linux-ext4 - Re: [PATCH] ext4: fix error processing in mb_free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <483E3D50.5010007@cn.fujitsu.com>
Date:	Thu, 29 May 2008 13:21:20 +0800
From:	Shen Feng <shen@...fujitsu.com>
To:	Andrew Morton <akpm@...ux-foundation.org>
CC:	linux-ext4@...r.kernel.org, cmm@...ibm.com,
	aneesh.kumar@...ux.vnet.ibm.com
Subject: Re: [PATCH] ext4: fix error processing in mb_free_blocks



Andrew Morton Wrote:
> On Thu, 29 May 2008 11:21:18 +0800 Shen Feng <shen@...fujitsu.com> wrote:
> 
>> The error processing of the return value of mb_free_blocks
>> is meanless because it only return 0. This fix includes
>> *make mb_free_blocks return void
>> *remove the error processing part in callers
> 
> This:
> 
>> *unlock group before calling ext4_error in mb_free_blocks
> 
> fixes a potential deadlock.
> 
>> @@ -1084,11 +1084,12 @@ static int mb_free_blocks(struct inode *inode, struct ext4_buddy *e4b,
>>  			blocknr += block;
>>  			blocknr +=
>>  			    le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block);
>> -
>> +			ext4_unlock_group(sb, e4b->bd_group);
>>  			ext4_error(sb, __func__, "double-free of inode"
>>  				   " %lu's block %llu(bit %u in group %lu)\n",
>>  				   inode ? inode->i_ino : 0, blocknr, block,
>>  				   e4b->bd_group);
>> +			ext4_lock_group(sb, e4b->bd_group);
>>  		}
>>  		mb_clear_bit(block, EXT4_MB_BITMAP(e4b));
>>  		e4b->bd_info->bb_counters[order]++;
> 
> but are we sure we can just drop the lock and then cheerfully proceed? 
> Whatever data that lock is protecting might have changed..

That's a real question to me when I fixed this.
I got the similar code in balloc.c from line 740 in ext4_free_blocks_sb.

		if (!ext4_clear_bit_atomic(sb_bgl_lock(sbi, block_group),
						bit + i, bitmap_bh->b_data)) {
			jbd_unlock_bh_state(bitmap_bh);
			ext4_error(sb, __func__,
				   "bit already cleared for block %llu",
				   (ext4_fsblk_t)(block + i));
			jbd_lock_bh_state(bitmap_bh);
			BUFFER_TRACE(bitmap_bh, "bit already cleared");
		} else {
			group_freed++;
		}
 
So I did the same fix.
Maybe this also needs to be fixed.

> 
> A safer-looking fix would be to return an error from mb_free_blocks()
> and handle the in the caller, once the ext4_unlock_group() has been
> performed.
> 
> 
> 

--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html