mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 02:39:48 +00:00
ff4ab5e02a
In xfs_bui_item_recover, there exists a use-after-free bug with regards to the inode that is involved in the bmap replay operation. If the mapping operation does not complete, we call xfs_bmap_unmap_extent to create a deferred op to finish the unmapping work, and we retain a pointer to the incore inode. Unfortunately, the very next thing we do is commit the transaction and drop the inode. If reclaim tears down the inode before we try to finish the defer ops, we dereference garbage and blow up. Therefore, create a way to join inodes to the defer ops freezer so that we can maintain the xfs_inode reference until we're done with the inode. Note: This imposes the requirement that there be enough memory to keep every incore inode in memory throughout recovery. Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Reviewed-by: Brian Foster <bfoster@redhat.com> Reviewed-by: Christoph Hellwig <hch@lst.de>
103 lines
3.4 KiB
C
103 lines
3.4 KiB
C
/* SPDX-License-Identifier: GPL-2.0+ */
|
|
/*
|
|
* Copyright (C) 2016 Oracle. All Rights Reserved.
|
|
* Author: Darrick J. Wong <darrick.wong@oracle.com>
|
|
*/
|
|
#ifndef __XFS_DEFER_H__
|
|
#define __XFS_DEFER_H__
|
|
|
|
struct xfs_btree_cur;
|
|
struct xfs_defer_op_type;
|
|
struct xfs_defer_capture;
|
|
|
|
/*
|
|
* Header for deferred operation list.
|
|
*/
|
|
enum xfs_defer_ops_type {
|
|
XFS_DEFER_OPS_TYPE_BMAP,
|
|
XFS_DEFER_OPS_TYPE_REFCOUNT,
|
|
XFS_DEFER_OPS_TYPE_RMAP,
|
|
XFS_DEFER_OPS_TYPE_FREE,
|
|
XFS_DEFER_OPS_TYPE_AGFL_FREE,
|
|
XFS_DEFER_OPS_TYPE_MAX,
|
|
};
|
|
|
|
/*
|
|
* Save a log intent item and a list of extents, so that we can replay
|
|
* whatever action had to happen to the extent list and file the log done
|
|
* item.
|
|
*/
|
|
struct xfs_defer_pending {
|
|
struct list_head dfp_list; /* pending items */
|
|
struct list_head dfp_work; /* work items */
|
|
struct xfs_log_item *dfp_intent; /* log intent item */
|
|
struct xfs_log_item *dfp_done; /* log done item */
|
|
unsigned int dfp_count; /* # extent items */
|
|
enum xfs_defer_ops_type dfp_type;
|
|
};
|
|
|
|
void xfs_defer_add(struct xfs_trans *tp, enum xfs_defer_ops_type type,
|
|
struct list_head *h);
|
|
int xfs_defer_finish_noroll(struct xfs_trans **tp);
|
|
int xfs_defer_finish(struct xfs_trans **tp);
|
|
void xfs_defer_cancel(struct xfs_trans *);
|
|
void xfs_defer_move(struct xfs_trans *dtp, struct xfs_trans *stp);
|
|
|
|
/* Description of a deferred type. */
|
|
struct xfs_defer_op_type {
|
|
struct xfs_log_item *(*create_intent)(struct xfs_trans *tp,
|
|
struct list_head *items, unsigned int count, bool sort);
|
|
void (*abort_intent)(struct xfs_log_item *intent);
|
|
struct xfs_log_item *(*create_done)(struct xfs_trans *tp,
|
|
struct xfs_log_item *intent, unsigned int count);
|
|
int (*finish_item)(struct xfs_trans *tp, struct xfs_log_item *done,
|
|
struct list_head *item, struct xfs_btree_cur **state);
|
|
void (*finish_cleanup)(struct xfs_trans *tp,
|
|
struct xfs_btree_cur *state, int error);
|
|
void (*cancel_item)(struct list_head *item);
|
|
unsigned int max_items;
|
|
};
|
|
|
|
extern const struct xfs_defer_op_type xfs_bmap_update_defer_type;
|
|
extern const struct xfs_defer_op_type xfs_refcount_update_defer_type;
|
|
extern const struct xfs_defer_op_type xfs_rmap_update_defer_type;
|
|
extern const struct xfs_defer_op_type xfs_extent_free_defer_type;
|
|
extern const struct xfs_defer_op_type xfs_agfl_free_defer_type;
|
|
|
|
/*
|
|
* This structure enables a dfops user to detach the chain of deferred
|
|
* operations from a transaction so that they can be continued later.
|
|
*/
|
|
struct xfs_defer_capture {
|
|
/* List of other capture structures. */
|
|
struct list_head dfc_list;
|
|
|
|
/* Deferred ops state saved from the transaction. */
|
|
struct list_head dfc_dfops;
|
|
unsigned int dfc_tpflags;
|
|
|
|
/* Block reservations for the data and rt devices. */
|
|
unsigned int dfc_blkres;
|
|
unsigned int dfc_rtxres;
|
|
|
|
/* Log reservation saved from the transaction. */
|
|
unsigned int dfc_logres;
|
|
|
|
/*
|
|
* An inode reference that must be maintained to complete the deferred
|
|
* work.
|
|
*/
|
|
struct xfs_inode *dfc_capture_ip;
|
|
};
|
|
|
|
/*
|
|
* Functions to capture a chain of deferred operations and continue them later.
|
|
* This doesn't normally happen except log recovery.
|
|
*/
|
|
int xfs_defer_ops_capture_and_commit(struct xfs_trans *tp,
|
|
struct xfs_inode *capture_ip, struct list_head *capture_list);
|
|
void xfs_defer_ops_continue(struct xfs_defer_capture *d, struct xfs_trans *tp,
|
|
struct xfs_inode **captured_ipp);
|
|
void xfs_defer_ops_release(struct xfs_mount *mp, struct xfs_defer_capture *d);
|
|
|
|
#endif /* __XFS_DEFER_H__ */
|