| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20080802040541.A163614544DD@imap.suse.de>
Date: Fri, 01 Aug 2008 20:57:16 -0700
From: <gregkh@...e.de>
To: jbacik@...hat.com, akpm@...ux-foundation.org, gregkh@...e.de,
jack@....cz, linux-ext4@...r.kernel.org,
torvalds@...ux-foundation.org
Cc: <stable@...nel.org>, <stable-commits@...r.kernel.org>
Subject: patch jbd-fix-possible-journal-overflow-issues.patch added to 2.6.25-stable tree
This is a note to let you know that we have just queued up the patch titled
Subject: jbd: fix possible journal overflow issues
to the 2.6.25-stable tree. Its filename is
jbd-fix-possible-journal-overflow-issues.patch
A git repo of this tree can be found at
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
>From 5b9a499d77e9dd39c9e6611ea10c56a31604f274 Mon Sep 17 00:00:00 2001
From: Josef Bacik <jbacik@...hat.com>
Date: Mon, 28 Apr 2008 02:16:12 -0700
Subject: jbd: fix possible journal overflow issues
From: Josef Bacik <jbacik@...hat.com>
commit 5b9a499d77e9dd39c9e6611ea10c56a31604f274 upstream
There are several cases where the running transaction can get buffers added to
its BJ_Metadata list which it never dirtied, which makes its t_nr_buffers
counter end up larger than its t_outstanding_credits counter.
This will cause issues when starting new transactions as while we are logging
buffers we decrement t_outstanding_buffers, so when t_outstanding_buffers goes
negative, we will report that we need less space in the journal than we
actually need, so transactions will be started even though there may not be
enough room for them. In the worst case scenario (which admittedly is almost
impossible to reproduce) this will result in the journal running out of space.
The fix is to only
refile buffers from the committing transaction to the running transactions
BJ_Modified list when b_modified is set on that journal, which is the only way
to be sure if the running transaction has modified that buffer.
This patch also fixes an accounting error in journal_forget, it is possible
that we can call journal_forget on a buffer without having modified it, only
gotten write access to it, so instead of freeing a credit, we only do so if
the buffer was modified. The assert will help catch if this problem occurs.
Without these two patches I could hit this assert within minutes of running
postmark, with them this issue no longer arises. Thank you,
Signed-off-by: Josef Bacik <jbacik@...hat.com>
Cc: <linux-ext4@...r.kernel.org>
Acked-by: Jan Kara <jack@....cz>
Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@...ux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@...e.de>
---
fs/jbd/commit.c | 3 +++
fs/jbd/transaction.c | 21 ++++++++++++++++++---
2 files changed, 21 insertions(+), 3 deletions(-)
--- a/fs/jbd/commit.c
+++ b/fs/jbd/commit.c
@@ -472,6 +472,9 @@ void journal_commit_transaction(journal_
*/
commit_transaction->t_state = T_COMMIT;
+ J_ASSERT(commit_transaction->t_nr_buffers <=
+ commit_transaction->t_outstanding_credits);
+
descriptor = NULL;
bufs = 0;
while (commit_transaction->t_buffers) {
--- a/fs/jbd/transaction.c
+++ b/fs/jbd/transaction.c
@@ -1235,6 +1235,7 @@ int journal_forget (handle_t *handle, st
struct journal_head *jh;
int drop_reserve = 0;
int err = 0;
+ int was_modified = 0;
BUFFER_TRACE(bh, "entry");
@@ -1253,6 +1254,9 @@ int journal_forget (handle_t *handle, st
goto not_jbd;
}
+ /* keep track of wether or not this transaction modified us */
+ was_modified = jh->b_modified;
+
/*
* The buffer's going from the transaction, we must drop
* all references -bzzz
@@ -1270,7 +1274,12 @@ int journal_forget (handle_t *handle, st
JBUFFER_TRACE(jh, "belongs to current transaction: unfile");
- drop_reserve = 1;
+ /*
+ * we only want to drop a reference if this transaction
+ * modified the buffer
+ */
+ if (was_modified)
+ drop_reserve = 1;
/*
* We are no longer going to journal this buffer.
@@ -1310,7 +1319,13 @@ int journal_forget (handle_t *handle, st
if (jh->b_next_transaction) {
J_ASSERT(jh->b_next_transaction == transaction);
jh->b_next_transaction = NULL;
- drop_reserve = 1;
+
+ /*
+ * only drop a reference if this transaction modified
+ * the buffer
+ */
+ if (was_modified)
+ drop_reserve = 1;
}
}
@@ -2135,7 +2150,7 @@ void __journal_refile_buffer(struct jour
jh->b_transaction = jh->b_next_transaction;
jh->b_next_transaction = NULL;
__journal_file_buffer(jh, jh->b_transaction,
- was_dirty ? BJ_Metadata : BJ_Reserved);
+ jh->b_modified ? BJ_Metadata : BJ_Reserved);
J_ASSERT_JH(jh, jh->b_transaction->t_state == T_RUNNING);
if (was_dirty)
Patches currently in stable-queue which might be from jbacik@...hat.com are
queue-2.6.25/jbd-fix-possible-journal-overflow-issues.patch
queue-2.6.25/jbd-fix-the-way-the-b_modified-flag-is-cleared.patch
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists