From: Greg Kroah-Hartman Date: Mon, 24 Jan 2022 07:59:39 +0000 (+0100) Subject: 4.9-stable patches X-Git-Tag: v4.4.300~101 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f6a73605f404af7df80c8ecfcc3c741083f5e354;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: ext4-don-t-use-the-orphan-list-when-migrating-an-inode.patch ext4-fix-bug_on-in-ext4_bread-when-write-quota-data.patch ext4-set-csum-seed-in-tmp-inode-while-migrating-to-extents.patch --- diff --git a/queue-4.9/ext4-don-t-use-the-orphan-list-when-migrating-an-inode.patch b/queue-4.9/ext4-don-t-use-the-orphan-list-when-migrating-an-inode.patch new file mode 100644 index 00000000000..299b2715113 --- /dev/null +++ b/queue-4.9/ext4-don-t-use-the-orphan-list-when-migrating-an-inode.patch @@ -0,0 +1,83 @@ +From 6eeaf88fd586f05aaf1d48cb3a139d2a5c6eb055 Mon Sep 17 00:00:00 2001 +From: Theodore Ts'o +Date: Wed, 5 Jan 2022 23:59:56 -0500 +Subject: ext4: don't use the orphan list when migrating an inode + +From: Theodore Ts'o + +commit 6eeaf88fd586f05aaf1d48cb3a139d2a5c6eb055 upstream. + +We probably want to remove the indirect block to extents migration +feature after a deprecation window, but until then, let's fix a +potential data loss problem caused by the fact that we put the +tmp_inode on the orphan list. In the unlikely case where we crash and +do a journal recovery, the data blocks belonging to the inode being +migrated are also represented in the tmp_inode on the orphan list --- +and so its data blocks will get marked unallocated, and available for +reuse. + +Instead, stop putting the tmp_inode on the oprhan list. So in the +case where we crash while migrating the inode, we'll leak an inode, +which is not a disaster. It will be easily fixed the next time we run +fsck, and it's better than potentially having blocks getting claimed +by two different files, and losing data as a result. + +Signed-off-by: Theodore Ts'o +Reviewed-by: Lukas Czerner +Cc: stable@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + fs/ext4/migrate.c | 19 ++++--------------- + 1 file changed, 4 insertions(+), 15 deletions(-) + +--- a/fs/ext4/migrate.c ++++ b/fs/ext4/migrate.c +@@ -462,12 +462,12 @@ int ext4_ext_migrate(struct inode *inode + percpu_down_write(&sbi->s_writepages_rwsem); + + /* +- * Worst case we can touch the allocation bitmaps, a bgd +- * block, and a block to link in the orphan list. We do need +- * need to worry about credits for modifying the quota inode. ++ * Worst case we can touch the allocation bitmaps and a block ++ * group descriptor block. We do need need to worry about ++ * credits for modifying the quota inode. + */ + handle = ext4_journal_start(inode, EXT4_HT_MIGRATE, +- 4 + EXT4_MAXQUOTAS_TRANS_BLOCKS(inode->i_sb)); ++ 3 + EXT4_MAXQUOTAS_TRANS_BLOCKS(inode->i_sb)); + + if (IS_ERR(handle)) { + retval = PTR_ERR(handle); +@@ -488,10 +488,6 @@ int ext4_ext_migrate(struct inode *inode + * Use the correct seed for checksum (i.e. the seed from 'inode'). This + * is so that the metadata blocks will have the correct checksum after + * the migration. +- * +- * Note however that, if a crash occurs during the migration process, +- * the recovery process is broken because the tmp_inode checksums will +- * be wrong and the orphans cleanup will fail. + */ + ei = EXT4_I(inode); + EXT4_I(tmp_inode)->i_csum_seed = ei->i_csum_seed; +@@ -503,7 +499,6 @@ int ext4_ext_migrate(struct inode *inode + clear_nlink(tmp_inode); + + ext4_ext_tree_init(handle, tmp_inode); +- ext4_orphan_add(handle, tmp_inode); + ext4_journal_stop(handle); + + /* +@@ -528,12 +523,6 @@ int ext4_ext_migrate(struct inode *inode + + handle = ext4_journal_start(inode, EXT4_HT_MIGRATE, 1); + if (IS_ERR(handle)) { +- /* +- * It is impossible to update on-disk structures without +- * a handle, so just rollback in-core changes and live other +- * work to orphan_list_cleanup() +- */ +- ext4_orphan_del(NULL, tmp_inode); + retval = PTR_ERR(handle); + goto out_tmp_inode; + } diff --git a/queue-4.9/ext4-fix-bug_on-in-ext4_bread-when-write-quota-data.patch b/queue-4.9/ext4-fix-bug_on-in-ext4_bread-when-write-quota-data.patch new file mode 100644 index 00000000000..7d7bbaaf8a1 --- /dev/null +++ b/queue-4.9/ext4-fix-bug_on-in-ext4_bread-when-write-quota-data.patch @@ -0,0 +1,103 @@ +From 380a0091cab482489e9b19e07f2a166ad2b76d5c Mon Sep 17 00:00:00 2001 +From: Ye Bin +Date: Thu, 23 Dec 2021 09:55:06 +0800 +Subject: ext4: Fix BUG_ON in ext4_bread when write quota data + +From: Ye Bin + +commit 380a0091cab482489e9b19e07f2a166ad2b76d5c upstream. + +We got issue as follows when run syzkaller: +[ 167.936972] EXT4-fs error (device loop0): __ext4_remount:6314: comm rep: Abort forced by user +[ 167.938306] EXT4-fs (loop0): Remounting filesystem read-only +[ 167.981637] Assertion failure in ext4_getblk() at fs/ext4/inode.c:847: '(EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY) || handle != NULL || create == 0' +[ 167.983601] ------------[ cut here ]------------ +[ 167.984245] kernel BUG at fs/ext4/inode.c:847! +[ 167.984882] invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI +[ 167.985624] CPU: 7 PID: 2290 Comm: rep Tainted: G B 5.16.0-rc5-next-20211217+ #123 +[ 167.986823] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014 +[ 167.988590] RIP: 0010:ext4_getblk+0x17e/0x504 +[ 167.989189] Code: c6 01 74 28 49 c7 c0 a0 a3 5c 9b b9 4f 03 00 00 48 c7 c2 80 9c 5c 9b 48 c7 c6 40 b6 5c 9b 48 c7 c7 20 a4 5c 9b e8 77 e3 fd ff <0f> 0b 8b 04 244 +[ 167.991679] RSP: 0018:ffff8881736f7398 EFLAGS: 00010282 +[ 167.992385] RAX: 0000000000000094 RBX: 1ffff1102e6dee75 RCX: 0000000000000000 +[ 167.993337] RDX: 0000000000000001 RSI: ffffffff9b6e29e0 RDI: ffffed102e6dee66 +[ 167.994292] RBP: ffff88816a076210 R08: 0000000000000094 R09: ffffed107363fa09 +[ 167.995252] R10: ffff88839b1fd047 R11: ffffed107363fa08 R12: ffff88816a0761e8 +[ 167.996205] R13: 0000000000000000 R14: 0000000000000021 R15: 0000000000000001 +[ 167.997158] FS: 00007f6a1428c740(0000) GS:ffff88839b000000(0000) knlGS:0000000000000000 +[ 167.998238] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 167.999025] CR2: 00007f6a140716c8 CR3: 0000000133216000 CR4: 00000000000006e0 +[ 167.999987] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 168.000944] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 168.001899] Call Trace: +[ 168.002235] +[ 168.007167] ext4_bread+0xd/0x53 +[ 168.007612] ext4_quota_write+0x20c/0x5c0 +[ 168.010457] write_blk+0x100/0x220 +[ 168.010944] remove_free_dqentry+0x1c6/0x440 +[ 168.011525] free_dqentry.isra.0+0x565/0x830 +[ 168.012133] remove_tree+0x318/0x6d0 +[ 168.014744] remove_tree+0x1eb/0x6d0 +[ 168.017346] remove_tree+0x1eb/0x6d0 +[ 168.019969] remove_tree+0x1eb/0x6d0 +[ 168.022128] qtree_release_dquot+0x291/0x340 +[ 168.023297] v2_release_dquot+0xce/0x120 +[ 168.023847] dquot_release+0x197/0x3e0 +[ 168.024358] ext4_release_dquot+0x22a/0x2d0 +[ 168.024932] dqput.part.0+0x1c9/0x900 +[ 168.025430] __dquot_drop+0x120/0x190 +[ 168.025942] ext4_clear_inode+0x86/0x220 +[ 168.026472] ext4_evict_inode+0x9e8/0xa22 +[ 168.028200] evict+0x29e/0x4f0 +[ 168.028625] dispose_list+0x102/0x1f0 +[ 168.029148] evict_inodes+0x2c1/0x3e0 +[ 168.030188] generic_shutdown_super+0xa4/0x3b0 +[ 168.030817] kill_block_super+0x95/0xd0 +[ 168.031360] deactivate_locked_super+0x85/0xd0 +[ 168.031977] cleanup_mnt+0x2bc/0x480 +[ 168.033062] task_work_run+0xd1/0x170 +[ 168.033565] do_exit+0xa4f/0x2b50 +[ 168.037155] do_group_exit+0xef/0x2d0 +[ 168.037666] __x64_sys_exit_group+0x3a/0x50 +[ 168.038237] do_syscall_64+0x3b/0x90 +[ 168.038751] entry_SYSCALL_64_after_hwframe+0x44/0xae + +In order to reproduce this problem, the following conditions need to be met: +1. Ext4 filesystem with no journal; +2. Filesystem image with incorrect quota data; +3. Abort filesystem forced by user; +4. umount filesystem; + +As in ext4_quota_write: +... + if (EXT4_SB(sb)->s_journal && !handle) { + ext4_msg(sb, KERN_WARNING, "Quota write (off=%llu, len=%llu)" + " cancelled because transaction is not started", + (unsigned long long)off, (unsigned long long)len); + return -EIO; + } +... +We only check handle if NULL when filesystem has journal. There is need +check handle if NULL even when filesystem has no journal. + +Signed-off-by: Ye Bin +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20211223015506.297766-1-yebin10@huawei.com +Signed-off-by: Theodore Ts'o +Cc: stable@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + fs/ext4/super.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -5602,7 +5602,7 @@ static ssize_t ext4_quota_write(struct s + struct buffer_head *bh; + handle_t *handle = journal_current_handle(); + +- if (EXT4_SB(sb)->s_journal && !handle) { ++ if (!handle) { + ext4_msg(sb, KERN_WARNING, "Quota write (off=%llu, len=%llu)" + " cancelled because transaction is not started", + (unsigned long long)off, (unsigned long long)len); diff --git a/queue-4.9/ext4-set-csum-seed-in-tmp-inode-while-migrating-to-extents.patch b/queue-4.9/ext4-set-csum-seed-in-tmp-inode-while-migrating-to-extents.patch new file mode 100644 index 00000000000..f1b62fe179b --- /dev/null +++ b/queue-4.9/ext4-set-csum-seed-in-tmp-inode-while-migrating-to-extents.patch @@ -0,0 +1,58 @@ +From e81c9302a6c3c008f5c30beb73b38adb0170ff2d Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Lu=C3=ADs=20Henriques?= +Date: Tue, 14 Dec 2021 17:50:58 +0000 +Subject: ext4: set csum seed in tmp inode while migrating to extents +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Luís Henriques + +commit e81c9302a6c3c008f5c30beb73b38adb0170ff2d upstream. + +When migrating to extents, the temporary inode will have it's own checksum +seed. This means that, when swapping the inodes data, the inode checksums +will be incorrect. + +This can be fixed by recalculating the extents checksums again. Or simply +by copying the seed into the temporary inode. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=213357 +Reported-by: Jeroen van Wolffelaar +Signed-off-by: Luís Henriques +Link: https://lore.kernel.org/r/20211214175058.19511-1-lhenriques@suse.de +Signed-off-by: Theodore Ts'o +Cc: stable@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + fs/ext4/migrate.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/fs/ext4/migrate.c ++++ b/fs/ext4/migrate.c +@@ -484,6 +484,17 @@ int ext4_ext_migrate(struct inode *inode + ext4_journal_stop(handle); + goto out_unlock; + } ++ /* ++ * Use the correct seed for checksum (i.e. the seed from 'inode'). This ++ * is so that the metadata blocks will have the correct checksum after ++ * the migration. ++ * ++ * Note however that, if a crash occurs during the migration process, ++ * the recovery process is broken because the tmp_inode checksums will ++ * be wrong and the orphans cleanup will fail. ++ */ ++ ei = EXT4_I(inode); ++ EXT4_I(tmp_inode)->i_csum_seed = ei->i_csum_seed; + i_size_write(tmp_inode, i_size_read(inode)); + /* + * Set the i_nlink to zero so it will be deleted later +@@ -527,7 +538,6 @@ int ext4_ext_migrate(struct inode *inode + goto out_tmp_inode; + } + +- ei = EXT4_I(inode); + i_data = ei->i_data; + memset(&lb, 0, sizeof(lb)); + diff --git a/queue-4.9/series b/queue-4.9/series index e9d52f427fc..602688dec7a 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -119,3 +119,6 @@ power-bq25890-enable-continuous-conversion-for-adc-a.patch ubifs-error-path-in-ubifs_remount_rw-seems-to-wrongly-free-write-buffers.patch iwlwifi-mvm-increase-the-scan-timeout-guard-to-30-seconds.patch drm-etnaviv-limit-submit-sizes.patch +ext4-set-csum-seed-in-tmp-inode-while-migrating-to-extents.patch +ext4-fix-bug_on-in-ext4_bread-when-write-quota-data.patch +ext4-don-t-use-the-orphan-list-when-migrating-an-inode.patch