From: Toshiyuki Okajima <toshi.okajima@xxxxxxxxxxxxxx>
You know, do_truncate() can call ext4_setattr() (via notify_change()).
And, ext4_setattr() can return with -EFBIG if the argument(length) of
do_truncate() is more than sbi->s_bitmap_maxbytes. At that time,
it also calls ext4_std_error() with -EFBIG.
Besides, a panic happens when ext4_setattr() returns with -EFBIG
after we mount an ext4 filesystem with errors=panic.
The following steps can make this problem easily.
(1)
# /bin/dd if=/dev/zero of=/tmp/img bs=1k seek=1000k count=1
# /sbin/mkfs.ext3 -Fq /tmp/img
# /bin/mount -o loop -t ext4 /tmp/img /mnt
# /bin/dd if=/dev/zero of=/mnt/file bs=1k seek=2143281137 count=1
# /bin/dmesg
...
EXT4-fs error (device loop0) in ext4_setattr: error 27
(2)
# /bin/dd if=/dev/zero of=/tmp/img bs=1k seek=1000k count=1
# /sbin/mkfs.ext3 -Fq /tmp/img
# /bin/mount -o loop,errors=panic -t ext4 /tmp/img /mnt
# /bin/dd if=/dev/zero of=/mnt/file bs=1k seek=2143281137 count=1
(PANIC!)
This problem is in:
5482 if (attr->ia_valid & ATTR_SIZE) {
5483 if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) {
5484 struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
5485
5486 if (attr->ia_size > sbi->s_bitmap_maxbytes) {
5487 error = -EFBIG;
5488 goto err_out;
5489 }
5490 }
5491 }
5543 err_out:
5544 ext4_std_error(inode->i_sb, error);
5545 if (!error)
5546 error = rc;
5547 return error;
(because ext4_setattr() calls ext4_std_error() when error == -EFBIG)
So, we change those into:
5482 if (attr->ia_valid & ATTR_SIZE) {
5483 if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) {
5484 struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
5485
5486 if (attr->ia_size > sbi->s_bitmap_maxbytes) {
5487 error = -EFBIG;
* 5488 goto err_out2;
5489 }
5490 }
5491 }
5543 err_out:
5544 ext4_std_error(inode->i_sb, error);
5545 if (!error)
5546 error = rc;
* 5547 err_out2:
5548 return error;
This changes prevent this problem from happening.
Signed-off-by: Toshiyuki Okajima <toshi.okajima@xxxxxxxxxxxxxx>
---
fs/ext4/inode.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 42272d6..e87bb45 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5485,7 +5485,7 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
if (attr->ia_size > sbi->s_bitmap_maxbytes) {
error = -EFBIG;
- goto err_out;
+ goto err_out2;
}
}
}
@@ -5544,6 +5544,7 @@ err_out:
ext4_std_error(inode->i_sb, error);
if (!error)
error = rc;
+err_out2:
return error;
}
--
1.5.5.6
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
