Akira Fujita 94d7c16cbb ext4: Fix double-free of blocks with EXT4_IOC_MOVE_EXT ... At the beginning of ext4_move_extent(), we call ext4_discard_preallocations() to discard inode PAs of orig and donor inodes. But in the following case, blocks can be double freed, so move ext4_discard_preallocations() to the end of ext4_move_extents(). 1. Discard inode PAs of orig and donor inodes with ext4_discard_preallocations() in ext4_move_extents(). orig : [ DATA1 ] donor: [ DATA2 ] 2. While data blocks are exchanging between orig and donor inodes, new inode PAs is created to orig by other process's block allocation. (Since there are semaphore gaps in ext4_move_extents().) And new inode PAs is used partially (2-1). 2-1 Create new inode PAs to orig inode orig : [ DATA1 | used PA1 | free PA1 ] donor: [ DATA2 ] 3. Donor inode which has old orig inode's blocks is deleted after EXT4_IOC_MOVE_EXT finished (3-1, 3-2). So the block bitmap corresponds to old orig inode's blocks are freed. 3-1 After EXT4_IOC_MOVE_EXT finished orig : [ DATA2 | free PA1 ] donor: [ DATA1 | used PA1 ] 3-2 Delete donor inode orig : [ DATA2 | free PA1 ] donor: [ FREE SPACE(DATA1) | FREE SPACE(used PA1) ] 4. The double-free of blocks is occurred, when close() is called to orig inode. Because ext4_discard_preallocations() for orig inode frees used PA1 and free PA1, though used PA1 is already freed in 3. 4-1 Double-free of blocks is occurred orig : [ DATA2 | FREE SPACE(free PA1) ] donor: [ FREE SPACE(DATA1) | DOUBLE FREE(used PA1) ] Signed-off-by: Akira Fujita <a-fujita@rs.jp.nec.com> Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>		2009-11-24 10:19:57 -05:00
..
acl.c	ext[234]: move over to 'check_acl' permission model	2009-09-08 11:09:04 -07:00
acl.h	ext[234]: move over to 'check_acl' permission model	2009-09-08 11:09:04 -07:00
balloc.c	ext4: fold ext4_free_blocks() and ext4_mb_free_blocks()	2009-11-22 07:44:56 -05:00
bitmap.c
block_validity.c	ext4: add check for wraparound in ext4_data_block_valid()	2009-11-22 20:48:34 -05:00
dir.c
ext4.h	ext4: call ext4_forget() from ext4_free_blocks()	2009-11-23 07:17:05 -05:00
ext4_extents.h	ext4: Split uninitialized extents for direct I/O	2009-09-28 15:49:08 -04:00
ext4_jbd2.c	ext4: fold ext4_journal_forget() into ext4_forget()	2009-11-22 21:00:13 -05:00
ext4_jbd2.h	ext4: fold ext4_journal_forget() into ext4_forget()	2009-11-22 21:00:13 -05:00
extents.c	ext4: call ext4_forget() from ext4_free_blocks()	2009-11-23 07:17:05 -05:00
file.c	const: mark struct vm_struct_operations	2009-09-27 11:39:25 -07:00
fsync.c	ext4: avoid issuing unnecessary barriers	2009-11-23 07:24:57 -05:00
hash.c
ialloc.c	ext4: fix build warning when EXT4FS_DEBUG is on	2009-07-27 21:44:40 -04:00
inode.c	ext4: call ext4_forget() from ext4_free_blocks()	2009-11-23 07:17:05 -05:00
ioctl.c	ext4: Return exchanged blocks count to user space in failure	2009-09-05 22:46:29 -04:00
Kconfig	ext4: drop ext4dev compat	2009-10-01 02:21:07 -04:00
Makefile
mballoc.c	ext4: use ext4_data_block_valid() in ext4_free_blocks()	2009-11-22 20:48:42 -05:00
mballoc.h	ext4: Use tracepoints for mb_history trace file	2009-09-30 00:32:42 -04:00
migrate.c	ext4: call ext4_forget() from ext4_free_blocks()	2009-11-23 07:17:05 -05:00
move_extent.c	ext4: Fix double-free of blocks with EXT4_IOC_MOVE_EXT	2009-11-24 10:19:57 -05:00
namei.c	ext4: fix potential buffer head leak when add_dirent_to_buf() returns ENOSPC	2009-11-23 07:25:49 -05:00
resize.c	ext4: Clarify the locking details in mballoc	2009-09-09 23:50:17 -04:00
super.c	ext4: make "norecovery" an alias for "noload"	2009-11-19 14:28:50 -05:00
symlink.c
xattr.c	ext4: call ext4_forget() from ext4_free_blocks()	2009-11-23 07:17:05 -05:00
xattr.h
xattr_security.c
xattr_trusted.c
xattr_user.c