linux-stable.git/fs/buffer.c, branch linux-2.6.16.y

buffer: memorder fix

2007-11-02T23:56:45+00:00

unlock_buffer(), like unlock_page(), must not clear the lock without
ensuring that the critical section is closed.

Mingming later sent the same patch, saying:

We are running SDET benchmark and saw double free issue for ext3 extended
attributes block, which complains the same xattr block already being freed (in
ext3_xattr_release_block()).  The problem could also been triggered by
multiple threads loop untar/rm a kernel tree.

The race is caused by missing a memory barrier at unlock_buffer() before the
lock bit being cleared, resulting in possible concurrent h_refcounter update.
That causes a reference counter leak, then later leads to the double free that
we have seen.

Inside unlock_buffer(), there is a memory barrier is placed *after* the lock
bit is being cleared, however, there is no memory barrier *before* the bit is
cleared.  On some arch the h_refcount update instruction and the clear bit
instruction could be reordered, thus leave the critical section re-entered.

The race is like this: For example, if the h_refcount is initialized as 1,

cpu 0:                                   cpu1
--------------------------------------   -----------------------------------
lock_buffer() /* test_and_set_bit */
clear_buffer_locked(bh);
                                        lock_buffer() /* test_and_set_bit */
h_refcount = h_refcount+1; /* = 2*/     h_refcount = h_refcount + 1; /*= 2 */
                                        clear_buffer_locked(bh);
....                                    ......

We lost a h_refcount here.  We need a memory barrier before the buffer head
lock bit being cleared to force the order of the two writes.  Please apply.

Signed-off-by: Nick Piggin 
Signed-off-by: Adrian Bunk

mm: fix bug in set_page_dirty_buffers

2007-01-20T21:16:03+00:00

This was triggered, but not the fault of, the dirty page accounting
patches. Suitable for -stable as well, after it goes upstream.

Unable to handle kernel NULL pointer dereference at virtual address 0000004c
EIP is at _spin_lock+0x12/0x66
Call Trace:
 [<401766e7>] __set_page_dirty_buffers+0x15/0xc0
 [<401401e7>] set_page_dirty+0x2c/0x51
 [<40140db2>] set_page_dirty_balance+0xb/0x3b
 [<40145d29>] __do_fault+0x1d8/0x279
 [<40147059>] __handle_mm_fault+0x125/0x951
 [<401133f1>] do_page_fault+0x440/0x59f
 [<4034d0c1>] error_code+0x39/0x40
 [<08048a33>] 0x8048a33
 =======================

Signed-off-by: Nick Piggin 
Signed-off-by: Adrian Bunk

grow_buffers() infinite loop fix (CVE-2006-5757/CVE-2006-6060)

2007-01-09T02:23:15+00:00

If grow_buffers() is for some reason passed a block number which wants to li
outside the maximum-addressable pagecache range (PAGE_SIZE * 4G bytes) then
will accidentally truncate `index' and will then instnatiate a page at the
wrong pagecache offset.  This causes __getblk_slow() to go into an infinite
loop.

This can happen with corrupted disks, or with software errors elsewhere.

Detect that, and handle it.

Signed-off-by: Andrew Morton 
Signed-off-by: Adrian Bunk

[PATCH] page migration: fail if page is in a vma flagged VM_LOCKED

2006-03-15T05:43:02+00:00

page migration currently simply retries a couple of times if try_to_unmap()
fails without inspecting the return code.

However, SWAP_FAIL indicates that the page is in a vma that has the
VM_LOCKED flag set (if ignore_refs ==1).  We can check for that return code
and avoid retrying the migration.

migrate_page_remove_references() now needs to return a reason why the
failure occured.  So switch migrate_page_remove_references to use -Exx
style error messages.

Signed-off-by: Christoph Lameter 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] Trivial optimization of ll_rw_block()

2006-02-03T16:32:10+00:00

The ll_rw_block() needs to get ref-count only if it submits a buffer().  This
patch avoids the needless get/put of ref-count.

Signed-off-by: OGAWA Hirofumi 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] reiserfs: zero b_private when allocating buffer heads

2006-02-01T16:53:26+00:00

The b_private field in buffer heads needs to be zero filled when the
buffers are allocated.  Thanks to Nathan Scott for finding this.  It was
causing problems on systems with both XFS and reiserfs.

Signed-off-by: Chris Mason 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] Direct Migration V9: Avoid writeback / page_migrate() method

2006-02-01T16:53:17+00:00

Migrate a page with buffers without requiring writeback

This introduces a new address space operation migratepage() that may be used
by a filesystem to implement its own version of page migration.

A version is provided that migrates buffers attached to pages.  Some
filesystems (ext2, ext3, xfs) are modified to utilize this feature.

The swapper address space operation are modified so that a regular
migrate_page() will occur for anonymous pages without writeback (migrate_pages
forces every anonymous page to have a swap entry).

Signed-off-by: Mike Kravetz 
Signed-off-by: Christoph Lameter 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

Make alloc_page_buffers() initialise buffer_heads using init_buffer(),

2006-01-16T22:02:07+00:00

like other routines here, to ensure buffers are correctly initialised
with respect to b_private/b_end_io.  Fixes an odd interaction between
XFS and reiserfs.

Signed-off-by: Nathan Scott

[PATCH] Unlinline a bunch of other functions

2006-01-15T02:27:06+00:00

Remove the "inline" keyword from a bunch of big functions in the kernel with
the goal of shrinking it by 30kb to 40kb

Signed-off-by: Arjan van de Ven 
Signed-off-by: Ingo Molnar 
Acked-by: Jeff Garzik 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] capable/capability.h (fs/)

2006-01-12T02:42:13+00:00

fs: Use  where capable() is used.

Signed-off-by: Randy Dunlap 
Acked-by: Tim Schmielau 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds