Eric Lee / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit a61d90d75d0f9e86432c45b496b4b0fbf0fd03dc

Authored by Jan Kara
Committed by Linus Torvalds
1 parent 463aea1a1c
Exists in master and in 39 other branches 8mp-imx_5.4.70_2.3.0, 8qm-imx_5.4.70_2.3.0, emb_imx_lf-5.15.y, emb_lf-6.1.y, imx_3.0.35_4.1.0, imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, imx_4.1.15_1.0.0_ga, pitx_8mp_lf-5.10.y, rt-smarc-imx_4.1.15_1.0.0_ga, rt_linux_5.15.71, smarc-8m-android-11.0.0_2.0.0, smarc-imx6_4.14.98_2.0.0_ga, smarc-imx6_4.9.88_2.0.0_ga, smarc-imx7_4.14.98_2.0.0_ga, smarc-imx7_4.9.11_1.0.0_ga, smarc-imx7_4.9.88_2.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-imx_4.1.15_1.0.0_ga, smarc-imx_4.9.11_1.0.0_ga, smarc-imx_4.9.51_imx8m_ga, smarc-imx_4.9.88_2.0.0_ga, smarc-m6.0.1_2.1.0-ga, smarc-n7.1.2_2.0.0-ga, smarc-rel_imx_4.1.15_1.2.0_ga, smarc_8m_00d0_imx_4.14.98_2.0.0_ga, smarc_8m_imx_4.14.78_1.0.0_ga, smarc_8m_imx_4.14.98_2.0.0_ga, smarc_8m_imx_4.19.35_1.1.0, smarc_8mm_imx_4.14.78_1.0.0_ga, smarc_8mm_imx_4.14.98_2.0.0_ga, smarc_8mm_imx_4.19.35_1.1.0, smarc_8mm_imx_5.4.24_2.1.0, smarc_8mp_lf-5.10.y, smarc_8mq_imx_5.4.24_2.1.0, smarc_8mq_lf-5.10.y, smarc_imx_lf-5.15.y

jbd: fix race in buffer processing in commit code 

In commit code, we scan buffers attached to a transaction.  During this
scan, we sometimes have to drop j_list_lock and then we recheck whether
the journal buffer head didn't get freed by journal_try_to_free_buffers().
 But checking for buffer_jbd(bh) isn't enough because a new journal head
could get attached to our buffer head.  So add a check whether the journal
head remained the same and whether it's still at the same transaction and
list.

This is a nasty bug and can cause problems like memory corruption (use after
free) or trigger various assertions in JBD code (observed).

Signed-off-by: Jan Kara <jack@suse.cz>
Cc: <stable@kernel.org>
Cc: <linux-ext4@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Showing 1 changed file with 4 additions and 2 deletions Side-by-side Diff

... ... @@ -241,7 +241,7 @@
241 241 spin_lock(&journal->j_list_lock);
242 242 }
243 243 /* Someone already cleaned up the buffer? */
244   - if (!buffer_jbd(bh)
  244 + if (!buffer_jbd(bh) || bh2jh(bh) != jh
245 245 || jh->b_transaction != commit_transaction
246 246 || jh->b_jlist != BJ_SyncData) {
247 247 jbd_unlock_bh_state(bh);
... ... @@ -478,7 +478,9 @@
478 478 spin_lock(&journal->j_list_lock);
479 479 continue;
480 480 }
481   - if (buffer_jbd(bh) && jh->b_jlist == BJ_Locked) {
  481 + if (buffer_jbd(bh) && bh2jh(bh) == jh &&
  482 + jh->b_transaction == commit_transaction &&
  483 + jh->b_jlist == BJ_Locked) {
482 484 __journal_unfile_buffer(jh);
483 485 jbd_unlock_bh_state(bh);
484 486 journal_remove_journal_head(bh);