5.4-stable patches

added patches:
	ext4-fix-race-condition-between-ext4_write-and-ext4_convert_inline_data.patch

diff --git a/queue-5.4/ext4-fix-race-condition-between-ext4_write-and-ext4_convert_inline_data.patch b/queue-5.4/ext4-fix-race-condition-between-ext4_write-and-ext4_convert_inline_data.patch
new file mode 100644 (file)
index 0000000..dedb841
--- /dev/null
+++ b/queue-5.4/ext4-fix-race-condition-between-ext4_write-and-ext4_convert_inline_data.patch
@@ -0,0 +1,130 @@
+From f87c7a4b084afc13190cbb263538e444cb2b392a Mon Sep 17 00:00:00 2001
+From: Baokun Li <libaokun1@huawei.com>
+Date: Thu, 28 Apr 2022 21:40:31 +0800
+Subject: ext4: fix race condition between ext4_write and ext4_convert_inline_data
+
+From: Baokun Li <libaokun1@huawei.com>
+
+commit f87c7a4b084afc13190cbb263538e444cb2b392a upstream.
+
+Hulk Robot reported a BUG_ON:
+ ==================================================================
+ EXT4-fs error (device loop3): ext4_mb_generate_buddy:805: group 0,
+ block bitmap and bg descriptor inconsistent: 25 vs 31513 free clusters
+ kernel BUG at fs/ext4/ext4_jbd2.c:53!
+ invalid opcode: 0000 [#1] SMP KASAN PTI
+ CPU: 0 PID: 25371 Comm: syz-executor.3 Not tainted 5.10.0+ #1
+ RIP: 0010:ext4_put_nojournal fs/ext4/ext4_jbd2.c:53 [inline]
+ RIP: 0010:__ext4_journal_stop+0x10e/0x110 fs/ext4/ext4_jbd2.c:116
+ [...]
+ Call Trace:
+  ext4_write_inline_data_end+0x59a/0x730 fs/ext4/inline.c:795
+  generic_perform_write+0x279/0x3c0 mm/filemap.c:3344
+  ext4_buffered_write_iter+0x2e3/0x3d0 fs/ext4/file.c:270
+  ext4_file_write_iter+0x30a/0x11c0 fs/ext4/file.c:520
+  do_iter_readv_writev+0x339/0x3c0 fs/read_write.c:732
+  do_iter_write+0x107/0x430 fs/read_write.c:861
+  vfs_writev fs/read_write.c:934 [inline]
+  do_pwritev+0x1e5/0x380 fs/read_write.c:1031
+ [...]
+ ==================================================================
+
+Above issue may happen as follows:
+           cpu1                     cpu2
+__________________________|__________________________
+do_pwritev
+ vfs_writev
+  do_iter_write
+   ext4_file_write_iter
+    ext4_buffered_write_iter
+     generic_perform_write
+      ext4_da_write_begin
+                           vfs_fallocate
+                            ext4_fallocate
+                             ext4_convert_inline_data
+                              ext4_convert_inline_data_nolock
+                               ext4_destroy_inline_data_nolock
+                                clear EXT4_STATE_MAY_INLINE_DATA
+                               ext4_map_blocks
+                                ext4_ext_map_blocks
+                                 ext4_mb_new_blocks
+                                  ext4_mb_regular_allocator
+                                   ext4_mb_good_group_nolock
+                                    ext4_mb_init_group
+                                     ext4_mb_init_cache
+                                      ext4_mb_generate_buddy  --> error
+       ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)
+                                ext4_restore_inline_data
+                                 set EXT4_STATE_MAY_INLINE_DATA
+       ext4_block_write_begin
+      ext4_da_write_end
+       ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)
+       ext4_write_inline_data_end
+        handle=NULL
+        ext4_journal_stop(handle)
+         __ext4_journal_stop
+          ext4_put_nojournal(handle)
+           ref_cnt = (unsigned long)handle
+           BUG_ON(ref_cnt == 0)  ---> BUG_ON
+
+The lock held by ext4_convert_inline_data is xattr_sem, but the lock
+held by generic_perform_write is i_rwsem. Therefore, the two locks can
+be concurrent.
+
+To solve above issue, we add inode_lock() for ext4_convert_inline_data().
+At the same time, move ext4_convert_inline_data() in front of
+ext4_punch_hole(), remove similar handling from ext4_punch_hole().
+
+Fixes: 0c8d414f163f ("ext4: let fallocate handle inline data correctly")
+Cc: stable@vger.kernel.org
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20220428134031.4153381-1-libaokun1@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Tadeusz Struk <tadeusz.struk@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/extents.c |    8 +++++---
+ fs/ext4/inode.c   |    9 ---------
+ 2 files changed, 5 insertions(+), 12 deletions(-)
+
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -4932,13 +4932,15 @@ long ext4_fallocate(struct file *file, i
+                    FALLOC_FL_INSERT_RANGE))
+               return -EOPNOTSUPP;
+ 
+-      if (mode & FALLOC_FL_PUNCH_HOLE)
+-              return ext4_punch_hole(inode, offset, len);
+-
++      inode_lock(inode);
+       ret = ext4_convert_inline_data(inode);
++      inode_unlock(inode);
+       if (ret)
+               return ret;
+ 
++      if (mode & FALLOC_FL_PUNCH_HOLE)
++              return ext4_punch_hole(inode, offset, len);
++
+       if (mode & FALLOC_FL_COLLAPSE_RANGE)
+               return ext4_collapse_range(inode, offset, len);
+ 
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -4322,15 +4322,6 @@ int ext4_punch_hole(struct inode *inode,
+ 
+       trace_ext4_punch_hole(inode, offset, length, 0);
+ 
+-      ext4_clear_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA);
+-      if (ext4_has_inline_data(inode)) {
+-              down_write(&EXT4_I(inode)->i_mmap_sem);
+-              ret = ext4_convert_inline_data(inode);
+-              up_write(&EXT4_I(inode)->i_mmap_sem);
+-              if (ret)
+-                      return ret;
+-      }
+-
+       /*
+        * Write out all dirty pages to avoid race conditions
+        * Then release them.

diff --git a/queue-5.4/series b/queue-5.4/series
index 53f942114e4f6b9125c4e197f74a5d34152131c3..22135fe847f023aa59c0cb3cebdd862948989382 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -15,3 +15,4 @@ drm-panfrost-fix-shrinker-list-corruption-by-madvise-ioctl.patch
 nilfs2-fix-incorrect-masking-of-permission-flags-for-symlinks.patch
 revert-evm-fix-memleak-in-init_desc.patch
 sched-rt-disable-rt_runtime_share-by-default.patch
+ext4-fix-race-condition-between-ext4_write-and-ext4_convert_inline_data.patch