Commit 0e9c919f authored by yangerkun's avatar yangerkun
Browse files

ext4: recheck buffer valid after page unlock

hulk inclusion
category: bugfix
bugzilla: 189306, https://gitee.com/openeuler/kernel/issues/I8BBWH


CVE: NA

----------------------------------------

We need destination address when we do dio read, and this addr can come
from mmap results for a journal data mode inode. Then dio_bio_complete
will dirty the page which the mmap addr point to(since we have fill dirty
data for this page). ext4_journalled_set_page_dirty will first set
PageChecked and then dirty page(do not dirty buffer), which leave
__ext4_journalled_writepage in ext4_writepage to do the rest thing
needed for journal data mode.

We need first start handle and then lock the page, so in
__ext4_journalled_writepage we first unlock the page and latter call
ext4_journal_start; after we relock the page, we do some check to
prevent the concurrence truncate and then walk through buffer to help
join journal. Actually, once we unlock the page, since we has not add
extra buffer refcount, so the buffer can also gone(concurrent happened
for jbd2_journal_commit_transaction and jbd2_log_do_checkpoint can
remove the extra buffer head ref and clear buffer dirty, so drop cache
can release buffer), and upper walk through buffer will trigger the
BUG_ON in page_buffers.

The problem does not exist in mainline since 3f079114 ("ext4:
Convert data=journal writeback to use ext4_writepages()") delete all
this code, and this patchset seems too complex to do the backport. So we
just fix it with a simpler way, check buffer valid before walk through
buffer.

Signed-off-by: default avataryangerkun <yangerkun@huawei.com>
parent fc824048
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment