Commit f0c411a3 authored by Baokun Li's avatar Baokun Li
Browse files

ext4: regenerate buddy after block freeing failed if under fc replay 

mainline inclusion
from mainline-v6.8-rc3
commit c9b528c35795b711331ed36dc3dbee90d5812d4e
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93HD9
CVE: CVE-2024-26601

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c9b528c35795b711331ed36dc3dbee90d5812d4e



--------------------------------

This mostly reverts commit 6bd97bf2 ("ext4: remove redundant
mb_regenerate_buddy()") and reintroduces mb_regenerate_buddy(). Based on
code in mb_free_blocks(), fast commit replay can end up marking as free
blocks that are already marked as such. This causes corruption of the
buddy bitmap so we need to regenerate it in that case.

Reported-by: default avatarJan Kara <jack@suse.cz>
Fixes: 6bd97bf2 ("ext4: remove redundant mb_regenerate_buddy()")
Signed-off-by: default avatarBaokun Li <libaokun1@huawei.com>
Reviewed-by: default avatarJan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20240104142040.2835097-4-libaokun1@huawei.com


Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>

Conflicts:
	fs/ext4/mballoc.c

Signed-off-by: default avatarBaokun Li <libaokun1@huawei.com>
parent 7d417511

fs/ext4/mballoc.c

+20 −0
Original line number Diff line number Diff line
@@ -822,6 +822,24 @@ void ext4_mb_generate_buddy(struct super_block *sb, 
	atomic64_add(period, &sbi->s_mb_generation_time);

}



static void mb_regenerate_buddy(struct ext4_buddy *e4b)

{

	int count;

	int order = 1;

	void *buddy;



	while ((buddy = mb_find_buddy(e4b, order++, &count)))

		ext4_set_bits(buddy, 0, count);



	e4b->bd_info->bb_fragments = 0;

	memset(e4b->bd_info->bb_counters, 0,

		sizeof(*e4b->bd_info->bb_counters) *

		(e4b->bd_sb->s_blocksize_bits + 2));



	ext4_mb_generate_buddy(e4b->bd_sb, e4b->bd_buddy,

		e4b->bd_bitmap, e4b->bd_group, e4b->bd_info);

}



/* The buddy information is attached the buddy cache inode

 * for convenience. The information regarding each group

 * is loaded via ext4_mb_load_buddy. The information involve
@@ -1504,6 +1522,8 @@ static void mb_free_blocks(struct inode *inode, struct ext4_buddy *e4b, 
			ext4_mark_group_bitmap_corrupted(

				sb, e4b->bd_group,

				EXT4_GROUP_INFO_BBITMAP_CORRUPT);

		} else {

			mb_regenerate_buddy(e4b);

		}

		goto done;

	}