| From b9a037b7f3c401d3c63e0423e56aef606b1ffaaf Mon Sep 17 00:00:00 2001 |
| From: Zhang Yi <yi.zhang@huawei.com> |
| Date: Fri, 7 May 2021 15:19:04 +0800 |
| Subject: ext4: cleanup in-core orphan list if ext4_truncate() failed to get a transaction handle |
| |
| From: Zhang Yi <yi.zhang@huawei.com> |
| |
| commit b9a037b7f3c401d3c63e0423e56aef606b1ffaaf upstream. |
| |
| In ext4_orphan_cleanup(), if ext4_truncate() failed to get a transaction |
| handle, it didn't remove the inode from the in-core orphan list, which |
| may probably trigger below error dump in ext4_destroy_inode() during the |
| final iput() and could lead to memory corruption on the later orphan |
| list changes. |
| |
| EXT4-fs (sda): Inode 6291467 (00000000b8247c67): orphan list check failed! |
| 00000000b8247c67: 0001f30a 00000004 00000000 00000023 ............#... |
| 00000000e24cde71: 00000006 014082a3 00000000 00000000 ......@......... |
| 0000000072c6a5ee: 00000000 00000000 00000000 00000000 ................ |
| ... |
| |
| This patch fix this by cleanup in-core orphan list manually if |
| ext4_truncate() return error. |
| |
| Cc: stable@kernel.org |
| Signed-off-by: Zhang Yi <yi.zhang@huawei.com> |
| Reviewed-by: Jan Kara <jack@suse.cz> |
| Link: https://lore.kernel.org/r/20210507071904.160808-1-yi.zhang@huawei.com |
| Signed-off-by: Theodore Ts'o <tytso@mit.edu> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| fs/ext4/super.c | 9 ++++++++- |
| 1 file changed, 8 insertions(+), 1 deletion(-) |
| |
| --- a/fs/ext4/super.c |
| +++ b/fs/ext4/super.c |
| @@ -3099,8 +3099,15 @@ static void ext4_orphan_cleanup(struct s |
| inode_lock(inode); |
| truncate_inode_pages(inode->i_mapping, inode->i_size); |
| ret = ext4_truncate(inode); |
| - if (ret) |
| + if (ret) { |
| + /* |
| + * We need to clean up the in-core orphan list |
| + * manually if ext4_truncate() failed to get a |
| + * transaction handle. |
| + */ |
| + ext4_orphan_del(NULL, inode); |
| ext4_std_error(inode->i_sb, ret); |
| + } |
| inode_unlock(inode); |
| nr_truncates++; |
| } else { |