[5.17,142/146] jbd2: fix a potential race while discarding reserved buffers after an abort

From: Ye Bin <yebin10@huawei.com>

From: Ye Bin <yebin10@huawei.com>

commit 23e3d7f7061f8682c751c46512718f47580ad8f0 upstream.

we got issue as follows:
[   72.796117] EXT4-fs error (device sda): ext4_journal_check_start:83: comm fallocate: Detected aborted journal
[   72.826847] EXT4-fs (sda): Remounting filesystem read-only
fallocate: fallocate failed: Read-only file system
[   74.791830] jbd2_journal_commit_transaction: jh=0xffff9cfefe725d90 bh=0x0000000000000000 end delay
[   74.793597] ------------[ cut here ]------------
[   74.794203] kernel BUG at fs/jbd2/transaction.c:2063!
[   74.794886] invalid opcode: 0000 [#1] PREEMPT SMP PTI
[   74.795533] CPU: 4 PID: 2260 Comm: jbd2/sda-8 Not tainted 5.17.0-rc8-next-20220315-dirty #150
[   74.798327] RIP: 0010:__jbd2_journal_unfile_buffer+0x3e/0x60
[   74.801971] RSP: 0018:ffffa828c24a3cb8 EFLAGS: 00010202
[   74.802694] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[   74.803601] RDX: 0000000000000001 RSI: ffff9cfefe725d90 RDI: ffff9cfefe725d90
[   74.804554] RBP: ffff9cfefe725d90 R08: 0000000000000000 R09: ffffa828c24a3b20
[   74.805471] R10: 0000000000000001 R11: 0000000000000001 R12: ffff9cfefe725d90
[   74.806385] R13: ffff9cfefe725d98 R14: 0000000000000000 R15: ffff9cfe833a4d00
[   74.807301] FS:  0000000000000000(0000) GS:ffff9d01afb00000(0000) knlGS:0000000000000000
[   74.808338] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   74.809084] CR2: 00007f2b81bf4000 CR3: 0000000100056000 CR4: 00000000000006e0
[   74.810047] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   74.810981] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   74.811897] Call Trace:
[   74.812241]  <TASK>
[   74.812566]  __jbd2_journal_refile_buffer+0x12f/0x180
[   74.813246]  jbd2_journal_refile_buffer+0x4c/0xa0
[   74.813869]  jbd2_journal_commit_transaction.cold+0xa1/0x148
[   74.817550]  kjournald2+0xf8/0x3e0
[   74.819056]  kthread+0x153/0x1c0
[   74.819963]  ret_from_fork+0x22/0x30

Above issue may happen as follows:
        write                   truncate                   kjournald2
generic_perform_write
 ext4_write_begin
  ext4_walk_page_buffers
   do_journal_get_write_access ->add BJ_Reserved list
 ext4_journalled_write_end
  ext4_walk_page_buffers
   write_end_fn
    ext4_handle_dirty_metadata
                ***************JBD2 ABORT**************
     jbd2_journal_dirty_metadata
 -> return -EROFS, jh in reserved_list
                                                   jbd2_journal_commit_transaction
                                                    while (commit_transaction->t_reserved_list)
                                                      jh = commit_transaction->t_reserved_list;
                        truncate_pagecache_range
                         do_invalidatepage
			  ext4_journalled_invalidatepage
			   jbd2_journal_invalidatepage
			    journal_unmap_buffer
			     __dispose_buffer
			      __jbd2_journal_unfile_buffer
			       jbd2_journal_put_journal_head ->put last ref_count
			        __journal_remove_journal_head
				 bh->b_private = NULL;
				 jh->b_bh = NULL;
				                      jbd2_journal_refile_buffer(journal, jh);
							bh = jh2bh(jh);
							->bh is NULL, later will trigger null-ptr-deref
				 journal_free_journal_head(jh);

After commit 96f1e0974575, we no longer hold the j_state_lock while
iterating over the list of reserved handles in
jbd2_journal_commit_transaction().  This potentially allows the
journal_head to be freed by journal_unmap_buffer while the commit
codepath is also trying to free the BJ_Reserved buffers.  Keeping
j_state_lock held while trying extends hold time of the lock
minimally, and solves this issue.

Fixes: 96f1e0974575("jbd2: avoid long hold times of j_state_lock while committing a transaction")
Signed-off-by: Ye Bin <yebin10@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20220317142137.1821590-1-yebin10@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/jbd2/commit.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Message ID	20220426081754.049154511@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Ye Bin <yebin10@huawei.com>, Jan Kara <jack@suse.cz>, Theodore Tso <tytso@mit.edu> Subject: [PATCH 5.17 142/146] jbd2: fix a potential race while discarding reserved buffers after an abort Date: Tue, 26 Apr 2022 10:22:17 +0200 Message-Id: <20220426081754.049154511@linuxfoundation.org> In-Reply-To: <20220426081750.051179617@linuxfoundation.org> References: <20220426081750.051179617@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.17,002/146] perf tools: Fix segfault accessing sample_id xyarray [5.17,003/146] drm/amd/display: Only set PSR version when valid [5.17,004/146] block/compat_ioctl: fix range check in BLKGETSIZE [5.17,005/146] gfs2: assign rgrp glock before compute_bitstructs [5.17,006/146] scsi: ufs: core: scsi_get_lba() error fix [5.17,007/146] net/sched: cls_u32: fix netns refcount changes in u32_change() [5.17,008/146] ALSA: usb-audio: Clear MIDI port active flag after draining [5.17,009/146] ALSA: usb-audio: add mapping for MSI MAG X570S Torpedo MAX. [5.17,010/146] ALSA: hda/realtek: Add quirk for Clevo NP70PNP [5.17,011/146] ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek [5.17,012/146] ASoC: topology: Correct error handling in soc_tplg_dapm_widget_create() [5.17,013/146] ASoC: rk817: Use devm_clk_get() in rk817_platform_probe [5.17,014/146] ASoC: msm8916-wcd-digital: Check failure for devm_snd_soc_register_component [5.17,015/146] ASoC: codecs: wcd934x: do not switch off SIDO Buck when codec is in use [5.17,016/146] dmaengine: idxd: fix device cleanup on disable [5.17,017/146] dmaengine: imx-sdma: Fix error checking in sdma_event_remap [5.17,018/146] dmaengine: mediatek:Fix PM usage reference leak of mtk_uart_apdma_alloc_chan_resou... [5.17,019/146] dmaengine: dw-edma: Fix unaligned 64bit access [5.17,020/146] spi: spi-mtk-nor: initialize spi controller after resume [5.17,021/146] firmware: cs_dsp: Fix overrun of unterminated control name string [5.17,022/146] esp: limit skb_page_frag_refill use to a single page [5.17,023/146] spi: cadence-quadspi: fix incorrect supports_op() return value [5.17,024/146] igc: Fix infinite loop in release_swfw_sync [5.17,025/146] igc: Fix BUG: scheduling while atomic [5.17,026/146] igc: Fix suspending when PTM is active [5.17,027/146] ice: allow creating VFs for !CONFIG_NET_SWITCHDEV [5.17,028/146] ice: fix crash in switchdev mode [5.17,029/146] ice: Fix memory leak in ice_get_orom_civd_data() [5.17,030/146] ALSA: hda/hdmi: fix warning about PCM count when used with SOF [5.17,031/146] rxrpc: Restore removed timer deletion [5.17,032/146] net/smc: Fix sock leak when release after smc_shutdown() [5.17,033/146] net/packet: fix packet_sock xmit return value checking [5.17,034/146] ip6_gre: Avoid updating tunnel->tun_hlen in __gre6_xmit() [5.17,035/146] ip6_gre: Fix skb_under_panic in __gre6_xmit() [5.17,036/146] net: restore alpha order to Ethernet devices in config [5.17,037/146] net/sched: cls_u32: fix possible leak in u32_init_knode() [5.17,038/146] l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upp... [5.17,039/146] ipv6: make ip6_rt_gc_expire an atomic_t [5.17,040/146] can: isotp: stop timeout monitoring when no first frame was sent [5.17,041/146] net: dsa: hellcreek: Calculate checksums in tagger [5.17,042/146] net: mscc: ocelot: fix broken IP multicast flooding [5.17,043/146] netlink: reset network and mac headers in netlink_dump() [5.17,044/146] drm/i915/display/psr: Unset enable_psr2_sel_fetch if other checks in intel_psr2_co... [5.17,045/146] RISC-V: KVM: Remove s & u as valid ISA extension [5.17,046/146] RISC-V: KVM: Restrict the extensions that can be disabled [5.17,047/146] net: stmmac: Use readl_poll_timeout_atomic() in atomic state [5.17,048/146] dmaengine: idxd: match type for retries var in idxd_enqcmds() [5.17,049/146] dmaengine: idxd: fix retry value to be constant for duration of function call [5.17,050/146] dmaengine: idxd: add RO check for wq max_batch_size write [5.17,051/146] dmaengine: idxd: add RO check for wq max_transfer_size write [5.17,052/146] dmaengine: idxd: skip clearing device context when device is read-only [5.17,053/146] selftests: mlxsw: vxlan_flooding: Prevent flooding of unwanted packets [5.17,054/146] selftests: mlxsw: vxlan_flooding_ipv6: Prevent flooding of unwanted packets [5.17,055/146] userfaultfd: mark uffd_wp regardless of VM_WRITE flag [5.17,056/146] arm64: mm: fix p?d_leaf() [5.17,057/146] XArray: Disallow sibling entries of nodes [5.17,058/146] drm/msm/gpu: Rename runtime suspend/resume functions [5.17,059/146] drm/msm/gpu: Remove mutex from wait_event condition [5.17,060/146] ARM: vexpress/spc: Avoid negative array index when !SMP [5.17,061/146] reset: renesas: Check return value of reset_control_deassert() [5.17,062/146] reset: tegra-bpmp: Restore Handle errors in BPMP response [5.17,063/146] platform/x86: samsung-laptop: Fix an unsigned comparison which can never be negative [5.17,064/146] ALSA: usb-audio: Fix undefined behavior due to shift overflowing the constant [5.17,065/146] drm/msm/disp: check the return value of kzalloc() [5.17,066/146] selftests: KVM: Free the GIC FD when cleaning up in arch_timer [5.17,067/146] ALSA: hda: intel-dsp-config: update AlderLake PCI IDs [5.17,068/146] arm64: dts: imx: Fix imx8*-var-som touchscreen property sizes [5.17,069/146] vxlan: fix error return code in vxlan_fdb_append [5.17,070/146] cifs: Check the IOCB_DIRECT flag, not O_DIRECT [5.17,071/146] net: atlantic: Avoid out-of-bounds indexing [5.17,072/146] mt76: Fix undefined behavior due to shift overflowing the constant [5.17,073/146] brcmfmac: sdio: Fix undefined behavior due to shift overflowing the constant [5.17,074/146] dpaa_eth: Fix missing of_node_put in dpaa_get_ts_info() [5.17,075/146] drm/msm/mdp5: check the return of kzalloc() [5.17,076/146] KVM: x86: hyper-v: Avoid writing to TSC page without an active vCPU [5.17,077/146] net: macb: Restart tx only if queue pointer is lagging [5.17,078/146] scsi: iscsi: Release endpoint ID when its freed [5.17,079/146] scsi: iscsi: Merge suspend fields [5.17,080/146] scsi: iscsi: Fix NOP handling during conn recovery [5.17,081/146] scsi: qedi: Fix failed disconnect handling [5.17,082/146] stat: fix inconsistency between struct stat and struct compat_stat [5.17,083/146] VFS: filename_create(): fix incorrect intent. [5.17,084/146] nvme: add a quirk to disable namespace identifiers [5.17,085/146] nvme-pci: disable namespace identifiers for the MAXIO MAP1002/1202 [5.17,086/146] nvme-pci: disable namespace identifiers for Qemu controllers [5.17,087/146] irq_work: use kasan_record_aux_stack_noalloc() record callstack [5.17,088/146] EDAC/synopsys: Read the error count from the correct register [5.17,089/146] mm/memory-failure.c: skip huge_zero_page in memory_failure() [5.17,090/146] memcg: sync flush only if periodic flush is delayed [5.17,091/146] mm, hugetlb: allow for "high" userspace addresses [5.17,092/146] oom_kill.c: futex: delay the OOM reaper to allow time for proper futex cleanup [5.17,093/146] mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() [5.17,094/146] ata: pata_marvell: Check the bmdma_addr beforing reading [5.17,095/146] dma: at_xdmac: fix a missing check on list iterator [5.17,096/146] dmaengine: imx-sdma: fix init of uart scripts [5.17,097/146] net: atlantic: invert deep par in pm functions, preventing null derefs [5.17,098/146] drm/radeon: fix logic inversion in radeon_sync_resv [5.17,099/146] io_uring: free iovec if file assignment fails [5.17,100/146] Input: omap4-keypad - fix pm_runtime_get_sync() error checking [5.17,101/146] scsi: sr: Do not leak information in ioctl [5.17,102/146] sched/pelt: Fix attach_entity_load_avg() corner case [5.17,103/146] perf/core: Fix perf_mmap fail when CONFIG_PERF_USE_VMALLOC enabled [5.17,104/146] drm/panel/raspberrypi-touchscreen: Avoid NULL deref if not initialised [5.17,105/146] drm/panel/raspberrypi-touchscreen: Initialise the bridge in prepare [5.17,106/146] powerpc/time: Always set decrementer in timer_interrupt() [5.17,107/146] KVM: PPC: Fix TCE handling for VFIO [5.17,108/146] drm/vc4: Use pm_runtime_resume_and_get to fix pm_runtime_get_sync() usage [5.17,109/146] powerpc/perf: Fix power9 event alternatives [5.17,110/146] powerpc/perf: Fix power10 event alternatives [5.17,111/146] arm/xen: Fix some refcount leaks [5.17,112/146] perf script: Always allow field data_src for auxtrace [5.17,113/146] perf report: Set PERF_SAMPLE_DATA_SRC bit for Arm SPE event [5.17,114/146] fs: fix acl translation [5.17,115/146] cifs: fix NULL ptr dereference in refresh_mounts() [5.17,116/146] cifs: use correct lock type in cifs_reconnect() [5.17,117/146] xtensa: patch_text: Fixup last cpu should be master [5.17,118/146] xtensa: fix a7 clobbering in coprocessor context load/store [5.17,119/146] openvswitch: fix OOB access in reserve_sfa_size() [5.17,120/146] gpio: Request interrupts after IRQ is initialized [5.17,121/146] ASoC: rt5682: fix an incorrect NULL check on list iterator [5.17,122/146] ASoC: soc-dapm: fix two incorrect uses of list iterator [5.17,123/146] e1000e: Fix possible overflow in LTR decoding [5.17,124/146] codecs: rt5682s: fix an incorrect NULL check on list iterator [5.17,125/146] ARC: entry: fix syscall_trace_exit argument [5.17,126/146] drm/vmwgfx: Fix gem refcounting and memory evictions [5.17,127/146] arm_pmu: Validate single/group leader events [5.17,128/146] KVM: x86/pmu: Update AMD PMC sample period to fix guest NMI-watchdog [5.17,129/146] KVM: x86: Dont re-acquire SRCU lock in complete_emulated_io() [5.17,130/146] KVM: x86: Pend KVM_REQ_APICV_UPDATE during vCPU creation to fix a race [5.17,131/146] KVM: nVMX: Defer APICv updates while L2 is active until L1 is active [5.17,132/146] KVM: SVM: Simplify and harden helper to flush SEV guest page(s) [5.17,133/146] KVM: SVM: Flush when freeing encrypted pages even on SME_COHERENT CPUs [5.17,134/146] ext4: fix fallocate to use file_modified to update permissions consistently [5.17,135/146] ext4: fix symlink file size not match to file content [5.17,136/146] ext4: fix use-after-free in ext4_search_dir [5.17,137/146] ext4: limit length to bitmap_maxbytes - blocksize in punch_hole [5.17,138/146] ext4, doc: fix incorrect h_reserved size [5.17,139/146] ext4: fix overhead calculation to account for the reserved gdt blocks [5.17,140/146] ext4: force overhead calculation if the s_overhead_cluster makes no sense [5.17,141/146] ext4: update the cached overhead value in the superblock [5.17,142/146] jbd2: fix a potential race while discarding reserved buffers after an abort [5.17,143/146] spi: atmel-quadspi: Fix the buswidth adjustment between spi-mem and controller [5.17,144/146] ASoC: SOF: topology: cleanup dailinks on widget unload [5.17,145/146] io_uring: fix leaks on IOPOLL and CQE_SKIP [5.17,146/146] arm64: dts: qcom: add IPA qcom,qmp property

[5.17,142/146] jbd2: fix a potential race while discarding reserved buffers after an abort

Commit Message

Patch