ext4_journal_ensure_credits.patch ext4-set-csum-seed-in-tmp-inode-while-migrating-to-extents.patch ext4-use-ext4_ext_remove_space-for-fast-commit-replay-delete-range.patch --- diff --git a/queue-5.16/ext4-destroy-ext4_fc_dentry_cachep-kmemcache-on-module-removal.patch b/queue-5.16/ext4-destroy-ext4_fc_dentry_cachep-kmemcache-on-module-removal.patch new file mode 100644 index 00000000000..59f0c325d75 --- /dev/null +++ b/queue-5.16/ext4-destroy-ext4_fc_dentry_cachep-kmemcache-on-module-removal.patch @@ -0,0 +1,69 @@ +From ab047d516dea72f011c15c04a929851e4d053109 Mon Sep 17 00:00:00 2001 +From: Sebastian Andrzej Siewior +Date: Thu, 23 Dec 2021 17:44:36 +0100 +Subject: ext4: destroy ext4_fc_dentry_cachep kmemcache on module removal + +From: Sebastian Andrzej Siewior + +commit ab047d516dea72f011c15c04a929851e4d053109 upstream. + +The kmemcache for ext4_fc_dentry_cachep remains registered after module +removal. + +Destroy ext4_fc_dentry_cachep kmemcache on module removal. + +Fixes: aa75f4d3daaeb ("ext4: main fast-commit commit path") +Signed-off-by: Sebastian Andrzej Siewior +Reviewed-by: Lukas Czerner +Reviewed-by: Harshad Shirwadkar +Link: https://lore.kernel.org/r/20211110134640.lyku5vklvdndw6uk@linutronix.de +Link: https://lore.kernel.org/r/YbiK3JetFFl08bd7@linutronix.de +Link: https://lore.kernel.org/r/20211223164436.2628390-1-bigeasy@linutronix.de +Signed-off-by: Theodore Ts'o +Cc: stable@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + fs/ext4/ext4.h | 1 + + fs/ext4/fast_commit.c | 5 +++++ + fs/ext4/super.c | 2 ++ + 3 files changed, 8 insertions(+) + +--- a/fs/ext4/ext4.h ++++ b/fs/ext4/ext4.h +@@ -2935,6 +2935,7 @@ bool ext4_fc_replay_check_excluded(struc + void ext4_fc_replay_cleanup(struct super_block *sb); + int ext4_fc_commit(journal_t *journal, tid_t commit_tid); + int __init ext4_fc_init_dentry_cache(void); ++void ext4_fc_destroy_dentry_cache(void); + + /* mballoc.c */ + extern const struct seq_operations ext4_mb_seq_groups_ops; +--- a/fs/ext4/fast_commit.c ++++ b/fs/ext4/fast_commit.c +@@ -2195,3 +2195,8 @@ int __init ext4_fc_init_dentry_cache(voi + + return 0; + } ++ ++void ext4_fc_destroy_dentry_cache(void) ++{ ++ kmem_cache_destroy(ext4_fc_dentry_cachep); ++} +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -6662,6 +6662,7 @@ static int __init ext4_init_fs(void) + out: + unregister_as_ext2(); + unregister_as_ext3(); ++ ext4_fc_destroy_dentry_cache(); + out05: + destroy_inodecache(); + out1: +@@ -6688,6 +6689,7 @@ static void __exit ext4_exit_fs(void) + unregister_as_ext2(); + unregister_as_ext3(); + unregister_filesystem(&ext4_fs_type); ++ ext4_fc_destroy_dentry_cache(); + destroy_inodecache(); + ext4_exit_mballoc(); + ext4_exit_sysfs(); diff --git a/queue-5.16/ext4-don-t-use-the-orphan-list-when-migrating-an-inode.patch b/queue-5.16/ext4-don-t-use-the-orphan-list-when-migrating-an-inode.patch new file mode 100644 index 00000000000..49ee09e45b6 --- /dev/null +++ b/queue-5.16/ext4-don-t-use-the-orphan-list-when-migrating-an-inode.patch @@ -0,0 +1,83 @@ +From 6eeaf88fd586f05aaf1d48cb3a139d2a5c6eb055 Mon Sep 17 00:00:00 2001 +From: Theodore Ts'o +Date: Wed, 5 Jan 2022 23:59:56 -0500 +Subject: ext4: don't use the orphan list when migrating an inode + +From: Theodore Ts'o + +commit 6eeaf88fd586f05aaf1d48cb3a139d2a5c6eb055 upstream. + +We probably want to remove the indirect block to extents migration +feature after a deprecation window, but until then, let's fix a +potential data loss problem caused by the fact that we put the +tmp_inode on the orphan list. In the unlikely case where we crash and +do a journal recovery, the data blocks belonging to the inode being +migrated are also represented in the tmp_inode on the orphan list --- +and so its data blocks will get marked unallocated, and available for +reuse. + +Instead, stop putting the tmp_inode on the oprhan list. So in the +case where we crash while migrating the inode, we'll leak an inode, +which is not a disaster. It will be easily fixed the next time we run +fsck, and it's better than potentially having blocks getting claimed +by two different files, and losing data as a result. + +Signed-off-by: Theodore Ts'o +Reviewed-by: Lukas Czerner +Cc: stable@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + fs/ext4/migrate.c | 19 ++++--------------- + 1 file changed, 4 insertions(+), 15 deletions(-) + +--- a/fs/ext4/migrate.c ++++ b/fs/ext4/migrate.c +@@ -437,12 +437,12 @@ int ext4_ext_migrate(struct inode *inode + percpu_down_write(&sbi->s_writepages_rwsem); + + /* +- * Worst case we can touch the allocation bitmaps, a bgd +- * block, and a block to link in the orphan list. We do need +- * need to worry about credits for modifying the quota inode. ++ * Worst case we can touch the allocation bitmaps and a block ++ * group descriptor block. We do need need to worry about ++ * credits for modifying the quota inode. + */ + handle = ext4_journal_start(inode, EXT4_HT_MIGRATE, +- 4 + EXT4_MAXQUOTAS_TRANS_BLOCKS(inode->i_sb)); ++ 3 + EXT4_MAXQUOTAS_TRANS_BLOCKS(inode->i_sb)); + + if (IS_ERR(handle)) { + retval = PTR_ERR(handle); +@@ -463,10 +463,6 @@ int ext4_ext_migrate(struct inode *inode + * Use the correct seed for checksum (i.e. the seed from 'inode'). This + * is so that the metadata blocks will have the correct checksum after + * the migration. +- * +- * Note however that, if a crash occurs during the migration process, +- * the recovery process is broken because the tmp_inode checksums will +- * be wrong and the orphans cleanup will fail. + */ + ei = EXT4_I(inode); + EXT4_I(tmp_inode)->i_csum_seed = ei->i_csum_seed; +@@ -478,7 +474,6 @@ int ext4_ext_migrate(struct inode *inode + clear_nlink(tmp_inode); + + ext4_ext_tree_init(handle, tmp_inode); +- ext4_orphan_add(handle, tmp_inode); + ext4_journal_stop(handle); + + /* +@@ -503,12 +498,6 @@ int ext4_ext_migrate(struct inode *inode + + handle = ext4_journal_start(inode, EXT4_HT_MIGRATE, 1); + if (IS_ERR(handle)) { +- /* +- * It is impossible to update on-disk structures without +- * a handle, so just rollback in-core changes and live other +- * work to orphan_list_cleanup() +- */ +- ext4_orphan_del(NULL, tmp_inode); + retval = PTR_ERR(handle); + goto out_tmp_inode; + } diff --git a/queue-5.16/ext4-fast-commit-may-miss-tracking-unwritten-range-during-ftruncate.patch b/queue-5.16/ext4-fast-commit-may-miss-tracking-unwritten-range-during-ftruncate.patch new file mode 100644 index 00000000000..78fdbde287c --- /dev/null +++ b/queue-5.16/ext4-fast-commit-may-miss-tracking-unwritten-range-during-ftruncate.patch @@ -0,0 +1,38 @@ +From 9725958bb75cdfa10f2ec11526fdb23e7485e8e4 Mon Sep 17 00:00:00 2001 +From: Xin Yin +Date: Thu, 23 Dec 2021 11:23:37 +0800 +Subject: ext4: fast commit may miss tracking unwritten range during ftruncate + +From: Xin Yin + +commit 9725958bb75cdfa10f2ec11526fdb23e7485e8e4 upstream. + +If use FALLOC_FL_KEEP_SIZE to alloc unwritten range at bottom, the +inode->i_size will not include the unwritten range. When call +ftruncate with fast commit enabled, it will miss to track the +unwritten range. + +Change to trace the full range during ftruncate. + +Signed-off-by: Xin Yin +Reviewed-by: Harshad Shirwadkar +Link: https://lore.kernel.org/r/20211223032337.5198-3-yinxin.x@bytedance.com +Signed-off-by: Theodore Ts'o +Cc: stable@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + fs/ext4/inode.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -5428,8 +5428,7 @@ int ext4_setattr(struct user_namespace * + ext4_fc_track_range(handle, inode, + (attr->ia_size > 0 ? attr->ia_size - 1 : 0) >> + inode->i_sb->s_blocksize_bits, +- (oldsize > 0 ? oldsize - 1 : 0) >> +- inode->i_sb->s_blocksize_bits); ++ EXT_MAX_BLOCKS - 1); + else + ext4_fc_track_range( + handle, inode, diff --git a/queue-5.16/ext4-fix-an-use-after-free-issue-about-data-journal-writeback-mode.patch b/queue-5.16/ext4-fix-an-use-after-free-issue-about-data-journal-writeback-mode.patch new file mode 100644 index 00000000000..692f2bef241 --- /dev/null +++ b/queue-5.16/ext4-fix-an-use-after-free-issue-about-data-journal-writeback-mode.patch @@ -0,0 +1,129 @@ +From 5c48a7df91499e371ef725895b2e2d21a126e227 Mon Sep 17 00:00:00 2001 +From: Zhang Yi +Date: Sat, 25 Dec 2021 17:09:37 +0800 +Subject: ext4: fix an use-after-free issue about data=journal writeback mode + +From: Zhang Yi + +commit 5c48a7df91499e371ef725895b2e2d21a126e227 upstream. + +Our syzkaller report an use-after-free issue that accessing the freed +buffer_head on the writeback page in __ext4_journalled_writepage(). The +problem is that if there was a truncate racing with the data=journalled +writeback procedure, the writeback length could become zero and +bget_one() refuse to get buffer_head's refcount, then the truncate +procedure release buffer once we drop page lock, finally, the last +ext4_walk_page_buffers() trigger the use-after-free problem. + +sync truncate +ext4_sync_file() + file_write_and_wait_range() + ext4_setattr(0) + inode->i_size = 0 + ext4_writepage() + len = 0 + __ext4_journalled_writepage() + page_bufs = page_buffers(page) + ext4_walk_page_buffers(bget_one) <- does not get refcount + do_invalidatepage() + free_buffer_head() + ext4_walk_page_buffers(page_bufs) <- trigger use-after-free + +After commit bdf96838aea6 ("ext4: fix race between truncate and +__ext4_journalled_writepage()"), we have already handled the racing +case, so the bget_one() and bput_one() are not needed. So this patch +simply remove these hunk, and recheck the i_size to make it safe. + +Fixes: bdf96838aea6 ("ext4: fix race between truncate and __ext4_journalled_writepage()") +Signed-off-by: Zhang Yi +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20211225090937.712867-1-yi.zhang@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman +--- + fs/ext4/inode.c | 37 ++++++++++--------------------------- + 1 file changed, 10 insertions(+), 27 deletions(-) + +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -1845,30 +1845,16 @@ int ext4_da_get_block_prep(struct inode + return 0; + } + +-static int bget_one(handle_t *handle, struct inode *inode, +- struct buffer_head *bh) +-{ +- get_bh(bh); +- return 0; +-} +- +-static int bput_one(handle_t *handle, struct inode *inode, +- struct buffer_head *bh) +-{ +- put_bh(bh); +- return 0; +-} +- + static int __ext4_journalled_writepage(struct page *page, + unsigned int len) + { + struct address_space *mapping = page->mapping; + struct inode *inode = mapping->host; +- struct buffer_head *page_bufs = NULL; + handle_t *handle = NULL; + int ret = 0, err = 0; + int inline_data = ext4_has_inline_data(inode); + struct buffer_head *inode_bh = NULL; ++ loff_t size; + + ClearPageChecked(page); + +@@ -1878,14 +1864,6 @@ static int __ext4_journalled_writepage(s + inode_bh = ext4_journalled_write_inline_data(inode, len, page); + if (inode_bh == NULL) + goto out; +- } else { +- page_bufs = page_buffers(page); +- if (!page_bufs) { +- BUG(); +- goto out; +- } +- ext4_walk_page_buffers(handle, inode, page_bufs, 0, len, +- NULL, bget_one); + } + /* + * We need to release the page lock before we start the +@@ -1906,7 +1884,8 @@ static int __ext4_journalled_writepage(s + + lock_page(page); + put_page(page); +- if (page->mapping != mapping) { ++ size = i_size_read(inode); ++ if (page->mapping != mapping || page_offset(page) > size) { + /* The page got truncated from under us */ + ext4_journal_stop(handle); + ret = 0; +@@ -1916,6 +1895,13 @@ static int __ext4_journalled_writepage(s + if (inline_data) { + ret = ext4_mark_inode_dirty(handle, inode); + } else { ++ struct buffer_head *page_bufs = page_buffers(page); ++ ++ if (page->index == size >> PAGE_SHIFT) ++ len = size & ~PAGE_MASK; ++ else ++ len = PAGE_SIZE; ++ + ret = ext4_walk_page_buffers(handle, inode, page_bufs, 0, len, + NULL, do_journal_get_write_access); + +@@ -1936,9 +1922,6 @@ static int __ext4_journalled_writepage(s + out: + unlock_page(page); + out_no_pagelock: +- if (!inline_data && page_bufs) +- ext4_walk_page_buffers(NULL, inode, page_bufs, 0, len, +- NULL, bput_one); + brelse(inode_bh); + return ret; + } diff --git a/queue-5.16/ext4-fix-bug_on-in-ext4_bread-when-write-quota-data.patch b/queue-5.16/ext4-fix-bug_on-in-ext4_bread-when-write-quota-data.patch new file mode 100644 index 00000000000..ea9b84a92c4 --- /dev/null +++ b/queue-5.16/ext4-fix-bug_on-in-ext4_bread-when-write-quota-data.patch @@ -0,0 +1,103 @@ +From 380a0091cab482489e9b19e07f2a166ad2b76d5c Mon Sep 17 00:00:00 2001 +From: Ye Bin +Date: Thu, 23 Dec 2021 09:55:06 +0800 +Subject: ext4: Fix BUG_ON in ext4_bread when write quota data + +From: Ye Bin + +commit 380a0091cab482489e9b19e07f2a166ad2b76d5c upstream. + +We got issue as follows when run syzkaller: +[ 167.936972] EXT4-fs error (device loop0): __ext4_remount:6314: comm rep: Abort forced by user +[ 167.938306] EXT4-fs (loop0): Remounting filesystem read-only +[ 167.981637] Assertion failure in ext4_getblk() at fs/ext4/inode.c:847: '(EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY) || handle != NULL || create == 0' +[ 167.983601] ------------[ cut here ]------------ +[ 167.984245] kernel BUG at fs/ext4/inode.c:847! +[ 167.984882] invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI +[ 167.985624] CPU: 7 PID: 2290 Comm: rep Tainted: G B 5.16.0-rc5-next-20211217+ #123 +[ 167.986823] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014 +[ 167.988590] RIP: 0010:ext4_getblk+0x17e/0x504 +[ 167.989189] Code: c6 01 74 28 49 c7 c0 a0 a3 5c 9b b9 4f 03 00 00 48 c7 c2 80 9c 5c 9b 48 c7 c6 40 b6 5c 9b 48 c7 c7 20 a4 5c 9b e8 77 e3 fd ff <0f> 0b 8b 04 244 +[ 167.991679] RSP: 0018:ffff8881736f7398 EFLAGS: 00010282 +[ 167.992385] RAX: 0000000000000094 RBX: 1ffff1102e6dee75 RCX: 0000000000000000 +[ 167.993337] RDX: 0000000000000001 RSI: ffffffff9b6e29e0 RDI: ffffed102e6dee66 +[ 167.994292] RBP: ffff88816a076210 R08: 0000000000000094 R09: ffffed107363fa09 +[ 167.995252] R10: ffff88839b1fd047 R11: ffffed107363fa08 R12: ffff88816a0761e8 +[ 167.996205] R13: 0000000000000000 R14: 0000000000000021 R15: 0000000000000001 +[ 167.997158] FS: 00007f6a1428c740(0000) GS:ffff88839b000000(0000) knlGS:0000000000000000 +[ 167.998238] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 167.999025] CR2: 00007f6a140716c8 CR3: 0000000133216000 CR4: 00000000000006e0 +[ 167.999987] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 168.000944] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 168.001899] Call Trace: +[ 168.002235] +[ 168.007167] ext4_bread+0xd/0x53 +[ 168.007612] ext4_quota_write+0x20c/0x5c0 +[ 168.010457] write_blk+0x100/0x220 +[ 168.010944] remove_free_dqentry+0x1c6/0x440 +[ 168.011525] free_dqentry.isra.0+0x565/0x830 +[ 168.012133] remove_tree+0x318/0x6d0 +[ 168.014744] remove_tree+0x1eb/0x6d0 +[ 168.017346] remove_tree+0x1eb/0x6d0 +[ 168.019969] remove_tree+0x1eb/0x6d0 +[ 168.022128] qtree_release_dquot+0x291/0x340 +[ 168.023297] v2_release_dquot+0xce/0x120 +[ 168.023847] dquot_release+0x197/0x3e0 +[ 168.024358] ext4_release_dquot+0x22a/0x2d0 +[ 168.024932] dqput.part.0+0x1c9/0x900 +[ 168.025430] __dquot_drop+0x120/0x190 +[ 168.025942] ext4_clear_inode+0x86/0x220 +[ 168.026472] ext4_evict_inode+0x9e8/0xa22 +[ 168.028200] evict+0x29e/0x4f0 +[ 168.028625] dispose_list+0x102/0x1f0 +[ 168.029148] evict_inodes+0x2c1/0x3e0 +[ 168.030188] generic_shutdown_super+0xa4/0x3b0 +[ 168.030817] kill_block_super+0x95/0xd0 +[ 168.031360] deactivate_locked_super+0x85/0xd0 +[ 168.031977] cleanup_mnt+0x2bc/0x480 +[ 168.033062] task_work_run+0xd1/0x170 +[ 168.033565] do_exit+0xa4f/0x2b50 +[ 168.037155] do_group_exit+0xef/0x2d0 +[ 168.037666] __x64_sys_exit_group+0x3a/0x50 +[ 168.038237] do_syscall_64+0x3b/0x90 +[ 168.038751] entry_SYSCALL_64_after_hwframe+0x44/0xae + +In order to reproduce this problem, the following conditions need to be met: +1. Ext4 filesystem with no journal; +2. Filesystem image with incorrect quota data; +3. Abort filesystem forced by user; +4. umount filesystem; + +As in ext4_quota_write: +... + if (EXT4_SB(sb)->s_journal && !handle) { + ext4_msg(sb, KERN_WARNING, "Quota write (off=%llu, len=%llu)" + " cancelled because transaction is not started", + (unsigned long long)off, (unsigned long long)len); + return -EIO; + } +... +We only check handle if NULL when filesystem has journal. There is need +check handle if NULL even when filesystem has no journal. + +Signed-off-by: Ye Bin +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20211223015506.297766-1-yebin10@huawei.com +Signed-off-by: Theodore Ts'o +Cc: stable@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + fs/ext4/super.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -6479,7 +6479,7 @@ static ssize_t ext4_quota_write(struct s + struct buffer_head *bh; + handle_t *handle = journal_current_handle(); + +- if (EXT4_SB(sb)->s_journal && !handle) { ++ if (!handle) { + ext4_msg(sb, KERN_WARNING, "Quota write (off=%llu, len=%llu)" + " cancelled because transaction is not started", + (unsigned long long)off, (unsigned long long)len); diff --git a/queue-5.16/ext4-fix-null-ptr-deref-in-__ext4_journal_ensure_credits.patch b/queue-5.16/ext4-fix-null-ptr-deref-in-__ext4_journal_ensure_credits.patch new file mode 100644 index 00000000000..1f25820e410 --- /dev/null +++ b/queue-5.16/ext4-fix-null-ptr-deref-in-__ext4_journal_ensure_credits.patch @@ -0,0 +1,90 @@ +From 298b5c521746d69c07beb2757292fb5ccc1b0f85 Mon Sep 17 00:00:00 2001 +From: Ye Bin +Date: Fri, 24 Dec 2021 18:03:41 +0800 +Subject: ext4: fix null-ptr-deref in '__ext4_journal_ensure_credits' + +From: Ye Bin + +commit 298b5c521746d69c07beb2757292fb5ccc1b0f85 upstream. + +We got issue as follows when run syzkaller test: +[ 1901.130043] EXT4-fs error (device vda): ext4_remount:5624: comm syz-executor.5: Abort forced by user +[ 1901.130901] Aborting journal on device vda-8. +[ 1901.131437] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.16: Detected aborted journal +[ 1901.131566] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.11: Detected aborted journal +[ 1901.132586] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.18: Detected aborted journal +[ 1901.132751] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.9: Detected aborted journal +[ 1901.136149] EXT4-fs error (device vda) in ext4_reserve_inode_write:6035: Journal has aborted +[ 1901.136837] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-fuzzer: Detected aborted journal +[ 1901.136915] ================================================================== +[ 1901.138175] BUG: KASAN: null-ptr-deref in __ext4_journal_ensure_credits+0x74/0x140 [ext4] +[ 1901.138343] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.13: Detected aborted journal +[ 1901.138398] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.1: Detected aborted journal +[ 1901.138808] Read of size 8 at addr 0000000000000000 by task syz-executor.17/968 +[ 1901.138817] +[ 1901.138852] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.30: Detected aborted journal +[ 1901.144779] CPU: 1 PID: 968 Comm: syz-executor.17 Not tainted 4.19.90-vhulk2111.1.0.h893.eulerosv2r10.aarch64+ #1 +[ 1901.146479] Hardware name: linux,dummy-virt (DT) +[ 1901.147317] Call trace: +[ 1901.147552] dump_backtrace+0x0/0x2d8 +[ 1901.147898] show_stack+0x28/0x38 +[ 1901.148215] dump_stack+0xec/0x15c +[ 1901.148746] kasan_report+0x108/0x338 +[ 1901.149207] __asan_load8+0x58/0xb0 +[ 1901.149753] __ext4_journal_ensure_credits+0x74/0x140 [ext4] +[ 1901.150579] ext4_xattr_delete_inode+0xe4/0x700 [ext4] +[ 1901.151316] ext4_evict_inode+0x524/0xba8 [ext4] +[ 1901.151985] evict+0x1a4/0x378 +[ 1901.152353] iput+0x310/0x428 +[ 1901.152733] do_unlinkat+0x260/0x428 +[ 1901.153056] __arm64_sys_unlinkat+0x6c/0xc0 +[ 1901.153455] el0_svc_common+0xc8/0x320 +[ 1901.153799] el0_svc_handler+0xf8/0x160 +[ 1901.154265] el0_svc+0x10/0x218 +[ 1901.154682] ================================================================== + +This issue may happens like this: + Process1 Process2 +ext4_evict_inode + ext4_journal_start + ext4_truncate + ext4_ind_truncate + ext4_free_branches + ext4_ind_truncate_ensure_credits + ext4_journal_ensure_credits_fn + ext4_journal_restart + handle->h_transaction = NULL; + mount -o remount,abort /mnt + -> trigger JBD abort + start_this_handle -> will return failed + ext4_xattr_delete_inode + ext4_journal_ensure_credits + ext4_journal_ensure_credits_fn + __ext4_journal_ensure_credits + jbd2_handle_buffer_credits + journal = handle->h_transaction->t_journal; ->null-ptr-deref + +Now, indirect truncate process didn't handle error. To solve this issue +maybe simply add check handle is abort in '__ext4_journal_ensure_credits' +is enough, and i also think this is necessary. + +Cc: stable@kernel.org +Signed-off-by: Ye Bin +Link: https://lore.kernel.org/r/20211224100341.3299128-1-yebin10@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman +--- + fs/ext4/ext4_jbd2.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/ext4/ext4_jbd2.c ++++ b/fs/ext4/ext4_jbd2.c +@@ -162,6 +162,8 @@ int __ext4_journal_ensure_credits(handle + { + if (!ext4_handle_valid(handle)) + return 0; ++ if (is_handle_aborted(handle)) ++ return -EROFS; + if (jbd2_handle_buffer_credits(handle) >= check_cred && + handle->h_revoke_credits >= revoke_cred) + return 0; diff --git a/queue-5.16/ext4-set-csum-seed-in-tmp-inode-while-migrating-to-extents.patch b/queue-5.16/ext4-set-csum-seed-in-tmp-inode-while-migrating-to-extents.patch new file mode 100644 index 00000000000..194599e02dd --- /dev/null +++ b/queue-5.16/ext4-set-csum-seed-in-tmp-inode-while-migrating-to-extents.patch @@ -0,0 +1,58 @@ +From e81c9302a6c3c008f5c30beb73b38adb0170ff2d Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Lu=C3=ADs=20Henriques?= +Date: Tue, 14 Dec 2021 17:50:58 +0000 +Subject: ext4: set csum seed in tmp inode while migrating to extents +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Luís Henriques + +commit e81c9302a6c3c008f5c30beb73b38adb0170ff2d upstream. + +When migrating to extents, the temporary inode will have it's own checksum +seed. This means that, when swapping the inodes data, the inode checksums +will be incorrect. + +This can be fixed by recalculating the extents checksums again. Or simply +by copying the seed into the temporary inode. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=213357 +Reported-by: Jeroen van Wolffelaar +Signed-off-by: Luís Henriques +Link: https://lore.kernel.org/r/20211214175058.19511-1-lhenriques@suse.de +Signed-off-by: Theodore Ts'o +Cc: stable@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + fs/ext4/migrate.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/fs/ext4/migrate.c ++++ b/fs/ext4/migrate.c +@@ -459,6 +459,17 @@ int ext4_ext_migrate(struct inode *inode + ext4_journal_stop(handle); + goto out_unlock; + } ++ /* ++ * Use the correct seed for checksum (i.e. the seed from 'inode'). This ++ * is so that the metadata blocks will have the correct checksum after ++ * the migration. ++ * ++ * Note however that, if a crash occurs during the migration process, ++ * the recovery process is broken because the tmp_inode checksums will ++ * be wrong and the orphans cleanup will fail. ++ */ ++ ei = EXT4_I(inode); ++ EXT4_I(tmp_inode)->i_csum_seed = ei->i_csum_seed; + i_size_write(tmp_inode, i_size_read(inode)); + /* + * Set the i_nlink to zero so it will be deleted later +@@ -502,7 +513,6 @@ int ext4_ext_migrate(struct inode *inode + goto out_tmp_inode; + } + +- ei = EXT4_I(inode); + i_data = ei->i_data; + memset(&lb, 0, sizeof(lb)); + diff --git a/queue-5.16/ext4-use-ext4_ext_remove_space-for-fast-commit-replay-delete-range.patch b/queue-5.16/ext4-use-ext4_ext_remove_space-for-fast-commit-replay-delete-range.patch new file mode 100644 index 00000000000..44be1460390 --- /dev/null +++ b/queue-5.16/ext4-use-ext4_ext_remove_space-for-fast-commit-replay-delete-range.patch @@ -0,0 +1,60 @@ +From 0b5b5a62b945a141e64011b2f90ee7e46f14be98 Mon Sep 17 00:00:00 2001 +From: Xin Yin +Date: Thu, 23 Dec 2021 11:23:36 +0800 +Subject: ext4: use ext4_ext_remove_space() for fast commit replay delete range + +From: Xin Yin + +commit 0b5b5a62b945a141e64011b2f90ee7e46f14be98 upstream. + +For now ,we use ext4_punch_hole() during fast commit replay delete range +procedure. But it will be affected by inode->i_size, which may not +correct during fast commit replay procedure. The following test will +failed. + +-create & write foo (len 1000K) +-falloc FALLOC_FL_ZERO_RANGE foo (range 400K - 600K) +-create & fsync bar +-falloc FALLOC_FL_PUNCH_HOLE foo (range 300K-500K) +-fsync foo +-crash before a full commit + +After the fast_commit reply procedure, the range 400K-500K will not be +removed. Because in this case, when calling ext4_punch_hole() the +inode->i_size is 0, and it just retruns with doing nothing. + +Change to use ext4_ext_remove_space() instead of ext4_punch_hole() +to remove blocks of inode directly. + +Signed-off-by: Xin Yin +Reviewed-by: Harshad Shirwadkar +Link: https://lore.kernel.org/r/20211223032337.5198-2-yinxin.x@bytedance.com +Signed-off-by: Theodore Ts'o +Cc: stable@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + fs/ext4/fast_commit.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/fs/ext4/fast_commit.c ++++ b/fs/ext4/fast_commit.c +@@ -1812,11 +1812,14 @@ ext4_fc_replay_del_range(struct super_bl + } + } + +- ret = ext4_punch_hole(inode, +- le32_to_cpu(lrange.fc_lblk) << sb->s_blocksize_bits, +- le32_to_cpu(lrange.fc_len) << sb->s_blocksize_bits); +- if (ret) +- jbd_debug(1, "ext4_punch_hole returned %d", ret); ++ down_write(&EXT4_I(inode)->i_data_sem); ++ ret = ext4_ext_remove_space(inode, lrange.fc_lblk, ++ lrange.fc_lblk + lrange.fc_len - 1); ++ up_write(&EXT4_I(inode)->i_data_sem); ++ if (ret) { ++ iput(inode); ++ return 0; ++ } + ext4_ext_replay_shrink_inode(inode, + i_size_read(inode) >> sb->s_blocksize_bits); + ext4_mark_inode_dirty(NULL, inode); diff --git a/queue-5.16/series b/queue-5.16/series index fdcb0a26cad..85cfcdd94d9 100644 --- a/queue-5.16/series +++ b/queue-5.16/series @@ -891,3 +891,11 @@ ext4-make-sure-quota-gets-properly-shutdown-on-error.patch ext4-fix-a-possible-abba-deadlock-due-to-busy-pa.patch ext4-initialize-err_blk-before-calling-__ext4_get_inode_loc.patch ext4-fix-fast-commit-may-miss-tracking-range-for-falloc_fl_zero_range.patch +ext4-set-csum-seed-in-tmp-inode-while-migrating-to-extents.patch +ext4-fix-bug_on-in-ext4_bread-when-write-quota-data.patch +ext4-use-ext4_ext_remove_space-for-fast-commit-replay-delete-range.patch +ext4-fast-commit-may-miss-tracking-unwritten-range-during-ftruncate.patch +ext4-destroy-ext4_fc_dentry_cachep-kmemcache-on-module-removal.patch +ext4-fix-null-ptr-deref-in-__ext4_journal_ensure_credits.patch +ext4-fix-an-use-after-free-issue-about-data-journal-writeback-mode.patch +ext4-don-t-use-the-orphan-list-when-migrating-an-inode.patch