vfs: fix possible deadlock in ext2, ext3, ext4 when using xattrs
[safe/jmp/linux-2.6] / fs / ext3 / balloc.c
index b41a7d7..da0cb2c 100644 (file)
@@ -32,7 +32,7 @@
  * The file system contains group descriptors which are located after the
  * super block.  Each descriptor contains the number of the bitmap block and
  * the free blocks count in the block.  The descriptors are loaded in memory
- * when a file system is mounted (see ext3_read_super).
+ * when a file system is mounted (see ext3_fill_super).
  */
 
 
@@ -80,13 +80,57 @@ struct ext3_group_desc * ext3_get_group_desc(struct super_block * sb,
        return desc + offset;
 }
 
+static int ext3_valid_block_bitmap(struct super_block *sb,
+                                       struct ext3_group_desc *desc,
+                                       unsigned int block_group,
+                                       struct buffer_head *bh)
+{
+       ext3_grpblk_t offset;
+       ext3_grpblk_t next_zero_bit;
+       ext3_fsblk_t bitmap_blk;
+       ext3_fsblk_t group_first_block;
+
+       group_first_block = ext3_group_first_block_no(sb, block_group);
+
+       /* check whether block bitmap block number is set */
+       bitmap_blk = le32_to_cpu(desc->bg_block_bitmap);
+       offset = bitmap_blk - group_first_block;
+       if (!ext3_test_bit(offset, bh->b_data))
+               /* bad block bitmap */
+               goto err_out;
+
+       /* check whether the inode bitmap block number is set */
+       bitmap_blk = le32_to_cpu(desc->bg_inode_bitmap);
+       offset = bitmap_blk - group_first_block;
+       if (!ext3_test_bit(offset, bh->b_data))
+               /* bad block bitmap */
+               goto err_out;
+
+       /* check whether the inode table block number is set */
+       bitmap_blk = le32_to_cpu(desc->bg_inode_table);
+       offset = bitmap_blk - group_first_block;
+       next_zero_bit = ext3_find_next_zero_bit(bh->b_data,
+                               offset + EXT3_SB(sb)->s_itb_per_group,
+                               offset);
+       if (next_zero_bit >= offset + EXT3_SB(sb)->s_itb_per_group)
+               /* good bitmap for inode tables */
+               return 1;
+
+err_out:
+       ext3_error(sb, __FUNCTION__,
+                       "Invalid block bitmap - "
+                       "block_group = %d, block = %lu",
+                       block_group, bitmap_blk);
+       return 0;
+}
+
 /**
  * read_block_bitmap()
  * @sb:                        super block
  * @block_group:       given block group
  *
- * Read the bitmap for a given block_group, reading into the specified
- * slot in the superblock's bitmap cache.
+ * Read the bitmap for a given block_group,and validate the
+ * bits for block/inode/inode tables are set in the bitmaps
  *
  * Return buffer_head on success or NULL in case of failure.
  */
@@ -95,17 +139,35 @@ read_block_bitmap(struct super_block *sb, unsigned int block_group)
 {
        struct ext3_group_desc * desc;
        struct buffer_head * bh = NULL;
+       ext3_fsblk_t bitmap_blk;
 
-       desc = ext3_get_group_desc (sb, block_group, NULL);
+       desc = ext3_get_group_desc(sb, block_group, NULL);
        if (!desc)
-               goto error_out;
-       bh = sb_bread(sb, le32_to_cpu(desc->bg_block_bitmap));
-       if (!bh)
-               ext3_error (sb, "read_block_bitmap",
+               return NULL;
+       bitmap_blk = le32_to_cpu(desc->bg_block_bitmap);
+       bh = sb_getblk(sb, bitmap_blk);
+       if (unlikely(!bh)) {
+               ext3_error(sb, __FUNCTION__,
                            "Cannot read block bitmap - "
                            "block_group = %d, block_bitmap = %u",
                            block_group, le32_to_cpu(desc->bg_block_bitmap));
-error_out:
+               return NULL;
+       }
+       if (likely(bh_uptodate_or_lock(bh)))
+               return bh;
+
+       if (bh_submit_read(bh) < 0) {
+               brelse(bh);
+               ext3_error(sb, __FUNCTION__,
+                           "Cannot read block bitmap - "
+                           "block_group = %d, block_bitmap = %u",
+                           block_group, le32_to_cpu(desc->bg_block_bitmap));
+               return NULL;
+       }
+       if (!ext3_valid_block_bitmap(sb, desc, block_group, bh)) {
+               brelse(bh);
+               return NULL;
+       }
        return bh;
 }
 /*
@@ -144,7 +206,7 @@ restart:
 
        printk("Block Allocation Reservation Windows Map (%s):\n", fn);
        while (n) {
-               rsv = list_entry(n, struct ext3_reserve_window_node, rsv_node);
+               rsv = rb_entry(n, struct ext3_reserve_window_node, rsv_node);
                if (verbose)
                        printk("reservation window 0x%p "
                               "start:  %lu, end:  %lu\n",
@@ -468,11 +530,13 @@ do_more:
            in_range (block, le32_to_cpu(desc->bg_inode_table),
                      sbi->s_itb_per_group) ||
            in_range (block + count - 1, le32_to_cpu(desc->bg_inode_table),
-                     sbi->s_itb_per_group))
+                     sbi->s_itb_per_group)) {
                ext3_error (sb, "ext3_free_blocks",
                            "Freeing blocks in system zones - "
                            "Block = "E3FSBLK", count = %lu",
                            block, count);
+               goto error_return;
+       }
 
        /*
         * We are about to start releasing blocks in the bitmap,
@@ -566,11 +630,9 @@ do_more:
        jbd_unlock_bh_state(bitmap_bh);
 
        spin_lock(sb_bgl_lock(sbi, block_group));
-       desc->bg_free_blocks_count =
-               cpu_to_le16(le16_to_cpu(desc->bg_free_blocks_count) +
-                       group_freed);
+       le16_add_cpu(&desc->bg_free_blocks_count, group_freed);
        spin_unlock(sb_bgl_lock(sbi, block_group));
-       percpu_counter_mod(&sbi->s_freeblocks_counter, count);
+       percpu_counter_add(&sbi->s_freeblocks_counter, count);
 
        /* We dirtied the bitmap block */
        BUFFER_TRACE(bitmap_bh, "dirtied bitmap block");
@@ -730,7 +792,7 @@ find_next_usable_block(ext3_grpblk_t start, struct buffer_head *bh,
                here = 0;
 
        p = ((char *)bh->b_data) + (here >> 3);
-       r = memscan(p, 0, (maxblocks - here + 7) >> 3);
+       r = memscan(p, 0, ((maxblocks + 7) >> 3) - (here >> 3));
        next = (r - ((char *)bh->b_data)) << 3;
 
        if (next < maxblocks && next >= start && ext3_test_allocatable(next, bh))
@@ -949,7 +1011,7 @@ static int find_next_reservable_window(
 
                prev = rsv;
                next = rb_next(&rsv->rsv_node);
-               rsv = list_entry(next,struct ext3_reserve_window_node,rsv_node);
+               rsv = rb_entry(next,struct ext3_reserve_window_node,rsv_node);
 
                /*
                 * Reached the last reservation, we can just append to the
@@ -1148,7 +1210,7 @@ retry:
         * check if the first free block is within the
         * free space we just reserved
         */
-       if (start_block >= my_rsv->rsv_start && start_block < my_rsv->rsv_end)
+       if (start_block >= my_rsv->rsv_start && start_block <= my_rsv->rsv_end)
                return 0;               /* success */
        /*
         * if the first free bit we found is out of the reservable space
@@ -1193,7 +1255,7 @@ static void try_to_extend_reservation(struct ext3_reserve_window_node *my_rsv,
        if (!next)
                my_rsv->rsv_end += size;
        else {
-               next_rsv = list_entry(next, struct ext3_reserve_window_node, rsv_node);
+               next_rsv = rb_entry(next, struct ext3_reserve_window_node, rsv_node);
 
                if ((next_rsv->rsv_start - my_rsv->rsv_end - 1) >= size)
                        my_rsv->rsv_end += size;
@@ -1271,7 +1333,7 @@ ext3_try_to_allocate_with_rsv(struct super_block *sb, handle_t *handle,
        }
        /*
         * grp_goal is a group relative block number (if there is a goal)
-        * 0 < grp_goal < EXT3_BLOCKS_PER_GROUP(sb)
+        * 0 <= grp_goal < EXT3_BLOCKS_PER_GROUP(sb)
         * first block is a filesystem wide block number
         * first block is the block number of the first block in this group
         */
@@ -1307,10 +1369,14 @@ ext3_try_to_allocate_with_rsv(struct super_block *sb, handle_t *handle,
                        if (!goal_in_my_reservation(&my_rsv->rsv_window,
                                                        grp_goal, group, sb))
                                grp_goal = -1;
-               } else if (grp_goal > 0 &&
-                         (my_rsv->rsv_end-grp_goal+1) < *count)
-                       try_to_extend_reservation(my_rsv, sb,
-                                       *count-my_rsv->rsv_end + grp_goal - 1);
+               } else if (grp_goal >= 0) {
+                       int curr = my_rsv->rsv_end -
+                                       (grp_goal + group_first_block) + 1;
+
+                       if (curr < *count)
+                               try_to_extend_reservation(my_rsv, sb,
+                                                       *count - curr);
+               }
 
                if ((my_rsv->rsv_start > group_last_block) ||
                                (my_rsv->rsv_end < group_first_block)) {
@@ -1504,17 +1570,15 @@ retry_alloc:
 
        /*
         * Now search the rest of the groups.  We assume that
-        * i and gdp correctly point to the last group visited.
+        * group_no and gdp correctly point to the last group visited.
         */
        for (bgi = 0; bgi < ngroups; bgi++) {
                group_no++;
                if (group_no >= ngroups)
                        group_no = 0;
                gdp = ext3_get_group_desc(sb, group_no, &gdp_bh);
-               if (!gdp) {
-                       *errp = -EIO;
-                       goto out;
-               }
+               if (!gdp)
+                       goto io_error;
                free_blocks = le16_to_cpu(gdp->bg_free_blocks_count);
                /*
                 * skip this group if the number of
@@ -1548,6 +1612,7 @@ retry_alloc:
         */
        if (my_rsv) {
                my_rsv = NULL;
+               windowsz = 0;
                group_no = goal_group;
                goto retry_alloc;
        }
@@ -1572,11 +1637,13 @@ allocated:
            in_range(ret_block, le32_to_cpu(gdp->bg_inode_table),
                      EXT3_SB(sb)->s_itb_per_group) ||
            in_range(ret_block + num - 1, le32_to_cpu(gdp->bg_inode_table),
-                     EXT3_SB(sb)->s_itb_per_group))
+                     EXT3_SB(sb)->s_itb_per_group)) {
                ext3_error(sb, "ext3_new_block",
                            "Allocating block in system zone - "
                            "blocks from "E3FSBLK", length %lu",
                             ret_block, num);
+               goto out;
+       }
 
        performed_allocation = 1;
 
@@ -1627,10 +1694,9 @@ allocated:
                        ret_block, goal_hits, goal_attempts);
 
        spin_lock(sb_bgl_lock(sbi, group_no));
-       gdp->bg_free_blocks_count =
-                       cpu_to_le16(le16_to_cpu(gdp->bg_free_blocks_count)-num);
+       le16_add_cpu(&gdp->bg_free_blocks_count, -num);
        spin_unlock(sb_bgl_lock(sbi, group_no));
-       percpu_counter_mod(&sbi->s_freeblocks_counter, -num);
+       percpu_counter_sub(&sbi->s_freeblocks_counter, num);
 
        BUFFER_TRACE(gdp_bh, "journal_dirty_metadata for group descriptor");
        err = ext3_journal_dirty_metadata(handle, gdp_bh);
@@ -1730,14 +1796,6 @@ ext3_fsblk_t ext3_count_free_blocks(struct super_block *sb)
 #endif
 }
 
-static inline int
-block_in_use(ext3_fsblk_t block, struct super_block *sb, unsigned char *map)
-{
-       return ext3_test_bit ((block -
-               le32_to_cpu(EXT3_SB(sb)->s_es->s_first_data_block)) %
-                        EXT3_BLOCKS_PER_GROUP(sb), map);
-}
-
 static inline int test_root(int a, int b)
 {
        int num = b;
@@ -1787,11 +1845,7 @@ static unsigned long ext3_bg_num_gdb_meta(struct super_block *sb, int group)
 
 static unsigned long ext3_bg_num_gdb_nometa(struct super_block *sb, int group)
 {
-       if (EXT3_HAS_RO_COMPAT_FEATURE(sb,
-                               EXT3_FEATURE_RO_COMPAT_SPARSE_SUPER) &&
-                       !ext3_group_sparse(group))
-               return 0;
-       return EXT3_SB(sb)->s_gdb_count;
+       return ext3_bg_has_super(sb, group) ? EXT3_SB(sb)->s_gdb_count : 0;
 }
 
 /**