This is a note to let you know that I've just added the patch titled
ext4: fix deadlock when converting an inline directory in nojournal mode
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
ext4-fix-deadlock-when-converting-an-inline-directory-in-nojournal-mode.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From f4ce24f54d9cca4f09a395f3eecce20d6bec4663 Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@xxxxxxx>
Date: Sat, 6 May 2023 21:04:01 -0400
Subject: ext4: fix deadlock when converting an inline directory in nojournal mode
From: Theodore Ts'o <tytso@xxxxxxx>
commit f4ce24f54d9cca4f09a395f3eecce20d6bec4663 upstream.
In no journal mode, ext4_finish_convert_inline_dir() can self-deadlock
by calling ext4_handle_dirty_dirblock() when it already has taken the
directory lock. There is a similar self-deadlock in
ext4_incvert_inline_data_nolock() for data files which we'll fix at
the same time.
A simple reproducer demonstrating the problem:
mke2fs -Fq -t ext2 -O inline_data -b 4k /dev/vdc 64
mount -t ext4 -o dirsync /dev/vdc /vdc
cd /vdc
mkdir file0
cd file0
touch file0
touch file1
attr -s BurnSpaceInEA -V abcde .
touch supercalifragilisticexpialidocious
Cc: stable@xxxxxxxxxx
Link: https://lore.kernel.org/r/20230507021608.1290720-1-tytso@xxxxxxx
Reported-by: syzbot+91dccab7c64e2850a4e5@xxxxxxxxxxxxxxxxxxxxxxxxx
Link: https://syzkaller.appspot.com/bug?id=ba84cc80a9491d65416bc7877e1650c87530fe8a
Signed-off-by: Theodore Ts'o <tytso@xxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/ext4/inline.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -1185,6 +1185,7 @@ static int ext4_finish_convert_inline_di
ext4_initialize_dirent_tail(dir_block,
inode->i_sb->s_blocksize);
set_buffer_uptodate(dir_block);
+ unlock_buffer(dir_block);
err = ext4_handle_dirty_dirblock(handle, inode, dir_block);
if (err)
return err;
@@ -1259,6 +1260,7 @@ static int ext4_convert_inline_data_nolo
if (!S_ISDIR(inode->i_mode)) {
memcpy(data_bh->b_data, buf, inline_size);
set_buffer_uptodate(data_bh);
+ unlock_buffer(data_bh);
error = ext4_handle_dirty_metadata(handle,
inode, data_bh);
} else {
@@ -1266,7 +1268,6 @@ static int ext4_convert_inline_data_nolo
buf, inline_size);
}
- unlock_buffer(data_bh);
out_restore:
if (error)
ext4_restore_inline_data(handle, inode, iloc, buf, inline_size);
Patches currently in stable-queue which might be from tytso@xxxxxxx are
queue-5.15/ext4-improve-error-recovery-code-paths-in-__ext4_remount.patch
queue-5.15/ext4-fix-warning-in-mb_find_extent.patch
queue-5.15/ext4-fix-deadlock-when-converting-an-inline-directory-in-nojournal-mode.patch
queue-5.15/ext4-bail-out-of-ext4_xattr_ibody_get-fails-for-any-reason.patch
queue-5.15/ext4-improve-error-handling-from-ext4_dirhash.patch
queue-5.15/ext4-add-bounds-checking-in-get_max_inline_xattr_value_size.patch
queue-5.15/ext4-avoid-a-potential-slab-out-of-bounds-in-ext4_group_desc_csum.patch
queue-5.15/ext4-check-iomap-type-only-if-ext4_iomap_begin-does-not-fail.patch
queue-5.15/ext4-fix-invalid-free-tracking-in-ext4_xattr_move_to_block.patch
queue-5.15/ext4-remove-a-bug_on-in-ext4_mb_release_group_pa.patch
queue-5.15/ext4-fix-data-races-when-using-cached-status-extents.patch
