iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/fs
History
Zhihao Cheng ddd896792e jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted 
[ Upstream commit 4a734f0869f970b8a9b65062ea40b09a5da9dba8 ]

Following process will fail assertion 'jh->b_frozen_data == NULL' in
jbd2_journal_dirty_metadata():

                   jbd2_journal_commit_transaction
unlink(dir/a)
 jh->b_transaction = trans1
 jh->b_jlist = BJ_Metadata
                    journal->j_running_transaction = NULL
                    trans1->t_state = T_COMMIT
unlink(dir/b)
 handle->h_trans = trans2
 do_get_write_access
  jh->b_modified = 0
  jh->b_frozen_data = frozen_buffer
  jh->b_next_transaction = trans2
 jbd2_journal_dirty_metadata
  is_handle_aborted
   is_journal_aborted // return false

           --> jbd2 abort <--

                     while (commit_transaction->t_buffers)
                      if (is_journal_aborted)
                       jbd2_journal_refile_buffer
                        __jbd2_journal_refile_buffer
                         WRITE_ONCE(jh->b_transaction,
						jh->b_next_transaction)
                         WRITE_ONCE(jh->b_next_transaction, NULL)
                         __jbd2_journal_file_buffer(jh, BJ_Reserved)
        J_ASSERT_JH(jh, jh->b_frozen_data == NULL) // assertion failure !

The reproducer (See detail in [Link]) reports:
 ------------[ cut here ]------------
 kernel BUG at fs/jbd2/transaction.c:1629!
 invalid opcode: 0000 [#1] PREEMPT SMP
 CPU: 2 PID: 584 Comm: unlink Tainted: G        W
 5.19.0-rc6-00115-g4a57a8400075-dirty #697
 RIP: 0010:jbd2_journal_dirty_metadata+0x3c5/0x470
 RSP: 0018:ffffc90000be7ce0 EFLAGS: 00010202
 Call Trace:
  <TASK>
  __ext4_handle_dirty_metadata+0xa0/0x290
  ext4_handle_dirty_dirblock+0x10c/0x1d0
  ext4_delete_entry+0x104/0x200
  __ext4_unlink+0x22b/0x360
  ext4_unlink+0x275/0x390
  vfs_unlink+0x20b/0x4c0
  do_unlinkat+0x42f/0x4c0
  __x64_sys_unlink+0x37/0x50
  do_syscall_64+0x35/0x80

After journal aborting, __jbd2_journal_refile_buffer() is executed with
holding @jh->b_state_lock, we can fix it by moving 'is_handle_aborted()'
into the area protected by @jh->b_state_lock.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=216251
Fixes: 470decc613ab20 ("[PATCH] jbd2: initial copy of files from jbd")
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Link: https://lore.kernel.org/r/20220715125152.4022726-1-chengzhihao1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-08-17 15:15:43 +02:00
..
9p
9p: fix EBADF errors in cached mode
2022-06-17 06:03:30 +09:00
adfs
fs: Convert block_read_full_page() to block_read_full_folio()
2022-05-09 16:21:44 -04:00
affs
affs: Convert affs to read_folio
2022-05-09 16:21:44 -04:00
afs
netfs: do not unlock and put the folio twice
2022-07-14 10:10:12 +02:00
autofs
…
befs
befs: Convert befs to read_folio
2022-05-09 16:21:45 -04:00
bfs
fs: Convert block_read_full_page() to block_read_full_folio()
2022-05-09 16:21:44 -04:00
btrfs
btrfs: update stripe_sectors::uptodate in steal_rbio
2022-08-17 15:14:54 +02:00
cachefiles
cachefiles: narrow the scope of flushed requests when releasing fd
2022-07-05 16:12:21 +01:00
ceph
netfs: do not unlock and put the folio twice
2022-07-14 10:10:12 +02:00
cifs
smb3: workaround negprot bug in some Samba servers
2022-07-13 19:59:47 -05:00
coda
coda: Convert coda to read_folio
2022-05-09 16:21:45 -04:00
configfs
configfs: fix a race in configfs_{,un}register_subsystem()
2022-02-22 18:30:28 +01:00
cramfs
cramfs: Convert cramfs to read_folio
2022-05-09 16:21:45 -04:00
crypto
fscrypt: add new helper functions for test_dummy_encryption
2022-05-09 16:18:54 -07:00
debugfs
debugfs: Document that debugfs_create functions need not be error checked
2022-02-25 11:56:13 +01:00
devpts
fsnotify: fix fsnotify hooks in pseudo filesystems
2022-01-24 14:17:02 +01:00
dlm
dlm: use kref_put_lock in __put_lkb
2022-05-02 11:23:49 -05:00
ecryptfs
ecryptfs: Convert ecryptfs to read_folio
2022-05-09 16:21:45 -04:00
efivarfs
…
efs
efs: Convert efs symlinks to read_folio
2022-05-09 16:21:45 -04:00
erofs
erofs: update ctx->pos for every emitted dirent
2022-08-17 15:14:21 +02:00
exfat
exfat: use updated exfat_chain directly during renaming
2022-06-09 21:26:32 +09:00
exportfs
exportfs: support idmapped mounts
2022-04-28 16:31:10 +02:00
ext2
ext2: Add more validity checks for inode counts
2022-08-17 15:14:00 +02:00
ext4
ext4: recover csum seed of tmp_inode after migrating to extents
2022-08-17 15:15:43 +02:00
f2fs
f2fs: do not count ENOENT for error case
2022-06-21 08:29:56 -07:00
fat
Not a lot of material this cycle. Many singleton patches against various
2022-05-27 11:22:03 -07:00
freevxfs
SPDX changes for 5.19-rc1
2022-06-03 10:34:34 -07:00
fscache
fscache: Fix invalidation/lookup race
2022-07-05 16:12:55 +01:00
fuse
fuse: fix deadlock between atomic O_TRUNC and page invalidation
2022-08-17 15:13:55 +02:00
gfs2
Page cache changes for 5.19
2022-05-24 19:55:07 -07:00
hfs
fs: Change try_to_free_buffers() to take a folio
2022-05-09 23:12:34 -04:00
hfsplus
fs: Change try_to_free_buffers() to take a folio
2022-05-09 23:12:34 -04:00
hostfs
hostfs: Convert hostfs to read_folio
2022-05-09 16:21:45 -04:00
hpfs
hpfs: Convert symlinks to read_folio
2022-05-09 16:21:45 -04:00
hugetlbfs
hugetlbfs: zero partial pages during fallocate hole punch
2022-06-16 19:11:32 -07:00
iomap
Page cache changes for 5.19
2022-05-24 19:55:07 -07:00
isofs
isofs: Convert symlinks and zisofs to read_folio
2022-05-09 16:21:45 -04:00
jbd2
jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted
2022-08-17 15:15:43 +02:00
jffs2
This pull request contains fixes for JFFS2, UBI and UBIFS
2022-06-03 14:42:24 -07:00
jfs
JFS: One bug fix and some code cleanup
2022-05-27 15:59:21 -07:00
kernfs
kernfs: fix potential NULL dereference in __kernfs_remove
2022-08-17 15:15:26 +02:00
ksmbd
ksmbd: fix heap-based overflow in set_ntacl_dacl()
2022-08-17 15:13:54 +02:00
lockd
lockd: detect and reject lock arguments that overflow
2022-08-17 15:13:42 +02:00
minix
fs: Convert block_read_full_page() to block_read_full_folio()
2022-05-09 16:21:44 -04:00
netfs
netfs: do not unlock and put the folio twice
2022-07-14 10:10:12 +02:00
nfs
pNFS/flexfiles: Report RDMA connection errors to the server
2022-08-17 15:13:40 +02:00
nfs_common
…
nfsd
nfsd: eliminate the NFSD_FILE_BREAK_* flags
2022-08-17 15:13:40 +02:00
nilfs2
nilfs2: fix incorrect masking of permission flags for symlinks
2022-07-03 15:42:33 -07:00
nls
…
notify
fanotify: refine the validation checks on non-dir inode mask
2022-06-28 11:18:13 +02:00
ntfs
ntfs: fix use-after-free in ntfs_ucsncmp()
2022-07-18 15:07:52 -07:00
ntfs3
Ntfs3 for 5.19
2022-06-03 16:57:16 -07:00
ocfs2
Revert "ocfs2: mount shared volume without ha stack"
2022-07-18 15:09:15 -07:00
omfs
fs: Convert block_read_full_page() to block_read_full_folio()
2022-05-09 16:21:44 -04:00
openpromfs
fs: allocate inode by using alloc_inode_sb()
2022-03-22 15:57:03 -07:00
orangefs
orangefs: Convert to free_folio
2022-05-09 23:12:53 -04:00
overlayfs
ovl: drop WARN_ON() dentry is NULL in ovl_encode_fh()
2022-08-17 15:13:48 +02:00
proc
Not a lot of material this cycle. Many singleton patches against various
2022-05-27 11:22:03 -07:00
pstore
pstore: Don't use semaphores in always-atomic-context code
2022-03-15 11:08:23 -07:00
qnx4
fs: Convert block_read_full_page() to block_read_full_folio()
2022-05-09 16:21:44 -04:00
qnx6
fs: Convert mpage_readpage to mpage_read_folio
2022-05-09 16:21:44 -04:00
quota
quota: Prevent memory allocation recursion while holding dq_lock
2022-06-06 10:08:10 +02:00
ramfs
Merge branch 'akpm' (patches from Andrew)
2021-11-09 10:11:53 -08:00
reiserfs
fs: Change try_to_free_buffers() to take a folio
2022-05-09 23:12:34 -04:00
romfs
romfs: Convert romfs to read_folio
2022-05-09 16:21:46 -04:00
smbfs_common
Add various fsctl structs
2022-05-23 20:24:12 -05:00
squashfs
Page cache changes for 5.19
2022-05-24 19:55:07 -07:00
sysfs
kobject: kobj_type: remove default_attrs
2022-04-05 15:39:19 +02:00
sysv
Not a lot of material this cycle. Many singleton patches against various
2022-05-27 11:22:03 -07:00
tracefs
tracefs: Fix syntax errors in comments
2022-06-17 19:01:28 -04:00
ubifs
This pull request contains fixes for JFFS2, UBI and UBIFS
2022-06-03 14:42:24 -07:00
udf
Page cache changes for 5.19
2022-05-24 19:55:07 -07:00
ufs
fs: Convert block_read_full_page() to block_read_full_folio()
2022-05-09 16:21:44 -04:00
unicode
kbuild: unify cmd_copy and cmd_shipped
2022-02-14 10:37:32 +09:00
vboxsf
vboxsf: Convert vboxsf to read_folio
2022-05-09 16:21:46 -04:00
verity
Page cache changes for 5.19
2022-05-24 19:55:07 -07:00
xfs
xfs: prevent a UAF when log IO errors race with unmount
2022-07-01 09:09:52 -07:00
zonefs
zonefs: fix zonefs_iomap_begin() for reads
2022-06-08 19:13:55 +09:00
aio.c
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2022-04-01 19:57:03 -07:00
anon_inodes.c
…
attr.c
vfs: Check the truncate maximum size in inode_newsize_ok()
2022-08-17 15:13:46 +02:00
bad_inode.c
…
binfmt_aout.c
…
binfmt_elf_fdpic.c
coredump: Snapshot the vmas in do_coredump
2022-03-08 12:55:29 -06:00
binfmt_elf_test.c
binfmt_elf: Introduce KUnit test
2022-03-03 20:38:56 -08:00
binfmt_elf.c
revert "fs/binfmt_elf: use PT_LOAD p_align values for static PIE"
2022-04-15 14:49:56 -07:00
binfmt_flat.c
binfmt_flat: Remove shared library support
2022-04-22 10:57:18 -07:00
binfmt_misc.c
Fix regression due to "fs: move binfmt_misc sysctl to its own file"
2022-02-09 09:50:02 -08:00
binfmt_script.c
…
buffer.c
fs: Convert drop_buffers() to use a folio
2022-05-09 23:12:34 -04:00
char_dev.c
…
compat_binfmt_elf.c
binfmt_elf: Introduce KUnit test
2022-03-03 20:38:56 -08:00
coredump.c
ptrace: Cleanups for v5.18
2022-03-28 17:29:53 -07:00
d_path.c
d_path: fix Kernel doc validator complaining
2021-11-06 13:30:32 -07:00
dax.c
libnvdimm for 5.19
2022-05-27 15:49:30 -07:00
dcache.c
mm: dcache: use kmem_cache_alloc_lru() to allocate dentry
2022-03-22 15:57:03 -07:00
direct-io.c
direct-io: remove random prefetches
2022-04-17 19:50:02 -06:00
drop_caches.c
…
eventfd.c
…
eventpoll.c
epoll: autoremove wakers even more aggressively
2022-08-17 15:13:59 +02:00
exec.c
fix race between exit_itimers() and /proc/pid/timers
2022-07-11 09:52:59 -07:00
fcntl.c
VFS: add FMODE_CAN_ODIRECT file flag
2022-05-09 18:20:49 -07:00
fhandle.c
…
file_table.c
Descriptor handling cleanups
2022-06-04 18:52:00 -07:00
file.c
fix the breakage in close_fd_get_file() calling conventions change
2022-06-05 15:03:03 -04:00
filesystems.c
…
fs_context.c
vfs: fs_context: fix up param length parsing in legacy_parse_param
2022-01-18 09:23:19 +02:00
fs_parser.c
fs_parse: allow parameter value to be empty
2021-12-09 14:09:36 -05:00
fs_pin.c
…
fs_struct.c
…
fs_types.c
…
fs-writeback.c
writeback: Fix inode->i_io_list not be protected by inode->i_lock error
2022-06-06 09:54:30 +02:00
fsopen.c
uninline may_mount() and don't opencode it in fspick(2)/fsopen(2)
2022-05-19 23:25:10 -04:00
init.c
…
inode.c
writeback: Fix inode->i_io_list not be protected by inode->i_lock error
2022-06-06 09:54:30 +02:00
internal.h
Cleanups (and one fix) around struct mount handling.
2022-06-04 19:00:05 -07:00
ioctl.c
Fixes for 5.18-rc1:
2022-04-01 19:35:56 -07:00
Kconfig
mm: hugetlb_vmemmap: cleanup CONFIG_HUGETLB_PAGE_FREE_VMEMMAP*
2022-04-28 23:16:15 -07:00
Kconfig.binfmt
m68knommu: changes for linux 5.19
2022-05-30 10:56:18 -07:00
kernel_read_file.c
…
libfs.c
fs: Convert simple_readpage to simple_read_folio
2022-05-09 16:21:44 -04:00
locks.c
fs/lock: add 2 callbacks to lock_manager_operations to resolve conflict
2022-05-19 12:25:39 -04:00
Makefile
io_uring: move to separate directory
2022-08-17 15:14:20 +02:00
mbcache.c
mbcache: add functions to delete entry if unused
2022-08-17 15:13:56 +02:00
mount.h
…
mpage.c
fs: Change try_to_free_buffers() to take a folio
2022-05-09 23:12:34 -04:00
namei.c
fs: Add missing umask strip in vfs_tmpfile
2022-08-17 15:13:47 +02:00
namespace.c
Cleanups (and one fix) around struct mount handling.
2022-06-04 19:00:05 -07:00
no-block.c
…
nsfs.c
…
open.c
RISC-V Patches for the 5.19 Merge Window, Part 1
2022-05-31 14:10:54 -07:00
pipe.c
Not a lot of material this cycle. Many singleton patches against various
2022-05-27 11:22:03 -07:00
pnode.c
…
pnode.h
…
posix_acl.c
fs: fix acl translation
2022-04-19 10:19:02 -07:00
proc_namespace.c
fs: add is_idmapped_mnt() helper
2021-12-03 18:44:06 +01:00
read_write.c
Thirteen hotfixes, Eight are cc:stable and the remainder are for post-5.18
2022-07-26 19:38:46 -07:00
readdir.c
…
remap_range.c
Revert "vf/remap: return the amount of bytes actually deduplicated"
2022-07-14 15:35:24 -07:00
select.c
select: Fix indefinitely sleeping task in poll_schedule_timeout()
2022-01-11 09:03:05 -08:00
seq_file.c
rxrpc: Fix locking issue
2022-05-22 21:03:01 +01:00
signalfd.c
Merge branch 'signal-for-v5.17' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2022-01-17 05:49:30 +02:00
splice.c
fs: check FMODE_LSEEK to control internal pipe splicing
2022-08-17 15:14:49 +02:00
stack.c
…
stat.c
RISC-V Patches for the 5.19 Merge Window, Part 1
2022-05-31 14:10:54 -07:00
statfs.c
…
super.c
block: add a bdev_stable_writes helper
2022-04-17 19:49:59 -06:00
sync.c
riscv: compat: syscall: Add compat_sys_call_table implementation
2022-04-26 13:36:25 -07:00
sysctls.c
fs: move namespace sysctls and declare fs base directory
2022-01-22 08:33:36 +02:00
timerfd.c
…
userfaultfd.c
userfaultfd: provide properly masked address for huge-pages
2022-07-26 18:25:01 -07:00
utimes.c
…
xattr.c
fs: split off do_getxattr from getxattr
2022-04-24 18:18:37 -06:00