| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <b39a740d-ae58-4b83-bede-dad0845da1dd@siemens.com>
Date: Thu, 8 Jan 2026 15:11:50 +0100
From: Jan Kiszka <jan.kiszka@...mens.com>
To: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, Jan Kara <jack@...e.cz>
Cc: stable@...r.kernel.org, Theodore Tso <tytso@....edu>,
patches@...ts.linux.dev, stable@...nel.org, Zhang Yi <yi.zhang@...wei.com>,
linux-ext4@...r.kernel.org,
Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
cip-dev <cip-dev@...ts.cip-project.org>
Subject: Re: [PATCH 6.12 242/262] ext4: fix checks for orphan inodes
On 08.01.26 11:43, Greg Kroah-Hartman wrote:
> On Thu, Jan 08, 2026 at 11:31:10AM +0100, Jan Kara wrote:
>> On Thu 08-01-26 09:19:23, Jan Kiszka wrote:
>>> On 13.10.25 16:46, Greg Kroah-Hartman wrote:
>>>> 6.12-stable review patch. If anyone has any objections, please let me know.
>>>>
>>>> ------------------
>>>>
>>>> From: Jan Kara <jack@...e.cz>
>>>>
>>>> commit acf943e9768ec9d9be80982ca0ebc4bfd6b7631e upstream.
>>>>
>>>> When orphan file feature is enabled, inode can be tracked as orphan
>>>> either in the standard orphan list or in the orphan file. The first can
>>>> be tested by checking ei->i_orphan list head, the second is recorded by
>>>> EXT4_STATE_ORPHAN_FILE inode state flag. There are several places where
>>>> we want to check whether inode is tracked as orphan and only some of
>>>> them properly check for both possibilities. Luckily the consequences are
>>>> mostly minor, the worst that can happen is that we track an inode as
>>>> orphan although we don't need to and e2fsck then complains (resulting in
>>>> occasional ext4/307 xfstest failures). Fix the problem by introducing a
>>>> helper for checking whether an inode is tracked as orphan and use it in
>>>> appropriate places.
>>>>
>>>> Fixes: 4a79a98c7b19 ("ext4: Improve scalability of ext4 orphan file handling")
>>>> Cc: stable@...nel.org
>>>> Signed-off-by: Jan Kara <jack@...e.cz>
>>>> Reviewed-by: Zhang Yi <yi.zhang@...wei.com>
>>>> Message-ID: <20250925123038.20264-2-jack@...e.cz>
>>>> Signed-off-by: Theodore Ts'o <tytso@....edu>
>>>> Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
>>>> ---
>>>> fs/ext4/ext4.h | 10 ++++++++++
>>>> fs/ext4/file.c | 2 +-
>>>> fs/ext4/inode.c | 2 +-
>>>> fs/ext4/orphan.c | 6 +-----
>>>> fs/ext4/super.c | 4 ++--
>>>> 5 files changed, 15 insertions(+), 9 deletions(-)
>>>>
>>>> --- a/fs/ext4/ext4.h
>>>> +++ b/fs/ext4/ext4.h
>>>> @@ -1970,6 +1970,16 @@ static inline bool ext4_verity_in_progre
>>>> #define NEXT_ORPHAN(inode) EXT4_I(inode)->i_dtime
>>>>
>>>> /*
>>>> + * Check whether the inode is tracked as orphan (either in orphan file or
>>>> + * orphan list).
>>>> + */
>>>> +static inline bool ext4_inode_orphan_tracked(struct inode *inode)
>>>> +{
>>>> + return ext4_test_inode_state(inode, EXT4_STATE_ORPHAN_FILE) ||
>>>> + !list_empty(&EXT4_I(inode)->i_orphan);
>>>> +}
>>>> +
>>>> +/*
>>>> * Codes for operating systems
>>>> */
>>>> #define EXT4_OS_LINUX 0
>>>> --- a/fs/ext4/file.c
>>>> +++ b/fs/ext4/file.c
>>>> @@ -354,7 +354,7 @@ static void ext4_inode_extension_cleanup
>>>> * to cleanup the orphan list in ext4_handle_inode_extension(). Do it
>>>> * now.
>>>> */
>>>> - if (!list_empty(&EXT4_I(inode)->i_orphan) && inode->i_nlink) {
>>>> + if (ext4_inode_orphan_tracked(inode) && inode->i_nlink) {
>>>> handle_t *handle = ext4_journal_start(inode, EXT4_HT_INODE, 2);
>>>>
>>>> if (IS_ERR(handle)) {
>>>> --- a/fs/ext4/inode.c
>>>> +++ b/fs/ext4/inode.c
>>>> @@ -4330,7 +4330,7 @@ static int ext4_fill_raw_inode(struct in
>>>> * old inodes get re-used with the upper 16 bits of the
>>>> * uid/gid intact.
>>>> */
>>>> - if (ei->i_dtime && list_empty(&ei->i_orphan)) {
>>>> + if (ei->i_dtime && !ext4_inode_orphan_tracked(inode)) {
>>>> raw_inode->i_uid_high = 0;
>>>> raw_inode->i_gid_high = 0;
>>>> } else {
>>>> --- a/fs/ext4/orphan.c
>>>> +++ b/fs/ext4/orphan.c
>>>> @@ -109,11 +109,7 @@ int ext4_orphan_add(handle_t *handle, st
>>>>
>>>> WARN_ON_ONCE(!(inode->i_state & (I_NEW | I_FREEING)) &&
>>>> !inode_is_locked(inode));
>>>> - /*
>>>> - * Inode orphaned in orphan file or in orphan list?
>>>> - */
>>>> - if (ext4_test_inode_state(inode, EXT4_STATE_ORPHAN_FILE) ||
>>>> - !list_empty(&EXT4_I(inode)->i_orphan))
>>>> + if (ext4_inode_orphan_tracked(inode))
>>>> return 0;
>>>>
>>>> /*
>>>> --- a/fs/ext4/super.c
>>>> +++ b/fs/ext4/super.c
>>>> @@ -1461,9 +1461,9 @@ static void ext4_free_in_core_inode(stru
>>>>
>>>> static void ext4_destroy_inode(struct inode *inode)
>>>> {
>>>> - if (!list_empty(&(EXT4_I(inode)->i_orphan))) {
>>>> + if (ext4_inode_orphan_tracked(inode)) {
>>>> ext4_msg(inode->i_sb, KERN_ERR,
>>>> - "Inode %lu (%p): orphan list check failed!",
>>>> + "Inode %lu (%p): inode tracked as orphan!",
>>>> inode->i_ino, EXT4_I(inode));
>>>> print_hex_dump(KERN_INFO, "", DUMP_PREFIX_ADDRESS, 16, 4,
>>>> EXT4_I(inode), sizeof(struct ext4_inode_info),
>>>>
>>>>
>>>
>>> Since this patch, I'm getting "inode tracked as orphan" warnings on ARM
>>> 32-bit boards (not qemu, other archs not tested yet) when rebooting or
>>> shutting down. The affected partition is used as backing storage for an
>>> overlayfs (Debian image built from [1]). Still, systemd reports to have
>>> sucessfully unmounted the partition.
>>>
>>> [ OK ] Stopped systemd-journal-flush.serv…lush Journal to Persistent Storage.
>>> [ OK ] Unmounted run-lock.mount - Legacy Locks Directory /run/lock.
>>> [ OK ] Unmounted tmp.mount - Temporary Directory /tmp.
>>> [ OK ] Stopped target swap.target - Swaps.
>>> Unmounting var.mount - /var...
>>> [ OK ] Unmounted var.mount - /var.
>>> [ OK ] Stopped target local-fs-pre.target…Preparation for Local File Systems.
>>> [ OK ] Reached target umount.target - Unmount All Filesystems.
>>> [ OK ] Stopped systemd-remount-fs.service…mount Root and Kernel File Systems.
>>> [ OK ] Stopped systemd-tmpfiles-setup-dev…Create Static Device Nodes in /dev.
>>> [ OK ] Stopped systemd-tmpfiles-setup-dev…ic Device Nodes in /dev gracefully.
>>> [ OK ] Reached target shutdown.target - System Shutdown.
>>> [ OK ] Reached target final.target - Late Shutdown Services.
>>> [ OK ] Finished systemd-poweroff.service - System Power Off.
>>> [ OK ] Reached target poweroff.target - System Power Off.
>>> [ 52.948231] watchdog: watchdog0: watchdog did not stop!
>>> [ 53.440970] EXT4-fs (mmcblk0p6): Inode 1 (b6b2dba9): inode tracked as orphan!
>>> [ 53.449709] CPU: 0 UID: 0 PID: 412 Comm: (sd-umount) Not tainted 6.12.52-00240-gf50bece98c66 #12
>>> [ 53.449728] Hardware name: ti TI AM335x BeagleBone Black/TI AM335x BeagleBone Black, BIOS 2025.07 07/01/2025
>>> [ 53.449740] Call trace:
>>> [ 53.449757] unwind_backtrace from show_stack+0x18/0x1c
>>> [ 53.449807] show_stack from dump_stack_lvl+0x68/0x74
>>> [ 53.449839] dump_stack_lvl from ext4_destroy_inode+0x7c/0x10c
>>> [ 53.449870] ext4_destroy_inode from destroy_inode+0x5c/0x70
>>> [ 53.449897] destroy_inode from ext4_mb_release+0xc8/0x268
>>> [ 53.449936] ext4_mb_release from ext4_put_super+0xe4/0x308
>>> [ 53.449962] ext4_put_super from generic_shutdown_super+0x84/0x154
>>> [ 53.449996] generic_shutdown_super from kill_block_super+0x18/0x34
>>> [ 53.450023] kill_block_super from ext4_kill_sb+0x28/0x3c
>>> [ 53.450059] ext4_kill_sb from deactivate_locked_super+0x58/0x90
>>> [ 53.450086] deactivate_locked_super from cleanup_mnt+0x74/0xd0
>>> [ 53.450113] cleanup_mnt from task_work_run+0x88/0xa0
>>> [ 53.450136] task_work_run from do_work_pending+0x394/0x3cc
>>> [ 53.450156] do_work_pending from slow_work_pending+0xc/0x24
>>> [ 53.450175] Exception stack(0xe093dfb0 to 0xe093dff8)
>>> [ 53.450190] dfa0: 00000000 00000009 00000000 00000000
>>> [ 53.450205] dfc0: be9e0b2c 004e2aa0 be9e0a20 00000034 be9e0a04 00000000 be9e0a20 00000000
>>> [ 53.450218] dfe0: 00000034 be9e095c b6ba609b b6b0f736 00030030 004e2ac0
>>> [ 53.730379] reboot: Power down
>>>
>>> I'm not getting the warning with the same image but kernels 6.18+ or
>>> also 6.17.13 (the latter received this as backport as well). I do get
>>> the warning with 6.1.159 as well, and also when moving up to 6.12.63
>>> which received further ext4 backports. I didn't test 6.6 or 5.15 so far,
>>> but I suspect they are equally affected.
>>>
>>> Before digging deep into this to me unfamiliar subsystem: Could we miss
>>> some backport(s) to 6.12 and below that 6.17+ have? Any suggestions to
>>> try out first?
>>
>> I suspect you're missing 4091c8206cfd ("ext4: clear i_state_flags when
>> alloc inode") (which BTW has Fixes tag to this commit).
>
> That is queued up for the next round of stable releases. Hopefully the
> -rc releases for them will go out in a day or so.
>
Perfect. It indeed looks like that this missing commit was causing the
issue.
Jan
--
Siemens AG, Foundational Technologies
Linux Expert Center
Powered by blists - more mailing lists