Re: [PATCH] ext4: drop tmp inode ownership before migration cleanup

[Jan Kara]

On Wed 30-09-26 16:02:41, Yichong Chen wrote:
> After the extent tree is transferred to the original inode,
> ext4_journal_ensure_credits() can fail before tmp_inode is cleared.  The
> subsequent iput(tmp_inode) may then free the transferred tree.
> 
> Clear tmp_inode's size and block count as soon as ownership is transferred.
> 
> Fixes: a413036791d0 ("ext4: Provide function to handle transaction restarts")
> Signed-off-by: Yichong Chen <chenyichong@xxxxxxxxxxxxx>
> ---
>  fs/ext4/migrate.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c
> index e588b4157604..11b3da396966 100644
> --- a/fs/ext4/migrate.c
> +++ b/fs/ext4/migrate.c
> @@ -570,6 +570,12 @@ int ext4_ext_migrate(struct inode *inode)
>  			free_ext_block(handle, tmp_inode);
>  	}
>  
> +	if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) {
> +		i_size_write(tmp_inode, 0);
> +		tmp_inode->i_blocks = 0;
> +		EXT4_I(tmp_inode)->i_csum_seed = tmp_csum_seed;
> +	}

I'd just move the setting of i_size, i_blocks and i_csum_seed above the
ext4_journal_ensure_credits() instead of adding this extra branch...

								Honza

> +
>  	/* We mark the tmp_inode dirty via ext4_ext_tree_init. */
>  	err = ext4_journal_ensure_credits(handle, 1, 0);
>  	if (err < 0) {
> -- 
> 2.51.0
> 
-- 
Jan Kara <jack@xxxxxxxx>
SUSE Labs, CR