linux.git/fs, branch v3.12-rc5

vfs: allow O_PATH file descriptors for fstatfs()

2013-10-12T20:12:31+00:00

Olga reported that file descriptors opened with O_PATH do not work with
fstatfs(), found during further development of ksh93's thread support.

There is no reason to not allow O_PATH file descriptors here (fstatfs is
very much a path operation), so use "fdget_raw()".  See commit
55815f70147d ("vfs: make O_PATH file descriptors usable for 'fstat()'")
for a very similar issue reported for fstat() by the same team.

Reported-and-tested-by: ольга крыжановская 
Acked-by: Al Viro 
Cc: stable@kernel.org	# O_PATH introduced in 3.0+
Signed-off-by: Linus Torvalds

Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4

2013-10-12T19:55:15+00:00

Pull ext4 bugfixes from Ted Ts'o:
 "A bug fix and performance regression fix for ext4"

* tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
  ext4: fix memory leak in xattr
  ext4: fix performance regression in writeback of random writes

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs

2013-10-12T19:54:24+00:00

Pull btrfs fixes from Chris Mason:
 "We've got more bug fixes in my for-linus branch:

  One of these fixes another corner of the compression oops from last
  time.  Miao nailed down some problems with concurrent snapshot
  deletion and drive balancing.

  I kept out one of his patches for more testing, but these are all
  stable"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
  Btrfs: fix oops caused by the space balance and dead roots
  Btrfs: insert orphan roots into fs radix tree
  Btrfs: limit delalloc pages outside of find_delalloc_range
  Btrfs: use right root when checking for hash collision

ext4: fix memory leak in xattr

2013-10-12T18:39:49+00:00

If we take the 2nd retry path in ext4_expand_extra_isize_ea, we
potentionally return from the function without having freed these
allocations.  If we don't do the return, we over-write the previous
allocation pointers, so we leak either way.

Spotted with Coverity.

[ Fixed by tytso to set is and bs to NULL after freeing these
  pointers, in case in the retry loop we later end up triggering an
  error causing a jump to cleanup, at which point we could have a double
  free bug. -- Ted ]

Signed-off-by: Dave Jones 
Signed-off-by: "Theodore Ts'o" 
Reviewed-by: Eric Sandeen 
Cc: stable@vger.kernel.org

Btrfs: fix oops caused by the space balance and dead roots

2013-10-11T01:31:02+00:00

When doing space balance and subvolume destroy at the same time, we met
the following oops:

kernel BUG at fs/btrfs/relocation.c:2247!
RIP: 0010: [] prepare_to_merge+0x154/0x1f0 [btrfs]
Call Trace:
 [] relocate_block_group+0x466/0x4e6 [btrfs]
 [] btrfs_relocate_block_group+0x143/0x275 [btrfs]
 [] btrfs_relocate_chunk.isra.27+0x5c/0x5a2 [btrfs]
 [] ? btrfs_item_key_to_cpu+0x15/0x31 [btrfs]
 [] ? btrfs_get_token_64+0x7e/0xcd [btrfs]
 [] ? btrfs_tree_read_unlock_blocking+0xb2/0xb7 [btrfs]
 [] btrfs_balance+0x9c7/0xb6f [btrfs]
 [] btrfs_ioctl_balance+0x234/0x2ac [btrfs]
 [] btrfs_ioctl+0xd87/0x1ef9 [btrfs]
 [] ? path_openat+0x234/0x4db
 [] ? __do_page_fault+0x31d/0x391
 [] ? vma_link+0x74/0x94
 [] vfs_ioctl+0x1d/0x39
 [] do_vfs_ioctl+0x32d/0x3e2
 [] SyS_ioctl+0x57/0x83
 [] ? do_page_fault+0xe/0x10
 [] system_call_fastpath+0x16/0x1b

It is because we returned the error number if the reference of the root was 0
when doing space relocation. It was not right here, because though the root
was dead(refs == 0), but the space it held still need be relocated, or we
could not remove the block group. So in this case, we should return the root
no matter it is dead or not.

Signed-off-by: Miao Xie 
Signed-off-by: Josef Bacik 
Signed-off-by: Chris Mason

Btrfs: insert orphan roots into fs radix tree

2013-10-11T01:30:53+00:00

Now we don't drop all the deleted snapshots/subvolumes before the space
balance. It means we have to relocate the space which is held by the dead
snapshots/subvolumes. So we must into them into fs radix tree, or we would
forget to commit the change of them when doing transaction commit, and it
would corrupt the metadata.

Signed-off-by: Miao Xie 
Signed-off-by: Josef Bacik 
Signed-off-by: Chris Mason

Btrfs: limit delalloc pages outside of find_delalloc_range

2013-10-11T01:27:56+00:00

Liu fixed part of this problem and unfortunately I steered him in slightly the
wrong direction and so didn't completely fix the problem.  The problem is we
limit the size of the delalloc range we are looking for to max bytes and then we
try to lock that range.  If we fail to lock the pages in that range we will
shrink the max bytes to a single page and re loop.  However if our first page is
inside of the delalloc range then we will end up limiting the end of the range
to a period before our first page.  This is illustrated below

[0 -------- delalloc range --------- 256mb]
                                  [page]

So find_delalloc_range will return with delalloc_start as 0 and end as 128mb,
and then we will notice that delalloc_start < *start and adjust it up, but not
adjust delalloc_end up, so things go sideways.  To fix this we need to not limit
the max bytes in find_delalloc_range, but in find_lock_delalloc_range and that
way we don't end up with this confusion.  Thanks,

Signed-off-by: Josef Bacik 
Signed-off-by: Chris Mason

Btrfs: use right root when checking for hash collision

2013-10-11T01:27:45+00:00

btrfs_rename was using the root of the old dir instead of the root of the new
dir when checking for a hash collision, so if you tried to move a file into a
subvol it would freak out because it would see the file you are trying to move
in its current root.  This fixes the bug where this would fail

btrfs subvol create test1
btrfs subvol create test2
mv test1 test2.

Thanks to Chris Murphy for catching this,

Cc: stable@vger.kernel.org
Reported-by: Chris Murphy 
Signed-off-by: Josef Bacik 
Signed-off-by: Chris Mason

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs

2013-10-05T19:17:24+00:00

Pull btrfs fixes from Chris Mason:
 "This is a small collection of fixes, including a regression fix from
  Liu Bo that solves rare crashes with compression on.

  I've merged my for-linus up to 3.12-rc3 because the top commit is only
  meant for 3.12.  The rest of the fixes are also available in my master
  branch on top of my last 3.11 based pull"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
  btrfs: Fix crash due to not allocating integrity data for a bioset
  Btrfs: fix a use-after-free bug in btrfs_dev_replace_finishing
  Btrfs: eliminate races in worker stopping code
  Btrfs: fix crash of compressed writes
  Btrfs: fix transid verify errors when recovering log tree

btrfs: Fix crash due to not allocating integrity data for a bioset

2013-10-05T14:52:10+00:00

When btrfs creates a bioset, we must also allocate the integrity data pool.
Otherwise btrfs will crash when it tries to submit a bio to a checksumming
disk:

 BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
 IP: [] mempool_alloc+0x4a/0x150
 PGD 2305e4067 PUD 23063d067 PMD 0
 Oops: 0000 [#1] PREEMPT SMP
 Modules linked in: btrfs scsi_debug xfs ext4 jbd2 ext3 jbd mbcache
sch_fq_codel eeprom lpc_ich mfd_core nfsd exportfs auth_rpcgss af_packet
raid6_pq xor zlib_deflate libcrc32c [last unloaded: scsi_debug]
 CPU: 1 PID: 4486 Comm: mount Not tainted 3.12.0-rc1-mcsum #2
 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
 task: ffff8802451c9720 ti: ffff880230698000 task.ti: ffff880230698000
 RIP: 0010:[]  [] mempool_alloc+0x4a/0x150
 RSP: 0018:ffff880230699688  EFLAGS: 00010286
 RAX: 0000000000000001 RBX: 0000000000000000 RCX: 00000000005f8445
 RDX: 0000000000000001 RSI: 0000000000000010 RDI: 0000000000000000
 RBP: ffff8802306996f8 R08: 0000000000011200 R09: 0000000000000008
 R10: 0000000000000020 R11: ffff88009d6e8000 R12: 0000000000011210
 R13: 0000000000000030 R14: ffff8802306996b8 R15: ffff8802451c9720
 FS:  00007f25b8a16800(0000) GS:ffff88024fc80000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
 CR2: 0000000000000018 CR3: 0000000230576000 CR4: 00000000000007e0
 Stack:
  ffff8802451c9720 0000000000000002 ffffffff81a97100 0000000000281250
  ffffffff81a96480 ffff88024fc99150 ffff880228d18200 0000000000000000
  0000000000000000 0000000000000040 ffff880230e8c2e8 ffff8802459dc900
 Call Trace:
  [] bio_integrity_alloc+0x48/0x1b0
  [] bio_integrity_prep+0xac/0x360
  [] ? mempool_alloc+0x58/0x150
  [] ? alloc_extent_state+0x31/0x110 [btrfs]
  [] blk_queue_bio+0x1c9/0x460
  [] generic_make_request+0xca/0x100
  [] submit_bio+0x79/0x160
  [] btrfs_map_bio+0x48e/0x5b0 [btrfs]
  [] btree_submit_bio_hook+0xda/0x110 [btrfs]
  [] submit_one_bio+0x6a/0xa0 [btrfs]
  [] read_extent_buffer_pages+0x250/0x310 [btrfs]
  [] ? __radix_tree_preload+0x66/0xf0
  [] ? radix_tree_insert+0x95/0x260
  [] btree_read_extent_buffer_pages.constprop.128+0xb6/0x120
[btrfs]
  [] read_tree_block+0x3a/0x60 [btrfs]
  [] open_ctree+0x139d/0x2030 [btrfs]
  [] btrfs_mount+0x53a/0x7d0 [btrfs]
  [] ? pcpu_alloc+0x8eb/0x9f0
  [] ? __kmalloc_track_caller+0x35/0x1e0
  [] mount_fs+0x20/0xd0
  [] vfs_kern_mount+0x76/0x120
  [] do_mount+0x200/0xa40
  [] ? strndup_user+0x5b/0x80
  [] SyS_mount+0x90/0xe0
  [] system_call_fastpath+0x1a/0x1f
 Code: 4c 8d 75 a8 4c 89 6d e8 45 89 e0 4c 8d 6f 30 48 89 5d d8 41 83 e0 af 48
89 fb 49 83 c6 18 4c 89 7d f8 65 4c 8b 3c 25 c0 b8 00 00 <48> 8b 73 18 44 89 c7
44 89 45 98 ff 53 20 48 85 c0 48 89 c2 74
 RIP  [] mempool_alloc+0x4a/0x150
  RSP 
 CR2: 0000000000000018
 ---[ end trace 7a96042017ed21e2 ]---

Signed-off-by: Darrick J. Wong 
Signed-off-by: Josef Bacik 
Signed-off-by: Chris Mason