From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: yangerkun <yangerkun@huawei.com>, Hulk Robot <hulkci@huawei.com>,
Jan Kara <jack@suse.cz>, Theodore Ts'o <tytso@mit.edu>,
Sasha Levin <sashal@kernel.org>,
linux-ext4@vger.kernel.org
Subject: [PATCH AUTOSEL 4.14 33/58] ext4: fix a bug in ext4_wait_for_tail_page_commit
Date: Wed, 11 Dec 2019 10:28:06 -0500 [thread overview]
Message-ID: <20191211152831.23507-33-sashal@kernel.org> (raw)
In-Reply-To: <20191211152831.23507-1-sashal@kernel.org>
From: yangerkun <yangerkun@huawei.com>
[ Upstream commit 565333a1554d704789e74205989305c811fd9c7a ]
No need to wait for any commit once the page is fully truncated.
Besides, it may confuse e.g. concurrent ext4_writepage() with the page
still be dirty (will be cleared by truncate_pagecache() in
ext4_setattr()) but buffers has been freed; and then trigger a bug
show as below:
[ 26.057508] ------------[ cut here ]------------
[ 26.058531] kernel BUG at fs/ext4/inode.c:2134!
...
[ 26.088130] Call trace:
[ 26.088695] ext4_writepage+0x914/0xb28
[ 26.089541] writeout.isra.4+0x1b4/0x2b8
[ 26.090409] move_to_new_page+0x3b0/0x568
[ 26.091338] __unmap_and_move+0x648/0x988
[ 26.092241] unmap_and_move+0x48c/0xbb8
[ 26.093096] migrate_pages+0x220/0xb28
[ 26.093945] kernel_mbind+0x828/0xa18
[ 26.094791] __arm64_sys_mbind+0xc8/0x138
[ 26.095716] el0_svc_common+0x190/0x490
[ 26.096571] el0_svc_handler+0x60/0xd0
[ 26.097423] el0_svc+0x8/0xc
Run the procedure (generate by syzkaller) parallel with ext3.
void main()
{
int fd, fd1, ret;
void *addr;
size_t length = 4096;
int flags;
off_t offset = 0;
char *str = "12345";
fd = open("a", O_RDWR | O_CREAT);
assert(fd >= 0);
/* Truncate to 4k */
ret = ftruncate(fd, length);
assert(ret == 0);
/* Journal data mode */
flags = 0xc00f;
ret = ioctl(fd, _IOW('f', 2, long), &flags);
assert(ret == 0);
/* Truncate to 0 */
fd1 = open("a", O_TRUNC | O_NOATIME);
assert(fd1 >= 0);
addr = mmap(NULL, length, PROT_WRITE | PROT_READ,
MAP_SHARED, fd, offset);
assert(addr != (void *)-1);
memcpy(addr, str, 5);
mbind(addr, length, 0, 0, 0, MPOL_MF_MOVE);
}
And the bug will be triggered once we seen the below order.
reproduce1 reproduce2
... | ...
truncate to 4k |
change to journal data mode |
| memcpy(set page dirty)
truncate to 0: |
ext4_setattr: |
... |
ext4_wait_for_tail_page_commit |
| mbind(trigger bug)
truncate_pagecache(clean dirty)| ...
... |
mbind will call ext4_writepage() since the page still be dirty, and then
report the bug since the buffers has been free. Fix it by return
directly once offset equals to 0 which means the page has been fully
truncated.
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: yangerkun <yangerkun@huawei.com>
Link: https://lore.kernel.org/r/20190919063508.1045-1-yangerkun@huawei.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/inode.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index f746abfd96977..19c160e7f7763 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5302,11 +5302,15 @@ static void ext4_wait_for_tail_page_commit(struct inode *inode)
offset = inode->i_size & (PAGE_SIZE - 1);
/*
- * All buffers in the last page remain valid? Then there's nothing to
- * do. We do the check mainly to optimize the common PAGE_SIZE ==
- * blocksize case
+ * If the page is fully truncated, we don't need to wait for any commit
+ * (and we even should not as __ext4_journalled_invalidatepage() may
+ * strip all buffers from the page but keep the page dirty which can then
+ * confuse e.g. concurrent ext4_writepage() seeing dirty page without
+ * buffers). Also we don't need to wait for any commit if all buffers in
+ * the page remain valid. This is most beneficial for the common case of
+ * blocksize == PAGESIZE.
*/
- if (offset > PAGE_SIZE - i_blocksize(inode))
+ if (!offset || offset > (PAGE_SIZE - i_blocksize(inode)))
return;
while (1) {
page = find_lock_page(inode->i_mapping,
--
2.20.1
next prev parent reply other threads:[~2019-12-11 15:31 UTC|newest]
Thread overview: 61+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-11 15:27 [PATCH AUTOSEL 4.14 01/58] scsi: lpfc: Fix discovery failures when target device connectivity bounces Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 02/58] scsi: mpt3sas: Fix clear pending bit in ioctl status Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 03/58] scsi: lpfc: Fix locking on mailbox command completion Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 04/58] Input: atmel_mxt_ts - disable IRQ across suspend Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 05/58] iommu/tegra-smmu: Fix page tables in > 4 GiB memory Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 06/58] scsi: target: compare full CHAP_A Algorithm strings Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 07/58] scsi: lpfc: Fix SLI3 hba in loop mode not discovering devices Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 08/58] scsi: csiostor: Don't enable IRQs too early Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 09/58] powerpc/pseries: Mark accumulate_stolen_time() as notrace Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 10/58] powerpc/pseries: Don't fail hash page table insert for bolted mapping Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 11/58] powerpc/tools: Don't quote $objdump in scripts Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 12/58] dma-debug: add a schedule point in debug_dma_dump_mappings() Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 13/58] clocksource/drivers/asm9260: Add a check for of_clk_get Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 14/58] powerpc/security/book3s64: Report L1TF status in sysfs Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 15/58] powerpc/book3s64/hash: Add cond_resched to avoid soft lockup warning Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 16/58] ext4: update direct I/O read lock pattern for IOCB_NOWAIT Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 17/58] jbd2: Fix statistics for the number of logged blocks Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 18/58] scsi: tracing: Fix handling of TRANSFER LENGTH == 0 for READ(6) and WRITE(6) Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 19/58] scsi: lpfc: Fix duplicate unreg_rpi error in port offline flow Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 20/58] f2fs: fix to update dir's i_pino during cross_rename Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 21/58] clk: qcom: Allow constant ratio freq tables for rcg Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 22/58] irqchip/irq-bcm7038-l1: Enable parent IRQ if necessary Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 23/58] irqchip: ingenic: Error out if IRQ domain creation failed Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 24/58] mfd: mfd-core: Honour Device Tree's request to disable a child-device Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 25/58] fs/quota: handle overflows of sysctl fs.quota.* and report as unsigned long Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 26/58] scsi: lpfc: fix: Coverity: lpfc_cmpl_els_rsp(): Null pointer dereferences Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 27/58] scsi: ufs: fix potential bug which ends in system hang Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 28/58] powerpc/pseries/cmm: Implement release() function for sysfs device Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 29/58] powerpc/security: Fix wrong message when RFI Flush is disable Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 30/58] scsi: atari_scsi: sun3_scsi: Set sg_tablesize to 1 instead of SG_NONE Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 31/58] clk: pxa: fix one of the pxa RTC clocks Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 32/58] bcache: at least try to shrink 1 node in bch_mca_scan() Sasha Levin
2019-12-12 3:48 ` John Stoffel
2019-12-12 3:52 ` Coly Li
2019-12-12 4:00 ` John Stoffel
2019-12-11 15:28 ` Sasha Levin [this message]
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 34/58] HID: logitech-hidpp: Silence intermittent get_battery_capacity errors Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 35/58] libnvdimm/btt: fix variable 'rc' set but not used Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 36/58] HID: Improve Windows Precision Touchpad detection Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 37/58] watchdog: aspeed: Fix clock behaviour for ast2600 Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 38/58] ext4: work around deleting a file with i_nlink == 0 safely Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 39/58] scsi: pm80xx: Fix for SATA device discovery Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 40/58] scsi: ufs: Fix error handing during hibern8 enter Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 41/58] scsi: scsi_debug: num_tgts must be >= 0 Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 42/58] scsi: NCR5380: Add disconnect_mask module parameter Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 43/58] scsi: iscsi: Don't send data to unbound connection Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 44/58] scsi: target: iscsi: Wait for all commands to finish before freeing a session Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 45/58] gpio: mpc8xxx: Don't overwrite default irq_set_type callback Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 46/58] apparmor: fix unsigned len comparison with less than zero Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 47/58] scripts/kallsyms: fix definitely-lost memory leak Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 48/58] f2fs: choose hardlimit when softlimit is larger than hardlimit in f2fs_statfs_project() Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 49/58] of: unittest: fix memory leak in attach_node_and_children Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 50/58] cdrom: respect device capabilities during opening action Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 51/58] perf script: Fix brstackinsn for AUXTRACE Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 52/58] perf regs: Make perf_reg_name() return "unknown" instead of NULL Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 53/58] s390/zcrypt: handle new reply code FILTERED_BY_HYPERVISOR Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 54/58] libfdt: define INT32_MAX and UINT32_MAX in libfdt_env.h Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 55/58] s390/cpum_sf: Check for SDBT and SDB consistency Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 56/58] ocfs2: fix passing zero to 'PTR_ERR' warning Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 57/58] kernel: sysctl: make drop_caches write-only Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 58/58] userfaultfd: require CAP_SYS_PTRACE for UFFD_FEATURE_EVENT_FORK Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191211152831.23507-33-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=hulkci@huawei.com \
--cc=jack@suse.cz \
--cc=linux-ext4@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=tytso@mit.edu \
--cc=yangerkun@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).