Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git...

Pull ext4 fixes from Ted Ts'o:
 "Some bug fixes, and an update to the URL's for the final version of
  Unicode 12.1.0"

* tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
  ext4: avoid panic during forced reboot due to aborted journal
  ext4: fix block validity checks for journal inodes using indirect blocks
  unicode: update to Unicode 12.1.0 final
  unicode: add missing check for an error return from utf8lookup()
  ext4: fix miscellaneous sparse warnings
  ext4: unsigned int compared against zero
  ext4: fix use-after-free in dx_release()
  ext4: fix data corruption caused by overlapping unaligned and aligned IO
  jbd2: fix potential double free
  ext4: zero out the unused memory region in the extent tree block

diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c
index 968f163b5febe0583fea3b2557dd0efec7266460..8e83741b02e031c197887fedb52b52e32209d1f3 100644 (file)
--- a/fs/ext4/block_validity.c
+++ b/fs/ext4/block_validity.c
@@ -142,7 +142,8 @@ static int ext4_protect_reserved_inode(struct super_block *sb, u32 ino)
        struct inode *inode;
        struct ext4_sb_info *sbi = EXT4_SB(sb);
        struct ext4_map_blocks map;
-       u32 i = 0, err = 0, num, n;
+       u32 i = 0, num;
+       int err = 0, n;
 
        if ((ino < EXT4_ROOT_INO) ||
            (ino > le32_to_cpu(sbi->s_es->s_inodes_count)))
@@ -276,6 +277,11 @@ int ext4_check_blockref(const char *function, unsigned int line,
        __le32 *bref = p;
        unsigned int blk;
 
+       if (ext4_has_feature_journal(inode->i_sb) &&
+           (inode->i_ino ==
+            le32_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_journal_inum)))
+               return 0;
+
        while (bref < p+max) {
                blk = le32_to_cpu(*bref++);
                if (blk &&

diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 0f89f5190cd7241aa1b6da7d878816d6787a52db..f2c62e2a0c982f46398e7a81b8657c535c10b272 100644 (file)
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -1035,6 +1035,7 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
        __le32 border;
        ext4_fsblk_t *ablocks = NULL; /* array of allocated blocks */
        int err = 0;
+       size_t ext_size = 0;
 
        /* make decision: where to split? */
        /* FIXME: now decision is simplest: at current extent */
@@ -1126,6 +1127,10 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
                le16_add_cpu(&neh->eh_entries, m);
        }
 
+       /* zero out unused area in the extent block */
+       ext_size = sizeof(struct ext4_extent_header) +
+               sizeof(struct ext4_extent) * le16_to_cpu(neh->eh_entries);
+       memset(bh->b_data + ext_size, 0, inode->i_sb->s_blocksize - ext_size);
        ext4_extent_block_csum_set(inode, neh);
        set_buffer_uptodate(bh);
        unlock_buffer(bh);
@@ -1205,6 +1210,11 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
                                sizeof(struct ext4_extent_idx) * m);
                        le16_add_cpu(&neh->eh_entries, m);
                }
+               /* zero out unused area in the extent block */
+               ext_size = sizeof(struct ext4_extent_header) +
+                  (sizeof(struct ext4_extent) * le16_to_cpu(neh->eh_entries));
+               memset(bh->b_data + ext_size, 0,
+                       inode->i_sb->s_blocksize - ext_size);
                ext4_extent_block_csum_set(inode, neh);
                set_buffer_uptodate(bh);
                unlock_buffer(bh);
@@ -1270,6 +1280,7 @@ static int ext4_ext_grow_indepth(handle_t *handle, struct inode *inode,
        ext4_fsblk_t newblock, goal = 0;
        struct ext4_super_block *es = EXT4_SB(inode->i_sb)->s_es;
        int err = 0;
+       size_t ext_size = 0;
 
        /* Try to prepend new index to old one */
        if (ext_depth(inode))
@@ -1295,9 +1306,11 @@ static int ext4_ext_grow_indepth(handle_t *handle, struct inode *inode,
                goto out;
        }
 
+       ext_size = sizeof(EXT4_I(inode)->i_data);
        /* move top-level index/leaf into new block */
-       memmove(bh->b_data, EXT4_I(inode)->i_data,
-               sizeof(EXT4_I(inode)->i_data));
+       memmove(bh->b_data, EXT4_I(inode)->i_data, ext_size);
+       /* zero out unused area in the extent block */
+       memset(bh->b_data + ext_size, 0, inode->i_sb->s_blocksize - ext_size);
 
        /* set size of new block */
        neh = ext_block_hdr(bh);

diff --git a/fs/ext4/file.c b/fs/ext4/file.c
index 98ec11f69cd4d0d50abbaf14b6fd82224a10e6d0..2c5baa5e8291165e07d5609b650c38c13eda587f 100644 (file)
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -264,6 +264,13 @@ ext4_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
        }
 
        ret = __generic_file_write_iter(iocb, from);
+       /*
+        * Unaligned direct AIO must be the only IO in flight. Otherwise
+        * overlapping aligned IO after unaligned might result in data
+        * corruption.
+        */
+       if (ret == -EIOCBQUEUED && unaligned_aio)
+               ext4_unwritten_wait(inode);
        inode_unlock(inode);
 
        if (ret > 0)

diff --git a/fs/ext4/fsmap.c b/fs/ext4/fsmap.c
index 4b99e2db95b8bca58e99f8629ecfce17417e25d3..dbccf46f177091ebb981e2cf9cb4c2fde951f9b9 100644 (file)
--- a/fs/ext4/fsmap.c
+++ b/fs/ext4/fsmap.c
@@ -626,7 +626,7 @@ int ext4_getfsmap(struct super_block *sb, struct ext4_fsmap_head *head,
 {
        struct ext4_fsmap dkeys[2];     /* per-dev keys */
        struct ext4_getfsmap_dev handlers[EXT4_GETFSMAP_DEVS];
-       struct ext4_getfsmap_info info = {0};
+       struct ext4_getfsmap_info info = { NULL };
        int i;
        int error = 0;
 

diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index 7e85ecf0b849f4a72d74f207da0de7a0138e8fda..e486e49b31ed7ac7e0db17f0e4205e51fb67538d 100644 (file)
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -608,7 +608,7 @@ static int ext4_getfsmap_format(struct ext4_fsmap *xfm, void *priv)
 static int ext4_ioc_getfsmap(struct super_block *sb,
                             struct fsmap_head __user *arg)
 {
-       struct getfsmap_info info = {0};
+       struct getfsmap_info info = { NULL };
        struct ext4_fsmap_head xhead = {0};
        struct fsmap_head head;
        bool aborted = false;

diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 6d50f53b7a1512bac9ef2f138ed371ed3b54fae7..cd01c4a67ffbd170567a1ab5ca07adb07a05aeb2 100644 (file)
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -872,12 +872,15 @@ static void dx_release(struct dx_frame *frames)
 {
        struct dx_root_info *info;
        int i;
+       unsigned int indirect_levels;
 
        if (frames[0].bh == NULL)
                return;
 
        info = &((struct dx_root *)frames[0].bh->b_data)->info;
-       for (i = 0; i <= info->indirect_levels; i++) {
+       /* save local copy, "info" may be freed after brelse() */
+       indirect_levels = info->indirect_levels;
+       for (i = 0; i <= indirect_levels; i++) {
                if (frames[i].bh == NULL)
                        break;
                brelse(frames[i].bh);

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index f71b5254a990a48833c63bd36d105c1806e52ab4..4079605d437ae7c34cce2f2073cac5d25a8997c5 100644 (file)
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -699,7 +699,7 @@ void __ext4_abort(struct super_block *sb, const char *function,
                        jbd2_journal_abort(EXT4_SB(sb)->s_journal, -EIO);
                save_error_info(sb, function, line);
        }
-       if (test_opt(sb, ERRORS_PANIC)) {
+       if (test_opt(sb, ERRORS_PANIC) && !system_going_down()) {
                if (EXT4_SB(sb)->s_journal &&
                  !(EXT4_SB(sb)->s_journal->j_flags & JBD2_REC_ERR))
                        return;
@@ -4661,7 +4661,7 @@ failed_mount:
 
 #ifdef CONFIG_QUOTA
        for (i = 0; i < EXT4_MAXQUOTAS; i++)
-               kfree(sbi->s_qf_names[i]);
+               kfree(get_qf_name(sb, sbi, i));
 #endif
        ext4_blkdev_remove(sbi);
        brelse(bh);

diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 37e16d969925683bfc03d9a020396cbe2ec55756..43df0c943229ca8fe3c41594ee61548979fc0399 100644 (file)
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -2375,22 +2375,19 @@ static struct kmem_cache *jbd2_journal_head_cache;
 static atomic_t nr_journal_heads = ATOMIC_INIT(0);
 #endif
 
-static int jbd2_journal_init_journal_head_cache(void)
+static int __init jbd2_journal_init_journal_head_cache(void)
 {
-       int retval;
-
-       J_ASSERT(jbd2_journal_head_cache == NULL);
+       J_ASSERT(!jbd2_journal_head_cache);
        jbd2_journal_head_cache = kmem_cache_create("jbd2_journal_head",
                                sizeof(struct journal_head),
                                0,              /* offset */
                                SLAB_TEMPORARY | SLAB_TYPESAFE_BY_RCU,
                                NULL);          /* ctor */
-       retval = 0;
        if (!jbd2_journal_head_cache) {
-               retval = -ENOMEM;
                printk(KERN_EMERG "JBD2: no memory for journal_head cache\n");
+               return -ENOMEM;
        }
-       return retval;
+       return 0;
 }
 
 static void jbd2_journal_destroy_journal_head_cache(void)
@@ -2636,28 +2633,38 @@ static void __exit jbd2_remove_jbd_stats_proc_entry(void)
 
 struct kmem_cache *jbd2_handle_cache, *jbd2_inode_cache;
 
+static int __init jbd2_journal_init_inode_cache(void)
+{
+       J_ASSERT(!jbd2_inode_cache);
+       jbd2_inode_cache = KMEM_CACHE(jbd2_inode, 0);
+       if (!jbd2_inode_cache) {
+               pr_emerg("JBD2: failed to create inode cache\n");
+               return -ENOMEM;
+       }
+       return 0;
+}
+
 static int __init jbd2_journal_init_handle_cache(void)
 {
+       J_ASSERT(!jbd2_handle_cache);
        jbd2_handle_cache = KMEM_CACHE(jbd2_journal_handle, SLAB_TEMPORARY);
-       if (jbd2_handle_cache == NULL) {
+       if (!jbd2_handle_cache) {
                printk(KERN_EMERG "JBD2: failed to create handle cache\n");
                return -ENOMEM;
        }
-       jbd2_inode_cache = KMEM_CACHE(jbd2_inode, 0);
-       if (jbd2_inode_cache == NULL) {
-               printk(KERN_EMERG "JBD2: failed to create inode cache\n");
-               kmem_cache_destroy(jbd2_handle_cache);
-               return -ENOMEM;
-       }
        return 0;
 }
 
+static void jbd2_journal_destroy_inode_cache(void)
+{
+       kmem_cache_destroy(jbd2_inode_cache);
+       jbd2_inode_cache = NULL;
+}
+
 static void jbd2_journal_destroy_handle_cache(void)
 {
        kmem_cache_destroy(jbd2_handle_cache);
        jbd2_handle_cache = NULL;
-       kmem_cache_destroy(jbd2_inode_cache);
-       jbd2_inode_cache = NULL;
 }
 
 /*
@@ -2668,11 +2675,15 @@ static int __init journal_init_caches(void)
 {
        int ret;
 
-       ret = jbd2_journal_init_revoke_caches();
+       ret = jbd2_journal_init_revoke_record_cache();
+       if (ret == 0)
+               ret = jbd2_journal_init_revoke_table_cache();
        if (ret == 0)
                ret = jbd2_journal_init_journal_head_cache();
        if (ret == 0)
                ret = jbd2_journal_init_handle_cache();
+       if (ret == 0)
+               ret = jbd2_journal_init_inode_cache();
        if (ret == 0)
                ret = jbd2_journal_init_transaction_cache();
        return ret;
@@ -2680,9 +2691,11 @@ static int __init journal_init_caches(void)
 
 static void jbd2_journal_destroy_caches(void)
 {
-       jbd2_journal_destroy_revoke_caches();
+       jbd2_journal_destroy_revoke_record_cache();
+       jbd2_journal_destroy_revoke_table_cache();
        jbd2_journal_destroy_journal_head_cache();
        jbd2_journal_destroy_handle_cache();
+       jbd2_journal_destroy_inode_cache();
        jbd2_journal_destroy_transaction_cache();
        jbd2_journal_destroy_slabs();
 }

diff --git a/fs/jbd2/revoke.c b/fs/jbd2/revoke.c
index a1143e57a718ee20c83b0c813fb13425beff2d16..69b9bc329964f7c91f2ec2da4845d9fbeafc80a2 100644 (file)
--- a/fs/jbd2/revoke.c
+++ b/fs/jbd2/revoke.c
@@ -178,33 +178,41 @@ static struct jbd2_revoke_record_s *find_revoke_record(journal_t *journal,
        return NULL;
 }
 
-void jbd2_journal_destroy_revoke_caches(void)
+void jbd2_journal_destroy_revoke_record_cache(void)
 {
        kmem_cache_destroy(jbd2_revoke_record_cache);
        jbd2_revoke_record_cache = NULL;
+}
+
+void jbd2_journal_destroy_revoke_table_cache(void)
+{
        kmem_cache_destroy(jbd2_revoke_table_cache);
        jbd2_revoke_table_cache = NULL;
 }
 
-int __init jbd2_journal_init_revoke_caches(void)
+int __init jbd2_journal_init_revoke_record_cache(void)
 {
        J_ASSERT(!jbd2_revoke_record_cache);
-       J_ASSERT(!jbd2_revoke_table_cache);
-
        jbd2_revoke_record_cache = KMEM_CACHE(jbd2_revoke_record_s,
                                        SLAB_HWCACHE_ALIGN|SLAB_TEMPORARY);
-       if (!jbd2_revoke_record_cache)
-               goto record_cache_failure;
 
+       if (!jbd2_revoke_record_cache) {
+               pr_emerg("JBD2: failed to create revoke_record cache\n");
+               return -ENOMEM;
+       }
+       return 0;
+}
+
+int __init jbd2_journal_init_revoke_table_cache(void)
+{
+       J_ASSERT(!jbd2_revoke_table_cache);
        jbd2_revoke_table_cache = KMEM_CACHE(jbd2_revoke_table_s,
                                             SLAB_TEMPORARY);
-       if (!jbd2_revoke_table_cache)
-               goto table_cache_failure;
-       return 0;
-table_cache_failure:
-       jbd2_journal_destroy_revoke_caches();
-record_cache_failure:
+       if (!jbd2_revoke_table_cache) {
+               pr_emerg("JBD2: failed to create revoke_table cache\n");
                return -ENOMEM;
+       }
+       return 0;
 }
 
 static struct jbd2_revoke_table_s *jbd2_journal_init_revoke_table(int hash_size)

diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index f940d31c2adc5553365160279f5ddd2e3e62c05e..8ca4fddc705fe999b80f90cf4968001af443f72c 100644 (file)
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -42,9 +42,11 @@ int __init jbd2_journal_init_transaction_cache(void)
                                        0,
                                        SLAB_HWCACHE_ALIGN|SLAB_TEMPORARY,
                                        NULL);
-       if (transaction_cache)
-               return 0;
-       return -ENOMEM;
+       if (!transaction_cache) {
+               pr_emerg("JBD2: failed to create transaction cache\n");
+               return -ENOMEM;
+       }
+       return 0;
 }
 
 void jbd2_journal_destroy_transaction_cache(void)

diff --git a/fs/unicode/README.utf8data b/fs/unicode/README.utf8data
index 9307cf0727de6494251fcf00e3b850ea7c08b7c9..c73786807d3b069d0266752d857a9fff344543fb 100644 (file)
--- a/fs/unicode/README.utf8data
+++ b/fs/unicode/README.utf8data
@@ -5,29 +5,15 @@ The full set of files can be found here:
 
   http://www.unicode.org/Public/12.1.0/ucd/
 
-Note!
-
-The URL's listed below are not stable.  That's because Unicode 12.1.0
-has not been officially released yet; it is scheduled to be released
-on May 8, 2019.  We taking Unicode 12.1.0 a few weeks early because it
-contains a new Japanese character which is required in order to
-specify Japenese dates after May 1, 2019, when Crown Prince Naruhito
-ascends to the Chrysanthemum Throne.  (Isn't internationalization fun?
-The abdication of Emperor Akihito of Japan is requiring dozens of
-software packages to be updated with only a month's notice.  :-)
-
-We will update the URL's (and any needed changes to the checksums)
-after the final Unicode 12.1.0 is released.
-
 Individual source links:
 
-  https://www.unicode.org/Public/12.1.0/ucd/CaseFolding-12.1.0d2.txt
-  https://www.unicode.org/Public/12.1.0/ucd/DerivedAge-12.1.0d3.txt
-  https://www.unicode.org/Public/12.1.0/ucd/extracted/DerivedCombiningClass-12.1.0d2.txt
-  https://www.unicode.org/Public/12.1.0/ucd/DerivedCoreProperties-12.1.0d2.txt
-  https://www.unicode.org/Public/12.1.0/ucd/NormalizationCorrections-12.1.0d1.txt
-  https://www.unicode.org/Public/12.1.0/ucd/NormalizationTest-12.1.0d3.txt
-  https://www.unicode.org/Public/12.1.0/ucd/UnicodeData-12.1.0d2.txt
+  https://www.unicode.org/Public/12.1.0/ucd/CaseFolding.txt
+  https://www.unicode.org/Public/12.1.0/ucd/DerivedAge.txt
+  https://www.unicode.org/Public/12.1.0/ucd/extracted/DerivedCombiningClass.txt
+  https://www.unicode.org/Public/12.1.0/ucd/DerivedCoreProperties.txt
+  https://www.unicode.org/Public/12.1.0/ucd/NormalizationCorrections.txt
+  https://www.unicode.org/Public/12.1.0/ucd/NormalizationTest.txt
+  https://www.unicode.org/Public/12.1.0/ucd/UnicodeData.txt
 
 md5sums (verify by running "md5sum -c README.utf8data"):
 

diff --git a/fs/unicode/utf8-norm.c b/fs/unicode/utf8-norm.c
index 20d440c3f2db26a5f1dfe41d6ae8fcca2caac935..801ed6d2ea3788a5c518d86c9336bd573dfe506c 100644 (file)
--- a/fs/unicode/utf8-norm.c
+++ b/fs/unicode/utf8-norm.c
@@ -714,6 +714,8 @@ int utf8byte(struct utf8cursor *u8c)
                        }
 
                        leaf = utf8lookup(u8c->data, u8c->hangul, u8c->s);
+                       if (!leaf)
+                               return -1;
                        ccc = LEAF_CCC(leaf);
                }
 

diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
index c2ffff5f9ae28f31b2f0e9a0058d16c285224271..6c9870e16b196c41413d22ca101ad779aa9f78e5 100644 (file)
--- a/include/linux/jbd2.h
+++ b/include/linux/jbd2.h
@@ -1318,7 +1318,7 @@ extern void               __wait_on_journal (journal_t *);
 
 /* Transaction cache support */
 extern void jbd2_journal_destroy_transaction_cache(void);
-extern int  jbd2_journal_init_transaction_cache(void);
+extern int __init jbd2_journal_init_transaction_cache(void);
 extern void jbd2_journal_free_transaction(transaction_t *);
 
 /*
@@ -1446,8 +1446,10 @@ static inline void jbd2_free_inode(struct jbd2_inode *jinode)
 /* Primary revoke support */
 #define JOURNAL_REVOKE_DEFAULT_HASH 256
 extern int        jbd2_journal_init_revoke(journal_t *, int);
-extern void       jbd2_journal_destroy_revoke_caches(void);
-extern int        jbd2_journal_init_revoke_caches(void);
+extern void       jbd2_journal_destroy_revoke_record_cache(void);
+extern void       jbd2_journal_destroy_revoke_table_cache(void);
+extern int __init jbd2_journal_init_revoke_record_cache(void);
+extern int __init jbd2_journal_init_revoke_table_cache(void);
 
 extern void       jbd2_journal_destroy_revoke(journal_t *);
 extern int        jbd2_journal_revoke (handle_t *, unsigned long long, struct buffer_head *);