• Jan Kara's avatar
    ext4: fix crashes in dioread_nolock mode · c0c009a0
    Jan Kara authored
    commit 74dae427 upstream.
    
    Competing overwrite DIO in dioread_nolock mode will just overwrite
    pointer to io_end in the inode. This may result in data corruption or
    extent conversion happening from IO completion interrupt because we
    don't properly set buffer_defer_completion() when unlocked DIO races
    with locked DIO to unwritten extent.
    
    Since unlocked DIO doesn't need io_end for anything, just avoid
    allocating it and corrupting pointer from inode for locked DIO.
    A cleaner fix would be to avoid these games with io_end pointer from the
    inode but that requires more intrusive changes so we leave that for
    later.
    Signed-off-by: default avatarJan Kara <jack@suse.cz>
    Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
    Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
    c0c009a0
inode.c 153 KB