From: "zhangyi (F)" <yi.zhang@huawei.com>
To: <linux-ext4@vger.kernel.org>
Cc: <jack@suse.cz>, <tytso@mit.edu>, <luoshijie1@huawei.com>,
<zhangxiaoxu5@huawei.com>, <yi.zhang@huawei.com>
Subject: [PATCH v2 2/2] jbd2: do not clear the BH_Mapped flag when forgetting a metadata buffer
Date: Tue, 11 Feb 2020 21:55:00 +0800 [thread overview]
Message-ID: <20200211135500.40524-3-yi.zhang@huawei.com> (raw)
In-Reply-To: <20200211135500.40524-1-yi.zhang@huawei.com>
Commit 904cdbd41d74 ("jbd2: clear dirty flag when revoking a buffer from
an older transaction") set the BH_Freed flag when forgetting a metadata
buffer which belongs to the committing transaction, it indicate the
committing process clear dirty bits when it is done with the buffer. But
it also clear the BH_Mapped flag at the same time, which may trigger
below NULL pointer oops when block_size < PAGE_SIZE.
rmdir 1 kjournald2 mkdir 2
jbd2_journal_commit_transaction
commit transaction N
jbd2_journal_forget
set_buffer_freed(bh1)
jbd2_journal_commit_transaction
commit transaction N+1
...
clear_buffer_mapped(bh1)
ext4_getblk(bh2 ummapped)
...
grow_dev_page
init_page_buffers
bh1->b_private=NULL
bh2->b_private=NULL
jbd2_journal_put_journal_head(jh1)
__journal_remove_journal_head(hb1)
jh1 is NULL and trigger oops
*) Dir entry block bh1 and bh2 belongs to one page, and the bh2 has
already been unmapped.
For the metadata buffer we forgetting, we should always keep the mapped
flag and clear the dirty flags is enough, so this patch pick out the
these buffers and keep their BH_Mapped flag.
Fixes: 904cdbd41d74 ("jbd2: clear dirty flag when revoking a buffer from an older transaction")
Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
---
fs/jbd2/commit.c | 20 ++++++++++++++++----
1 file changed, 16 insertions(+), 4 deletions(-)
diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
index ecc2ea5f1b59..8f6f4ddd8b78 100644
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -985,12 +985,24 @@ void jbd2_journal_commit_transaction(journal_t *journal)
* pagesize and it is attached to the last partial page.
*/
if (buffer_freed(bh) && !jh->b_next_transaction) {
+ struct address_space *mapping;
+
clear_buffer_freed(bh);
clear_buffer_jbddirty(bh);
- clear_buffer_mapped(bh);
- clear_buffer_new(bh);
- clear_buffer_req(bh);
- bh->b_bdev = NULL;
+ /*
+ * We can (and need to) unmap buffer only for normal
+ * mappings. Block device buffers need to stay mapped
+ * all the time. We need to be careful about the check
+ * because the data page mapping can get cleared under
+ * our hands.
+ */
+ mapping = READ_ONCE(bh->b_page->mapping);
+ if (!(mapping && sb_is_blkdev_sb(mapping->host->i_sb))) {
+ clear_buffer_mapped(bh);
+ clear_buffer_new(bh);
+ clear_buffer_req(bh);
+ bh->b_bdev = NULL;
+ }
}
if (buffer_jbddirty(bh)) {
--
2.17.2
next prev parent reply other threads:[~2020-02-11 13:56 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-11 13:54 [PATCH v2 0/2] jbd2: fix an oops problem zhangyi (F)
2020-02-11 13:54 ` [PATCH v2 1/2] jbd2: move the clearing of b_modified flag to the journal_unmap_buffer() zhangyi (F)
2020-02-12 10:45 ` Jan Kara
2020-02-11 13:55 ` zhangyi (F) [this message]
2020-02-12 10:48 ` [PATCH v2 2/2] jbd2: do not clear the BH_Mapped flag when forgetting a metadata buffer Jan Kara
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200211135500.40524-3-yi.zhang@huawei.com \
--to=yi.zhang@huawei.com \
--cc=jack@suse.cz \
--cc=linux-ext4@vger.kernel.org \
--cc=luoshijie1@huawei.com \
--cc=tytso@mit.edu \
--cc=zhangxiaoxu5@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).