From patchwork Tue Feb 18 19:54:53 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 231133 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DE4E5C34047 for ; Tue, 18 Feb 2020 20:03:39 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id B54E12464E for ; Tue, 18 Feb 2020 20:03:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1582056219; bh=RJptZS0OKYne+gFv/LGiaLgBKwZ9QaewdZfuLKFKubs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=z/ksIaOlhZVDfzPyzCNF+QWgjV6huF/Y3zfmmly4tMFJLGwApYmpHTBHoWvPfg1j7 6HCVUUj199K6m+XkVo8x5fWUjnp1sf+YMPW13IkxoSttbCOG/mAdwaCs1FdPVu7KBA ljVnAC5juwEPttthbz0OOZUIdc/6uSJdd6i2NQq0= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729123AbgBRUDi (ORCPT ); Tue, 18 Feb 2020 15:03:38 -0500 Received: from mail.kernel.org ([198.145.29.99]:44966 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728964AbgBRUDi (ORCPT ); Tue, 18 Feb 2020 15:03:38 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 4C1B921D56; Tue, 18 Feb 2020 20:03:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1582056216; bh=RJptZS0OKYne+gFv/LGiaLgBKwZ9QaewdZfuLKFKubs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jw8p+AVBzQypSeOopJ8CrgNDARSAaXwp6MSL8R9rsZWl93k9iaTbjo8R11EVnZyMV iJYxYhcGnUq3LmKKRvM3kF1TT0LGDDqXXTHiPn9jA2pOJfN1nfMM6BYb9fD2W8hrTF /D2wZkbSb8zXqwWTsjdvbSO65zqx+bhvHUWi4Fg4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jan Kara , "zhangyi (F)" , Theodore Tso , stable@kernel.org Subject: [PATCH 5.5 32/80] jbd2: do not clear the BH_Mapped flag when forgetting a metadata buffer Date: Tue, 18 Feb 2020 20:54:53 +0100 Message-Id: <20200218190435.536576320@linuxfoundation.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20200218190432.043414522@linuxfoundation.org> References: <20200218190432.043414522@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: zhangyi (F) commit c96dceeabf765d0b1b1f29c3bf50a5c01315b820 upstream. Commit 904cdbd41d74 ("jbd2: clear dirty flag when revoking a buffer from an older transaction") set the BH_Freed flag when forgetting a metadata buffer which belongs to the committing transaction, it indicate the committing process clear dirty bits when it is done with the buffer. But it also clear the BH_Mapped flag at the same time, which may trigger below NULL pointer oops when block_size < PAGE_SIZE. rmdir 1 kjournald2 mkdir 2 jbd2_journal_commit_transaction commit transaction N jbd2_journal_forget set_buffer_freed(bh1) jbd2_journal_commit_transaction commit transaction N+1 ... clear_buffer_mapped(bh1) ext4_getblk(bh2 ummapped) ... grow_dev_page init_page_buffers bh1->b_private=NULL bh2->b_private=NULL jbd2_journal_put_journal_head(jh1) __journal_remove_journal_head(hb1) jh1 is NULL and trigger oops *) Dir entry block bh1 and bh2 belongs to one page, and the bh2 has already been unmapped. For the metadata buffer we forgetting, we should always keep the mapped flag and clear the dirty flags is enough, so this patch pick out the these buffers and keep their BH_Mapped flag. Link: https://lore.kernel.org/r/20200213063821.30455-3-yi.zhang@huawei.com Fixes: 904cdbd41d74 ("jbd2: clear dirty flag when revoking a buffer from an older transaction") Reviewed-by: Jan Kara Signed-off-by: zhangyi (F) Signed-off-by: Theodore Ts'o Cc: stable@kernel.org Signed-off-by: Greg Kroah-Hartman --- fs/jbd2/commit.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) --- a/fs/jbd2/commit.c +++ b/fs/jbd2/commit.c @@ -985,12 +985,29 @@ restart_loop: * pagesize and it is attached to the last partial page. */ if (buffer_freed(bh) && !jh->b_next_transaction) { + struct address_space *mapping; + clear_buffer_freed(bh); clear_buffer_jbddirty(bh); - clear_buffer_mapped(bh); - clear_buffer_new(bh); - clear_buffer_req(bh); - bh->b_bdev = NULL; + + /* + * Block device buffers need to stay mapped all the + * time, so it is enough to clear buffer_jbddirty and + * buffer_freed bits. For the file mapping buffers (i.e. + * journalled data) we need to unmap buffer and clear + * more bits. We also need to be careful about the check + * because the data page mapping can get cleared under + * out hands, which alse need not to clear more bits + * because the page and buffers will be freed and can + * never be reused once we are done with them. + */ + mapping = READ_ONCE(bh->b_page->mapping); + if (mapping && !sb_is_blkdev_sb(mapping->host->i_sb)) { + clear_buffer_mapped(bh); + clear_buffer_new(bh); + clear_buffer_req(bh); + bh->b_bdev = NULL; + } } if (buffer_jbddirty(bh)) {