Skip to contentSkip to conversation

FAILED: patch "[PATCH] ext4: fix potential race between s_group_info online resizing" failed to apply to 4.4-stable tree

PATCH [email protected] 1 participant 1 message Feb 27, 2020

Subsystems (2)
Stable branch ext4 file system
lore
Share & tools
lore

[email protected]

author maintainer
#0 lore raw

The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From df3da4ea5a0fc5d115c90d5aa6caa4dd433750a7 Mon Sep 17 00:00:00 2001
From: Suraj Jitindar Singh <[email protected]>
Date: Tue, 18 Feb 2020 19:08:50 -0800
Subject: [PATCH] ext4: fix potential race between s_group_info online resizing
and access

During an online resize an array of pointers to s_group_info gets replaced so it can get enlarged. If there is a concurrent access to the array in ext4_get_group_info() and this memory has been reused then this can lead to an invalid memory access.

Link https://bugzilla.kernel.org/show_bug.cgi?id=206443
Link https://lore.kernel.org/r/[email protected] open here
Signed-off-by Suraj Jitindar Singh <[email protected]>
Signed-off-by Theodore Ts'o <[email protected]>
Reviewed-by Balbir Singh <[email protected]>
Cc [email protected]
fs/ext4/ext4.h +4 -4
index b51003f75568..b1ece5329738 100644
@@ -1462,7 +1462,7 @@ struct ext4_sb_info {
 #endif
 
 	/* for buddy allocator */
-	struct ext4_group_info ***s_group_info;
+	struct ext4_group_info ** __rcu *s_group_info;
 	struct inode *s_buddy_cache;
 	spinlock_t s_md_lock;
 	unsigned short *s_mb_offsets;

@@ -2994,13 +2994,13 @@ static inline
 struct ext4_group_info *ext4_get_group_info(struct super_block *sb,
 					    ext4_group_t group)
 {
-	 struct ext4_group_info ***grp_info;
+	 struct ext4_group_info **grp_info;
 	 long indexv, indexh;
 	 BUG_ON(group >= EXT4_SB(sb)->s_groups_count);
-	 grp_info = EXT4_SB(sb)->s_group_info;
 	 indexv = group >> (EXT4_DESC_PER_BLOCK_BITS(sb));
 	 indexh = group & ((EXT4_DESC_PER_BLOCK(sb)) - 1);
-	 return grp_info[indexv][indexh];
+	 grp_info = sbi_array_rcu_deref(EXT4_SB(sb), s_group_info, indexv);
+	 return grp_info[indexh];
 }
 
 /*
fs/ext4/mballoc.c +35 -17

114 lines not on this page · raw message