• Baokun Li's avatar
    ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop · eee22187
    Baokun Li authored
    In do_writepages, if the value returned by ext4_writepages is "-ENOMEM"
    and "wbc->sync_mode == WB_SYNC_ALL", retry until the condition is not met.
    
    In __ext4_get_inode_loc, if the bh returned by sb_getblk is NULL,
    the function returns -ENOMEM.
    
    In __getblk_slow, if the return value of grow_buffers is less than 0,
    the function returns NULL.
    
    When the three processes are connected in series like the following stack,
    an infinite loop may occur:
    
    do_writepages					<--- keep retrying
     ext4_writepages
      mpage_map_and_submit_extent
       mpage_map_one_extent
        ext4_map_blocks
         ext4_ext_map_blocks
          ext4_ext_handle_unwritten_extents
           ext4_ext_convert_to_initialized
            ext4_split_extent
             ext4_split_extent_at
              __ext4_ext_dirty
               __ext4_mark_inode_dirty
                ext4_reserve_inode_write
                 ext4_get_inode_loc
                  __ext4_get_inode_loc		<--- return -ENOMEM
                   sb_getblk
                    __getblk_gfp
                     __getblk_slow			<--- return NULL
                      grow_buffers
                       grow_dev_page		<--- return -ENXIO
                        ret = (block < end_block) ? 1 : -ENXIO;
    
    In this issue, bg_inode_table_hi is overwritten as an incorrect value.
    As a result, `block < end_block` cannot be met in grow_dev_page.
    Therefore, __ext4_get_inode_loc always returns '-ENOMEM' and do_writepages
    keeps retrying. As a result, the writeback process is in the D state due
    to an infinite loop.
    
    Add a check on inode table block in the __ext4_get_inode_loc function by
    referring to ext4_read_inode_bitmap to avoid this infinite loop.
    
    Cc: stable@kernel.org
    Signed-off-by: default avatarBaokun Li <libaokun1@huawei.com>
    Reviewed-by: default avatarRitesh Harjani (IBM) <ritesh.list@gmail.com>
    Link: https://lore.kernel.org/r/20220817132701.3015912-3-libaokun1@huawei.comSigned-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
    eee22187
inode.c 181 KB