From: Chandan Rajendra chandan@linux.ibm.com
mainline inclusion from mainline-5.4-rc1 commit 547b9ad698b434eadca46319cb47e5875b55ef03 category: bugfix bugzilla: 23039 CVE: NA ---------------------------
When executing generic/388 on a ppc64le machine, we notice the following call trace,
VFS: brelse: Trying to free free buffer WARNING: CPU: 0 PID: 6637 at /root/repos/linux/fs/buffer.c:1195 __brelse+0x84/0xc0
Call Trace: __brelse+0x80/0xc0 (unreliable) invalidate_bh_lru+0x78/0xc0 on_each_cpu_mask+0xa8/0x130 on_each_cpu_cond_mask+0x130/0x170 invalidate_bh_lrus+0x44/0x60 invalidate_bdev+0x38/0x70 ext4_put_super+0x294/0x560 generic_shutdown_super+0xb0/0x170 kill_block_super+0x38/0xb0 deactivate_locked_super+0xa4/0xf0 cleanup_mnt+0x164/0x1d0 task_work_run+0x110/0x160 do_notify_resume+0x414/0x460 ret_from_except_lite+0x70/0x74
The warning happens because flush_descriptor() drops bh reference it does not own. The bh reference acquired by jbd2_journal_get_descriptor_buffer() is owned by the log_bufs list and gets released when this list is processed. The reference for doing IO is only acquired in write_dirty_buffer() later in flush_descriptor().
Reported-by: Harish Sriram harish@linux.ibm.com Reviewed-by: Jan Kara jack@suse.cz Signed-off-by: Chandan Rajendra chandan@linux.ibm.com Signed-off-by: Theodore Ts'o tytso@mit.edu
Signed-off-by: zhangyi (F) yi.zhang@huawei.com Reviewed-by: Zhang Xiaoxu zhangxiaoxu5@huawei.com Signed-off-by: Yang Yingliang yangyingliang@huawei.com --- fs/jbd2/revoke.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/fs/jbd2/revoke.c b/fs/jbd2/revoke.c index 5f438dc..fa60878 100644 --- a/fs/jbd2/revoke.c +++ b/fs/jbd2/revoke.c @@ -644,10 +644,8 @@ static void flush_descriptor(journal_t *journal, { jbd2_journal_revoke_header_t *header;
- if (is_journal_aborted(journal)) { - put_bh(descriptor); + if (is_journal_aborted(journal)) return; - }
header = (jbd2_journal_revoke_header_t *)descriptor->b_data; header->r_count = cpu_to_be32(offset);