mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-28 05:12:49 +00:00
nilfs2: fix potential bug in end_buffer_async_write
According to a syzbot report, end_buffer_async_write(), which handles the completion of block device writes, may detect abnormal condition of the buffer async_write flag and cause a BUG_ON failure when using nilfs2. Nilfs2 itself does not use end_buffer_async_write(). But, the async_write flag is now used as a marker by commit7f42ec3941
("nilfs2: fix issue with race condition of competition between segments for dirty blocks") as a means of resolving double list insertion of dirty blocks in nilfs_lookup_dirty_data_buffers() and nilfs_lookup_node_buffers() and the resulting crash. This modification is safe as long as it is used for file data and b-tree node blocks where the page caches are independent. However, it was irrelevant and redundant to also introduce async_write for segment summary and super root blocks that share buffers with the backing device. This led to the possibility that the BUG_ON check in end_buffer_async_write would fail as described above, if independent writebacks of the backing device occurred in parallel. The use of async_write for segment summary buffers has already been removed in a previous change. Fix this issue by removing the manipulation of the async_write flag for the remaining super root block buffer. Link: https://lkml.kernel.org/r/20240203161645.4992-1-konishi.ryusuke@gmail.com Fixes:7f42ec3941
("nilfs2: fix issue with race condition of competition between segments for dirty blocks") Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com> Reported-by: syzbot+5c04210f7c7f897c1e7f@syzkaller.appspotmail.com Closes: https://lkml.kernel.org/r/00000000000019a97c05fd42f8c8@google.com Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
This commit is contained in:
parent
b9e4bc1046
commit
5bc09b397c
1 changed files with 5 additions and 3 deletions
|
@ -1703,7 +1703,6 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci)
|
||||||
|
|
||||||
list_for_each_entry(bh, &segbuf->sb_payload_buffers,
|
list_for_each_entry(bh, &segbuf->sb_payload_buffers,
|
||||||
b_assoc_buffers) {
|
b_assoc_buffers) {
|
||||||
set_buffer_async_write(bh);
|
|
||||||
if (bh == segbuf->sb_super_root) {
|
if (bh == segbuf->sb_super_root) {
|
||||||
if (bh->b_folio != bd_folio) {
|
if (bh->b_folio != bd_folio) {
|
||||||
folio_lock(bd_folio);
|
folio_lock(bd_folio);
|
||||||
|
@ -1714,6 +1713,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci)
|
||||||
}
|
}
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
|
set_buffer_async_write(bh);
|
||||||
if (bh->b_folio != fs_folio) {
|
if (bh->b_folio != fs_folio) {
|
||||||
nilfs_begin_folio_io(fs_folio);
|
nilfs_begin_folio_io(fs_folio);
|
||||||
fs_folio = bh->b_folio;
|
fs_folio = bh->b_folio;
|
||||||
|
@ -1800,7 +1800,6 @@ static void nilfs_abort_logs(struct list_head *logs, int err)
|
||||||
|
|
||||||
list_for_each_entry(bh, &segbuf->sb_payload_buffers,
|
list_for_each_entry(bh, &segbuf->sb_payload_buffers,
|
||||||
b_assoc_buffers) {
|
b_assoc_buffers) {
|
||||||
clear_buffer_async_write(bh);
|
|
||||||
if (bh == segbuf->sb_super_root) {
|
if (bh == segbuf->sb_super_root) {
|
||||||
clear_buffer_uptodate(bh);
|
clear_buffer_uptodate(bh);
|
||||||
if (bh->b_folio != bd_folio) {
|
if (bh->b_folio != bd_folio) {
|
||||||
|
@ -1809,6 +1808,7 @@ static void nilfs_abort_logs(struct list_head *logs, int err)
|
||||||
}
|
}
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
|
clear_buffer_async_write(bh);
|
||||||
if (bh->b_folio != fs_folio) {
|
if (bh->b_folio != fs_folio) {
|
||||||
nilfs_end_folio_io(fs_folio, err);
|
nilfs_end_folio_io(fs_folio, err);
|
||||||
fs_folio = bh->b_folio;
|
fs_folio = bh->b_folio;
|
||||||
|
@ -1896,8 +1896,9 @@ static void nilfs_segctor_complete_write(struct nilfs_sc_info *sci)
|
||||||
BIT(BH_Delay) | BIT(BH_NILFS_Volatile) |
|
BIT(BH_Delay) | BIT(BH_NILFS_Volatile) |
|
||||||
BIT(BH_NILFS_Redirected));
|
BIT(BH_NILFS_Redirected));
|
||||||
|
|
||||||
set_mask_bits(&bh->b_state, clear_bits, set_bits);
|
|
||||||
if (bh == segbuf->sb_super_root) {
|
if (bh == segbuf->sb_super_root) {
|
||||||
|
set_buffer_uptodate(bh);
|
||||||
|
clear_buffer_dirty(bh);
|
||||||
if (bh->b_folio != bd_folio) {
|
if (bh->b_folio != bd_folio) {
|
||||||
folio_end_writeback(bd_folio);
|
folio_end_writeback(bd_folio);
|
||||||
bd_folio = bh->b_folio;
|
bd_folio = bh->b_folio;
|
||||||
|
@ -1905,6 +1906,7 @@ static void nilfs_segctor_complete_write(struct nilfs_sc_info *sci)
|
||||||
update_sr = true;
|
update_sr = true;
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
|
set_mask_bits(&bh->b_state, clear_bits, set_bits);
|
||||||
if (bh->b_folio != fs_folio) {
|
if (bh->b_folio != fs_folio) {
|
||||||
nilfs_end_folio_io(fs_folio, 0);
|
nilfs_end_folio_io(fs_folio, 0);
|
||||||
fs_folio = bh->b_folio;
|
fs_folio = bh->b_folio;
|
||||||
|
|
Loading…
Reference in a new issue