]> www.infradead.org Git - users/jedix/linux-maple.git/commitdiff
xfs: xfs_iflush_cluster fails to abort on error
authorDave Chinner <dchinner@redhat.com>
Wed, 18 May 2016 03:53:42 +0000 (13:53 +1000)
committerDhaval Giani <dhaval.giani@oracle.com>
Fri, 20 Jan 2017 22:21:54 +0000 (17:21 -0500)
Orabug: 25256934

[ Upstream commit b1438f477934f5a4d5a44df26f3079a7575d5946 ]

When a failure due to an inode buffer occurs, the error handling
fails to abort the inode writeback correctly. This can result in the
inode being reclaimed whilst still in the AIL, leading to
use-after-free situations as well as filesystems that cannot be
unmounted as the inode log items left in the AIL never get removed.

Fix this by ensuring fatal errors from xfs_imap_to_bp() result in
the inode flush being aborted correctly.

cc: <stable@vger.kernel.org> # 3.10.x-
Reported-by: Shyam Kaushik <shyam@zadarastorage.com>
Diagnosed-by: Shyam Kaushik <shyam@zadarastorage.com>
Tested-by: Shyam Kaushik <shyam@zadarastorage.com>
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
(cherry picked from commit 6659d79405e4c4ec1abac74aaf551fb822081112)
Signed-off-by: Dhaval Giani <dhaval.giani@oracle.com>
fs/xfs/xfs_inode.c

index 539a85fddbc26864004e80f5fb229c6c2de565b8..e395a5c6b937d32604c0c46f863ae2c5612a7a6f 100644 (file)
@@ -3358,7 +3358,7 @@ xfs_iflush(
        struct xfs_buf          **bpp)
 {
        struct xfs_mount        *mp = ip->i_mount;
-       struct xfs_buf          *bp;
+       struct xfs_buf          *bp = NULL;
        struct xfs_dinode       *dip;
        int                     error;
 
@@ -3400,14 +3400,22 @@ xfs_iflush(
        }
 
        /*
-        * Get the buffer containing the on-disk inode.
+        * Get the buffer containing the on-disk inode. We are doing a try-lock
+        * operation here, so we may get  an EAGAIN error. In that case, we
+        * simply want to return with the inode still dirty.
+        *
+        * If we get any other error, we effectively have a corruption situation
+        * and we cannot flush the inode, so we treat it the same as failing
+        * xfs_iflush_int().
         */
        error = xfs_imap_to_bp(mp, NULL, &ip->i_imap, &dip, &bp, XBF_TRYLOCK,
                               0);
-       if (error || !bp) {
+       if (error == -EAGAIN) {
                xfs_ifunlock(ip);
                return error;
        }
+       if (error)
+               goto corrupt_out;
 
        /*
         * First flush out the inode that xfs_iflush was called with.
@@ -3435,7 +3443,8 @@ xfs_iflush(
        return 0;
 
 corrupt_out:
-       xfs_buf_relse(bp);
+       if (bp)
+               xfs_buf_relse(bp);
        xfs_force_shutdown(mp, SHUTDOWN_CORRUPT_INCORE);
 cluster_corrupt_out:
        error = -EFSCORRUPTED;