diff options
| author | Jan Kara <jack@suse.cz> | 2016-08-11 12:38:55 -0400 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2017-06-05 21:16:49 +0100 |
| commit | b329791bdb180d5618ca8635bc481dc476a69589 (patch) | |
| tree | 24ae9ea963e96a01945c39c366dc3feb989b6c9b /fs | |
| parent | 5cf6cf8d961dd03b564c63d8aa2a56f5908ae038 (diff) | |
| download | linux-stable-b329791bdb180d5618ca8635bc481dc476a69589.tar.gz linux-stable-b329791bdb180d5618ca8635bc481dc476a69589.tar.bz2 linux-stable-b329791bdb180d5618ca8635bc481dc476a69589.zip | |
ext4: avoid deadlock when expanding inode size
commit 2e81a4eeedcaa66e35f58b81e0755b87057ce392 upstream.
When we need to move xattrs into external xattr block, we call
ext4_xattr_block_set() from ext4_expand_extra_isize_ea(). That may end
up calling ext4_mark_inode_dirty() again which will recurse back into
the inode expansion code leading to deadlocks.
Protect from recursion using EXT4_STATE_NO_EXPAND inode flag and move
its management into ext4_expand_extra_isize_ea() since its manipulation
is safe there (due to xattr_sem) from possible races with
ext4_xattr_set_handle() which plays with it as well.
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
[bwh: Backported to 3.16: adjust context[
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/ext4/inode.c | 2 | ||||
| -rw-r--r-- | fs/ext4/xattr.c | 19 |
2 files changed, 13 insertions, 8 deletions
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 898e9659ebf1..4a4a6c6c4b14 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -5062,8 +5062,6 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode) sbi->s_want_extra_isize, iloc, handle); if (ret) { - ext4_set_inode_state(inode, - EXT4_STATE_NO_EXPAND); if (mnt_count != le16_to_cpu(sbi->s_es->s_mnt_count)) { ext4_warning(inode->i_sb, diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c index 2d1e5803839f..59935132fd53 100644 --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -1277,11 +1277,13 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize, int s_min_extra_isize = le16_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_min_extra_isize); down_write(&EXT4_I(inode)->xattr_sem); + /* + * Set EXT4_STATE_NO_EXPAND to avoid recursion when marking inode dirty + */ + ext4_set_inode_state(inode, EXT4_STATE_NO_EXPAND); retry: - if (EXT4_I(inode)->i_extra_isize >= new_extra_isize) { - up_write(&EXT4_I(inode)->xattr_sem); - return 0; - } + if (EXT4_I(inode)->i_extra_isize >= new_extra_isize) + goto out; header = IHDR(inode, raw_inode); entry = IFIRST(header); @@ -1306,8 +1308,7 @@ retry: (void *)header, total_ino, inode->i_sb->s_blocksize); EXT4_I(inode)->i_extra_isize = new_extra_isize; - error = 0; - goto cleanup; + goto out; } /* @@ -1467,6 +1468,8 @@ retry: kfree(bs); } brelse(bh); +out: + ext4_clear_inode_state(inode, EXT4_STATE_NO_EXPAND); up_write(&EXT4_I(inode)->xattr_sem); return 0; @@ -1478,6 +1481,10 @@ cleanup: kfree(is); kfree(bs); brelse(bh); + /* + * We deliberately leave EXT4_STATE_NO_EXPAND set here since inode + * size expansion failed. + */ up_write(&EXT4_I(inode)->xattr_sem); return error; } |