linux-toradex.git/fs/ocfs2, branch v2.6.32.28

ocfs2: Don't walk off the end of fast symlinks.

2010-10-29T04:44:02+00:00

commit 1fc8a117865b54590acd773a55fbac9221b018f0 upstream.

ocfs2 fast symlinks are NUL terminated strings stored inline in the
inode data area.  However, disk corruption or a local attacker could, in
theory, remove that NUL.  Because we're using strlen() (my fault,
introduced in a731d1 when removing vfs_follow_link()), we could walk off
the end of that string.

Signed-off-by: Joel Becker 
Signed-off-by: Greg Kroah-Hartman

ocfs2: Fix incorrect checksum validation error

2010-09-20T20:17:46+00:00

commit f5ce5a08a40f2086435858ddc80cb40394b082eb upstream.

For local mounts, ocfs2_read_locked_inode() calls ocfs2_read_blocks_sync() to
read the inode off the disk. The latter first checks to see if that block is
cached in the journal, and, if so, returns that block. That is ok.

But ocfs2_read_locked_inode() goes wrong when it tries to validate the checksum
of such blocks. Blocks that are cached in the journal may not have had their
checksum computed as yet. We should not validate the checksums of such blocks.

Fixes ossbz#1282
http://oss.oracle.com/bugzilla/show_bug.cgi?id=1282

Signed-off-by: Sunil Mushran 
Singed-off-by: Tao Ma 
Signed-off-by: Greg Kroah-Hartman

Fix the nested PR lock calling issue in ACL

2010-08-26T23:41:39+00:00

commit 845b6cf34150100deb5f58c8a37a372b111f2918 upstream.

Hi,

Thanks a lot for all the review and comments so far;) I'd like to send
the improved (V4) version of this patch.

This patch fixes a deadlock in OCFS2 ACL. We found this bug in OCFS2
and Samba integration using scenario, the symptom is several smbd
processes will be hung under heavy workload. Finally we found out it
is the nested PR lock calling that leads to this deadlock:

 node1        node2
              gr PR
                |
                V
 PR(EX)---> BAST:OCFS2_LOCK_BLOCKED
                |
                V
              rq PR
                |
                V
              wait=1

After requesting the 2nd PR lock, the process "smbd" went into D
state. It can only be woken up when the 1st PR lock's RO holder equals
zero. There should be an ocfs2_inode_unlock in the calling path later
on, which can decrement the RO holder. But since it has been in
uninterruptible sleep, the unlock function has no chance to be called.

The related stack trace is:
smbd          D ffff8800013d0600     0  9522   5608 0x00000000
 ffff88002ca7fb18 0000000000000282 ffff88002f964500 ffff88002ca7fa98
 ffff8800013d0600 ffff88002ca7fae0 ffff88002f964340 ffff88002f964340
 ffff88002ca7ffd8 ffff88002ca7ffd8 ffff88002f964340 ffff88002f964340
Call Trace:
[] schedule_timeout+0x175/0x210
[] wait_for_common+0xf0/0x210
[] __ocfs2_cluster_lock+0x3b9/0xa90 [ocfs2]
[] ocfs2_inode_lock_full_nested+0x255/0xdb0 [ocfs2]
[] ocfs2_get_acl+0x69/0x120 [ocfs2]
[] ocfs2_check_acl+0x28/0x80 [ocfs2]
[] acl_permission_check+0x57/0xb0
[] generic_permission+0x1d/0xc0
[] ocfs2_permission+0x10a/0x1d0 [ocfs2]
[] inode_permission+0x45/0x100
[] sys_chdir+0x53/0x90
[] system_call_fastpath+0x16/0x1b
[<00007f34a4ef6927>] 0x7f34a4ef6927

For details, please see:
https://bugzilla.novell.com/show_bug.cgi?id=614332 and
http://oss.oracle.com/bugzilla/show_bug.cgi?id=1278

Signed-off-by: Jiaju Zhang 
Acked-by: Mark Fasheh 
Signed-off-by: Joel Becker 
Signed-off-by: Greg Kroah-Hartman

ocfs2/dlm: remove potential deadlock -V3

2010-08-26T23:41:38+00:00

commit b11f1f1ab73fd358b1b734a9427744802202ba68 upstream.

When we need to take both dlm_domain_lock and dlm->spinlock, we should take
them in order of: dlm_domain_lock then dlm->spinlock.

There is pathes disobey this order. That is calling dlm_lockres_put() with
dlm->spinlock held in dlm_run_purge_list. dlm_lockres_put() calls dlm_put() at
the ref and dlm_put() locks on dlm_domain_lock.

Fix:
Don't grab/put the dlm when the initialising/releasing lockres.
That grab is not required because we don't call dlm_unregister_domain()
based on refcount.

Signed-off-by: Wengang Wang 
Signed-off-by: Joel Becker 
Signed-off-by: Greg Kroah-Hartman

ocfs2/dlm: avoid incorrect bit set in refmap on recovery master

2010-08-26T23:41:37+00:00

commit a524812b7eaa7783d7811198921100f079034e61 upstream.

In the following situation, there remains an incorrect bit in refmap on the
recovery master. Finally the recovery master will fail at purging the lockres
due to the incorrect bit in refmap.

1) node A has no interest on lockres A any longer, so it is purging it.
2) the owner of lockres A is node B, so node A is sending de-ref message
to node B.
3) at this time, node B crashed. node C becomes the recovery master. it recovers
lockres A(because the master is the dead node B).
4) node A migrated lockres A to node C with a refbit there.
5) node A failed to send de-ref message to node B because it crashed. The failure
is ignored. no other action is done for lockres A any more.

For mormal, re-send the deref message to it to recovery master can fix it. Well,
ignoring the failure of deref to the original master and not recovering the lockres
to recovery master has the same effect. And the later is simpler.

Signed-off-by: Wengang Wang 
Acked-by: Srinivas Eeda 
Signed-off-by: Joel Becker 
Signed-off-by: Greg Kroah-Hartman

ocfs2: Count more refcount records in file system fragmentation.

2010-08-26T23:41:36+00:00

commit 8a2e70c40ff58f82dde67770e6623ca45f0cb0c8 upstream.

The refcount record calculation in ocfs2_calc_refcount_meta_credits
is too optimistic that we can always allocate contiguous clusters
and handle an already existed refcount rec as a whole. Actually
because of file system fragmentation, we may have the chance to split
a refcount record into 3 parts during the transaction. So consider
the worst case in record calculation.

Signed-off-by: Tao Ma 
Signed-off-by: Joel Becker 
Signed-off-by: Greg Kroah-Hartman

ocfs2 fix o2dlm dlm run purgelist (rev 3)

2010-08-26T23:41:36+00:00

commit 7beaf243787f85a2ef9213ccf13ab4a243283fde upstream.

This patch fixes two problems in dlm_run_purgelist

1. If a lockres is found to be in use, dlm_run_purgelist keeps trying to purge
the same lockres instead of trying the next lockres.

2. When a lockres is found unused, dlm_run_purgelist releases lockres spinlock
before setting DLM_LOCK_RES_DROPPING_REF and calls dlm_purge_lockres.
spinlock is reacquired but in this window lockres can get reused. This leads
to BUG.

This patch modifies dlm_run_purgelist to skip lockres if it's in use and purge
 next lockres. It also sets DLM_LOCK_RES_DROPPING_REF before releasing the
lockres spinlock protecting it from getting reused.

Signed-off-by: Srinivas Eeda 
Acked-by: Sunil Mushran 
Signed-off-by: Joel Becker 
Signed-off-by: Greg Kroah-Hartman

ocfs2/dlm: fix a dead lock

2010-08-26T23:41:36+00:00

commit 6d98c3ccb52f692f1a60339dde7c700686a5568b upstream.

When we have to take both dlm->master_lock and lockres->spinlock,
take them in order

lockres->spinlock and then dlm->master_lock.

The patch fixes a violation of the rule.
We can simply move taking dlm->master_lock to where we have dropped res->spinlock
since when we access res->state and free mle memory we don't need master_lock's
protection.

Signed-off-by: Wengang Wang 
Signed-off-by: Joel Becker 
Signed-off-by: Greg Kroah-Hartman

ocfs2: do not overwrite error codes in ocfs2_init_acl

2010-08-26T23:41:35+00:00

commit 6eda3dd33f8a0ce58ee56a11351758643a698db4 upstream.

Setting the acl while creating a new inode depends on
the error codes of posix_acl_create_masq. This patch fix
a issue of overwriting the error codes of it.

Reported-by: Pawel Zawora 
Signed-off-by: Tiger Yang 
Signed-off-by: Joel Becker 
Signed-off-by: Greg Kroah-Hartman

Skip check for mandatory locks when unlocking

2010-08-13T20:20:22+00:00

commit ee860b6a650360c91f5d5f9a94262aad9be90015 upstream.

ocfs2_lock() will skip locks on file which has mode set to 02666. This
is a problem in cases where the mode of the file is changed after a
process has obtained a lock on the file.

ocfs2_lock() should skip the check for mandatory locks when unlocking a
file.

Signed-off-by: Sachin Prabhu 
Signed-off-by: Joel Becker 
Signed-off-by: Neil Brown 
Signed-off-by: Greg Kroah-Hartman