]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
4.14-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 15 Aug 2022 11:29:15 +0000 (13:29 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 15 Aug 2022 11:29:15 +0000 (13:29 +0200)
added patches:
ext4-add-ext4_inode_has_xattr_space-macro-in-xattr.h.patch
ext4-correct-max_inline_xattr_value_size-computing.patch
ext4-correct-the-misjudgment-in-ext4_iget_extra_inode.patch
ext4-fix-extent-status-tree-race-in-writeback-error-recovery-path.patch
ext4-fix-use-after-free-in-ext4_xattr_set_entry.patch
ext4-make-sure-ext4_append-always-allocates-new-block.patch
ext4-remove-ea-inode-entry-from-mbcache-on-inode-eviction.patch
ext4-update-s_overhead_clusters-in-the-superblock-during-an-on-line-resize.patch

queue-4.14/ext4-add-ext4_inode_has_xattr_space-macro-in-xattr.h.patch [new file with mode: 0644]
queue-4.14/ext4-correct-max_inline_xattr_value_size-computing.patch [new file with mode: 0644]
queue-4.14/ext4-correct-the-misjudgment-in-ext4_iget_extra_inode.patch [new file with mode: 0644]
queue-4.14/ext4-fix-extent-status-tree-race-in-writeback-error-recovery-path.patch [new file with mode: 0644]
queue-4.14/ext4-fix-use-after-free-in-ext4_xattr_set_entry.patch [new file with mode: 0644]
queue-4.14/ext4-make-sure-ext4_append-always-allocates-new-block.patch [new file with mode: 0644]
queue-4.14/ext4-remove-ea-inode-entry-from-mbcache-on-inode-eviction.patch [new file with mode: 0644]
queue-4.14/ext4-update-s_overhead_clusters-in-the-superblock-during-an-on-line-resize.patch [new file with mode: 0644]
queue-4.14/series

diff --git a/queue-4.14/ext4-add-ext4_inode_has_xattr_space-macro-in-xattr.h.patch b/queue-4.14/ext4-add-ext4_inode_has_xattr_space-macro-in-xattr.h.patch
new file mode 100644 (file)
index 0000000..4f20d70
--- /dev/null
@@ -0,0 +1,45 @@
+From 179b14152dcb6a24c3415200603aebca70ff13af Mon Sep 17 00:00:00 2001
+From: Baokun Li <libaokun1@huawei.com>
+Date: Thu, 16 Jun 2022 10:13:55 +0800
+Subject: ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h
+
+From: Baokun Li <libaokun1@huawei.com>
+
+commit 179b14152dcb6a24c3415200603aebca70ff13af upstream.
+
+When adding an xattr to an inode, we must ensure that the inode_size is
+not less than EXT4_GOOD_OLD_INODE_SIZE + extra_isize + pad. Otherwise,
+the end position may be greater than the start position, resulting in UAF.
+
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
+Link: https://lore.kernel.org/r/20220616021358.2504451-2-libaokun1@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/xattr.h |   13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/fs/ext4/xattr.h
++++ b/fs/ext4/xattr.h
+@@ -95,6 +95,19 @@ struct ext4_xattr_entry {
+ #define EXT4_ZERO_XATTR_VALUE ((void *)-1)
++/*
++ * If we want to add an xattr to the inode, we should make sure that
++ * i_extra_isize is not 0 and that the inode size is not less than
++ * EXT4_GOOD_OLD_INODE_SIZE + extra_isize + pad.
++ *   EXT4_GOOD_OLD_INODE_SIZE   extra_isize header   entry   pad  data
++ * |--------------------------|------------|------|---------|---|-------|
++ */
++#define EXT4_INODE_HAS_XATTR_SPACE(inode)                             \
++      ((EXT4_I(inode)->i_extra_isize != 0) &&                         \
++       (EXT4_GOOD_OLD_INODE_SIZE + EXT4_I(inode)->i_extra_isize +     \
++        sizeof(struct ext4_xattr_ibody_header) + EXT4_XATTR_PAD <=    \
++        EXT4_INODE_SIZE((inode)->i_sb)))
++
+ struct ext4_xattr_info {
+       const char *name;
+       const void *value;
diff --git a/queue-4.14/ext4-correct-max_inline_xattr_value_size-computing.patch b/queue-4.14/ext4-correct-max_inline_xattr_value_size-computing.patch
new file mode 100644 (file)
index 0000000..9ff706e
--- /dev/null
@@ -0,0 +1,36 @@
+From c9fd167d57133c5b748d16913c4eabc55e531c73 Mon Sep 17 00:00:00 2001
+From: Baokun Li <libaokun1@huawei.com>
+Date: Thu, 16 Jun 2022 10:13:57 +0800
+Subject: ext4: correct max_inline_xattr_value_size computing
+
+From: Baokun Li <libaokun1@huawei.com>
+
+commit c9fd167d57133c5b748d16913c4eabc55e531c73 upstream.
+
+If the ext4 inode does not have xattr space, 0 is returned in the
+get_max_inline_xattr_value_size function. Otherwise, the function returns
+a negative value when the inode does not contain EXT4_STATE_XATTR.
+
+Cc: stable@kernel.org
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20220616021358.2504451-4-libaokun1@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/inline.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -40,6 +40,9 @@ static int get_max_inline_xattr_value_si
+       struct ext4_inode *raw_inode;
+       int free, min_offs;
++      if (!EXT4_INODE_HAS_XATTR_SPACE(inode))
++              return 0;
++
+       min_offs = EXT4_SB(inode->i_sb)->s_inode_size -
+                       EXT4_GOOD_OLD_INODE_SIZE -
+                       EXT4_I(inode)->i_extra_isize -
diff --git a/queue-4.14/ext4-correct-the-misjudgment-in-ext4_iget_extra_inode.patch b/queue-4.14/ext4-correct-the-misjudgment-in-ext4_iget_extra_inode.patch
new file mode 100644 (file)
index 0000000..77fc2c3
--- /dev/null
@@ -0,0 +1,35 @@
+From fd7e672ea98b95b9d4c9dae316639f03c16a749d Mon Sep 17 00:00:00 2001
+From: Baokun Li <libaokun1@huawei.com>
+Date: Thu, 16 Jun 2022 10:13:58 +0800
+Subject: ext4: correct the misjudgment in ext4_iget_extra_inode
+
+From: Baokun Li <libaokun1@huawei.com>
+
+commit fd7e672ea98b95b9d4c9dae316639f03c16a749d upstream.
+
+Use the EXT4_INODE_HAS_XATTR_SPACE macro to more accurately
+determine whether the inode have xattr space.
+
+Cc: stable@kernel.org
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20220616021358.2504451-5-libaokun1@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/inode.c |    3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -4737,8 +4737,7 @@ static inline int ext4_iget_extra_inode(
+       __le32 *magic = (void *)raw_inode +
+                       EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize;
+-      if (EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize + sizeof(__le32) <=
+-          EXT4_INODE_SIZE(inode->i_sb) &&
++      if (EXT4_INODE_HAS_XATTR_SPACE(inode)  &&
+           *magic == cpu_to_le32(EXT4_XATTR_MAGIC)) {
+               ext4_set_inode_state(inode, EXT4_STATE_XATTR);
+               return ext4_find_inline_data_nolock(inode);
diff --git a/queue-4.14/ext4-fix-extent-status-tree-race-in-writeback-error-recovery-path.patch b/queue-4.14/ext4-fix-extent-status-tree-race-in-writeback-error-recovery-path.patch
new file mode 100644 (file)
index 0000000..4aa3a07
--- /dev/null
@@ -0,0 +1,52 @@
+From 7f0d8e1d607c1a4fa9a27362a108921d82230874 Mon Sep 17 00:00:00 2001
+From: Eric Whitney <enwlinux@gmail.com>
+Date: Wed, 15 Jun 2022 12:05:30 -0400
+Subject: ext4: fix extent status tree race in writeback error recovery path
+
+From: Eric Whitney <enwlinux@gmail.com>
+
+commit 7f0d8e1d607c1a4fa9a27362a108921d82230874 upstream.
+
+A race can occur in the unlikely event ext4 is unable to allocate a
+physical cluster for a delayed allocation in a bigalloc file system
+during writeback.  Failure to allocate a cluster forces error recovery
+that includes a call to mpage_release_unused_pages().  That function
+removes any corresponding delayed allocated blocks from the extent
+status tree.  If a new delayed write is in progress on the same cluster
+simultaneously, resulting in the addition of an new extent containing
+one or more blocks in that cluster to the extent status tree, delayed
+block accounting can be thrown off if that delayed write then encounters
+a similar cluster allocation failure during future writeback.
+
+Write lock the i_data_sem in mpage_release_unused_pages() to fix this
+problem.  Ext4's block/cluster accounting code for bigalloc relies on
+i_data_sem for mutual exclusion, as is found in the delayed write path,
+and the locking in mpage_release_unused_pages() is missing.
+
+Cc: stable@kernel.org
+Reported-by: Ye Bin <yebin10@huawei.com>
+Signed-off-by: Eric Whitney <enwlinux@gmail.com>
+Link: https://lore.kernel.org/r/20220615160530.1928801-1-enwlinux@gmail.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/inode.c |    7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -1756,7 +1756,14 @@ static void mpage_release_unused_pages(s
+               ext4_lblk_t start, last;
+               start = index << (PAGE_SHIFT - inode->i_blkbits);
+               last = end << (PAGE_SHIFT - inode->i_blkbits);
++
++              /*
++               * avoid racing with extent status tree scans made by
++               * ext4_insert_delayed_block()
++               */
++              down_write(&EXT4_I(inode)->i_data_sem);
+               ext4_es_remove_extent(inode, start, last - start + 1);
++              up_write(&EXT4_I(inode)->i_data_sem);
+       }
+       pagevec_init(&pvec, 0);
diff --git a/queue-4.14/ext4-fix-use-after-free-in-ext4_xattr_set_entry.patch b/queue-4.14/ext4-fix-use-after-free-in-ext4_xattr_set_entry.patch
new file mode 100644 (file)
index 0000000..3fc5678
--- /dev/null
@@ -0,0 +1,123 @@
+From 67d7d8ad99beccd9fe92d585b87f1760dc9018e3 Mon Sep 17 00:00:00 2001
+From: Baokun Li <libaokun1@huawei.com>
+Date: Thu, 16 Jun 2022 10:13:56 +0800
+Subject: ext4: fix use-after-free in ext4_xattr_set_entry
+
+From: Baokun Li <libaokun1@huawei.com>
+
+commit 67d7d8ad99beccd9fe92d585b87f1760dc9018e3 upstream.
+
+Hulk Robot reported a issue:
+==================================================================
+BUG: KASAN: use-after-free in ext4_xattr_set_entry+0x18ab/0x3500
+Write of size 4105 at addr ffff8881675ef5f4 by task syz-executor.0/7092
+
+CPU: 1 PID: 7092 Comm: syz-executor.0 Not tainted 4.19.90-dirty #17
+Call Trace:
+[...]
+ memcpy+0x34/0x50 mm/kasan/kasan.c:303
+ ext4_xattr_set_entry+0x18ab/0x3500 fs/ext4/xattr.c:1747
+ ext4_xattr_ibody_inline_set+0x86/0x2a0 fs/ext4/xattr.c:2205
+ ext4_xattr_set_handle+0x940/0x1300 fs/ext4/xattr.c:2386
+ ext4_xattr_set+0x1da/0x300 fs/ext4/xattr.c:2498
+ __vfs_setxattr+0x112/0x170 fs/xattr.c:149
+ __vfs_setxattr_noperm+0x11b/0x2a0 fs/xattr.c:180
+ __vfs_setxattr_locked+0x17b/0x250 fs/xattr.c:238
+ vfs_setxattr+0xed/0x270 fs/xattr.c:255
+ setxattr+0x235/0x330 fs/xattr.c:520
+ path_setxattr+0x176/0x190 fs/xattr.c:539
+ __do_sys_lsetxattr fs/xattr.c:561 [inline]
+ __se_sys_lsetxattr fs/xattr.c:557 [inline]
+ __x64_sys_lsetxattr+0xc2/0x160 fs/xattr.c:557
+ do_syscall_64+0xdf/0x530 arch/x86/entry/common.c:298
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+RIP: 0033:0x459fe9
+RSP: 002b:00007fa5e54b4c08 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd
+RAX: ffffffffffffffda RBX: 000000000051bf60 RCX: 0000000000459fe9
+RDX: 00000000200003c0 RSI: 0000000020000180 RDI: 0000000020000140
+RBP: 000000000051bf60 R08: 0000000000000001 R09: 0000000000000000
+R10: 0000000000001009 R11: 0000000000000246 R12: 0000000000000000
+R13: 00007ffc73c93fc0 R14: 000000000051bf60 R15: 00007fa5e54b4d80
+[...]
+==================================================================
+
+Above issue may happen as follows:
+-------------------------------------
+ext4_xattr_set
+  ext4_xattr_set_handle
+    ext4_xattr_ibody_find
+      >> s->end < s->base
+      >> no EXT4_STATE_XATTR
+      >> xattr_check_inode is not executed
+    ext4_xattr_ibody_set
+      ext4_xattr_set_entry
+       >> size_t min_offs = s->end - s->base
+       >> UAF in memcpy
+
+we can easily reproduce this problem with the following commands:
+    mkfs.ext4 -F /dev/sda
+    mount -o debug_want_extra_isize=128 /dev/sda /mnt
+    touch /mnt/file
+    setfattr -n user.cat -v `seq -s z 4096|tr -d '[:digit:]'` /mnt/file
+
+In ext4_xattr_ibody_find, we have the following assignment logic:
+  header = IHDR(inode, raw_inode)
+         = raw_inode + EXT4_GOOD_OLD_INODE_SIZE + i_extra_isize
+  is->s.base = IFIRST(header)
+             = header + sizeof(struct ext4_xattr_ibody_header)
+  is->s.end = raw_inode + s_inode_size
+
+In ext4_xattr_set_entry
+  min_offs = s->end - s->base
+           = s_inode_size - EXT4_GOOD_OLD_INODE_SIZE - i_extra_isize -
+            sizeof(struct ext4_xattr_ibody_header)
+  last = s->first
+  free = min_offs - ((void *)last - s->base) - sizeof(__u32)
+       = s_inode_size - EXT4_GOOD_OLD_INODE_SIZE - i_extra_isize -
+         sizeof(struct ext4_xattr_ibody_header) - sizeof(__u32)
+
+In the calculation formula, all values except s_inode_size and
+i_extra_size are fixed values. When i_extra_size is the maximum value
+s_inode_size - EXT4_GOOD_OLD_INODE_SIZE, min_offs is -4 and free is -8.
+The value overflows. As a result, the preceding issue is triggered when
+memcpy is executed.
+
+Therefore, when finding xattr or setting xattr, check whether
+there is space for storing xattr in the inode to resolve this issue.
+
+Cc: stable@kernel.org
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20220616021358.2504451-3-libaokun1@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/xattr.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -2179,8 +2179,9 @@ int ext4_xattr_ibody_find(struct inode *
+       struct ext4_inode *raw_inode;
+       int error;
+-      if (EXT4_I(inode)->i_extra_isize == 0)
++      if (!EXT4_INODE_HAS_XATTR_SPACE(inode))
+               return 0;
++
+       raw_inode = ext4_raw_inode(&is->iloc);
+       header = IHDR(inode, raw_inode);
+       is->s.base = is->s.first = IFIRST(header);
+@@ -2208,8 +2209,9 @@ int ext4_xattr_ibody_inline_set(handle_t
+       struct ext4_xattr_search *s = &is->s;
+       int error;
+-      if (EXT4_I(inode)->i_extra_isize == 0)
++      if (!EXT4_INODE_HAS_XATTR_SPACE(inode))
+               return -ENOSPC;
++
+       error = ext4_xattr_set_entry(i, s, handle, inode, false /* is_block */);
+       if (error)
+               return error;
diff --git a/queue-4.14/ext4-make-sure-ext4_append-always-allocates-new-block.patch b/queue-4.14/ext4-make-sure-ext4_append-always-allocates-new-block.patch
new file mode 100644 (file)
index 0000000..e1ff1a1
--- /dev/null
@@ -0,0 +1,58 @@
+From b8a04fe77ef1360fbf73c80fddbdfeaa9407ed1b Mon Sep 17 00:00:00 2001
+From: Lukas Czerner <lczerner@redhat.com>
+Date: Mon, 4 Jul 2022 16:27:21 +0200
+Subject: ext4: make sure ext4_append() always allocates new block
+
+From: Lukas Czerner <lczerner@redhat.com>
+
+commit b8a04fe77ef1360fbf73c80fddbdfeaa9407ed1b upstream.
+
+ext4_append() must always allocate a new block, otherwise we run the
+risk of overwriting existing directory block corrupting the directory
+tree in the process resulting in all manner of problems later on.
+
+Add a sanity check to see if the logical block is already allocated and
+error out if it is.
+
+Cc: stable@kernel.org
+Signed-off-by: Lukas Czerner <lczerner@redhat.com>
+Reviewed-by: Andreas Dilger <adilger@dilger.ca>
+Link: https://lore.kernel.org/r/20220704142721.157985-2-lczerner@redhat.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/namei.c |   16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -52,6 +52,7 @@ static struct buffer_head *ext4_append(h
+                                       struct inode *inode,
+                                       ext4_lblk_t *block)
+ {
++      struct ext4_map_blocks map;
+       struct buffer_head *bh;
+       int err;
+@@ -61,6 +62,21 @@ static struct buffer_head *ext4_append(h
+               return ERR_PTR(-ENOSPC);
+       *block = inode->i_size >> inode->i_sb->s_blocksize_bits;
++      map.m_lblk = *block;
++      map.m_len = 1;
++
++      /*
++       * We're appending new directory block. Make sure the block is not
++       * allocated yet, otherwise we will end up corrupting the
++       * directory.
++       */
++      err = ext4_map_blocks(NULL, inode, &map, 0);
++      if (err < 0)
++              return ERR_PTR(err);
++      if (err) {
++              EXT4_ERROR_INODE(inode, "Logical block already allocated");
++              return ERR_PTR(-EFSCORRUPTED);
++      }
+       bh = ext4_bread(handle, inode, *block, EXT4_GET_BLOCKS_CREATE);
+       if (IS_ERR(bh))
diff --git a/queue-4.14/ext4-remove-ea-inode-entry-from-mbcache-on-inode-eviction.patch b/queue-4.14/ext4-remove-ea-inode-entry-from-mbcache-on-inode-eviction.patch
new file mode 100644 (file)
index 0000000..5b632df
--- /dev/null
@@ -0,0 +1,107 @@
+From 6bc0d63dad7f9f54d381925ee855b402f652fa39 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Tue, 12 Jul 2022 12:54:22 +0200
+Subject: ext4: remove EA inode entry from mbcache on inode eviction
+
+From: Jan Kara <jack@suse.cz>
+
+commit 6bc0d63dad7f9f54d381925ee855b402f652fa39 upstream.
+
+Currently we remove EA inode from mbcache as soon as its xattr refcount
+drops to zero. However there can be pending attempts to reuse the inode
+and thus refcount handling code has to handle the situation when
+refcount increases from zero anyway. So save some work and just keep EA
+inode in mbcache until it is getting evicted. At that moment we are sure
+following iget() of EA inode will fail anyway (or wait for eviction to
+finish and load things from the disk again) and so removing mbcache
+entry at that moment is fine and simplifies the code a bit.
+
+CC: stable@vger.kernel.org
+Fixes: 82939d7999df ("ext4: convert to mbcache2")
+Signed-off-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20220712105436.32204-3-jack@suse.cz
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/inode.c |    2 ++
+ fs/ext4/xattr.c |   24 ++++++++----------------
+ fs/ext4/xattr.h |    1 +
+ 3 files changed, 11 insertions(+), 16 deletions(-)
+
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -206,6 +206,8 @@ void ext4_evict_inode(struct inode *inod
+       trace_ext4_evict_inode(inode);
++      if (EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL)
++              ext4_evict_ea_inode(inode);
+       if (inode->i_nlink) {
+               /*
+                * When journalling data dirty buffers are tracked only in the
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -433,6 +433,14 @@ error:
+       return err;
+ }
++/* Remove entry from mbcache when EA inode is getting evicted */
++void ext4_evict_ea_inode(struct inode *inode)
++{
++      if (EA_INODE_CACHE(inode))
++              mb_cache_entry_delete(EA_INODE_CACHE(inode),
++                      ext4_xattr_inode_get_hash(inode), inode->i_ino);
++}
++
+ static int
+ ext4_xattr_inode_verify_hashes(struct inode *ea_inode,
+                              struct ext4_xattr_entry *entry, void *buffer,
+@@ -1018,10 +1026,8 @@ static int ext4_xattr_ensure_credits(han
+ static int ext4_xattr_inode_update_ref(handle_t *handle, struct inode *ea_inode,
+                                      int ref_change)
+ {
+-      struct mb_cache *ea_inode_cache = EA_INODE_CACHE(ea_inode);
+       struct ext4_iloc iloc;
+       s64 ref_count;
+-      u32 hash;
+       int ret;
+       inode_lock(ea_inode);
+@@ -1046,14 +1052,6 @@ static int ext4_xattr_inode_update_ref(h
+                       set_nlink(ea_inode, 1);
+                       ext4_orphan_del(handle, ea_inode);
+-
+-                      if (ea_inode_cache) {
+-                              hash = ext4_xattr_inode_get_hash(ea_inode);
+-                              mb_cache_entry_create(ea_inode_cache,
+-                                                    GFP_NOFS, hash,
+-                                                    ea_inode->i_ino,
+-                                                    true /* reusable */);
+-                      }
+               }
+       } else {
+               WARN_ONCE(ref_count < 0, "EA inode %lu ref_count=%lld",
+@@ -1066,12 +1064,6 @@ static int ext4_xattr_inode_update_ref(h
+                       clear_nlink(ea_inode);
+                       ext4_orphan_add(handle, ea_inode);
+-
+-                      if (ea_inode_cache) {
+-                              hash = ext4_xattr_inode_get_hash(ea_inode);
+-                              mb_cache_entry_delete(ea_inode_cache, hash,
+-                                                    ea_inode->i_ino);
+-                      }
+               }
+       }
+--- a/fs/ext4/xattr.h
++++ b/fs/ext4/xattr.h
+@@ -190,6 +190,7 @@ extern void ext4_xattr_inode_array_free(
+ extern int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,
+                           struct ext4_inode *raw_inode, handle_t *handle);
++extern void ext4_evict_ea_inode(struct inode *inode);
+ extern const struct xattr_handler *ext4_xattr_handlers[];
diff --git a/queue-4.14/ext4-update-s_overhead_clusters-in-the-superblock-during-an-on-line-resize.patch b/queue-4.14/ext4-update-s_overhead_clusters-in-the-superblock-during-an-on-line-resize.patch
new file mode 100644 (file)
index 0000000..c583c04
--- /dev/null
@@ -0,0 +1,45 @@
+From de394a86658ffe4e89e5328fd4993abfe41b7435 Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Wed, 29 Jun 2022 00:00:25 -0400
+Subject: ext4: update s_overhead_clusters in the superblock during an on-line resize
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+commit de394a86658ffe4e89e5328fd4993abfe41b7435 upstream.
+
+When doing an online resize, the on-disk superblock on-disk wasn't
+updated.  This means that when the file system is unmounted and
+remounted, and the on-disk overhead value is non-zero, this would
+result in the results of statfs(2) to be incorrect.
+
+This was partially fixed by Commits 10b01ee92df5 ("ext4: fix overhead
+calculation to account for the reserved gdt blocks"), 85d825dbf489
+("ext4: force overhead calculation if the s_overhead_cluster makes no
+sense"), and eb7054212eac ("ext4: update the cached overhead value in
+the superblock").
+
+However, since it was too expensive to forcibly recalculate the
+overhead for bigalloc file systems at every mount, this didn't fix the
+problem for bigalloc file systems.  This commit should address the
+problem when resizing file systems with the bigalloc feature enabled.
+
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@kernel.org
+Reviewed-by: Andreas Dilger <adilger@dilger.ca>
+Link: https://lore.kernel.org/r/20220629040026.112371-1-tytso@mit.edu
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/resize.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -1456,6 +1456,7 @@ static void ext4_update_super(struct sup
+        * Update the fs overhead information
+        */
+       ext4_calculate_overhead(sb);
++      es->s_overhead_clusters = cpu_to_le32(sbi->s_overhead);
+       if (test_opt(sb, DEBUG))
+               printk(KERN_DEBUG "EXT4-fs: added group %u:"
index 89579ec50aa38b9df5b4da0f10a4402a7e12f3c7..a47e976ee406fcb2a8b305de17d9166407a20dfe 100644 (file)
@@ -151,3 +151,11 @@ video-fbdev-s3fb-check-the-size-of-screen-before-mem.patch
 scsi-zfcp-fix-missing-auto-port-scan-and-thus-missing-target-ports.patch
 x86-olpc-fix-logical-not-is-only-applied-to-the-left-hand-side.patch
 spmi-trace-fix-stack-out-of-bound-access-in-spmi-tracing-functions.patch
+ext4-add-ext4_inode_has_xattr_space-macro-in-xattr.h.patch
+ext4-make-sure-ext4_append-always-allocates-new-block.patch
+ext4-remove-ea-inode-entry-from-mbcache-on-inode-eviction.patch
+ext4-fix-use-after-free-in-ext4_xattr_set_entry.patch
+ext4-update-s_overhead_clusters-in-the-superblock-during-an-on-line-resize.patch
+ext4-fix-extent-status-tree-race-in-writeback-error-recovery-path.patch
+ext4-correct-max_inline_xattr_value_size-computing.patch
+ext4-correct-the-misjudgment-in-ext4_iget_extra_inode.patch