iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/fs
History
Ye Bin 1b8f787ef5 ext4: fix warning in 'ext4_da_release_space' 
Syzkaller report issue as follows:
EXT4-fs (loop0): Free/Dirty block details
EXT4-fs (loop0): free_blocks=0
EXT4-fs (loop0): dirty_blocks=0
EXT4-fs (loop0): Block reservation details
EXT4-fs (loop0): i_reserved_data_blocks=0
EXT4-fs warning (device loop0): ext4_da_release_space:1527: ext4_da_release_space: ino 18, to_free 1 with only 0 reserved data blocks
------------[ cut here ]------------
WARNING: CPU: 0 PID: 92 at fs/ext4/inode.c:1528 ext4_da_release_space+0x25e/0x370 fs/ext4/inode.c:1524
Modules linked in:
CPU: 0 PID: 92 Comm: kworker/u4:4 Not tainted 6.0.0-syzkaller-09423-g493ffd6605b2 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
Workqueue: writeback wb_workfn (flush-7:0)
RIP: 0010:ext4_da_release_space+0x25e/0x370 fs/ext4/inode.c:1528
RSP: 0018:ffffc900015f6c90 EFLAGS: 00010296
RAX: 42215896cd52ea00 RBX: 0000000000000000 RCX: 42215896cd52ea00
RDX: 0000000000000000 RSI: 0000000080000001 RDI: 0000000000000000
RBP: 1ffff1100e907d96 R08: ffffffff816aa79d R09: fffff520002bece5
R10: fffff520002bece5 R11: 1ffff920002bece4 R12: ffff888021fd2000
R13: ffff88807483ecb0 R14: 0000000000000001 R15: ffff88807483e740
FS:  0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555569ba628 CR3: 000000000c88e000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 ext4_es_remove_extent+0x1ab/0x260 fs/ext4/extents_status.c:1461
 mpage_release_unused_pages+0x24d/0xef0 fs/ext4/inode.c:1589
 ext4_writepages+0x12eb/0x3be0 fs/ext4/inode.c:2852
 do_writepages+0x3c3/0x680 mm/page-writeback.c:2469
 __writeback_single_inode+0xd1/0x670 fs/fs-writeback.c:1587
 writeback_sb_inodes+0xb3b/0x18f0 fs/fs-writeback.c:1870
 wb_writeback+0x41f/0x7b0 fs/fs-writeback.c:2044
 wb_do_writeback fs/fs-writeback.c:2187 [inline]
 wb_workfn+0x3cb/0xef0 fs/fs-writeback.c:2227
 process_one_work+0x877/0xdb0 kernel/workqueue.c:2289
 worker_thread+0xb14/0x1330 kernel/workqueue.c:2436
 kthread+0x266/0x300 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
 </TASK>

Above issue may happens as follows:
ext4_da_write_begin
  ext4_create_inline_data
    ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS);
    ext4_set_inode_flag(inode, EXT4_INODE_INLINE_DATA);
__ext4_ioctl
  ext4_ext_migrate -> will lead to eh->eh_entries not zero, and set extent flag
ext4_da_write_begin
  ext4_da_convert_inline_data_to_extent
    ext4_da_write_inline_data_begin
      ext4_da_map_blocks
        ext4_insert_delayed_block
	  if (!ext4_es_scan_clu(inode, &ext4_es_is_delonly, lblk))
	    if (!ext4_es_scan_clu(inode, &ext4_es_is_mapped, lblk))
	      ext4_clu_mapped(inode, EXT4_B2C(sbi, lblk)); -> will return 1
	       allocated = true;
          ext4_es_insert_delayed_block(inode, lblk, allocated);
ext4_writepages
  mpage_map_and_submit_extent(handle, &mpd, &give_up_on_write); -> return -ENOSPC
  mpage_release_unused_pages(&mpd, give_up_on_write); -> give_up_on_write == 1
    ext4_es_remove_extent
      ext4_da_release_space(inode, reserved);
        if (unlikely(to_free > ei->i_reserved_data_blocks))
	  -> to_free == 1  but ei->i_reserved_data_blocks == 0
	  -> then trigger warning as above

To solve above issue, forbid inode do migrate which has inline data.

Cc: stable@kernel.org
Reported-by: syzbot+c740bb18df70ad00952e@syzkaller.appspotmail.com
Signed-off-by: Ye Bin <yebin10@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20221018022701.683489-1-yebin10@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
2022-11-06 01:07:59 -04:00
..
9p
9p: Fix some kernel-doc comments
2022-07-02 18:52:21 +09:00
adfs
fs: Convert block_read_full_page() to block_read_full_folio()
2022-05-09 16:21:44 -04:00
affs
affs: move from strlcpy with unused retval to strscpy
2022-08-19 13:03:10 +02:00
afs
struct file-related stuff
2022-10-06 17:13:18 -07:00
autofs
autofs: remove unused ino field inode
2022-07-17 17:31:42 -07:00
befs
befs: Convert befs_symlink_read_folio() to use a folio
2022-08-02 12:34:03 -04:00
bfs
fs: Convert block_read_full_page() to block_read_full_folio()
2022-05-09 16:21:44 -04:00
btrfs
btrfs: set generation before calling btrfs_clean_tree_block in btrfs_init_new_buffer
2022-09-29 17:08:31 +02:00
cachefiles
cachefiles: make on-demand request distribution fairer
2022-08-31 16:41:10 +01:00
ceph
We have a good pile of various fixes and cleanups from Xiubo, Jeff,
2022-08-11 12:41:07 -07:00
cifs
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2022-09-22 13:02:10 -07:00
coda
coda: Convert coda_symlink_filler() to use a folio
2022-08-02 12:34:03 -04:00
configfs
…
cramfs
cramfs: read_mapping_page() is synchronous
2022-08-02 12:34:02 -04:00
crypto
STATX_DIOALIGN for 6.1
2022-10-03 20:33:41 -07:00
debugfs
debugfs: add debugfs_lookup_and_remove()
2022-09-05 13:02:34 +02:00
devpts
…
dlm
Networking changes for 6.1.
2022-10-04 13:38:03 -07:00
ecryptfs
whack-a-mole: constifying struct path *
2022-10-06 17:31:02 -07:00
efivarfs
efi: vars: Move efivar caching layer into efivarfs
2022-06-24 20:40:19 +02:00
efs
efs: Convert efs symlinks to read_folio
2022-05-09 16:21:45 -04:00
erofs
erofs: clean up erofs_iget()
2022-09-27 17:27:45 +08:00
exfat
whack-a-mole: cropped up open-coded file_inode() uses...
2022-10-06 17:22:11 -07:00
exportfs
Change calling conventions for filldir_t
2022-08-17 17:25:04 -04:00
ext2
- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe
2022-08-05 16:32:45 -07:00
ext4
ext4: fix warning in 'ext4_da_release_space'
2022-11-06 01:07:59 -04:00
f2fs
STATX_DIOALIGN for 6.1
2022-10-03 20:33:41 -07:00
fat
struct file-related stuff
2022-10-06 17:13:18 -07:00
freevxfs
freevxfs: Convert vxfs_immed_read_folio() to use a folio
2022-08-02 12:34:03 -04:00
fscache
fscache: add tracepoint when failing cookie
2022-08-09 14:13:59 +01:00
fuse
iov_iter stuff, part 2, rebased
2022-08-08 20:04:35 -07:00
gfs2
struct file-related stuff
2022-10-06 17:13:18 -07:00
hfs
hfs: Remove check for PageError
2022-06-29 08:51:06 -04:00
hfsplus
Folio changes for 6.0
2022-08-03 10:35:43 -07:00
hostfs
hostfs: Handle page write errors correctly
2022-08-02 12:34:02 -04:00
hpfs
hpfs: Convert symlinks to read_folio
2022-05-09 16:21:45 -04:00
hugetlbfs
iov_iter stuff, part 2, rebased
2022-08-08 20:04:35 -07:00
iomap
iomap: add a tracepoint for mappings returned by map_blocks
2022-10-02 11:42:19 -07:00
isofs
fs/buffer: Combine two submit_bh() and ll_rw_block() arguments
2022-07-14 12:14:32 -06:00
jbd2
jbd2: add miss release buffer head in fc_do_one_pass()
2022-09-30 23:46:54 -04:00
jffs2
This pull request contains fixes for JFFS2, UBI and UBIFS
2022-06-03 14:42:24 -07:00
jfs
Folio changes for 6.0
2022-08-03 10:35:43 -07:00
kernfs
kernfs: Fix typo 'the the' in comment
2022-07-28 10:57:25 +02:00
ksmbd
struct file-related stuff
2022-10-06 17:13:18 -07:00
lockd
SUNRPC: Parametrize how much of argsize should be zeroed
2022-09-26 14:02:42 -04:00
minix
fs: Convert block_read_full_page() to block_read_full_folio()
2022-05-09 16:21:44 -04:00
netfs
netfs: do not unlock and put the folio twice
2022-07-14 10:10:12 +02:00
nfs
whack-a-mole: cropped up open-coded file_inode() uses...
2022-10-06 17:22:11 -07:00
nfs_common
…
nfsd
struct file-related stuff
2022-10-06 17:13:18 -07:00
nilfs2
Folio changes for 6.0
2022-08-03 10:35:43 -07:00
nls
…
notify
fs/notify: constify path
2022-09-01 17:37:29 -04:00
ntfs
The first two changes that involve files outside of fs/ext4:
2022-10-06 17:45:53 -07:00
ntfs3
ntfs3: rework xattr handlers and switch to POSIX ACL VFS helpers
2022-08-31 08:49:46 +02:00
ocfs2
struct file-related stuff
2022-10-06 17:13:18 -07:00
omfs
fs: Convert block_read_full_page() to block_read_full_folio()
2022-05-09 16:21:44 -04:00
openpromfs
…
orangefs
orangefs: use ->f_mapping
2022-09-01 17:46:06 -04:00
overlayfs
whack-a-mole: constifying struct path *
2022-10-06 17:31:02 -07:00
proc
whack-a-mole: constifying struct path *
2022-10-06 17:31:02 -07:00
pstore
Revert "pstore: migrate to crypto acomp interface"
2022-09-30 08:16:06 -07:00
qnx4
fs: Convert block_read_full_page() to block_read_full_folio()
2022-05-09 16:21:44 -04:00
qnx6
fs: Convert mpage_readpage to mpage_read_folio
2022-05-09 16:21:44 -04:00
quota
- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe
2022-08-05 16:32:45 -07:00
ramfs
…
reiserfs
Change calling conventions for filldir_t
2022-08-17 17:25:04 -04:00
romfs
romfs: Convert romfs to read_folio
2022-05-09 16:21:46 -04:00
smbfs_common
Add various fsctl structs
2022-05-23 20:24:12 -05:00
squashfs
squashfs: don't call kmalloc in decompressors
2022-08-28 14:02:45 -07:00
sysfs
kobject: kobj_type: remove default_attrs
2022-04-05 15:39:19 +02:00
sysv
Not a lot of material this cycle. Many singleton patches against various
2022-05-27 11:22:03 -07:00
tracefs
tracefs: Only clobber mode/uid/gid on remount if asked
2022-09-08 17:10:54 -04:00
ubifs
- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe
2022-08-05 16:32:45 -07:00
udf
fs/buffer: Combine two submit_bh() and ll_rw_block() arguments
2022-07-14 12:14:32 -06:00
ufs
Folio changes for 6.0
2022-08-03 10:35:43 -07:00
unicode
…
vboxsf
vboxsf: Convert vboxsf to read_folio
2022-05-09 16:21:46 -04:00
verity
for-6.1-tag
2022-10-06 17:36:48 -07:00
xfs
The first two changes that involve files outside of fs/ext4:
2022-10-06 17:45:53 -07:00
zonefs
New code for 6.0:
2022-08-11 13:11:49 -07:00
aio.c
iov_iter work, part 1 - isolated cleanups and optimizations.
2022-08-03 13:50:22 -07:00
anon_inodes.c
dynamic_dname(): drop unused dentry argument
2022-08-20 11:34:04 -04:00
attr.c
vfs: Check the truncate maximum size in inode_newsize_ok()
2022-08-08 10:39:29 -07:00
bad_inode.c
…
binfmt_elf_fdpic.c
…
binfmt_elf_test.c
…
binfmt_elf.c
revert "fs/binfmt_elf: use PT_LOAD p_align values for static PIE"
2022-04-15 14:49:56 -07:00
binfmt_flat.c
binfmt_flat: Remove shared library support
2022-04-22 10:57:18 -07:00
binfmt_misc.c
…
binfmt_script.c
…
buffer.c
fs/buffer: make submit_bh & submit_bh_wbc return type as void
2022-09-29 23:01:40 -04:00
char_dev.c
…
compat_binfmt_elf.c
…
coredump.c
[brown paperbag] fix coredump breakage
2022-10-03 20:28:38 -04:00
d_path.c
d_path.c: typo fix...
2022-08-20 11:34:33 -04:00
dax.c
Merge branch 'for-6.0/dax' into libnvdimm-fixes
2022-09-24 18:14:12 -07:00
dcache.c
dcache: move the DCACHE_OP_COMPARE case out of the __d_lookup_rcu loop
2022-08-17 14:33:03 -07:00
direct-io.c
iov_iter: advancing variants of iov_iter_get_pages{,_alloc}()
2022-08-08 22:37:22 -04:00
drop_caches.c
…
eventfd.c
…
eventpoll.c
epoll: autoremove wakers even more aggressively
2022-07-17 17:31:40 -07:00
exec.c
whack-a-mole: cropped up open-coded file_inode() uses...
2022-10-06 17:22:11 -07:00
fcntl.c
keep iocb_flags() result cached in struct file
2022-06-10 16:10:23 -04:00
fhandle.c
do_sys_name_to_handle(): constify path
2022-09-01 17:36:39 -04:00
file_table.c
locks: fix TOCTOU race when granting write lease
2022-08-16 10:59:54 -04:00
file.c
fix the breakage in close_fd_get_file() calling conventions change
2022-06-05 15:03:03 -04:00
filesystems.c
…
fs_context.c
…
fs_parser.c
…
fs_pin.c
…
fs_struct.c
…
fs_types.c
…
fs-writeback.c
fs: record I_DIRTY_TIME even if inode already has I_DIRTY_INODE
2022-09-29 23:02:00 -04:00
fsopen.c
uninline may_mount() and don't opencode it in fspick(2)/fsopen(2)
2022-05-19 23:25:10 -04:00
init.c
…
inode.c
saner inode_init_always()
2022-10-06 16:49:00 -07:00
internal.h
whack-a-mole: constifying struct path *
2022-10-06 17:31:02 -07:00
ioctl.c
Fixes for 5.18-rc1:
2022-04-01 19:35:56 -07:00
Kconfig
mm: hugetlb_vmemmap: introduce the name HVO
2022-08-08 18:06:42 -07:00
Kconfig.binfmt
a.out: Remove the a.out implementation
2022-09-27 07:11:02 -07:00
kernel_read_file.c
fs/kernel_read_file: allow to read files up-to ssize_t
2022-06-16 19:58:21 -07:00
libfs.c
fs: Convert simple_readpage to simple_read_folio
2022-05-09 16:21:44 -04:00
locks.c
locks: Fix dropped call to ->fl_release_private()
2022-08-17 15:08:58 -04:00
Makefile
a.out: Remove the a.out implementation
2022-09-27 07:11:02 -07:00
mbcache.c
mbcache: Avoid nesting of cache->c_list_lock under bit locks
2022-09-30 23:46:52 -04:00
mount.h
switch try_to_unlazy_next() to __legitimize_mnt()
2022-07-05 16:18:21 -04:00
mpage.c
Folio changes for 6.0
2022-08-03 10:35:43 -07:00
namei.c
nd_jump_link(): constify path
2022-09-01 17:39:49 -04:00
namespace.c
fs: require CAP_SYS_ADMIN in target namespace for idmapped mounts
2022-08-17 11:27:11 +02:00
no-block.c
…
nsfs.c
dynamic_dname(): drop unused dentry argument
2022-08-20 11:34:04 -04:00
open.c
struct file-related stuff
2022-10-06 17:13:18 -07:00
pipe.c
dynamic_dname(): drop unused dentry argument
2022-08-20 11:34:04 -04:00
pnode.c
…
pnode.h
…
posix_acl.c
acl: fix the comments of posix_acl_xattr_set
2022-09-17 12:47:51 +02:00
proc_namespace.c
vfs: escape hash as well
2022-06-28 13:58:05 -04:00
read_write.c
[coredump] don't use __kernel_write() on kmap_local_page()
2022-09-28 14:28:40 -04:00
readdir.c
Change calling conventions for filldir_t
2022-08-17 17:25:04 -04:00
remap_range.c
- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe
2022-08-05 16:32:45 -07:00
select.c
…
seq_file.c
rxrpc: Fix locking issue
2022-05-22 21:03:01 +01:00
signalfd.c
…
splice.c
iter_to_pipe(): switch to advancing variant of iov_iter_get_pages()
2022-08-08 22:37:23 -04:00
stack.c
…
stat.c
vfs: support STATX_DIOALIGN on block devices
2022-09-11 19:47:12 -05:00
statfs.c
…
super.c
fscrypt: stop using keyrings subsystem for fscrypt_master_key
2022-09-21 20:33:06 -07:00
sync.c
riscv: compat: syscall: Add compat_sys_call_table implementation
2022-04-26 13:36:25 -07:00
sysctls.c
…
timerfd.c
…
userfaultfd.c
lsm/stable-6.1 PR 20221003
2022-10-03 17:51:52 -07:00
utimes.c
…
xattr.c
xattr: always us is_posix_acl_xattr() helper
2022-09-21 12:01:29 +02:00