From patchwork Sat Jul 20 16:53:47 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Zheng Liu X-Patchwork-Id: 260462 Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id A6D8E2C008F for ; Sun, 21 Jul 2013 02:54:07 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754588Ab3GTQyF (ORCPT ); Sat, 20 Jul 2013 12:54:05 -0400 Received: from mail-pa0-f43.google.com ([209.85.220.43]:35324 "EHLO mail-pa0-f43.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754446Ab3GTQyD (ORCPT ); Sat, 20 Jul 2013 12:54:03 -0400 Received: by mail-pa0-f43.google.com with SMTP id hz11so5527820pad.16 for ; Sat, 20 Jul 2013 09:54:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:x-mailer; bh=jN2mcc+Q41cEYEpt86O/D6N58HHzQXmRyYAOT9trf/4=; b=FP73mcdhAMllzcMKueEfO0r86HHT69J03m4f4zY+D+bqbrryvi2bY+SdCBCURlV5x0 01NSDeGzxbL9zBrwR0/fTUbGRjBBs3loi3qQ5B5CRXG9HK5lkw9GbaC3l3zqjo8l+5Bt EhJn75I9Cn8C0WeBgBMiWipy58qcVVt/ee9htxbr7QWBCD9r5ptIRzqwRe7U593YlGv7 I9v3VIZrzeRUeIfWOtjQsjF+hVO2zAMR0Rb5MIDtuZdHz6zGcT07/Kmb+7GO50d2XDs3 zyX4lN+fOBmGBUTUb2Rf5Cg+0DihSk0XBO2Lo3ztOxx6bZHjMIm6c1cs3+BifPRbCFnr 9eqA== X-Received: by 10.68.131.68 with SMTP id ok4mr23094636pbb.146.1374339241807; Sat, 20 Jul 2013 09:54:01 -0700 (PDT) Received: from lz-devel.taobao.ali.com ([182.92.247.2]) by mx.google.com with ESMTPSA id v20sm29266605paj.4.2013.07.20.09.53.57 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Sat, 20 Jul 2013 09:54:01 -0700 (PDT) From: Zheng Liu To: linux-fsdevel@vger.kernel.org, linux-ext4@vger.kernel.org Cc: Zheng Liu , Jan Kara , Al Viro Subject: [PATCH] ext3: fix a bug when we try to open a file with O_TMPFILE flag Date: Sun, 21 Jul 2013 00:53:47 +0800 Message-Id: <1374339227-9382-1-git-send-email-wenqing.lz@taobao.com> X-Mailer: git-send-email 1.7.9.7 Sender: linux-ext4-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-ext4@vger.kernel.org From: Zheng Liu When we try to open a file with O_TMPFILE flag, we will trigger a bug. The root cause is that in ext4_orphan_add() we check ->i_nlink == 0 and this check always fails because we set ->i_nlink = 1 in inode_init_always(). We can use the following program to trigger it: int main(int argc, char *argv[]) { int fd; fd = open(argv[1], O_TMPFILE, 0666); if (fd < 0) { perror("open "); return -1; } close(fd); return 0; } The oops message looks like this: kernel: kernel BUG at fs/ext3/namei.c:1992! kernel: invalid opcode: 0000 [#1] SMP kernel: Modules linked in: ext4 jbd2 crc16 cpufreq_ondemand ipv6 dm_mirror dm_region_hash dm_log dm_mod parport_pc parport serio_raw sg dcdbas pcspkr i2c_i801 ehci_pci ehci_hcd button acpi_cpufreq mperf e1000e ptp pps_core ttm drm_kms_helper drm hwmon i2c_algo_bit i2c_core ext3 jbd sd_mod ahci libahci libata scsi_mod uhci_hcd kernel: CPU: 0 PID: 2882 Comm: tst_tmpfile Not tainted 3.11.0-rc1+ #4 kernel: Hardware name: Dell Inc. OptiPlex 780 /0V4W66, BIOS A05 08/11/2010 kernel: task: ffff880112d30050 ti: ffff8801124d4000 task.ti: ffff8801124d4000 kernel: RIP: 0010:[] [] ext3_orphan_add+0x6a/0x1eb [ext3] kernel: RSP: 0018:ffff8801124d5cc8 EFLAGS: 00010202 kernel: RAX: 0000000000000000 RBX: ffff880111510128 RCX: ffff8801114683a0 kernel: RDX: 0000000000000000 RSI: ffff880111510128 RDI: ffff88010fcf65a8 kernel: RBP: ffff8801124d5d18 R08: 0080000000000000 R09: ffffffffa00d3b7f kernel: R10: ffff8801114683a0 R11: ffff8801032a2558 R12: 0000000000000000 kernel: R13: ffff88010fcf6800 R14: ffff8801032a2558 R15: ffff8801115100d8 kernel: FS: 00007f5d172b5700(0000) GS:ffff880117c00000(0000) knlGS:0000000000000000 kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b kernel: CR2: 00007f5d16df15d0 CR3: 0000000110b1d000 CR4: 00000000000407f0 kernel: Stack: kernel: 000000000000000c ffff8801048a7dc8 ffff8801114685a8 ffffffffa00b80d7 kernel: ffff8801124d5e38 ffff8801032a2558 ffff88010ce24d68 0000000000000000 kernel: ffff88011146b300 ffff8801124d5d44 ffff8801124d5d78 ffffffffa00db7e1 kernel: Call Trace: kernel: [] ? journal_start+0x8c/0xbd [jbd] kernel: [] ext3_tmpfile+0xb2/0x13b [ext3] kernel: [] path_openat+0x11f/0x5e7 kernel: [] ? list_del+0x11/0x30 kernel: [] ? __dequeue_entity+0x33/0x38 kernel: [] do_filp_open+0x3f/0x8d kernel: [] ? __alloc_fd+0x50/0x102 kernel: [] do_sys_open+0x13b/0x1cd kernel: [] SyS_open+0x1e/0x20 kernel: [] system_call_fastpath+0x16/0x1b kernel: Code: 39 c7 0f 85 67 01 00 00 0f b7 03 25 00 f0 00 00 3d 00 40 00 00 74 18 3d 00 80 00 00 74 11 3d 00 a0 00 00 74 0a 83 7b 48 00 74 04 <0f> 0b eb fe 49 8b 85 50 03 00 00 4c 89 f6 48 c7 c7 c0 99 0e a0 kernel: RIP [] ext3_orphan_add+0x6a/0x1eb [ext3] kernel: RSP Here we couldn't call clear_nlink() directly because in d_tmpfile() we will call inode_dec_link_count() to decrease ->i_nlink. So this commit tries to call d_tmpfile() before ext4_orphan_add() to fix this problem. Signed-off-by: Zheng Liu Cc: Jan Kara Cc: Al Viro --- fs/ext3/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c index 998ea11..1194b1f 100644 --- a/fs/ext3/namei.c +++ b/fs/ext3/namei.c @@ -1780,11 +1780,11 @@ retry: inode->i_op = &ext3_file_inode_operations; inode->i_fop = &ext3_file_operations; ext3_set_aops(inode); + d_tmpfile(dentry, inode); err = ext3_orphan_add(handle, inode); if (err) goto err_drop_inode; mark_inode_dirty(inode); - d_tmpfile(dentry, inode); unlock_new_inode(inode); } ext3_journal_stop(handle);