aboutsummaryrefslogtreecommitdiffstats
path: root/fs
diff options
context:
space:
mode:
authorDmitry Monakhov2013-04-03 21:08:52 -0500
committerGreg Kroah-Hartman2013-05-07 22:08:24 -0500
commit5c5c79d431221917eef944c4c026b3044a5acc2a (patch)
tree6cb00ac6b6a079625946eb3cf5232ef5fc547ed4 /fs
parent45932b3fd127c47269e3ba43d771033f30d25f78 (diff)
downloadkernel-omap-5c5c79d431221917eef944c4c026b3044a5acc2a.tar.gz
kernel-omap-5c5c79d431221917eef944c4c026b3044a5acc2a.tar.xz
kernel-omap-5c5c79d431221917eef944c4c026b3044a5acc2a.zip
ext4: fix journal callback list traversal
commit 5d3ee20855e28169d711b394857ee608a5023094 upstream. It is incorrect to use list_for_each_entry_safe() for journal callback traversial because ->next may be removed by other task: ->ext4_mb_free_metadata() ->ext4_mb_free_metadata() ->ext4_journal_callback_del() This results in the following issue: WARNING: at lib/list_debug.c:62 __list_del_entry+0x1c0/0x250() Hardware name: list_del corruption. prev->next should be ffff88019a4ec198, but was 6b6b6b6b6b6b6b6b Modules linked in: cpufreq_ondemand acpi_cpufreq freq_table mperf coretemp kvm_intel kvm crc32c_intel ghash_clmulni_intel microcode sg xhci_hcd button sd_mod crc_t10dif aesni_intel ablk_helper cryptd lrw aes_x86_64 xts gf128mul ahci libahci pata_acpi ata_generic dm_mirror dm_region_hash dm_log dm_mod Pid: 16400, comm: jbd2/dm-1-8 Tainted: G W 3.8.0-rc3+ #107 Call Trace: [<ffffffff8106fb0d>] warn_slowpath_common+0xad/0xf0 [<ffffffff8106fc06>] warn_slowpath_fmt+0x46/0x50 [<ffffffff813637e9>] ? ext4_journal_commit_callback+0x99/0xc0 [<ffffffff8148cae0>] __list_del_entry+0x1c0/0x250 [<ffffffff813637bf>] ext4_journal_commit_callback+0x6f/0xc0 [<ffffffff813ca336>] jbd2_journal_commit_transaction+0x23a6/0x2570 [<ffffffff8108aa42>] ? try_to_del_timer_sync+0x82/0xa0 [<ffffffff8108b491>] ? del_timer_sync+0x91/0x1e0 [<ffffffff813d3ecf>] kjournald2+0x19f/0x6a0 [<ffffffff810ad630>] ? wake_up_bit+0x40/0x40 [<ffffffff813d3d30>] ? bit_spin_lock+0x80/0x80 [<ffffffff810ac6be>] kthread+0x10e/0x120 [<ffffffff810ac5b0>] ? __init_kthread_worker+0x70/0x70 [<ffffffff818ff6ac>] ret_from_fork+0x7c/0xb0 [<ffffffff810ac5b0>] ? __init_kthread_worker+0x70/0x70 This patch fix the issue as follows: - ext4_journal_commit_callback() make list truly traversial safe simply by always starting from list_head - fix race between two ext4_journal_callback_del() and ext4_journal_callback_try_del() Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org> Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs')
-rw-r--r--fs/ext4/ext4_jbd2.h6
-rw-r--r--fs/ext4/mballoc.c8
-rw-r--r--fs/ext4/super.c7
3 files changed, 14 insertions, 7 deletions
diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h
index 7177f9b21cb2..dbd9ae199e18 100644
--- a/fs/ext4/ext4_jbd2.h
+++ b/fs/ext4/ext4_jbd2.h
@@ -170,16 +170,20 @@ static inline void ext4_journal_callback_add(handle_t *handle,
170 * ext4_journal_callback_del: delete a registered callback 170 * ext4_journal_callback_del: delete a registered callback
171 * @handle: active journal transaction handle on which callback was registered 171 * @handle: active journal transaction handle on which callback was registered
172 * @jce: registered journal callback entry to unregister 172 * @jce: registered journal callback entry to unregister
173 * Return true if object was sucessfully removed
173 */ 174 */
174static inline void ext4_journal_callback_del(handle_t *handle, 175static inline bool ext4_journal_callback_try_del(handle_t *handle,
175 struct ext4_journal_cb_entry *jce) 176 struct ext4_journal_cb_entry *jce)
176{ 177{
178 bool deleted;
177 struct ext4_sb_info *sbi = 179 struct ext4_sb_info *sbi =
178 EXT4_SB(handle->h_transaction->t_journal->j_private); 180 EXT4_SB(handle->h_transaction->t_journal->j_private);
179 181
180 spin_lock(&sbi->s_md_lock); 182 spin_lock(&sbi->s_md_lock);
183 deleted = !list_empty(&jce->jce_list);
181 list_del_init(&jce->jce_list); 184 list_del_init(&jce->jce_list);
182 spin_unlock(&sbi->s_md_lock); 185 spin_unlock(&sbi->s_md_lock);
186 return deleted;
183} 187}
184 188
185int 189int
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 82f8c2d92e17..b443e62b65c2 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -4449,11 +4449,11 @@ ext4_mb_free_metadata(handle_t *handle, struct ext4_buddy *e4b,
4449 node = rb_prev(new_node); 4449 node = rb_prev(new_node);
4450 if (node) { 4450 if (node) {
4451 entry = rb_entry(node, struct ext4_free_data, efd_node); 4451 entry = rb_entry(node, struct ext4_free_data, efd_node);
4452 if (can_merge(entry, new_entry)) { 4452 if (can_merge(entry, new_entry) &&
4453 ext4_journal_callback_try_del(handle, &entry->efd_jce)) {
4453 new_entry->efd_start_cluster = entry->efd_start_cluster; 4454 new_entry->efd_start_cluster = entry->efd_start_cluster;
4454 new_entry->efd_count += entry->efd_count; 4455 new_entry->efd_count += entry->efd_count;
4455 rb_erase(node, &(db->bb_free_root)); 4456 rb_erase(node, &(db->bb_free_root));
4456 ext4_journal_callback_del(handle, &entry->efd_jce);
4457 kmem_cache_free(ext4_free_data_cachep, entry); 4457 kmem_cache_free(ext4_free_data_cachep, entry);
4458 } 4458 }
4459 } 4459 }
@@ -4461,10 +4461,10 @@ ext4_mb_free_metadata(handle_t *handle, struct ext4_buddy *e4b,
4461 node = rb_next(new_node); 4461 node = rb_next(new_node);
4462 if (node) { 4462 if (node) {
4463 entry = rb_entry(node, struct ext4_free_data, efd_node); 4463 entry = rb_entry(node, struct ext4_free_data, efd_node);
4464 if (can_merge(new_entry, entry)) { 4464 if (can_merge(new_entry, entry) &&
4465 ext4_journal_callback_try_del(handle, &entry->efd_jce)) {
4465 new_entry->efd_count += entry->efd_count; 4466 new_entry->efd_count += entry->efd_count;
4466 rb_erase(node, &(db->bb_free_root)); 4467 rb_erase(node, &(db->bb_free_root));
4467 ext4_journal_callback_del(handle, &entry->efd_jce);
4468 kmem_cache_free(ext4_free_data_cachep, entry); 4468 kmem_cache_free(ext4_free_data_cachep, entry);
4469 } 4469 }
4470 } 4470 }
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 24c767d0b0f4..5575a451508c 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -452,10 +452,13 @@ static void ext4_journal_commit_callback(journal_t *journal, transaction_t *txn)
452 struct super_block *sb = journal->j_private; 452 struct super_block *sb = journal->j_private;
453 struct ext4_sb_info *sbi = EXT4_SB(sb); 453 struct ext4_sb_info *sbi = EXT4_SB(sb);
454 int error = is_journal_aborted(journal); 454 int error = is_journal_aborted(journal);
455 struct ext4_journal_cb_entry *jce, *tmp; 455 struct ext4_journal_cb_entry *jce;
456 456
457 BUG_ON(txn->t_state == T_FINISHED);
457 spin_lock(&sbi->s_md_lock); 458 spin_lock(&sbi->s_md_lock);
458 list_for_each_entry_safe(jce, tmp, &txn->t_private_list, jce_list) { 459 while (!list_empty(&txn->t_private_list)) {
460 jce = list_entry(txn->t_private_list.next,
461 struct ext4_journal_cb_entry, jce_list);
459 list_del_init(&jce->jce_list); 462 list_del_init(&jce->jce_list);
460 spin_unlock(&sbi->s_md_lock); 463 spin_unlock(&sbi->s_md_lock);
461 jce->jce_func(sb, jce, error); 464 jce->jce_func(sb, jce, error);