• Mingming Cao's avatar
    [PATCH] ext[34]: EA block reference count racing fix · 8a2bfdcb
    Mingming Cao authored
    There are race issues around ext[34] xattr block release code.
    
    ext[34]_xattr_release_block() checks the reference count of xattr block
    (h_refcount) and frees that xattr block if it is the last one reference it.
     Unlike ext2, the check of this counter is unprotected by any lock.
    ext[34]_xattr_release_block() will free the mb_cache entry before freeing
    that xattr block.  There is a small window between the check for the re
    h_refcount ==1 and the call to mb_cache_entry_free().  During this small
    window another inode might find this xattr block from the mbcache and reuse
    it, racing a refcount updates.  The xattr block will later be freed by the
    first inode without notice other inode is still use it.  Later if that
    block is reallocated as a datablock for other file, then more serious
    problem might happen.
    
    We need put a lock around places checking the refount as well to avoid
    racing issue.  Another place need this kind of protection is in
    ext3_xattr_block_set(), where it will modify the xattr block content in-
    the-fly if the refcount is 1 (means it's the only inode reference it).
    
    This will also fix another issue: the xattr block may not get freed at all
    if no lock is to protect the refcount check at the release time.  It is
    possible that the last two inodes could release the shared xattr block at
    the same time.  But both of them think they are not the last one so only
    decreased the h_refcount without freeing xattr block at all.
    
    We need to call lock_buffer() after ext3_journal_get_write_access() to
    avoid deadlock (because the later will call lock_buffer()/unlock_buffer
    () as well).
    Signed-off-by: default avatarMingming Cao <cmm@us.ibm.com>
    Cc: Andreas Gruenbacher <agruen@suse.de>
    Cc: <linux-ext4@vger.kernel.org>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    8a2bfdcb
xattr.c 34.4 KB