lkml.org 
[lkml]   [2021]   [Oct]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH -next v2 4/6] ext4: avoid to re-read mmp check data get from page cache
From
Date


On 2021/10/7 20:44, Jan Kara wrote:
> On Sat 11-09-21 17:00:57, Ye Bin wrote:
>> As call read_mmp_block pass bh_check which value is NULL, then call
>> sb_getblk to get buffer_head. But mmp_block's buffer_head is already exist
>> which also is uptodate. Lead to compare the same data.
>>
>> Signed-off-by: Ye Bin <yebin10@huawei.com>
> This looks good, except that read_mmp_block() also releases bh it is passed
> in case of error. So it can free buffer head which is still referenced from
> EXT4_SB(sb)->s_mmp_bh and cause use-after-free issues.
>
> I guess I would just get rid of sb_getblk() in read_mmp_block() and always
> expect valid bh passed. The only place that passes NULL bh after this
> patch is one case in ext4_multi_mount_protect() and that can call
> sb_getblk() on its own. That way we can also simplify read_mmp_block()
> prototype to:
>
> static int read_mmp_block(struct super_block *sb, struct buffer_head *bh);
>
> Honza
> Yeah, I will refactor 'read_mmp_block'.
>> ---
>> fs/ext4/mmp.c | 17 ++++++-----------
>> 1 file changed, 6 insertions(+), 11 deletions(-)
>>
>> diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c
>> index 4433fe7e9e86..007bde3c12b8 100644
>> --- a/fs/ext4/mmp.c
>> +++ b/fs/ext4/mmp.c
>> @@ -213,10 +213,7 @@ static int kmmpd(void *data)
>> * we need to check if the MMP block is as we write it.
>> */
>> if (jiffies - last_check_time > mmp_check_interval * HZ) {
>> - struct buffer_head *bh_check = NULL;
>> - struct mmp_struct *mmp_check;
>> -
>> - retval = read_mmp_block(sb, &bh_check, mmp_block);
>> + retval = read_mmp_block(sb, &bh, mmp_block);
>> if (retval) {
>> ext4_error_err(sb, -retval,
>> "error reading MMP data: %d",
>> @@ -224,20 +221,18 @@ static int kmmpd(void *data)
>> goto wait_to_exit;
>> }
>>
>> - mmp_check = (struct mmp_struct *)(bh_check->b_data);
>> - if (seq != mmp_check->mmp_seq ||
>> - memcmp(nodename, mmp_check->mmp_nodename,
>> - sizeof(mmp->mmp_nodename))) {
>> - dump_mmp_msg(sb, mmp_check,
>> + mmp = (struct mmp_struct *)(bh->b_data);
>> + if (seq != le32_to_cpu(mmp->mmp_seq) ||
>> + memcmp(nodename, mmp->mmp_nodename,
>> + sizeof(nodename))) {
>> + dump_mmp_msg(sb, mmp,
>> "Error while updating MMP info. "
>> "The filesystem seems to have been"
>> " multiply mounted.");
>> ext4_error_err(sb, EBUSY, "abort");
>> - put_bh(bh_check);
>> retval = -EBUSY;
>> goto wait_to_exit;
>> }
>> - put_bh(bh_check);
>> last_check_time = jiffies;
>> }
>>
>> --
>> 2.31.1
>>

\
 
 \ /
  Last update: 2021-10-08 05:53    [W:0.726 / U:0.008 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site