aboutsummaryrefslogtreecommitdiffstats
path: root/fs/ext4/inode.c
diff options
context:
space:
mode:
authorJan Kara <[email protected]>2025-07-09 08:48:32 +0000
committerTheodore Ts'o <[email protected]>2025-07-18 03:25:21 +0000
commit91b8ca8b26729b729dda8a4eddb9aceaea706f37 (patch)
tree7d69629902d36182c8440a8648cab1b71a063b2f /fs/ext4/inode.c
parentext4: fix inode use after free in ext4_end_io_rsv_work() (diff)
downloadkernel-91b8ca8b26729b729dda8a4eddb9aceaea706f37.tar.gz
kernel-91b8ca8b26729b729dda8a4eddb9aceaea706f37.zip
ext4: Make sure BH_New bit is cleared in ->write_end handler
Currently we clear BH_New bit in case of error and also in the standard ext4_write_end() handler (in block_commit_write()). However ext4_journalled_write_end() misses this clearing and thus we are leaving stale BH_New bits behind. Generally ext4_block_write_begin() clears these bits before any harm can be done but in case blocksize < pagesize and we hit some error when processing a page with these stale bits, we'll try to zero buffers with these stale BH_New bits and jbd2 will complain (as buffers were not prepared for writing in this transaction). Fix the problem by clearing BH_New bits in ext4_journalled_write_end() and WARN if ext4_block_write_begin() sees stale BH_New bits. Reported-by: Baolin Liu <[email protected]> Reported-by: Zhi Long <[email protected]> Fixes: 3910b513fcdf ("ext4: persist the new uptodate buffers in ext4_journalled_zero_new_buffers") Signed-off-by: Jan Kara <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Theodore Ts'o <[email protected]>
Diffstat (limited to 'fs/ext4/inode.c')
-rw-r--r--fs/ext4/inode.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 8bdf2029ebc7..eeccb6f588f9 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1189,7 +1189,7 @@ int ext4_block_write_begin(handle_t *handle, struct folio *folio,
}
continue;
}
- if (buffer_new(bh))
+ if (WARN_ON_ONCE(buffer_new(bh)))
clear_buffer_new(bh);
if (!buffer_mapped(bh)) {
WARN_ON(bh->b_size != blocksize);
@@ -1417,6 +1417,7 @@ static int write_end_fn(handle_t *handle, struct inode *inode,
ret = ext4_dirty_journalled_data(handle, bh);
clear_buffer_meta(bh);
clear_buffer_prio(bh);
+ clear_buffer_new(bh);
return ret;
}