kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/fs/ext4
History
Jan Kara c27d67c8d4 ext4: fix oops on corrupted filesystem 
commit 74177f55b7 upstream.

When filesystem is corrupted in the right way, it can happen
ext4_mark_iloc_dirty() in ext4_orphan_add() returns error and we
subsequently remove inode from the in-memory orphan list. However this
deletion is done with list_del(&EXT4_I(inode)->i_orphan) and thus we
leave i_orphan list_head with a stale content. Later we can look at this
content causing list corruption, oops, or other issues. The reported
trace looked like:

WARNING: CPU: 0 PID: 46 at lib/list_debug.c:53 __list_del_entry+0x6b/0x100()
list_del corruption, 0000000061c1d6e0->next is LIST_POISON1
0000000000100100)
CPU: 0 PID: 46 Comm: ext4.exe Not tainted 4.1.0-rc4+ #250
Stack:
 60462947 62219960 602ede24 62219960
 602ede24 603ca293 622198f0 602f02eb
 62219950 6002c12c 62219900 601b4d6b
Call Trace:
 [<6005769c>] ? vprintk_emit+0x2dc/0x5c0
 [<602ede24>] ? printk+0x0/0x94
 [<600190bc>] show_stack+0xdc/0x1a0
 [<602ede24>] ? printk+0x0/0x94
 [<602ede24>] ? printk+0x0/0x94
 [<602f02eb>] dump_stack+0x2a/0x2c
 [<6002c12c>] warn_slowpath_common+0x9c/0xf0
 [<601b4d6b>] ? __list_del_entry+0x6b/0x100
 [<6002c254>] warn_slowpath_fmt+0x94/0xa0
 [<602f4d09>] ? __mutex_lock_slowpath+0x239/0x3a0
 [<6002c1c0>] ? warn_slowpath_fmt+0x0/0xa0
 [<60023ebf>] ? set_signals+0x3f/0x50
 [<600a205a>] ? kmem_cache_free+0x10a/0x180
 [<602f4e88>] ? mutex_lock+0x18/0x30
 [<601b4d6b>] __list_del_entry+0x6b/0x100
 [<601177ec>] ext4_orphan_del+0x22c/0x2f0
 [<6012f27c>] ? __ext4_journal_start_sb+0x2c/0xa0
 [<6010b973>] ? ext4_truncate+0x383/0x390
 [<6010bc8b>] ext4_write_begin+0x30b/0x4b0
 [<6001bb50>] ? copy_from_user+0x0/0xb0
 [<601aa840>] ? iov_iter_fault_in_readable+0xa0/0xc0
 [<60072c4f>] generic_perform_write+0xaf/0x1e0
 [<600c4166>] ? file_update_time+0x46/0x110
 [<60072f0f>] __generic_file_write_iter+0x18f/0x1b0
 [<6010030f>] ext4_file_write_iter+0x15f/0x470
 [<60094e10>] ? unlink_file_vma+0x0/0x70
 [<6009b180>] ? unlink_anon_vmas+0x0/0x260
 [<6008f169>] ? free_pgtables+0xb9/0x100
 [<600a6030>] __vfs_write+0xb0/0x130
 [<600a61d5>] vfs_write+0xa5/0x170
 [<600a63d6>] SyS_write+0x56/0xe0
 [<6029fcb0>] ? __libc_waitpid+0x0/0xa0
 [<6001b698>] handle_syscall+0x68/0x90
 [<6002633d>] userspace+0x4fd/0x600
 [<6002274f>] ? save_registers+0x1f/0x40
 [<60028bd7>] ? arch_prctl+0x177/0x1b0
 [<60017bd5>] fork_handler+0x85/0x90

Fix the problem by using list_del_init() as we always should with
i_orphan list.

Reported-by: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2016-08-22 22:37:54 +01:00
..
acl.c ext2/3/4: use generic posix ACL infrastructure 2014-01-25 23:58:19 -05:00
acl.h ext2/3/4: use generic posix ACL infrastructure 2014-01-25 23:58:19 -05:00
balloc.c ext4: move error report out of atomic context in ext4_init_block_bitmap() 2014-11-05 11:43:06 +00:00
bitmap.c ext4: Replace open coded mdata csum feature to helper function 2014-11-05 11:43:06 +00:00
block_validity.c fs/ext4: use rbtree postorder iteration helper instead of opencoding 2014-01-23 16:37:03 -08:00
dir.c ext4: remove unused local variable "stored" from ext4_readdir(...) 2014-05-27 12:48:55 -04:00
ext4.h ext4: add lockdep annotations for i_data_sem 2016-05-01 00:06:07 +02:00
ext4_extents.h ext4: rename uninitialized extents to unwritten 2014-04-20 23:45:47 -04:00
ext4_jbd2.c ext4: fix potential use after free in __ext4_journal_stop 2015-12-13 17:48:47 +00:00
ext4_jbd2.h ext4: make local functions static 2014-05-12 10:50:23 -04:00
extents.c ext4: fix loss of delalloc extent info in ext4_zero_range() 2015-09-30 13:20:54 +01:00
extents_status.c ext4: fix data corruption caused by unwritten and delayed extents 2015-05-12 09:36:39 +01:00
extents_status.h ext4: add ext4_es_store_pblock_status() 2014-02-19 20:15:15 -05:00
file.c ext4: prevent bugon on race between write/fcntl 2014-11-13 11:48:59 +00:00
fsync.c ext4: Fix fsync error handling after filesystem abort 2013-06-12 22:38:04 -04:00
hash.c ext4: reduce one "if" comparison in ext4_dirhash() 2013-02-01 22:33:21 -05:00
ialloc.c ext4: clean up error handling when orphan list is corrupted 2016-08-22 22:37:52 +01:00
indirect.c ext4: don't retry file block mapping on bigalloc fs with non-extent file 2015-07-15 10:00:48 +01:00
inline.c ext4: Replace open coded mdata csum feature to helper function 2014-11-05 11:43:06 +00:00
inode.c ext4: fix data exposure after a crash 2016-08-22 22:37:51 +01:00
ioctl.c ext4: Replace open coded mdata csum feature to helper function 2014-11-05 11:43:06 +00:00
Kconfig ext4: fix Kconfig documentation for CONFIG_EXT4_DEBUG 2013-04-21 20:32:03 -04:00
Makefile ext4: Remove CONFIG_EXT4_FS_XATTR 2012-12-10 16:30:43 -05:00
mballoc.c ext4: replace open coded nofail allocation in ext4_free_blocks() 2015-07-20 14:38:53 +01:00
mballoc.h ext4: remove unused ac_ex_scanned 2014-02-20 13:32:10 -05:00
migrate.c ext4: correctly migrate a file with a hole at the beginning 2015-07-20 14:38:52 +01:00
mmp.c ext4: Replace open coded mdata csum feature to helper function 2014-11-05 11:43:06 +00:00
move_extent.c ext4: add lockdep annotations for i_data_sem 2016-05-01 00:06:07 +02:00
namei.c ext4: fix oops on corrupted filesystem 2016-08-22 22:37:54 +01:00
page-io.c Clean ups and miscellaneous bug fixes, in particular for the new 2014-06-08 13:03:35 -07:00
resize.c ext4: fix potential integer overflow 2016-03-04 10:26:39 +00:00
super.c ext4: add lockdep annotations for i_data_sem 2016-05-01 00:06:07 +02:00
symlink.c ext4: Remove CONFIG_EXT4_FS_XATTR 2012-12-10 16:30:43 -05:00
truncate.h ext4: move common truncate functions to header file 2011-06-27 19:16:04 -04:00
xattr.c ext4: Replace open coded mdata csum feature to helper function 2014-11-05 11:43:06 +00:00
xattr.h ext4: each filesystem creates and uses its own mb_cache 2014-03-18 19:24:49 -04:00
xattr_security.c Merge branch 'for_linus' into for_linus_merged 2012-01-10 11:54:07 -05:00
xattr_trusted.c ext2/3/4: delete unneeded includes of module.h 2012-01-09 13:52:10 +01:00
xattr_user.c ext2/3/4: delete unneeded includes of module.h 2012-01-09 13:52:10 +01:00