Commit 027f14f5 authored by Theodore Ts'o's avatar Theodore Ts'o
Browse files

ext4: don't try to processed freed blocks until mballoc is initialized 

If we try to make any changes via the journal between when the journal
is initialized, but before the multi-block allocated is initialized,
we will end up deferencing a NULL pointer when the journal commit
callback function calls ext4_process_freed_data().

The proximate cause of this failure was commit 2d01ddc8 ("ext4:
save error info to sb through journal if available") since file system
corruption problems detected before the call to ext4_mb_init() would
result in a journal commit before we aborted the mount of the file
system.... and we would then trigger the NULL pointer deref.

Link: https://lore.kernel.org/r/YAm8qH/0oo2ofSMR@mit.edu


Reported-by: default avatarMurphy Zhou <jencce.kernel@gmail.com>
Reviewed-by: default avatarJan Kara <jack@suse.cz>
Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
parent 59ebc7fd

fs/ext4/super.c

+8 −1
Original line number Diff line number Diff line
@@ -4875,7 +4875,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) 


	set_task_ioprio(sbi->s_journal->j_task, journal_ioprio);



	sbi->s_journal->j_commit_callback = ext4_journal_commit_callback;

	sbi->s_journal->j_submit_inode_data_buffers =

		ext4_journal_submit_inode_data_buffers;

	sbi->s_journal->j_finish_inode_data_buffers =
@@ -4987,6 +4986,14 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) 
		goto failed_mount5;

	}



	/*

	 * We can only set up the journal commit callback once

	 * mballoc is initialized

	 */

	if (sbi->s_journal)

		sbi->s_journal->j_commit_callback =

			ext4_journal_commit_callback;



	block = ext4_count_free_clusters(sb);

	ext4_free_blocks_count_set(sbi->s_es, 

				   EXT4_C2B(sbi, block));