From patchwork Wed Jun 10 00:14:09 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: gregkh@suse.de X-Patchwork-Id: 28364 Return-Path: X-Original-To: patchwork-incoming@bilbo.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from ozlabs.org (ozlabs.org [203.10.76.45]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "mx.ozlabs.org", Issuer "CA Cert Signing Authority" (verified OK)) by bilbo.ozlabs.org (Postfix) with ESMTPS id C5AE0B70B3 for ; Wed, 10 Jun 2009 13:36:57 +1000 (EST) Received: by ozlabs.org (Postfix) id B66B9DDD0C; Wed, 10 Jun 2009 13:36:57 +1000 (EST) Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by ozlabs.org (Postfix) with ESMTP id 55DD5DDD04 for ; Wed, 10 Jun 2009 13:36:57 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757588AbZFJDgH (ORCPT ); Tue, 9 Jun 2009 23:36:07 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1757586AbZFJDgG (ORCPT ); Tue, 9 Jun 2009 23:36:06 -0400 Received: from kroah.org ([198.145.64.141]:57253 "EHLO coco.kroah.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757428AbZFJDgC (ORCPT ); Tue, 9 Jun 2009 23:36:02 -0400 Received: from localhost (124-9-6-2.static.tfn.net.tw [124.9.6.2]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by coco.kroah.org (Postfix) with ESMTPSA id 899C9490D8; Tue, 9 Jun 2009 20:36:04 -0700 (PDT) X-Mailbox-Line: From greg@blue.kroah.org Tue Jun 9 17:23:49 2009 Message-Id: <20090610002349.130372706@blue.kroah.org> User-Agent: quilt/0.48-1 Date: Tue, 09 Jun 2009 17:14:09 -0700 From: Greg KH To: linux-kernel@vger.kernel.org, stable@kernel.org Cc: Justin Forbes , Zwane Mwaikambo , Theodore Ts'o , Randy Dunlap , Dave Jones , Chuck Wolber , Chris Wedgwood , Michael Krufky , Chuck Ebbert , Domenico Andreoli , Willy Tarreau , Rodrigo Rubira Branco , Jake Edge , Eugene Teo , torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Eric Sandeen , linux-ext4@vger.kernel.org, Greg Kroah-Hartman Subject: [patch 41/60] ext4: fix bb_prealloc_list corruption due to wrong group locking References: <20090610001328.251476848@blue.kroah.org> Content-Disposition: inline; filename=ext4-fix-bb_prealloc_list-corruption-due-to-wrong-group-locking.patch Lines: 69 In-Reply-To: <20090610032135.GA19346@kroah.com> Sender: linux-ext4-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-ext4@vger.kernel.org -stable review patch. If anyone has any objections, please let us know. ------------------ From: Eric Sandeen (cherry-picked from commit d33a1976fbee1ee321d6f014333d8f03a39d526c) This is for Red Hat bug 490026: EXT4 panic, list corruption in ext4_mb_new_inode_pa ext4_lock_group(sb, group) is supposed to protect this list for each group, and a common code flow to remove an album is like this: ext4_get_group_no_and_offset(sb, pa->pa_pstart, &grp, NULL); ext4_lock_group(sb, grp); list_del(&pa->pa_group_list); ext4_unlock_group(sb, grp); so it's critical that we get the right group number back for this prealloc context, to lock the right group (the one associated with this pa) and prevent concurrent list manipulation. however, ext4_mb_put_pa() passes in (pa->pa_pstart - 1) with a comment, "-1 is to protect from crossing allocation group". This makes sense for the group_pa, where pa_pstart is advanced by the length which has been used (in ext4_mb_release_context()), and when the entire length has been used, pa_pstart has been advanced to the first block of the next group. However, for inode_pa, pa_pstart is never advanced; it's just set once to the first block in the group and not moved after that. So in this case, if we subtract one in ext4_mb_put_pa(), we are actually locking the *previous* group, and opening the race with the other threads which do not subtract off the extra block. Signed-off-by: Eric Sandeen Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman --- fs/ext4/mballoc.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -3698,6 +3698,7 @@ static void ext4_mb_put_pa(struct ext4_a struct super_block *sb, struct ext4_prealloc_space *pa) { unsigned long grp; + ext4_fsblk_t grp_blk; if (!atomic_dec_and_test(&pa->pa_count) || pa->pa_free != 0) return; @@ -3712,8 +3713,12 @@ static void ext4_mb_put_pa(struct ext4_a pa->pa_deleted = 1; spin_unlock(&pa->pa_lock); - /* -1 is to protect from crossing allocation group */ - ext4_get_group_no_and_offset(sb, pa->pa_pstart - 1, &grp, NULL); + grp_blk = pa->pa_pstart; + /* If linear, pa_pstart may be in the next group when pa is used up */ + if (pa->pa_linear) + grp_blk--; + + ext4_get_group_no_and_offset(sb, grp_blk, &grp, NULL); /* * possible race: