On Wed, Feb 24, 2016 at 09:32:19AM +0200, Nikolay Borisov wrote: > From: Jan Kara <jack@xxxxxxxx> > > commit ed8ad83808f009ade97ebbf6519bc3a97fefbc0c upstream > > ext4 can update bh->b_state non-atomically in _ext4_get_block() and > ext4_da_get_block_prep(). Usually this is fine since bh is just a > temporary storage for mapping information on stack but in some cases it > can be fully living bh attached to a page. In such case non-atomic > update of bh->b_state can race with an atomic update which then gets > lost. Usually when we are mapping bh and thus updating bh->b_state > non-atomically, nobody else touches the bh and so things work out fine > but there is one case to especially worry about: ext4_finish_bio() uses > BH_Uptodate_Lock on the first bh in the page to synchronize handling of > PageWriteback state. So when blocksize < pagesize, we can be atomically > modifying bh->b_state of a buffer that actually isn't under IO and thus > can race e.g. with delalloc trying to map that buffer. The result is > that we can mistakenly set / clear BH_Uptodate_Lock bit resulting in the > corruption of PageWriteback state or missed unlock of BH_Uptodate_Lock. > > Fix the problem by always updating bh->b_state bits atomically. > > CC: stable@xxxxxxxxxxxxxxx > Reported-by: Nikolay Borisov <kernel@xxxxxxxx> > Signed-off-by: Jan Kara <jack@xxxxxxx> > Signed-off-by: Theodore Ts'o <tytso@xxxxxxx> > Signed-off-by: Nikolay Borisov <kernel@xxxxxxxx> > [NB: Backported to 4.4.2] Acked-by: Theodore Ts'o <tytso@xxxxxxx> (This failed the auto backport to the 4.4 stable branch; thanks to Nikolay for backporting it.) - Ted -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html