Zheng Liu
e94bd3490f
ext4: fix a BUG when opening a file with O_TMPFILE flag
When we try to open a file with O_TMPFILE flag, we will trigger a bug.
The root cause is that in ext4_orphan_add() we check ->i_nlink == 0 and
this check always fails because we set ->i_nlink = 1 in
inode_init_always(). We can use the following program to trigger it:
int main(int argc, char *argv[])
{
int fd;
fd = open(argv[1], O_TMPFILE, 0666);
if (fd < 0) {
perror("open ");
return -1;
}
close(fd);
return 0;
}
The oops message looks like this:
kernel BUG at fs/ext4/namei.c:2572!
invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
Modules linked in: dlci bridge stp hidp cmtp kernelcapi l2tp_ppp l2tp_netlink l2tp_core sctp libcrc32c rfcomm tun fuse nfnetli
nk can_raw ipt_ULOG can_bcm x25 scsi_transport_iscsi ipx p8023 p8022 appletalk phonet psnap vmw_vsock_vmci_transport af_key vmw_vmci rose vsock atm can netrom ax25 af_rxrpc ir
da pppoe pppox ppp_generic slhc bluetooth nfc rfkill rds caif_socket caif crc_ccitt af_802154 llc2 llc snd_hda_codec_realtek snd_hda_intel snd_hda_codec serio_raw snd_pcm pcsp
kr edac_core snd_page_alloc snd_timer snd soundcore r8169 mii sr_mod cdrom pata_atiixp radeon backlight drm_kms_helper ttm
CPU: 1 PID: 1812571 Comm: trinity-child2 Not tainted 3.11.0-rc1+ #12
Hardware name: Gigabyte Technology Co., Ltd. GA-MA78GM-S2H/GA-MA78GM-S2H, BIOS F12a 04/23/2010
task: ffff88007dfe69a0 ti: ffff88010f7b6000 task.ti: ffff88010f7b6000
RIP: 0010:[<ffffffff8125ce69>] [<ffffffff8125ce69>] ext4_orphan_add+0x299/0x2b0
RSP: 0018:ffff88010f7b7cf8 EFLAGS: 00010202
RAX: 0000000000000000 RBX: ffff8800966d3020 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff88007dfe70b8 RDI: 0000000000000001
RBP: ffff88010f7b7d40 R08: ffff880126a3c4e0 R09: ffff88010f7b7ca0
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801271fd668
R13: ffff8800966d2f78 R14: ffff88011d7089f0 R15: ffff88007dfe69a0
FS: 00007f70441a3740(0000) GS:ffff88012a800000(0000) knlGS:00000000f77c96c0
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000002834000 CR3: 0000000107964000 CR4: 00000000000007e0
DR0: 0000000000780000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Stack:
0000000000002000 00000020810b6dde 0000000000000000 ffff88011d46db00
ffff8800966d3020 ffff88011d7089f0 ffff88009c7f4c10 ffff88010f7b7f2c
ffff88007dfe69a0 ffff88010f7b7da8 ffffffff8125cfac ffff880100000004
Call Trace:
[<ffffffff8125cfac>] ext4_tmpfile+0x12c/0x180
[<ffffffff811cba78>] path_openat+0x238/0x700
[<ffffffff8100afc4>] ? native_sched_clock+0x24/0x80
[<ffffffff811cc647>] do_filp_open+0x47/0xa0
[<ffffffff811db73f>] ? __alloc_fd+0xaf/0x200
[<ffffffff811ba2e4>] do_sys_open+0x124/0x210
[<ffffffff81010725>] ? syscall_trace_enter+0x25/0x290
[<ffffffff811ba3ee>] SyS_open+0x1e/0x20
[<ffffffff816ca8d4>] tracesys+0xdd/0xe2
[<ffffffff81001001>] ? start_thread_common.constprop.6+0x1/0xa0
Code: 04 00 00 00 89 04 24 31 c0 e8 c4 77 04 00 e9 43 fe ff ff 66 25 00 d0 66 3d 00 80 0f 84 0e fe ff ff 83 7b 48 00 0f 84 04 fe ff ff <0f> 0b 49 8b 8c 24 50 07 00 00 e9 88 fe ff ff 0f 1f 84 00 00 00
Here we couldn't call clear_nlink() directly because in d_tmpfile() we
will call inode_dec_link_count() to decrease ->i_nlink. So this commit
tries to call d_tmpfile() before ext4_orphan_add() to fix this problem.
Reported-by: Dave Jones <davej@redhat.com>
Signed-off-by: Zheng Liu <wenqing.lz@taobao.com>
Tested-by: Darrick J. Wong <darrick.wong@oracle.com>
Tested-by: Dave Jones <davej@redhat.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Acked-by: Al Viro <viro@zeniv.linux.org.uk>
|
2013-07-20 21:58:38 -04:00 |
| .. |
|
acl.c
|
ext4: fix the number of credits needed for acl ops with inline data
|
2013-02-09 15:23:03 -05:00 |
|
acl.h
|
fs: take the ACL checks to common code
|
2011-07-25 14:30:23 -04:00 |
|
balloc.c
|
ext4: fix ext4_get_group_number()
|
2013-07-05 23:11:16 -04:00 |
|
bitmap.c
|
ext4: Checksum the block bitmap properly with bigalloc enabled
|
2012-10-22 00:34:32 -04:00 |
|
block_validity.c
|
ext2/3/4: delete unneeded includes of module.h
|
2012-01-09 13:52:10 +01:00 |
|
dir.c
|
[readdir] convert ext4
|
2013-06-29 12:56:40 +04:00 |
|
ext4.h
|
Lots of bug fixes, cleanups and optimizations. In the bug fixes
|
2013-07-02 09:39:34 -07:00 |
|
ext4_extents.h
|
ext4: mext_insert_extents should update extent block checksum
|
2013-04-19 14:04:12 -04:00 |
|
ext4_jbd2.c
|
ext4: provide wrappers for transaction reservation calls
|
2013-06-04 12:37:50 -04:00 |
|
ext4_jbd2.h
|
ext4: use transaction reservation for extent conversion in ext4_end_io
|
2013-06-04 13:21:11 -04:00 |
|
extents.c
|
ext4: call ext4_es_lru_add() after handling cache miss
|
2013-07-16 10:28:47 -04:00 |
|
extents_status.c
|
ext4: make the extent_status code more robust against ENOMEM failures
|
2013-07-15 00:12:14 -04:00 |
|
extents_status.h
|
ext4: improve extent cache shrink mechanism to avoid to burn CPU time
|
2013-07-01 08:12:37 -04:00 |
|
file.c
|
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
|
2013-07-03 09:10:19 -07:00 |
|
fsync.c
|
ext4: Fix fsync error handling after filesystem abort
|
2013-06-12 22:38:04 -04:00 |
|
hash.c
|
ext4: reduce one "if" comparison in ext4_dirhash()
|
2013-02-01 22:33:21 -05:00 |
|
ialloc.c
|
ext4: provide wrappers for transaction reservation calls
|
2013-06-04 12:37:50 -04:00 |
|
indirect.c
|
ext4: translate flag bits to strings in tracepoints
|
2013-07-01 08:12:40 -04:00 |
|
inline.c
|
Lots of bug fixes, cleanups and optimizations. In the bug fixes
|
2013-07-02 09:39:34 -07:00 |
|
inode.c
|
ext4: call ext4_es_lru_add() after handling cache miss
|
2013-07-16 10:28:47 -04:00 |
|
ioctl.c
|
ext4: fix usless declarations
|
2013-04-09 22:48:36 -04:00 |
|
Kconfig
|
ext4: fix Kconfig documentation for CONFIG_EXT4_DEBUG
|
2013-04-21 20:32:03 -04:00 |
|
Makefile
|
ext4: Remove CONFIG_EXT4_FS_XATTR
|
2012-12-10 16:30:43 -05:00 |
|
mballoc.c
|
ext4: don't allow ext4_free_blocks() to fail due to ENOMEM
|
2013-07-13 00:40:35 -04:00 |
|
mballoc.h
|
ext4: use module parameters instead of debugfs for mballoc_debug
|
2013-02-09 16:28:20 -05:00 |
|
migrate.c
|
ext4: do not convert to indirect with bigalloc enabled
|
2013-04-11 10:54:46 -04:00 |
|
mmp.c
|
ext4: mark all metadata I/O with REQ_META
|
2013-04-20 15:46:17 -04:00 |
|
move_extent.c
|
ext4: delete unused variables
|
2013-06-17 08:56:26 -04:00 |
|
namei.c
|
ext4: fix a BUG when opening a file with O_TMPFILE flag
|
2013-07-20 21:58:38 -04:00 |
|
page-io.c
|
ext4: rate limit printk in buffer_io_error()
|
2013-07-11 22:42:42 -04:00 |
|
resize.c
|
ext4: fix corruption when online resizing a fs with 1K block size
|
2013-07-01 08:12:08 -04:00 |
|
super.c
|
ext4: don't show usrquota/grpquota twice in /proc/mounts
|
2013-07-11 18:54:37 -04:00 |
|
symlink.c
|
ext4: Remove CONFIG_EXT4_FS_XATTR
|
2012-12-10 16:30:43 -05:00 |
|
truncate.h
|
ext4: move common truncate functions to header file
|
2011-06-27 19:16:04 -04:00 |
|
xattr.c
|
ext4: fix miscellaneous big endian warnings
|
2013-04-09 23:59:55 -04:00 |
|
xattr.h
|
ext4: reserve xattr index for Rich ACL support
|
2013-04-18 14:53:15 -04:00 |
|
xattr_security.c
|
Merge branch 'for_linus' into for_linus_merged
|
2012-01-10 11:54:07 -05:00 |
|
xattr_trusted.c
|
ext2/3/4: delete unneeded includes of module.h
|
2012-01-09 13:52:10 +01:00 |
|
xattr_user.c
|
ext2/3/4: delete unneeded includes of module.h
|
2012-01-09 13:52:10 +01:00 |