ext4: make sure directory and symlink blocks are revoked

When an inode gets unlinked, the functions ext4_clear_blocks() and
ext4_remove_blocks() call ext4_forget() for all the buffer heads
corresponding to the deleted inode's data blocks.  If the inode is a
directory or a symlink, the is_metadata parameter must be non-zero so
ext4_forget() will revoke them via jbd2_journal_revoke().  Otherwise,
if these blocks are reused for a data file, and the system crashes
before a journal checkpoint, the journal replay could end up
corrupting these data blocks.

Thanks to Curt Wohlgemuth for pointing out potential problems in this
area.

Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: stable@kernel.org

diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 715264b4bae4b421c110af69ed3ccf8dc32bb1f6..74dcff84c3a8c3c5a9d8488530a56eb5eedbac25 100644 (file)
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -2074,7 +2074,7 @@ static int ext4_remove_blocks(handle_t *handle, struct inode *inode,
                ext_debug("free last %u blocks starting %llu\n", num, start);
                for (i = 0; i < num; i++) {
                        bh = sb_find_get_block(inode->i_sb, start + i);
-                       ext4_forget(handle, 0, inode, bh, start + i);
+                       ext4_forget(handle, metadata, inode, bh, start + i);
                }
                ext4_free_blocks(handle, inode, start, num, metadata);
        } else if (from == le32_to_cpu(ex->ee_block)

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 13de1dd751f55e7dc45f6bb6688871a98e92feda..c420aaba6e9c2d3f22c73dc794311cb23a6f18c4 100644 (file)
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4121,6 +4121,8 @@ static void ext4_clear_blocks(handle_t *handle, struct inode *inode,
                              __le32 *last)
 {
        __le32 *p;
+       int     is_metadata = S_ISDIR(inode->i_mode) || S_ISLNK(inode->i_mode);
+
        if (try_to_extend_transaction(handle, inode)) {
                if (bh) {
                        BUFFER_TRACE(bh, "call ext4_handle_dirty_metadata");
@@ -4151,11 +4153,11 @@ static void ext4_clear_blocks(handle_t *handle, struct inode *inode,
 
                        *p = 0;
                        tbh = sb_find_get_block(inode->i_sb, nr);
-                       ext4_forget(handle, 0, inode, tbh, nr);
+                       ext4_forget(handle, is_metadata, inode, tbh, nr);
                }
        }
 
-       ext4_free_blocks(handle, inode, block_to_free, count, 0);
+       ext4_free_blocks(handle, inode, block_to_free, count, is_metadata);
 }
 
 /**