Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

ext2: Fix BUG_ON in evict() on inode deletion

Browse source 
Commit 8e3dffc6 introduced a regression where deleting inode with
large extended attributes leads to triggering
  BUG_ON(inode->i_state != (I_FREEING | I_CLEAR))
in fs/inode.c:evict(). That happens because freeing of xattr block
dirtied the inode and it happened after clear_inode() has been called.

Fix the issue by moving removal of xattr block into ext2_evict_inode()
before clear_inode() call close to a place where data blocks are
truncated. That is also more logical place and removes surprising
requirement that ext2_free_blocks() mustn't dirty the inode.

Reported-by: Tyler Hicks <tyhicks@canonical.com>
Signed-off-by: Jan Kara <jack@suse.cz>
This commit is contained in:
Jan Kara 2013-03-13 12:57:08 +01:00
parent af591ad896
commit c288d29696
2 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
fs/ext2/ialloc.c
View file

@ -118,7 +118,6 @@ void ext2_free_inode (struct inode * inode)
* as writing the quota to disk may need the lock as well. * as writing the quota to disk may need the lock as well.
*/ */
/* Quota is already initialized in iput() */ /* Quota is already initialized in iput() */
ext2_xattr_delete_inode(inode);
dquot_free_inode(inode); dquot_free_inode(inode);
dquot_drop(inode); dquot_drop(inode);

2
fs/ext2/inode.c
View file

@ -34,6 +34,7 @@
#include "ext2.h" #include "ext2.h"
#include "acl.h" #include "acl.h"
#include "xip.h" #include "xip.h"
#include "xattr.h"
static int __ext2_write_inode(struct inode *inode, int do_sync); static int __ext2_write_inode(struct inode *inode, int do_sync);
@ -88,6 +89,7 @@ void ext2_evict_inode(struct inode * inode)
inode->i_size = 0; inode->i_size = 0;
if (inode->i_blocks) if (inode->i_blocks)
ext2_truncate_blocks(inode, 0); ext2_truncate_blocks(inode, 0);
ext2_xattr_delete_inode(inode);
} }
invalidate_inode_buffers(inode); invalidate_inode_buffers(inode);