From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <stable-owner@vger.kernel.org>
Received: from imap.thunk.org ([74.207.234.97]:34202 "EHLO imap.thunk.org"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1756566AbcB0SQn (ORCPT <rfc822;stable@vger.kernel.org>);
	Sat, 27 Feb 2016 13:16:43 -0500
Date: Sat, 27 Feb 2016 13:16:34 -0500
From: Theodore Ts'o <tytso@mit.edu>
To: Nikolay Borisov <kernel@kyup.com>
Cc: stable@vger.kernel.org, jack@suse.com, gregkh@linuxfoundation.org,
	Jan Kara <jack@suse.cz>
Subject: Re: [PATCH] ext4: fix bh->b_state corruption
Message-ID: <20160227181634.GA15325@thunk.org>
References: <1456299139-30433-1-git-send-email-kernel@kyup.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1456299139-30433-1-git-send-email-kernel@kyup.com>
Sender: stable-owner@vger.kernel.org
List-ID: <stable.vger.kernel.org>

On Wed, Feb 24, 2016 at 09:32:19AM +0200, Nikolay Borisov wrote:
> From: Jan Kara <jack@suse.com>
> 
> commit ed8ad83808f009ade97ebbf6519bc3a97fefbc0c upstream
> 
> ext4 can update bh->b_state non-atomically in _ext4_get_block() and
> ext4_da_get_block_prep(). Usually this is fine since bh is just a
> temporary storage for mapping information on stack but in some cases it
> can be fully living bh attached to a page. In such case non-atomic
> update of bh->b_state can race with an atomic update which then gets
> lost. Usually when we are mapping bh and thus updating bh->b_state
> non-atomically, nobody else touches the bh and so things work out fine
> but there is one case to especially worry about: ext4_finish_bio() uses
> BH_Uptodate_Lock on the first bh in the page to synchronize handling of
> PageWriteback state. So when blocksize < pagesize, we can be atomically
> modifying bh->b_state of a buffer that actually isn't under IO and thus
> can race e.g. with delalloc trying to map that buffer. The result is
> that we can mistakenly set / clear BH_Uptodate_Lock bit resulting in the
> corruption of PageWriteback state or missed unlock of BH_Uptodate_Lock.
> 
> Fix the problem by always updating bh->b_state bits atomically.
> 
> CC: stable@vger.kernel.org
> Reported-by: Nikolay Borisov <kernel@kyup.com>
> Signed-off-by: Jan Kara <jack@suse.cz>
> Signed-off-by: Theodore Ts'o <tytso@mit.edu>
> Signed-off-by: Nikolay Borisov <kernel@kyup.com>
> [NB: Backported to 4.4.2]

Acked-by: Theodore Ts'o <tytso@mit.edu>

(This failed the auto backport to the 4.4 stable branch; thanks to
Nikolay for backporting it.)

						- Ted