Dmitry Monakhov 30d8c83528 ext4: prevent bugon on race between write/fcntl ... commit a41537e69b upstream. O_DIRECT flags can be toggeled via fcntl(F_SETFL). But this value checked twice inside ext4_file_write_iter() and __generic_file_write() which result in BUG_ON inside ext4_direct_IO. Let's initialize iocb->private unconditionally. TESTCASE: xfstest:generic/036 https://patchwork.ozlabs.org/patch/402445/ #TYPICAL STACK TRACE: kernel BUG at fs/ext4/inode.c:2960! invalid opcode: 0000 [#1] SMP Modules linked in: brd iTCO_wdt lpc_ich mfd_core igb ptp dm_mirror dm_region_hash dm_log dm_mod CPU: 6 PID: 5505 Comm: aio-dio-fcntl-r Not tainted 3.17.0-rc2-00176-gff5c017 #161 Hardware name: Intel Corporation W2600CR/W2600CR, BIOS SE5C600.86B.99.99.x028.061320111235 06/13/2011 task: ffff88080e95a7c0 ti: ffff88080f908000 task.ti: ffff88080f908000 RIP: 0010:[<ffffffff811fabf2>] [<ffffffff811fabf2>] ext4_direct_IO+0x162/0x3d0 RSP: 0018:ffff88080f90bb58 EFLAGS: 00010246 RAX: 0000000000000400 RBX: ffff88080fdb2a28 RCX: 00000000a802c818 RDX: 0000040000080000 RSI: ffff88080d8aeb80 RDI: 0000000000000001 RBP: ffff88080f90bbc8 R08: 0000000000000000 R09: 0000000000001581 R10: 0000000000000000 R11: 0000000000000000 R12: ffff88080d8aeb80 R13: ffff88080f90bbf8 R14: ffff88080fdb28c8 R15: ffff88080fdb2a28 FS: 00007f23b2055700(0000) GS:ffff880818400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f23b2045000 CR3: 000000080cedf000 CR4: 00000000000407e0 Stack: ffff88080f90bb98 0000000000000000 7ffffffffffffffe ffff88080fdb2c30 0000000000000200 0000000000000200 0000000000000001 0000000000000200 ffff88080f90bbc8 ffff88080fdb2c30 ffff88080f90be08 0000000000000200 Call Trace: [<ffffffff8112ca9d>] generic_file_direct_write+0xed/0x180 [<ffffffff8112f2b2>] __generic_file_write_iter+0x222/0x370 [<ffffffff811f495b>] ext4_file_write_iter+0x34b/0x400 [<ffffffff811bd709>] ? aio_run_iocb+0x239/0x410 [<ffffffff811bd709>] ? aio_run_iocb+0x239/0x410 [<ffffffff810990e5>] ? local_clock+0x25/0x30 [<ffffffff810abd94>] ? __lock_acquire+0x274/0x700 [<ffffffff811f4610>] ? ext4_unwritten_wait+0xb0/0xb0 [<ffffffff811bd756>] aio_run_iocb+0x286/0x410 [<ffffffff810990e5>] ? local_clock+0x25/0x30 [<ffffffff810ac359>] ? lock_release_holdtime+0x29/0x190 [<ffffffff811bc05b>] ? lookup_ioctx+0x4b/0xf0 [<ffffffff811bde3b>] do_io_submit+0x55b/0x740 [<ffffffff811bdcaa>] ? do_io_submit+0x3ca/0x740 [<ffffffff811be030>] SyS_io_submit+0x10/0x20 [<ffffffff815ce192>] system_call_fastpath+0x16/0x1b Code: 01 48 8b 80 f0 01 00 00 48 8b 18 49 8b 45 10 0f 85 f1 01 00 00 48 03 45 c8 48 3b 43 48 0f 8f e3 01 00 00 49 83 7c 24 18 00 75 04 <0f> 0b eb fe f0 ff 83 ec 01 00 00 49 8b 44 24 18 8b 00 85 c0 89 RIP [<ffffffff811fabf2>] ext4_direct_IO+0x162/0x3d0 RSP <ffff88080f90bb58> Reported-by: Sasha Levin <sasha.levin@oracle.com> Signed-off-by: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org> [hujianyang: Backported to 3.10 - Move initialization of iocb->private to ext4_file_write() as we don't have ext4_file_write_iter(), which is introduced by commit 9b884164. - Adjust context to make 'overwrite' changes apply to ext4_file_dio_write() as ext4_file_dio_write() is not move into ext4_file_write()] Signed-off-by: hujianyang <hujianyang@huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2015-02-11 14:48:17 +08:00
..
9p	aio: don't include aio.h in sched.h	2013-05-07 20:16:25 -07:00
adfs	fs: Limit sys_mount to only request filesystem modules.	2013-03-03 19:36:31 -08:00
affs	fs: Limit sys_mount to only request filesystem modules.	2013-03-03 19:36:31 -08:00
afs	aio: don't include aio.h in sched.h	2013-05-07 20:16:25 -07:00
autofs4	autofs - remove autofs dentry mount check	2013-05-06 13:06:59 -07:00
befs	befs_readdir(): do not increment ->f_pos if filldir tells us to stop	2013-05-31 15:17:56 -04:00
bfs	fs: Limit sys_mount to only request filesystem modules.	2013-03-03 19:36:31 -08:00
btrfs	Btrfs: don't delay inode ref updates during log replay	2015-01-16 06:59:02 -08:00
cachefiles	lift sb_start_write() out of ->write()	2013-04-09 14:12:56 -04:00
ceph	ceph: allow sync_read/write return partial successed size of read/write.	2014-01-09 12:24:25 -08:00
cifs	CIFS: Fix SMB2 readdir error handling	2014-10-05 14:54:11 -07:00
coda	lift sb_start_write() out of ->write()	2013-04-09 14:12:56 -04:00
configfs	configfs: fix race between dentry put and lookup	2013-11-29 11:11:53 -08:00
cramfs	fs: Limit sys_mount to only request filesystem modules.	2013-03-03 19:36:31 -08:00
debugfs	debugfs: debugfs_remove_recursive() must not rely on list_empty(d_subdirs)	2013-08-14 22:59:10 -07:00
devpts	devpts: plug the memory leak in kill_sb	2013-12-04 10:55:49 -08:00
dlm	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2013-05-01 14:08:52 -07:00
ecryptfs	eCryptfs: Remove buggy and unnecessary write in file name decode routine	2015-01-08 09:58:17 -08:00
efivarfs	efivarfs: Never return ENOENT from firmware again	2013-05-13 20:12:10 +01:00
efs	fs: Limit sys_mount to only request filesystem modules.	2013-03-03 19:36:31 -08:00
exofs	ore: Fix wrong math in allocation of per device BIO	2014-02-13 13:48:00 -08:00
exportfs	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
ext2	ext2: Fix oops in ext2_get_block() called from ext2_quota_write()	2014-12-16 09:09:43 -08:00
ext3	ext3: Don't check quota format when there are no quota files	2014-11-14 08:48:00 -08:00
ext4	ext4: prevent bugon on race between write/fcntl	2015-02-11 14:48:17 +08:00
f2fs	f2fs updates for v3.10	2013-05-08 15:11:48 -07:00
fat	fat: fix possible overflow for fat_clusters	2013-05-24 16:22:50 -07:00
freevxfs	fs: Readd the fs module aliases.	2013-03-12 18:55:21 -07:00
fscache	fs/fscache/stats.c: fix memory leak	2013-04-29 15:54:27 -07:00
fuse	fuse: handle large user and group ID	2014-07-28 08:00:02 -07:00
gfs2	GFS2: Increase i_writecount during gfs2_setattr_chown	2014-01-25 08:27:11 -08:00
hfs	hfs: avoid crash in hfs_bnode_create	2013-05-24 16:22:51 -07:00
hfsplus	aio: don't include aio.h in sched.h	2013-05-07 20:16:25 -07:00
hostfs	hostfs: use kmalloc instead of kzalloc	2013-05-04 15:48:45 -04:00
hpfs	hpfs: better test for errors	2013-07-13 11:42:26 -07:00
hppfs	hppfs: get rid of ->fsync()	2013-04-29 15:41:42 -04:00
hugetlbfs	cope with potentially long ->d_dname() output for shmem/hugetlb	2013-10-18 07:45:45 -07:00
isofs	isofs: Fix unchecked printing of ER records	2015-01-08 09:58:15 -08:00
jbd	Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs	2013-05-03 09:56:25 -07:00
jbd2	jbd2: free bh when descriptor block checksum fails	2014-11-14 08:47:57 -08:00
jffs2	kill wbuf_queued/wbuf_dwork_lock	2014-11-14 08:47:55 -08:00
jfs	jfs: fix error path in ialloc	2013-11-13 12:05:31 +09:00
lockd	LOCKD: Fix a race when initialising nlmsvc_timeout	2015-01-27 07:52:33 -08:00
logfs	block: Remove bi_idx references	2013-03-23 14:15:31 -07:00
minix	fs: Limit sys_mount to only request filesystem modules.	2013-03-03 19:36:31 -08:00
ncpfs	ncpfs: return proper error from NCP_IOC_SETROOT ioctl	2015-01-08 09:58:17 -08:00
nfs	NFSv4.1: Fix an Oops in nfs41_walk_client_list	2015-02-05 22:35:36 -08:00
nfs_common	nfs_common: Update the translation between nfsv3 acls linux posix acls	2013-02-13 06:15:14 -08:00
nfsd	nfsd4: fix xdr4 inclusion of escaped char	2015-01-16 06:59:02 -08:00
nilfs2	nilfs2: fix deadlock of segment constructor over I_SYNC flag	2015-02-11 14:48:16 +08:00
nls
notify	fsnotify: next_i is freed during fsnotify_unmount_inodes.	2015-01-27 07:52:33 -08:00
ntfs	aio: don't include aio.h in sched.h	2013-05-07 20:16:25 -07:00
ocfs2	ocfs2: fix journal commit deadlock	2015-01-16 06:59:00 -08:00
omfs	fs: Limit sys_mount to only request filesystem modules.	2013-03-03 19:36:31 -08:00
openpromfs	fs: Limit sys_mount to only request filesystem modules.	2013-03-03 19:36:31 -08:00
proc	userns: Add a knob to disable setgroups on a per user namespace basis	2015-01-08 09:58:16 -08:00
pstore	pstore/ram: avoid atomic accesses for ioremapped regions	2015-02-05 22:35:40 -08:00
qnx4	fs: Limit sys_mount to only request filesystem modules.	2013-03-03 19:36:31 -08:00
qnx6	qnx6: qnx6_readdir() has a braino in pos calculation	2013-05-31 15:17:31 -04:00
quota	quota: provide interface for readding allocated space into reserved space	2015-01-29 17:40:57 -08:00
ramfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2013-02-26 20:16:07 -08:00
reiserfs	reiserfs: call truncate_setsize under tailpack mutex	2014-07-06 18:54:15 -07:00
romfs	romfs: fix nommu map length to keep inside filesystem	2013-04-29 09:17:57 +10:00
squashfs	fs: Limit sys_mount to only request filesystem modules. (Part 3)	2013-03-11 07:09:48 -07:00
sysfs	sysfs: check if one entry has been removed before freeing	2013-04-05 15:35:52 -07:00
sysv	sysv: Add forgotten superblock lock init for v7 fs	2013-10-05 07:13:09 -07:00
ubifs	UBIFS: fix free log space calculation	2014-11-14 08:47:54 -08:00
udf	udf: Verify symlink size before loading it	2015-01-08 09:58:17 -08:00
ufs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2013-04-30 09:36:50 -07:00
xfs	xfs: don't zero partial page cache pages during O_DIRECT writes	2014-09-17 09:04:01 -07:00
aio.c	aio: fix kernel memory disclosure in io_getevents() introduced in v3.10	2014-06-30 20:09:45 -07:00
anon_inodes.c	get_empty_filp()/alloc_file() leave both ->f_pos and ->f_version zero	2013-02-26 02:46:11 -05:00
attr.c	fs,userns: Change inode_capable to capable_wrt_inode_uidgid	2014-06-16 13:42:52 -07:00
bad_inode.c
binfmt_aout.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2013-05-01 17:51:54 -07:00
binfmt_elf_fdpic.c	Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc	2013-05-02 10:16:16 -07:00
binfmt_elf.c	fs/binfmt_elf.c: prevent a coredump with a large vm_map_count from Oopsing	2013-10-13 16:08:31 -07:00
binfmt_em86.c
binfmt_flat.c	new helper: read_code()	2013-04-29 15:40:23 -04:00
binfmt_misc.c	binfmt_misc: reuse string_unescape_inplace()	2013-04-30 17:04:03 -07:00
binfmt_script.c
binfmt_som.c
bio-integrity.c	bio-integrity: Fix bio_integrity_verify segment start bug	2014-03-23 21:38:21 -07:00
bio.c	block: Fix bio_copy_data()	2013-10-05 07:13:09 -07:00
block_dev.c	writeback: Fix periodic writeback after fs mount	2013-07-28 16:29:40 -07:00
buffer.c	vfs: fix data corruption when blocksize < pagesize for mmaped data	2014-11-14 08:47:54 -08:00
char_dev.c
compat_binfmt_elf.c
compat_ioctl.c	Removed unused typedef to avoid "unused local typedef" warnings.	2013-05-04 15:03:05 -04:00
compat.c	aio: don't include aio.h in sched.h	2013-05-07 20:16:25 -07:00
coredump.c	coredump: fix the setting of PF_DUMPCORE	2014-07-31 12:53:50 -07:00
coredump.h
dcache.c	vfs: fix bad hashing of dentries	2014-09-17 09:04:02 -07:00
dcookies.c	fs/compat: fix lookup_dcookie() parameter handling	2014-02-13 13:48:00 -08:00
direct-io.c	Merge branch 'for-3.10/core' of git://git.kernel.dk/linux-block	2013-05-08 10:13:35 -07:00
drop_caches.c
eventfd.c
eventpoll.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal	2013-05-01 07:21:43 -07:00
exec.c	metag: Reduce maximum stack size to 256MB	2014-06-07 13:25:38 -07:00
fcntl.c	new helper: file_inode(file)	2013-02-22 23:31:31 -05:00
fhandle.c
file_table.c	don't bother with {get,put}_write_access() on non-regular files	2014-05-30 21:52:12 -07:00
file.c	fs/file.c:fdtable: avoid triggering OOMs from alloc_fdmem	2014-02-22 12:41:25 -08:00
filesystems.c	fs: Limit sys_mount to only request filesystem modules.	2013-03-03 19:36:31 -08:00
fs_struct.c	constify path_get/path_put and fs_struct.c stuff	2013-03-01 23:51:07 -05:00
fs-writeback.c	writeback: fix a subtle race condition in I_DIRTY clearing	2015-01-16 06:59:02 -08:00
generic_acl.c
inode.c	fs,userns: Change inode_capable to capable_wrt_inode_uidgid	2014-06-16 13:42:52 -07:00
internal.h	splice: don't pass the address of ->f_pos to methods	2013-06-20 19:02:45 +04:00
ioctl.c	new helper: file_inode(file)	2013-02-22 23:31:31 -05:00
ioprio.c	block: Fix computation of merged request priority	2014-11-21 09:22:53 -08:00
Kconfig	efivarfs: Move to fs/efivarfs	2013-04-17 13:25:09 +01:00
Kconfig.binfmt	fs: make binfmt support for #! scripts modular and removable	2013-04-30 17:04:04 -07:00
libfs.c
locks.c	locks: allow __break_lease to sleep even when break_time is 0	2014-05-13 13:59:44 +02:00
Makefile	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2013-05-01 17:51:54 -07:00
mbcache.c
mount.h	vfs: Is mounted should be testing mnt_ns for NULL or error.	2014-02-06 11:08:16 -08:00
mpage.c
namei.c	vfs: fix bad hashing of dentries	2014-09-17 09:04:02 -07:00
namespace.c	umount: Disallow unprivileged mount force	2015-01-08 09:58:16 -08:00
no-block.c
open.c	don't bother with {get,put}_write_access() on non-regular files	2014-05-30 21:52:12 -07:00
pipe.c	vfs: fix subtle use-after-free of pipe_inode_info	2013-12-11 22:36:26 -08:00
pnode.c	vfs: Fix invalid ida_remove() call	2013-05-31 15:16:33 -04:00
pnode.h	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2013-05-01 17:51:54 -07:00
posix_acl.c	posix_acl: handle NULL ACL in posix_acl_equiv_mode	2014-06-07 13:25:33 -07:00
proc_namespace.c
read_write.c	fs/compat: fix parameter handling for compat readv/writev syscalls	2014-02-13 13:48:00 -08:00
readdir.c	new helper: file_inode(file)	2013-02-22 23:31:31 -05:00
select.c	sched/rt: Move rt specific bits into new header file	2013-02-07 20:51:08 +01:00
seq_file.c	seq_file: always update file->f_pos in seq_lseek()	2013-11-13 12:05:34 +09:00
signalfd.c	switch signalfd{,4}() to COMPAT_SYSCALL_DEFINE	2013-03-03 22:58:46 -05:00
splice.c	fuse: fix pipe_buf_operations	2014-02-13 13:47:59 -08:00
stack.c
stat.c	quota: provide interface for readding allocated space into reserved space	2015-01-29 17:40:57 -08:00
statfs.c	vfs: allow O_PATH file descriptors for fstatfs()	2013-10-18 07:45:44 -07:00
super.c	fs: Fix theoretical division by 0 in super_cache_scan().	2014-11-14 08:47:54 -08:00
sync.c	teach SYSCALL_DEFINE<n> how to deal with long long/unsigned long long	2013-03-03 22:46:22 -05:00
timerfd.c	compat: restore timerfd settime and gettime compat syscalls	2013-03-02 09:35:13 -05:00
utimes.c
xattr_acl.c
xattr.c