• Jan Kara's avatar
    ext4: Fix buffer double free in ext4_alloc_branch() · c5c7b8dd
    Jan Kara authored
    Error recovery in ext4_alloc_branch() calls ext4_forget() even for
    buffer corresponding to indirect block it did not allocate. This leads
    to brelse() being called twice for that buffer (once from ext4_forget()
    and once from cleanup in ext4_ind_map_blocks()) leading to buffer use
    count misaccounting. Eventually (but often much later because there
    are other users of the buffer) we will see messages like:
    VFS: brelse: Trying to free free buffer
    
    Another manifestation of this problem is an error:
    JBD2 unexpected failure: jbd2_journal_revoke: !buffer_revoked(bh);
    inconsistent data on disk
    
    The fix is easy - don't forget buffer we did not allocate. Also add an
    explanatory comment because the indexing at ext4_alloc_branch() is
    somewhat subtle.
    Signed-off-by: default avatarJan Kara <jack@suse.cz>
    Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
    Cc: stable@vger.kernel.org
    c5c7b8dd
indirect.c 40.5 KB