linux/fs
zhangyi (F) c96dceeabf jbd2: do not clear the BH_Mapped flag when forgetting a metadata buffer
Commit 904cdbd41d ("jbd2: clear dirty flag when revoking a buffer from
an older transaction") set the BH_Freed flag when forgetting a metadata
buffer which belongs to the committing transaction, it indicate the
committing process clear dirty bits when it is done with the buffer. But
it also clear the BH_Mapped flag at the same time, which may trigger
below NULL pointer oops when block_size < PAGE_SIZE.

rmdir 1             kjournald2                 mkdir 2
                    jbd2_journal_commit_transaction
		    commit transaction N
jbd2_journal_forget
set_buffer_freed(bh1)
                    jbd2_journal_commit_transaction
                     commit transaction N+1
                     ...
                     clear_buffer_mapped(bh1)
                                               ext4_getblk(bh2 ummapped)
                                               ...
                                               grow_dev_page
                                                init_page_buffers
                                                 bh1->b_private=NULL
                                                 bh2->b_private=NULL
                     jbd2_journal_put_journal_head(jh1)
                      __journal_remove_journal_head(hb1)
		       jh1 is NULL and trigger oops

*) Dir entry block bh1 and bh2 belongs to one page, and the bh2 has
   already been unmapped.

For the metadata buffer we forgetting, we should always keep the mapped
flag and clear the dirty flags is enough, so this patch pick out the
these buffers and keep their BH_Mapped flag.

Link: https://lore.kernel.org/r/20200213063821.30455-3-yi.zhang@huawei.com
Fixes: 904cdbd41d ("jbd2: clear dirty flag when revoking a buffer from an older transaction")
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
2020-02-13 12:06:28 -05:00
..
9p
adfs fs/adfs: bigdir: Fix an error code in adfs_fplus_read() 2020-01-25 11:31:59 -05:00
affs
afs afs: Fix characters allowed into cell names 2020-01-26 08:54:04 -08:00
autofs
befs
bfs
btrfs fs-dedupe-last-block-tag 2020-01-28 15:18:23 -08:00
cachefiles
ceph ceph: hold extra reference to r_parent over life of request 2020-01-21 19:02:37 +01:00
cifs CIFS: Fix task struct use-after-free on reconnect 2020-01-26 19:24:17 -06:00
coda
configfs
cramfs
crypto fscrypt: improve format of no-key names 2020-01-22 14:50:03 -08:00
debugfs debugfs: Return -EPERM when locked down 2020-01-14 16:14:48 +01:00
devpts
dlm
ecryptfs
efivarfs
efs
erofs erofs: clean up z_erofs_submit_queue() 2020-01-21 16:46:23 +08:00
exportfs
ext2
ext4 ext4: add cond_resched() to ext4_protect_reserved_inode 2020-02-13 11:56:26 -05:00
f2fs fsverity updates for 5.6 2020-01-28 15:31:03 -08:00
fat
freevxfs
fscache
fuse fuse: fix fuse_send_readpages() in the syncronous read case 2020-01-16 11:09:36 +01:00
gfs2
hfs
hfsplus
hostfs
hpfs
hugetlbfs
iomap
isofs
jbd2 jbd2: do not clear the BH_Mapped flag when forgetting a metadata buffer 2020-02-13 12:06:28 -05:00
jffs2
jfs
kernfs fs/kernfs/dir.c: Clean code by removing always true condition 2020-01-14 16:14:47 +01:00
lockd
minix
nfs y2038: core, driver and file system changes 2020-01-29 14:55:47 -08:00
nfs_common
nfsd
nilfs2
nls
notify
ntfs
ocfs2
omfs
openpromfs
orangefs
overlayfs
proc Merge branch 'work.openat2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2020-01-29 11:20:24 -08:00
pstore pstore/ram: Regularize prz label allocation lifetime 2020-01-08 17:05:45 -08:00
qnx4
qnx6
quota
ramfs
reiserfs reiserfs: fix handling of -EOPNOTSUPP in reiserfs_for_each_xattr 2020-01-16 16:49:29 +01:00
romfs
squashfs
sysfs
sysv
tracefs
ubifs ubifs: allow both hash and disk name to be provided in no-key names 2020-01-22 14:49:56 -08:00
udf
ufs
unicode
verity fs-verity: use u64_to_user_ptr() 2020-01-14 13:28:28 -08:00
xfs
aio.c
anon_inodes.c
attr.c
bad_inode.c
binfmt_aout.c
binfmt_elf_fdpic.c
binfmt_elf.c
binfmt_em86.c
binfmt_flat.c
binfmt_misc.c
binfmt_script.c
block_dev.c
buffer.c smp: Remove allocation mask from on_each_cpu_cond.*() 2020-01-24 20:40:09 +01:00
char_dev.c chardev: Avoid potential use-after-free in 'chrdev_open()' 2020-01-06 20:10:26 +01:00
compat_binfmt_elf.c
compat.c
coredump.c
d_path.c
dax.c
dcache.c
dcookies.c
direct-io.c
drop_caches.c
eventfd.c
eventpoll.c eventpoll: support non-blocking do_epoll_ctl() calls 2020-01-29 15:45:47 -07:00
exec.c
fcntl.c
fhandle.c
file_table.c
file.c threads-v5.6 2020-01-29 19:38:34 -08:00
filesystems.c
fs_context.c
fs_parser.c
fs_pin.c
fs_struct.c
fs_types.c
fs-writeback.c
fsopen.c
inode.c fscrypt: don't allow v1 policies with casefolding 2020-01-22 14:47:15 -08:00
internal.h for-5.6/io_uring-vfs-2020-01-29 2020-01-29 18:53:37 -08:00
io_uring.c for-5.6/io_uring-vfs-2020-01-29 2020-01-29 18:53:37 -08:00
io-wq.c io_uring: fix linked command file table usage 2020-01-29 13:46:44 -07:00
io-wq.h io_uring: fix linked command file table usage 2020-01-29 13:46:44 -07:00
ioctl.c
Kconfig
Kconfig.binfmt
libfs.c
locks.c
Makefile
mbcache.c
mount.h
mpage.c fs: move guard_bio_eod() after bio_set_op_attrs 2020-01-09 08:16:12 -07:00
namei.c Merge branch 'work.openat2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2020-01-29 11:20:24 -08:00
namespace.c
no-block.c
nsfs.c Merge branch 'work.openat2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2020-01-29 11:20:24 -08:00
open.c fs: make build_open_flags() available internally 2020-01-20 17:01:53 -07:00
pipe.c
pnode.c
pnode.h
posix_acl.c
proc_namespace.c
read_write.c fs: allow deduplication of eof block into the end of the destination file 2020-01-23 18:20:48 +01:00
readdir.c readdir: make user_access_begin() use the real access range 2020-01-23 10:15:28 -08:00
select.c
seq_file.c
signalfd.c
splice.c
stack.c
stat.c fs: make two stat prep helpers available 2020-01-20 17:03:54 -07:00
statfs.c
super.c
sync.c
timerfd.c timerfd: Make timerfd_settime() time namespace aware 2020-01-14 12:20:53 +01:00
userfaultfd.c
utimes.c
xattr.c