fix-BUG_ON-in-mb_free_blocks

   1 ext4: fix BUG_ON in mb_free_blocks()
   2
   3 If we suffer a block allocation failure (for example due to a memory
   4 allocation failure), it's possible that we will call
   5 ext4_discard_allocated_blocks() before we've actually allocated any
   6 blocks.  In that case, fe_len and fe_start in ac->ac_f_ex will still
   7 be zero, and this will result in mb_free_blocks(inode, e4b, 0, 0)
   8 triggering the BUG_ON on mb_free_blocks():
   9
  10         BUG_ON(last >= (sb->s_blocksize << 3));
  11
  12 Fix this by bailing out of ext4_discard_allocated_blocks() if fs_len
  13 is zero.
  14
  15 Also fix a missing ext4_mb_unload_buddy() call in
  16 ext4_discard_allocated_blocks().
  17
  18 Google-Bug-Id: 16844242
  19
  20 Fixes: 86f0afd463215fc3e58020493482faa4ac3a4d69
  21 Signed-off-by: Theodore Ts'o <tytso@mit.edu>
  22 Cc: stable@vger.kernel.org
  23 ---
  24  fs/ext4/mballoc.c | 5 +++++
  25  1 file changed, 5 insertions(+)
  26
  27 diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
  28 index 9560277..8b0f9ef 100644
  29 --- a/fs/ext4/mballoc.c
  30 +++ b/fs/ext4/mballoc.c
  31 @@ -1412,6 +1412,8 @@ static void mb_free_blocks(struct inode *inode, struct ext4_buddy *e4b,
  32         int last = first + count - 1;
  33         struct super_block *sb = e4b->bd_sb;
  34
  35 +       if (WARN_ON(count == 0))
  36 +               return;
  37         BUG_ON(last >= (sb->s_blocksize << 3));
  38         assert_spin_locked(ext4_group_lock_ptr(sb, e4b->bd_group));
  39         /* Don't bother if the block group is corrupt. */
  40 @@ -3221,6 +3223,8 @@ static void ext4_discard_allocated_blocks(struct ext4_allocation_context *ac)
  41         int err;
  42
  43         if (pa == NULL) {
  44 +               if (ac->ac_f_ex.fe_len == 0)
  45 +                       return;
  46                 err = ext4_mb_load_buddy(ac->ac_sb, ac->ac_f_ex.fe_group, &e4b);
  47                 if (err) {
  48                         /*
  49 @@ -3235,6 +3239,7 @@ static void ext4_discard_allocated_blocks(struct ext4_allocation_context *ac)
  50                 mb_free_blocks(ac->ac_inode, &e4b, ac->ac_f_ex.fe_start,
  51                                ac->ac_f_ex.fe_len);
  52                 ext4_unlock_group(ac->ac_sb, ac->ac_f_ex.fe_group);
  53 +               ext4_mb_unload_buddy(&e4b);
  54                 return;
  55         }
  56         if (pa->pa_type == MB_INODE_PA)
  57 --
  58 2.1.0
  59