Archive-only list for patches
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	patches@lists.linux.dev, Guanghui Yang <3497809730@qq.com>,
	Jan Kara <jack@suse.cz>, Theodore Tso <tytso@mit.edu>
Subject: [PATCH 6.12 31/77] ext4: propagate errors from fast commit range replay
Date: Tue, 25 Aug 2026 15:25:53 +0200	[thread overview]
Message-ID: <20260825132542.780793654@linuxfoundation.org> (raw)
In-Reply-To: <20260825132541.580275153@linuxfoundation.org>

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Guanghui Yang <3497809730@qq.com>

commit d8b8dd3530bf41e14b118702cdaf9de64bb96885 upstream.

ext4_fc_replay() stops replaying fast commit tags only when a tag
handler returns a negative error. However, ext4_fc_replay_add_range()
and ext4_fc_replay_del_range() currently return 0 from their common
exit paths even after internal failures.

This hides errors from ext4_fc_record_modified_inode(),
ext4_map_blocks(), ext4_find_extent(), ext4_ext_insert_extent(),
ext4_ext_replay_update_ex(), and ext4_ext_remove_space(). As a result,
a failed ADD_RANGE or DEL_RANGE replay can be treated as successful and
the replay code may continue with subsequent fast commit tags.

This is particularly problematic for DEL_RANGE because it may already
have marked blocks as free before ext4_ext_remove_space() fails. If the
error is swallowed, replay may continue from a partially applied range
operation.

Return the saved error from the common exit paths and make the
ERR_PTR() cases in ADD_RANGE store PTR_ERR() before jumping to out.

Fixes: 8016e29f4362 ("ext4: fast commit recovery path")
Cc: stable@vger.kernel.org
Signed-off-by: Guanghui Yang <3497809730@qq.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/tencent_E3622146846A84C75C31C7D32AC4D5AD0605@qq.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/fast_commit.c |   16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

--- a/fs/ext4/fast_commit.c
+++ b/fs/ext4/fast_commit.c
@@ -1799,8 +1799,11 @@ static int ext4_fc_replay_add_range(stru
 		if (ret == 0) {
 			/* Range is not mapped */
 			path = ext4_find_extent(inode, cur, path, 0);
-			if (IS_ERR(path))
+			if (IS_ERR(path)) {
+				ret = PTR_ERR(path);
+				path = NULL;
 				goto out;
+			}
 			memset(&newex, 0, sizeof(newex));
 			newex.ee_block = cpu_to_le32(cur);
 			ext4_ext_store_pblock(
@@ -1812,8 +1815,11 @@ static int ext4_fc_replay_add_range(stru
 			path = ext4_ext_insert_extent(NULL, inode,
 						      path, &newex, 0);
 			up_write((&EXT4_I(inode)->i_data_sem));
-			if (IS_ERR(path))
+			if (IS_ERR(path)) {
+				ret = PTR_ERR(path);
+				path = NULL;
 				goto out;
+			}
 			goto next;
 		}
 
@@ -1860,10 +1866,11 @@ next:
 	}
 	ext4_ext_replay_shrink_inode(inode, i_size_read(inode) >>
 					sb->s_blocksize_bits);
+	ret = 0;
 out:
 	ext4_free_ext_path(path);
 	iput(inode);
-	return 0;
+	return ret;
 }
 
 /* Replay DEL_RANGE tag */
@@ -1924,9 +1931,10 @@ ext4_fc_replay_del_range(struct super_bl
 	ext4_ext_replay_shrink_inode(inode,
 		i_size_read(inode) >> sb->s_blocksize_bits);
 	ext4_mark_inode_dirty(NULL, inode);
+	ret = 0;
 out:
 	iput(inode);
-	return 0;
+	return ret;
 }
 
 static void ext4_fc_set_bitmaps_and_counters(struct super_block *sb)



  parent reply	other threads:[~2026-08-25 13:44 UTC|newest]

Thread overview: 86+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-25 13:25 [PATCH 6.12 00/77] 6.12.106-rc1 review Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 01/77] PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 02/77] Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 03/77] ALSA: scarlett2: Use a private URB for the notification endpoint Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 04/77] rndis_host: add overflow check in rndis_rx_fixup() Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 05/77] gpio: ml-ioh: use raw_spinlock_t for the register lock Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 06/77] gve: fix zero-length skb frag with header-split Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 07/77] hwmon: (ltc4286) Fix symbol namespace of MODULE_IMPORT_NS() Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 08/77] netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 09/77] inet: frags: add inet_frag_putn() helper Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 10/77] ipv4: frags: remove ipq_put() Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 11/77] inet: frags: change inet_frag_kill() to defer refcount updates Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 12/77] inet: frags: save a pair of atomic operations in reassembly Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 13/77] inet: frags: publish queues before arming timer Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 14/77] serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 15/77] NTB: ntb_netdev: Preserve RX queue depth on allocation failure Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 16/77] serial: amba-pl011: synchronize DMA teardown Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 17/77] serial: sc16is7xx: rename EFR mutex with generic name Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 18/77] serial: sc16is7xx: use guards for simple mutex locks Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 19/77] serial: sc16is7xx: enable THRI before filling TX FIFO Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 20/77] xfs: namespace the maximum length/refcount symbols Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 21/77] xfs: dont use a xfs_log_iovec for ri_buf in log recovery Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 22/77] xfs: bounds-check buffer log items dirty bitmap Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 23/77] xfs: hoist per-bucket unlinked list check to helper Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 24/77] xfs: dont livelock in scrub on a circular unlinked list Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 25/77] ALSA: dummy: Check card index validity at probe Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 26/77] ocfs2: fix missing metadata reservation for large xattrs Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 27/77] null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 28/77] kcov: fix data corruption and race conditions on PREEMPT_RT Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 29/77] ext4: stop retrying saturated xattr cache entries Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 30/77] ext4: clear error before retrying inode xattr space fallback Greg Kroah-Hartman
2026-08-25 13:25 ` Greg Kroah-Hartman [this message]
2026-08-25 13:25 ` [PATCH 6.12 32/77] xfs: validate attr entry pointer before field access Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 33/77] libceph: fix OOB read in decode_watchers() via missing bounds check Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 34/77] nfc: digital: clamp SENSF_RES length to the destination buffer Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 35/77] nfc: fdp: bound the device-reported read length and fix an skb leak Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 36/77] nfc: microread: validate target discovery payload lengths Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.12 37/77] nfc: llcp: bound the connect_sn TLV walk to the skb Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 38/77] nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 39/77] nfc: llcp: reject PDUs shorter than the LLCP header Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 40/77] nfc: pn533: purge fragmented skbs during cleanup Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 41/77] nfc: st21nfca: validate ATR_REQ length against the received frame Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 42/77] nfc: nci: fix out-of-bounds write in nci_target_auto_activated() Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 43/77] nfc: nci: fix uninit-value in the RF discover/activated NTF handlers Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 44/77] nfc: nci: free destination parameters when closing a connection Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 45/77] ndisc: ndisc_send_redirect() cleanup Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 46/77] Input: byd - synchronize timer deletion before freeing private data Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 47/77] ipv4: reject undersized MTUs in ip_do_fragment() Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 48/77] ipv6: fix use-after-free in ip6_finish_output2() Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 49/77] nvmet-auth: zero the AUTH_RECEIVE response buffer Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 50/77] nvmet-fc: fix invalid free in LS IOD error path Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 51/77] nvmet-tcp: bound SGL data length before allocating command buffers Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 52/77] nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 53/77] selinux: require a classs permission values to cover its permission count Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 54/77] mptcp: pm: fix data race in add_addr timer callback Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 55/77] ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 56/77] drm/xe: Fix DPT allocation paths Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 57/77] HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 58/77] HID: magicmouse: re-enable multitouch after reset-resume Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 59/77] HID: magicmouse: do not keep a stale msc->input if no input is claimed Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 60/77] HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 61/77] HID: core: fix OOB read of field->usage in hid_set_field() Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 62/77] net/ionic: avoid OOB TX partner lookup for hwstamp RXQ Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 63/77] xfrm: fix sk_dst_cache double-free in xfrm_user_policy() Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 64/77] ipv4: start using dst_dev_rcu() Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 65/77] mptcp: pm: fix memory leak from alloc-during-teardown race Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 66/77] Input: atkbd - skip deactivate for HONOR FMB-Ps internal keyboard Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 67/77] Input: atkbd - skip deactivate for HONOR ZQC-P Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 68/77] HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 69/77] HID: nintendo: register input device after capabilities are set Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 70/77] HID: nintendo: stop device IO before hid_hw_stop on probe failure Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 71/77] HID: core: fix number/pointer type confusion on long items Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 72/77] HID: sensor: custom: Fix use-after-free in enable_sensor Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 73/77] HID: hyperv: validate initial device info bounds Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 74/77] Bluetooth: hci_event: fix LE list UAF on reset Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 75/77] Bluetooth: hci_event: validate LE Set CIG Parameters response Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 76/77] Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.12 77/77] Bluetooth: hci_aml: validate firmware segment lengths Greg Kroah-Hartman
2026-08-25 22:32 ` [PATCH 6.12 00/77] 6.12.106-rc1 review Florian Fainelli
2026-08-26  0:09 ` Shuah Khan
2026-08-26  6:14 ` Ron Economos
2026-08-26  6:38 ` Pavel Machek
2026-08-26  7:33 ` Dominique Martinet
2026-08-26 10:32 ` Brett A C Sheffield
2026-08-26 11:56 ` Miguel Ojeda
2026-08-26 13:09 ` Peter Schneider

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260825132542.780793654@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=3497809730@qq.com \
    --cc=jack@suse.cz \
    --cc=patches@lists.linux.dev \
    --cc=stable@vger.kernel.org \
    --cc=tytso@mit.edu \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox