lkml.org 
[lkml]   [2016]   [Jun]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.2.y-ckt 119/206] xfs: xfs_iflush_cluster fails to abort on error
    Date
    4.2.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

    ---8<------------------------------------------------------------

    From: Dave Chinner <dchinner@redhat.com>

    commit b1438f477934f5a4d5a44df26f3079a7575d5946 upstream.

    When a failure due to an inode buffer occurs, the error handling
    fails to abort the inode writeback correctly. This can result in the
    inode being reclaimed whilst still in the AIL, leading to
    use-after-free situations as well as filesystems that cannot be
    unmounted as the inode log items left in the AIL never get removed.

    Fix this by ensuring fatal errors from xfs_imap_to_bp() result in
    the inode flush being aborted correctly.

    Reported-by: Shyam Kaushik <shyam@zadarastorage.com>
    Diagnosed-by: Shyam Kaushik <shyam@zadarastorage.com>
    Tested-by: Shyam Kaushik <shyam@zadarastorage.com>
    Signed-off-by: Dave Chinner <dchinner@redhat.com>
    Reviewed-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Dave Chinner <david@fromorbit.com>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    fs/xfs/xfs_inode.c | 17 +++++++++++++----
    1 file changed, 13 insertions(+), 4 deletions(-)

    diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
    index 3da9f4d..13c58cf 100644
    --- a/fs/xfs/xfs_inode.c
    +++ b/fs/xfs/xfs_inode.c
    @@ -3286,7 +3286,7 @@ xfs_iflush(
    struct xfs_buf **bpp)
    {
    struct xfs_mount *mp = ip->i_mount;
    - struct xfs_buf *bp;
    + struct xfs_buf *bp = NULL;
    struct xfs_dinode *dip;
    int error;

    @@ -3328,14 +3328,22 @@ xfs_iflush(
    }

    /*
    - * Get the buffer containing the on-disk inode.
    + * Get the buffer containing the on-disk inode. We are doing a try-lock
    + * operation here, so we may get an EAGAIN error. In that case, we
    + * simply want to return with the inode still dirty.
    + *
    + * If we get any other error, we effectively have a corruption situation
    + * and we cannot flush the inode, so we treat it the same as failing
    + * xfs_iflush_int().
    */
    error = xfs_imap_to_bp(mp, NULL, &ip->i_imap, &dip, &bp, XBF_TRYLOCK,
    0);
    - if (error || !bp) {
    + if (error == -EAGAIN) {
    xfs_ifunlock(ip);
    return error;
    }
    + if (error)
    + goto corrupt_out;

    /*
    * First flush out the inode that xfs_iflush was called with.
    @@ -3363,7 +3371,8 @@ xfs_iflush(
    return 0;

    corrupt_out:
    - xfs_buf_relse(bp);
    + if (bp)
    + xfs_buf_relse(bp);
    xfs_force_shutdown(mp, SHUTDOWN_CORRUPT_INCORE);
    cluster_corrupt_out:
    error = -EFSCORRUPTED;
    --
    2.7.4
    \
     
     \ /
      Last update: 2016-06-10 00:21    [W:4.046 / U:0.052 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site