From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:44849 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1422997AbbD2MLo (ORCPT ); Wed, 29 Apr 2015 08:11:44 -0400 Subject: Patch "Btrfs: fix inode eviction infinite loop after extent_same ioctl" has been added to the 3.19-stable tree To: fdmanana@suse.com, clm@fb.com, gregkh@linuxfoundation.org, osandov@osandov.com Cc: , From: Date: Wed, 29 Apr 2015 14:11:37 +0200 Message-ID: <1430309497234166@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled Btrfs: fix inode eviction infinite loop after extent_same ioctl to the 3.19-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: btrfs-fix-inode-eviction-infinite-loop-after-extent_same-ioctl.patch and it can be found in the queue-3.19 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From 113e8283869b9855c8b999796aadd506bbac155f Mon Sep 17 00:00:00 2001 From: Filipe Manana Date: Mon, 30 Mar 2015 18:26:47 +0100 Subject: Btrfs: fix inode eviction infinite loop after extent_same ioctl From: Filipe Manana commit 113e8283869b9855c8b999796aadd506bbac155f upstream. If we pass a length of 0 to the extent_same ioctl, we end up locking an extent range with a start offset greater then its end offset (if the destination file's offset is greater than zero). This results in a warning from extent_io.c:insert_state through the following call chain: btrfs_extent_same() btrfs_double_lock() lock_extent_range() lock_extent(inode->io_tree, offset, offset + len - 1) lock_extent_bits() __set_extent_bit() insert_state() --> WARN_ON(end < start) This leads to an infinite loop when evicting the inode. This is the same problem that my previous patch titled "Btrfs: fix inode eviction infinite loop after cloning into it" addressed but for the extent_same ioctl instead of the clone ioctl. Signed-off-by: Filipe Manana Reviewed-by: Omar Sandoval Signed-off-by: Chris Mason Signed-off-by: Greg Kroah-Hartman --- fs/btrfs/ioctl.c | 3 +++ 1 file changed, 3 insertions(+) --- a/fs/btrfs/ioctl.c +++ b/fs/btrfs/ioctl.c @@ -2897,6 +2897,9 @@ static int btrfs_extent_same(struct inod if (src == dst) return -EINVAL; + if (len == 0) + return 0; + btrfs_double_lock(src, loff, dst, dst_loff, len); ret = extent_same_check_offsets(src, loff, len); Patches currently in stable-queue which might be from fdmanana@suse.com are queue-3.19/btrfs-fix-log-tree-corruption-when-fs-mounted-with-o-discard.patch queue-3.19/btrfs-fix-inode-eviction-infinite-loop-after-extent_same-ioctl.patch queue-3.19/btrfs-fix-inode-eviction-infinite-loop-after-cloning-into-it.patch