From patchwork Wed Jul 1 09:32:27 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Zhihao Cheng X-Patchwork-Id: 1320352 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.infradead.org (client-ip=2001:8b0:10b:1231::1; helo=merlin.infradead.org; envelope-from=linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=huawei.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; secure) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=merlin.20170209 header.b=iqzX665x; dkim-atps=neutral Received: from merlin.infradead.org (merlin.infradead.org [IPv6:2001:8b0:10b:1231::1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 49xbjh4bV5z9s1x for ; Wed, 1 Jul 2020 19:37:28 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=merlin.20170209; h=Sender:Content-Transfer-Encoding: Content-Type:Cc:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:MIME-Version:Message-ID:Date:Subject:To:From: Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender :Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Owner; bh=DKVF32ioEXWkpcaQlNcEREyAu4qGLsPLGfsKjE6o630=; b=iqzX665xdm4UsgDR900L7RgE9Z +vsiM7zMr08CBk2H4ZIULDwwcmM9+/jdOw2EGNgHpLmKUScvLTW+bHQZjq2ubFAYz16mtBtCDYvAI LcWhiaA0frzOF8aBsVa1bUnjo/DjTLFnoklY7ZpZhzN/33zhqS4atbowue9UspaK/O8zkOgYzq/80 i2Paz3lcm8XYp2GauSdEq5TcHoZtY7MAwciaQsvscoZyQlfgQUzf2cu2wL7ZSUws5UF1R0mpGNJsC ZVNCPFcs4uaI+u/yTdQ/D/AYEpy5B7ghFjFNFN+muJ8OiijykKLjX9Ww2gWDwYSHZuOXLxXteiO6V UKnEr6NQ==; Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1jqZ9G-0000XE-Rf; Wed, 01 Jul 2020 09:35:23 +0000 Received: from szxga06-in.huawei.com ([45.249.212.32] helo=huawei.com) by merlin.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1jqZ5s-00071D-Rv for linux-mtd@lists.infradead.org; Wed, 01 Jul 2020 09:31:54 +0000 Received: from DGGEMS413-HUB.china.huawei.com (unknown [172.30.72.58]) by Forcepoint Email with ESMTP id 5578593866925948708A; Wed, 1 Jul 2020 17:31:45 +0800 (CST) Received: from huawei.com (10.175.127.227) by DGGEMS413-HUB.china.huawei.com (10.3.19.213) with Microsoft SMTP Server id 14.3.487.0; Wed, 1 Jul 2020 17:31:33 +0800 From: Zhihao Cheng To: , Subject: [PATCH] ubifs: Fix a potential space leak problem while linking tmpfile Date: Wed, 1 Jul 2020 17:32:27 +0800 Message-ID: <20200701093227.674945-1-chengzhihao1@huawei.com> X-Mailer: git-send-email 2.25.4 MIME-Version: 1.0 X-Originating-IP: [10.175.127.227] X-CFilter-Loop: Reflected X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20200701_053153_258696_FC9729CB X-CRM114-Status: UNSURE ( 7.13 ) X-CRM114-Notice: Please train this message. X-Spam-Score: -2.3 (--) X-Spam-Report: SpamAssassin version 3.4.4 on merlin.infradead.org summary: Content analysis details: (-2.3 points) pts rule name description ---- ---------------------- -------------------------------------------------- -2.3 RCVD_IN_DNSWL_MED RBL: Sender listed at https://www.dnswl.org/, medium trust [45.249.212.32 listed in list.dnswl.org] 0.0 RCVD_IN_MSPIKE_H4 RBL: Very Good reputation (+4) [45.249.212.32 listed in wl.mailspike.net] -0.0 SPF_HELO_PASS SPF: HELO matches SPF record -0.0 SPF_PASS SPF: sender matches SPF record 0.0 RCVD_IN_MSPIKE_WL Mailspike good senders X-BeenThere: linux-mtd@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Linux MTD discussion mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org Sender: "linux-mtd" Errors-To: linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org There is a potential space leak problem while linking tmpfile, in which case, inode node (with nlink=0) is valid in tnc (on flash), which leads to space leak. Meanwhile, the corresponding data nodes won't be released from tnc. For example, (A reproducer can be found in Link): $ mount UBIFS [process A] [process B] [TNC] [orphan area] ubifs_tmpfile inode_A (nlink=0) inode_A do_commit inode_A (nlink=0) inode_A ↑ (comment: It makes sure not replay inode_A in next mount) ubifs_link inode_A (nlink=0) inode_A ubifs_delete_orphan inode_A (nlink=0) do_commit inode_A (nlink=0) ---> POWERCUT <--- (ubifs_jnl_update) $ mount UBIFS inode_A will neither be replayed in ubifs_replay_journal() nor ubifs_mount_orphans(). inode_A (nlink=0) with its data nodes will always on tnc, it occupy space but is non-visable for users. Commit ee1438ce5dc4d ("ubifs: Check link count of inodes when killing orphans.") handles problem in mistakenly deleting relinked tmpfile while replaying orphan area. Since that, tmpfile inode should always live in orphan area even it is linked. Fix it by reverting commit 32fe905c17f001 ("ubifs: Fix O_TMPFILE corner case in ubifs_link()"). Signed-off-by: Zhihao Cheng Cc: Fixes: 32fe905c17f001 ("ubifs: Fix O_TMPFILE corner case in ubifs_link()") Link: https://bugzilla.kernel.org/show_bug.cgi?id=208405 --- fs/ubifs/dir.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c index ef85ec167a84..9534c4bb598f 100644 --- a/fs/ubifs/dir.c +++ b/fs/ubifs/dir.c @@ -722,11 +722,6 @@ static int ubifs_link(struct dentry *old_dentry, struct inode *dir, goto out_fname; lock_2_inodes(dir, inode); - - /* Handle O_TMPFILE corner case, it is allowed to link a O_TMPFILE. */ - if (inode->i_nlink == 0) - ubifs_delete_orphan(c, inode->i_ino); - inc_nlink(inode); ihold(inode); inode->i_ctime = current_time(inode); @@ -747,8 +742,6 @@ static int ubifs_link(struct dentry *old_dentry, struct inode *dir, dir->i_size -= sz_change; dir_ui->ui_size = dir->i_size; drop_nlink(inode); - if (inode->i_nlink == 0) - ubifs_add_orphan(c, inode->i_ino); unlock_2_inodes(dir, inode); ubifs_release_budget(c, &req); iput(inode);