Re: [RFC PATCH -v2 8/9] ext4: Fix double free of blocks

["Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>]

On Tue, Nov 04, 2008 at 11:46:04AM -0500, Theodore Tso wrote:
> On Mon, Nov 03, 2008 at 11:06:08PM +0530, Aneesh Kumar K.V wrote:
> > blocks freed but not yet committed will be marked free
> > in disk bitmap. We need to consider them as used when
> > releasing inode prealloc space. Otherwise we would
> > double free them via mb_free_blocks
> 
> Stupid question...   
> 
> Blocks that are added to an inode's preallocation list were initially
> free, right?  And once they are in the inode's preallocation they are
> marked in use by mballoc, so they can't be allocated for another
> inode.  If a block in the preallocation list is used, it's removed
> from the preallocation line.  So even if that inode is subsequented
> unlinked or truncated, I'm curious how the double free situation
> happens in the first place.
> 
> What am I missing?
> 

We we discard  inode preallocation we look at the block bitmap
and mark the blocks found free in the bitmap using mb_free_blocks.
Now if we  allocate some blocks and later free some of them we would
have called ext4_mb_free blocks on them which mean we would have
marked the blocks free on bitmap. Now on file close we release
inode pa. We look at the block bitmap and if the block is free
in bitmap we call mb_free_blocks. Also on committing the transaction we
call mb_free_blocks on them. To avoid the above we need to make sure
when we discard_inode_pa we look at a bitmap that have block freed
and not yet committed as used.

-aneesh