• Ritesh Harjani's avatar
    ext4: fix accessing uninit percpu counter variable with fast_commit · b45f189a
    Ritesh Harjani authored
    When running generic/527 with fast_commit configuration, the following
    issue is seen on Power.  With fast_commit, during ext4_fc_replay()
    (which can be called from ext4_fill_super()), if inode eviction
    happens then it can access an uninitialized percpu counter variable.
    
    This patch adds the check before accessing the counters in
    ext4_free_inode() path.
    
    [  321.165371] run fstests generic/527 at 2021-04-29 08:38:43
    [  323.027786] EXT4-fs (dm-0): mounted filesystem with ordered data mode. Opts: block_validity. Quota mode: none.
    [  323.618772] BUG: Unable to handle kernel data access on read at 0x1fbd80000
    [  323.619767] Faulting instruction address: 0xc000000000bae78c
    cpu 0x1: Vector: 300 (Data Access) at [c000000010706ef0]
        pc: c000000000bae78c: percpu_counter_add_batch+0x3c/0x100
        lr: c0000000006d0bb0: ext4_free_inode+0x780/0xb90
        pid   = 5593, comm = mount
    	ext4_free_inode+0x780/0xb90
    	ext4_evict_inode+0xa8c/0xc60
    	evict+0xfc/0x1e0
    	ext4_fc_replay+0xc50/0x20f0
    	do_one_pass+0xfe0/0x1350
    	jbd2_journal_recover+0x184/0x2e0
    	jbd2_journal_load+0x1c0/0x4a0
    	ext4_fill_super+0x2458/0x4200
    	mount_bdev+0x1dc/0x290
    	ext4_mount+0x28/0x40
    	legacy_get_tree+0x4c/0xa0
    	vfs_get_tree+0x4c/0x120
    	path_mount+0xcf8/0xd70
    	do_mount+0x80/0xd0
    	sys_mount+0x3fc/0x490
    	system_call_exception+0x384/0x3d0
    	system_call_common+0xec/0x278
    
    Cc: stable@kernel.org
    Fixes: 8016e29f ("ext4: fast commit recovery path")
    Signed-off-by: default avatarRitesh Harjani <riteshh@linux.ibm.com>
    Reviewed-by: default avatarHarshad Shirwadkar <harshadshirwadkar@gmail.com>
    Link: https://lore.kernel.org/r/6cceb9a75c54bef8fa9696c1b08c8df5ff6169e2.1619692410.git.riteshh@linux.ibm.comSigned-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
    b45f189a
ialloc.c 44.6 KB