kevin/linux
1
Fork 0
Code
master
linux/fs/ext4
History
Baokun Li 6121258c2b ext4: fix off by one issue in alloc_flex_gd() 
Wesley reported an issue:

==================================================================
EXT4-fs (dm-5): resizing filesystem from 7168 to 786432 blocks
------------[ cut here ]------------
kernel BUG at fs/ext4/resize.c:324!
CPU: 9 UID: 0 PID: 3576 Comm: resize2fs Not tainted 6.11.0+ #27
RIP: 0010:ext4_resize_fs+0x1212/0x12d0
Call Trace:
 __ext4_ioctl+0x4e0/0x1800
 ext4_ioctl+0x12/0x20
 __x64_sys_ioctl+0x99/0xd0
 x64_sys_call+0x1206/0x20d0
 do_syscall_64+0x72/0x110
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
==================================================================

While reviewing the patch, Honza found that when adjusting resize_bg in
alloc_flex_gd(), it was possible for flex_gd->resize_bg to be bigger than
flexbg_size.

The reproduction of the problem requires the following:

 o_group = flexbg_size * 2 * n;
 o_size = (o_group + 1) * group_size;
 n_group: [o_group + flexbg_size, o_group + flexbg_size * 2)
 o_size = (n_group + 1) * group_size;

Take n=0,flexbg_size=16 as an example:

              last:15
|o---------------|--------------n-|
o_group:0    resize to      n_group:30

The corresponding reproducer is:

img=test.img
rm -f $img
truncate -s 600M $img
mkfs.ext4 -F $img -b 1024 -G 16 8M
dev=`losetup -f --show $img`
mkdir -p /tmp/test
mount $dev /tmp/test
resize2fs $dev 248M

Delete the problematic plus 1 to fix the issue, and add a WARN_ON_ONCE()
to prevent the issue from happening again.

[ Note: another reproucer which this commit fixes is:

  img=test.img
  rm -f $img
  truncate -s 25MiB $img
  mkfs.ext4 -b 4096 -E nodiscard,lazy_itable_init=0,lazy_journal_init=0 $img
  truncate -s 3GiB $img
  dev=`losetup -f --show $img`
  mkdir -p /tmp/test
  mount $dev /tmp/test
  resize2fs $dev 3G
  umount $dev
  losetup -d $dev

  -- TYT ]

Reported-by: Wesley Hershberger <wesley.hershberger@canonical.com>
Closes: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2081231
Reported-by: Stéphane Graber <stgraber@stgraber.org>
Closes: https://lore.kernel.org/all/20240925143325.518508-1-aleksandr.mikhalitsyn@canonical.com/
Tested-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
Tested-by: Eric Sandeen <sandeen@redhat.com>
Fixes: 665d3e0af4 ("ext4: reduce unnecessary memory allocation in alloc_flex_gd()")
Cc: stable@vger.kernel.org
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20240927133329.1015041-1-libaokun@huaweicloud.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
2024-10-04 17:36:28 -04:00
..
.kunitconfig ext4: add .kunitconfig fragment to enable ext4-specific tests 2021-02-11 23:16:30 -05:00
acl.c ext4: convert to ctime accessor functions 2023-07-24 10:29:54 +02:00
acl.h Revert "ext4: apply umask if ACL support is disabled" 2024-05-02 18:25:39 -04:00
balloc.c ext4: add some kunit stub for mballoc kunit test 2023-10-05 22:32:16 -04:00
bitmap.c ext4: move checksum length calculation of inode bitmap into ext4_inode_bitmap_csum_[verify/set]() functions 2024-09-03 22:12:15 -04:00
block_validity.c ext4: block_validity: Remove unnecessary ‘NULL’ values from new_node 2024-06-27 09:34:00 -04:00
crypto.c ext4: Move CONFIG_UNICODE defguards into the code flow 2024-06-07 17:00:45 +02:00
dir.c Lots of cleanups and bug fixes this cycle, primarily in the block 2024-09-20 19:26:45 -07:00
ext4_extents.h ext4: fix sparse warnings 2021-08-30 23:36:50 -04:00
ext4_jbd2.c use ->bd_mapping instead of ->bd_inode->i_mapping 2024-05-03 02:36:51 -04:00
ext4_jbd2.h ext4: split ext4_journal_start trace for debug 2022-12-01 10:46:54 -05:00
ext4.h Lots of cleanups and bug fixes this cycle, primarily in the block 2024-09-20 19:26:45 -07:00
extents_status.c ext4: drop all delonly descriptions 2024-09-02 15:26:15 -04:00
extents_status.h ext4: drop ext4_es_is_delonly() 2024-09-02 15:26:14 -04:00
extents.c ext4: save unnecessary indentation in ext4_ext_create_new_leaf() 2024-09-03 22:14:16 -04:00
fast_commit.c ext4: use handle to mark fc as ineligible in __track_dentry_update() 2024-10-04 17:35:54 -04:00
fast_commit.h ext4: add missing validation of fast-commit record lengths 2022-12-08 21:49:24 -05:00
file.c ext4: dax: keep orphan list before truncate overflow allocated blocks 2024-09-03 22:14:16 -04:00
fsmap.c ext4: port block device access to file 2024-02-25 12:05:26 +01:00
fsmap.h ext4: fsmap: fix the block/inode bitmap comment 2021-06-24 09:48:29 -04:00
fsync.c ext4: drop EXT4_MF_FS_ABORTED flag 2023-07-29 18:37:53 -04:00
hash.c ext4: remove redundant checks of s_encoding 2023-08-27 11:27:13 -04:00
ialloc.c ext4: check buffer_verified in advance to avoid unneeded ext4_get_group_info() 2024-09-03 22:12:16 -04:00
indirect.c ext4: update delalloc data reserve spcae in ext4_es_insert_extent() 2024-09-02 15:26:14 -04:00
inline.c Lots of cleanups and bug fixes this cycle, primarily in the block 2024-09-20 19:26:45 -07:00
inode-test.c ext4: add missing MODULE_DESCRIPTION() 2024-07-05 16:07:24 -04:00
inode.c Lots of cleanups and bug fixes this cycle, primarily in the block 2024-09-20 19:26:45 -07:00
ioctl.c introduce fd_file(), convert all accessors to it. 2024-08-12 22:00:43 -04:00
Kconfig fs: add CONFIG_BUFFER_HEAD 2023-08-02 09:13:09 -06:00
Makefile ext4: move ext4 crypto code to its own file crypto.c 2022-05-21 22:24:24 -04:00
mballoc-test.c ext4: add test_mb_mark_used_cost to estimate cost of mb_mark_used 2024-05-03 00:12:32 -04:00
mballoc.c ext4: convert EXT4_B2C(sbi->s_stripe) users to EXT4_NUM_B2C 2024-09-03 22:14:17 -04:00
mballoc.h ext4: convert ac_buddy_page to ac_buddy_folio 2024-05-07 15:38:17 -04:00
migrate.c ext4: fix i_data_sem unlock order in ext4_ind_migrate() 2024-09-03 22:14:17 -04:00
mmp.c ext4: replace read-only check for shutdown check in mmp code 2023-07-29 18:37:53 -04:00
move_extent.c ext4: get rid of ppath in get_ext_path() 2024-09-03 22:12:17 -04:00
namei.c ext4: explicitly exit when ext4_find_inline_entry returns an error 2024-09-03 22:12:16 -04:00
orphan.c ext4: remove trailing newline from ext4_msg() message 2022-12-08 21:49:23 -05:00
page-io.c ext4: remove calls to to set/clear the folio error flag 2024-05-09 00:23:51 -04:00
readpage.c ext4: reduce stack usage in ext4_mpage_readpages() 2024-08-26 21:47:03 -04:00
resize.c ext4: fix off by one issue in alloc_flex_gd() 2024-10-04 17:36:28 -04:00
super.c ext4: check stripe size compatibility on remount as well 2024-09-03 22:14:17 -04:00
symlink.c ext4_get_link(): fix breakage in RCU mode 2024-02-25 02:10:32 -05:00
sysfs.c ext4: add positive int attr pointer to avoid sysfs variables overflow 2024-05-02 23:48:30 -04:00
truncate.h ext4: Convert to use mapping->invalidate_lock 2021-07-13 14:29:00 +02:00
verity.c fs: Convert aops->write_begin to take a folio 2024-08-07 11:33:21 +02:00
xattr_hurd.c fs: port xattr to mnt_idmap 2023-01-19 09:24:28 +01:00
xattr_security.c fs: port xattr to mnt_idmap 2023-01-19 09:24:28 +01:00
xattr_trusted.c fs: port xattr to mnt_idmap 2023-01-19 09:24:28 +01:00
xattr_user.c fs: port xattr to mnt_idmap 2023-01-19 09:24:28 +01:00
xattr.c ext4: mark fc as ineligible using an handle in ext4_xattr_set() 2024-10-04 17:36:09 -04:00
xattr.h ext4: annotate struct ext4_xattr_inode_array with __counted_by() 2024-08-26 23:40:06 -04:00