Commit c00c5e1d authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 

Pull ext4 fixes from Ted Ts'o:
 "Fix some syzbot-detected bugs, as well as other bugs found by I/O
  injection testing.

  Change ext4's fallocate to consistently drop set[ug]id bits when an
  fallocate operation might possibly change the user-visible contents of
  a file.

  Also, improve handling of potentially invalid values in the the
  s_overhead_cluster superblock field to avoid ext4 returning a negative
  number of free blocks"

* tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
  jbd2: fix a potential race while discarding reserved buffers after an abort
  ext4: update the cached overhead value in the superblock
  ext4: force overhead calculation if the s_overhead_cluster makes no sense
  ext4: fix overhead calculation to account for the reserved gdt blocks
  ext4, doc: fix incorrect h_reserved size
  ext4: limit length to bitmap_maxbytes - blocksize in punch_hole
  ext4: fix use-after-free in ext4_search_dir
  ext4: fix bug_on in start_this_handle during umount filesystem
  ext4: fix symlink file size not match to file content
  ext4: fix fallocate to use file_modified to update permissions consistently
parents 2e5991fa 23e3d7f7

Documentation/filesystems/ext4/attributes.rst

+1 −1
Original line number Diff line number Diff line
@@ -76,7 +76,7 @@ The beginning of an extended attribute block is in 
     - Checksum of the extended attribute block.

   * - 0x14

     - \_\_u32

     - h\_reserved[2]

     - h\_reserved[3]

     - Zero.



The checksum is calculated against the FS UUID, the 64-bit block number

fs/ext4/ext4.h

+6 −1
Original line number Diff line number Diff line
@@ -2273,6 +2273,10 @@ static inline int ext4_forced_shutdown(struct ext4_sb_info *sbi) 
 * Structure of a directory entry

 */

#define EXT4_NAME_LEN 255

/*

 * Base length of the ext4 directory entry excluding the name length

 */

#define EXT4_BASE_DIR_LEN (sizeof(struct ext4_dir_entry_2) - EXT4_NAME_LEN)



struct ext4_dir_entry {

	__le32	inode;			/* Inode number */
@@ -3032,7 +3036,7 @@ extern int ext4_inode_attach_jinode(struct inode *inode); 
extern int ext4_can_truncate(struct inode *inode);

extern int ext4_truncate(struct inode *);

extern int ext4_break_layouts(struct inode *);

extern int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length);

extern int ext4_punch_hole(struct file *file, loff_t offset, loff_t length);

extern void ext4_set_inode_flags(struct inode *, bool init);

extern int ext4_alloc_da_blocks(struct inode *inode);

extern void ext4_set_aops(struct inode *inode);
@@ -3064,6 +3068,7 @@ int ext4_fileattr_set(struct user_namespace *mnt_userns, 
		      struct dentry *dentry, struct fileattr *fa);

int ext4_fileattr_get(struct dentry *dentry, struct fileattr *fa);

extern void ext4_reset_inode_seed(struct inode *inode);

int ext4_update_overhead(struct super_block *sb);



/* migrate.c */

extern int ext4_ext_migrate(struct inode *);

fs/ext4/extents.c

+25 −7
Original line number Diff line number Diff line
@@ -4500,9 +4500,9 @@ static int ext4_alloc_file_blocks(struct file *file, ext4_lblk_t offset, 
	return ret > 0 ? ret2 : ret;

}



static int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len);

static int ext4_collapse_range(struct file *file, loff_t offset, loff_t len);



static int ext4_insert_range(struct inode *inode, loff_t offset, loff_t len);

static int ext4_insert_range(struct file *file, loff_t offset, loff_t len);



static long ext4_zero_range(struct file *file, loff_t offset,

			    loff_t len, int mode)
@@ -4574,6 +4574,10 @@ static long ext4_zero_range(struct file *file, loff_t offset, 
	/* Wait all existing dio workers, newcomers will block on i_rwsem */

	inode_dio_wait(inode);



	ret = file_modified(file);

	if (ret)

		goto out_mutex;



	/* Preallocate the range including the unaligned edges */

	if (partial_begin || partial_end) {

		ret = ext4_alloc_file_blocks(file,
@@ -4690,7 +4694,7 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len) 
		return -EOPNOTSUPP;



	if (mode & FALLOC_FL_PUNCH_HOLE) {

		ret = ext4_punch_hole(inode, offset, len);

		ret = ext4_punch_hole(file, offset, len);

		goto exit;

	}
@@ -4699,12 +4703,12 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len) 
		goto exit;



	if (mode & FALLOC_FL_COLLAPSE_RANGE) {

		ret = ext4_collapse_range(inode, offset, len);

		ret = ext4_collapse_range(file, offset, len);

		goto exit;

	}



	if (mode & FALLOC_FL_INSERT_RANGE) {

		ret = ext4_insert_range(inode, offset, len);

		ret = ext4_insert_range(file, offset, len);

		goto exit;

	}
@@ -4740,6 +4744,10 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len) 
	/* Wait all existing dio workers, newcomers will block on i_rwsem */

	inode_dio_wait(inode);



	ret = file_modified(file);

	if (ret)

		goto out;



	ret = ext4_alloc_file_blocks(file, lblk, max_blocks, new_size, flags);

	if (ret)

		goto out;
@@ -5241,8 +5249,9 @@ ext4_ext_shift_extents(struct inode *inode, handle_t *handle, 
 * This implements the fallocate's collapse range functionality for ext4

 * Returns: 0 and non-zero on error.

 */

static int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len)

static int ext4_collapse_range(struct file *file, loff_t offset, loff_t len)

{

	struct inode *inode = file_inode(file);

	struct super_block *sb = inode->i_sb;

	struct address_space *mapping = inode->i_mapping;

	ext4_lblk_t punch_start, punch_stop;
@@ -5294,6 +5303,10 @@ static int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len) 
	/* Wait for existing dio to complete */

	inode_dio_wait(inode);



	ret = file_modified(file);

	if (ret)

		goto out_mutex;



	/*

	 * Prevent page faults from reinstantiating pages we have released from

	 * page cache.
@@ -5387,8 +5400,9 @@ static int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len) 
 * by len bytes.

 * Returns 0 on success, error otherwise.

 */

static int ext4_insert_range(struct inode *inode, loff_t offset, loff_t len)

static int ext4_insert_range(struct file *file, loff_t offset, loff_t len)

{

	struct inode *inode = file_inode(file);

	struct super_block *sb = inode->i_sb;

	struct address_space *mapping = inode->i_mapping;

	handle_t *handle;
@@ -5445,6 +5459,10 @@ static int ext4_insert_range(struct inode *inode, loff_t offset, loff_t len) 
	/* Wait for existing dio to complete */

	inode_dio_wait(inode);



	ret = file_modified(file);

	if (ret)

		goto out_mutex;



	/*

	 * Prevent page faults from reinstantiating pages we have released from

	 * page cache.

fs/ext4/inode.c

+16 −2
Original line number Diff line number Diff line
@@ -3953,12 +3953,14 @@ int ext4_break_layouts(struct inode *inode) 
 * Returns: 0 on success or negative on failure

 */



int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length)

int ext4_punch_hole(struct file *file, loff_t offset, loff_t length)

{

	struct inode *inode = file_inode(file);

	struct super_block *sb = inode->i_sb;

	ext4_lblk_t first_block, stop_block;

	struct address_space *mapping = inode->i_mapping;

	loff_t first_block_offset, last_block_offset;

	loff_t first_block_offset, last_block_offset, max_length;

	struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);

	handle_t *handle;

	unsigned int credits;

	int ret = 0, ret2 = 0;
@@ -4001,6 +4003,14 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length) 
		   offset;

	}



	/*

	 * For punch hole the length + offset needs to be within one block

	 * before last range. Adjust the length if it goes beyond that limit.

	 */

	max_length = sbi->s_bitmap_maxbytes - inode->i_sb->s_blocksize;

	if (offset + length > max_length)

		length = max_length - offset;



	if (offset & (sb->s_blocksize - 1) ||

	    (offset + length) & (sb->s_blocksize - 1)) {

		/*
@@ -4016,6 +4026,10 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length) 
	/* Wait all existing dio workers, newcomers will block on i_rwsem */

	inode_dio_wait(inode);



	ret = file_modified(file);

	if (ret)

		goto out_mutex;



	/*

	 * Prevent page faults from reinstantiating pages we have released from

	 * page cache.

fs/ext4/ioctl.c

+16 −0
Original line number Diff line number Diff line
@@ -1652,3 +1652,19 @@ long ext4_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 
	return ext4_ioctl(file, cmd, (unsigned long) compat_ptr(arg));

}

#endif



static void set_overhead(struct ext4_super_block *es, const void *arg)

{

	es->s_overhead_clusters = cpu_to_le32(*((unsigned long *) arg));

}



int ext4_update_overhead(struct super_block *sb)

{

	struct ext4_sb_info *sbi = EXT4_SB(sb);



	if (sb_rdonly(sb) || sbi->s_overhead == 0 ||

	    sbi->s_overhead == le32_to_cpu(sbi->s_es->s_overhead_clusters))

		return 0;



	return ext4_update_superblocks_fn(sb, set_overhead, &sbi->s_overhead);

}