From 8349ac425efb9ebe33015cd7cc3d83b70fa8c4aa Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 29 Aug 2014 15:29:37 -0700 Subject: [PATCH] 3.16-stable patches added patches: ext4-fix-bug_on-in-mb_free_blocks.patch --- .../ext4-fix-bug_on-in-mb_free_blocks.patch | 62 +++++++++++++++++++ queue-3.16/series | 1 + 2 files changed, 63 insertions(+) create mode 100644 queue-3.16/ext4-fix-bug_on-in-mb_free_blocks.patch diff --git a/queue-3.16/ext4-fix-bug_on-in-mb_free_blocks.patch b/queue-3.16/ext4-fix-bug_on-in-mb_free_blocks.patch new file mode 100644 index 00000000000..ace4f705798 --- /dev/null +++ b/queue-3.16/ext4-fix-bug_on-in-mb_free_blocks.patch @@ -0,0 +1,62 @@ +From c99d1e6e83b06744c75d9f5e491ed495a7086b7b Mon Sep 17 00:00:00 2001 +From: Theodore Ts'o +Date: Sat, 23 Aug 2014 17:47:28 -0400 +Subject: ext4: fix BUG_ON in mb_free_blocks() + +From: Theodore Ts'o + +commit c99d1e6e83b06744c75d9f5e491ed495a7086b7b upstream. + +If we suffer a block allocation failure (for example due to a memory +allocation failure), it's possible that we will call +ext4_discard_allocated_blocks() before we've actually allocated any +blocks. In that case, fe_len and fe_start in ac->ac_f_ex will still +be zero, and this will result in mb_free_blocks(inode, e4b, 0, 0) +triggering the BUG_ON on mb_free_blocks(): + + BUG_ON(last >= (sb->s_blocksize << 3)); + +Fix this by bailing out of ext4_discard_allocated_blocks() if fs_len +is zero. + +Also fix a missing ext4_mb_unload_buddy() call in +ext4_discard_allocated_blocks(). + +Google-Bug-Id: 16844242 + +Fixes: 86f0afd463215fc3e58020493482faa4ac3a4d69 +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/mballoc.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -1412,6 +1412,8 @@ static void mb_free_blocks(struct inode + int last = first + count - 1; + struct super_block *sb = e4b->bd_sb; + ++ if (WARN_ON(count == 0)) ++ return; + BUG_ON(last >= (sb->s_blocksize << 3)); + assert_spin_locked(ext4_group_lock_ptr(sb, e4b->bd_group)); + /* Don't bother if the block group is corrupt. */ +@@ -3220,6 +3222,8 @@ static void ext4_discard_allocated_block + int err; + + if (pa == NULL) { ++ if (ac->ac_f_ex.fe_len == 0) ++ return; + err = ext4_mb_load_buddy(ac->ac_sb, ac->ac_f_ex.fe_group, &e4b); + if (err) { + /* +@@ -3234,6 +3238,7 @@ static void ext4_discard_allocated_block + mb_free_blocks(ac->ac_inode, &e4b, ac->ac_f_ex.fe_start, + ac->ac_f_ex.fe_len); + ext4_unlock_group(ac->ac_sb, ac->ac_f_ex.fe_group); ++ ext4_mb_unload_buddy(&e4b); + return; + } + if (pa->pa_type == MB_INODE_PA) diff --git a/queue-3.16/series b/queue-3.16/series index 4d1f4f66912..38b20c32f8b 100644 --- a/queue-3.16/series +++ b/queue-3.16/series @@ -60,3 +60,4 @@ kvm-ppc-book3s-fix-lpcr-one_reg-interface.patch kvm-nvmx-fix-acknowledge-interrupt-on-exit-when-apicv-is-in-use.patch revert-kvm-x86-increase-the-number-of-fixed-mtrr-regs-to-10.patch kvm-iommu-fix-the-third-parameter-of-kvm_iommu_put_pages-cve-2014-3601.patch +ext4-fix-bug_on-in-mb_free_blocks.patch -- 2.47.3