| 0/0 |
2026/05/17 10:49 |
flow |
assessment-security |
1h01m
Results: map[DenialOfService:false Explanation:Based on the analysis of the bug report and the kernel source code, here is the
assessment of the security impact:
**Analysis:**
The bug report is a `WARNING: possible circular locking dependency detected`
from lockdep, involving two locks in the ext4 filesystem:
`sbi->s_writepages_rwsem` and `ei->xattr_sem`.
Lockdep detected the following two locking chains:
1. **`ei->xattr_sem` -> `sbi->s_writepages_rwsem`**:
This occurs during inode eviction (`ext4_evict_inode`). If the inode requires
extra isize expansion (`ext4_try_to_expand_extra_isize`), it acquires the
`ei->xattr_sem` of the inode. It then attempts to move extended attributes to
an external block, which may drop the reference to an existing EA inode
(`iput(ea_inode)`). Dropping the last reference triggers `iput_final` ->
`write_inode_now` -> `ext4_writepages`, which acquires
`sbi->s_writepages_rwsem`.
2. **`sbi->s_writepages_rwsem` -> `ei->xattr_sem`**:
This occurs during the `EXT4_IOC_MIGRATE` ioctl (`ext4_ext_migrate`). The
function first acquires `sbi->s_writepages_rwsem` to prevent races with
writeback. It then creates a new temporary inode (`ext4_new_inode`), which
initializes its security attributes (`security_inode_init_security` ->
`ext4_initxattrs`). Setting the initial xattrs acquires the `ei->xattr_sem`
of this newly created temporary inode.
**Conclusion:**
This is a **false positive** lockdep warning. Lockdep groups locks by their
initialization class. It sees that a lock of class `xattr_sem` is acquired
before `s_writepages_rwsem` (Chain 1), and later `s_writepages_rwsem` is
acquired before a lock of class `xattr_sem` (Chain 2). However, in Chain 2, the
`xattr_sem` belongs to a *newly allocated, temporary inode* that is not yet
visible to any other thread. Because no other thread can possibly hold the
`xattr_sem` of this new inode, a deadlock can never actually occur.
Since this is a false positive lockdep warning, it has **no security impact**.
Lockdep is a debugging tool and is disabled in production kernel builds. Even if
it were enabled, a lockdep warning merely prints a stack trace and disables
further lock debugging; it does not halt the system or cause memory corruption.
An unprivileged user can trigger this warning on any standard ext4 filesystem
because they can create/delete files with xattrs (triggering Chain 1) and call
`EXT4_IOC_MIGRATE` on files they own (triggering Chain 2). It can also be
triggered by mounting a crafted filesystem image (as the syzkaller reproducer
does). However, due to the lack of any real deadlock or memory safety issue, it
is not exploitable and does not cause a Denial of Service. Exploitable:false FilesystemTrigger:true NetworkTrigger:false PeripheralTrigger:false RemoteTrigger:false Unprivileged:true UserNamespace:false VMGuestTrigger:false VMHostTrigger:false]
|
| 1/1 |
2026/05/17 10:49 |
action |
syz-repro-to-c-repro |
0m
Results: map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <setjmp.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#include <linux/loop.h>
#ifndef __NR_memfd_create
#define __NR_memfd_create 319
#endif
static unsigned long long procid;
//% This code is derived from puff.{c,h}, found in the zlib development. The
//% original files come with the following copyright notice:
//% Copyright (C) 2002-2013 Mark Adler, all rights reserved
//% version 2.3, 21 Jan 2013
//% This software is provided 'as-is', without any express or implied
//% warranty. In no event will the author be held liable for any damages
//% arising from the use of this software.
//% Permission is granted to anyone to use this software for any purpose,
//% including commercial applications, and to alter it and redistribute it
//% freely, subject to the following restrictions:
//% 1. The origin of this software must not be misrepresented; you must not
//% claim that you wrote the original software. If you use this software
//% in a product, an acknowledgment in the product documentation would be
//% appreciated but is not required.
//% 2. Altered source versions must be plainly marked as such, and must not be
//% misrepresented as being the original software.
//% 3. This notice may not be removed or altered from any source distribution.
//% Mark Adler madler@alumni.caltech.edu
//% BEGIN CODE DERIVED FROM puff.{c,h}
#define MAXBITS 15
#define MAXLCODES 286
#define MAXDCODES 30
#define MAXCODES (MAXLCODES + MAXDCODES)
#define FIXLCODES 288
struct puff_state {
unsigned char* out;
unsigned long outlen;
unsigned long outcnt;
const unsigned char* in;
unsigned long inlen;
unsigned long incnt;
int bitbuf;
int bitcnt;
jmp_buf env;
};
static int puff_bits(struct puff_state* s, int need)
{
long val = s->bitbuf;
while (s->bitcnt < need) {
if (s->incnt == s->inlen)
longjmp(s->env, 1);
val |= (long)(s->in[s->incnt++]) << s->bitcnt;
s->bitcnt += 8;
}
s->bitbuf = (int)(val >> need);
s->bitcnt -= need;
return (int)(val & ((1L << need) - 1));
}
static int puff_stored(struct puff_state* s)
{
s->bitbuf = 0;
s->bitcnt = 0;
if (s->incnt + 4 > s->inlen)
return 2;
unsigned len = s->in[s->incnt++];
len |= s->in[s->incnt++] << 8;
if (s->in[s->incnt++] != (~len & 0xff) ||
s->in[s->incnt++] != ((~len >> 8) & 0xff))
return -2;
if (s->incnt + len > s->inlen)
return 2;
if (s->outcnt + len > s->outlen)
return 1;
for (; len--; s->outcnt++, s->incnt++) {
if (s->in[s->incnt])
s->out[s->outcnt] = s->in[s->incnt];
}
return 0;
}
struct puff_huffman {
short* count;
short* symbol;
};
static int puff_decode(struct puff_state* s, const struct puff_huffman* h)
{
int first = 0;
int index = 0;
int bitbuf = s->bitbuf;
int left = s->bitcnt;
int code = first = index = 0;
int len = 1;
short* next = h->count + 1;
while (1) {
while (left--) {
code |= bitbuf & 1;
bitbuf >>= 1;
int count = *next++;
if (code - count < first) {
s->bitbuf = bitbuf;
s->bitcnt = (s->bitcnt - len) & 7;
return h->symbol[index + (code - first)];
}
index += count;
first += count;
first <<= 1;
code <<= 1;
len++;
}
left = (MAXBITS + 1) - len;
if (left == 0)
break;
if (s->incnt == s->inlen)
longjmp(s->env, 1);
bitbuf = s->in[s->incnt++];
if (left > 8)
left = 8;
}
return -10;
}
static int puff_construct(struct puff_huffman* h, const short* length, int n)
{
int len;
for (len = 0; len <= MAXBITS; len++)
h->count[len] = 0;
int symbol;
for (symbol = 0; symbol < n; symbol++)
(h->count[length[symbol]])++;
if (h->count[0] == n)
return 0;
int left = 1;
for (len = 1; len <= MAXBITS; len++) {
left <<= 1;
left -= h->count[len];
if (left < 0)
return left;
}
short offs[MAXBITS + 1];
offs[1] = 0;
for (len = 1; len < MAXBITS; len++)
offs[len + 1] = offs[len] + h->count[len];
for (symbol = 0; symbol < n; symbol++)
if (length[symbol] != 0)
h->symbol[offs[length[symbol]]++] = symbol;
return left;
}
static int puff_codes(struct puff_state* s,
const struct puff_huffman* lencode,
const struct puff_huffman* distcode)
{
static const short lens[29] = {
3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17, 19, 23, 27, 31,
35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258};
static const short lext[29] = {
0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2,
3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0};
static const short dists[30] = {
1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193,
257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145,
8193, 12289, 16385, 24577};
static const short dext[30] = {
0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6,
7, 7, 8, 8, 9, 9, 10, 10, 11, 11,
12, 12, 13, 13};
int symbol;
do {
symbol = puff_decode(s, lencode);
if (symbol < 0)
return symbol;
if (symbol < 256) {
if (s->outcnt == s->outlen)
return 1;
if (symbol)
s->out[s->outcnt] = symbol;
s->outcnt++;
} else if (symbol > 256) {
symbol -= 257;
if (symbol >= 29)
return -10;
int len = lens[symbol] + puff_bits(s, lext[symbol]);
symbol = puff_decode(s, distcode);
if (symbol < 0)
return symbol;
unsigned dist = dists[symbol] + puff_bits(s, dext[symbol]);
if (dist > s->outcnt)
return -11;
if (s->outcnt + len > s->outlen)
return 1;
while (len--) {
if (dist <= s->outcnt && s->out[s->outcnt - dist])
s->out[s->outcnt] = s->out[s->outcnt - dist];
s->outcnt++;
}
}
} while (symbol != 256);
return 0;
}
static int puff_fixed(struct puff_state* s)
{
static int virgin = 1;
static short lencnt[MAXBITS + 1], lensym[FIXLCODES];
static short distcnt[MAXBITS + 1], distsym[MAXDCODES];
static struct puff_huffman lencode, distcode;
if (virgin) {
lencode.count = lencnt;
lencode.symbol = lensym;
distcode.count = distcnt;
distcode.symbol = distsym;
short lengths[FIXLCODES];
int symbol;
for (symbol = 0; symbol < 144; symbol++)
lengths[symbol] = 8;
for (; symbol < 256; symbol++)
lengths[symbol] = 9;
for (; symbol < 280; symbol++)
lengths[symbol] = 7;
for (; symbol < FIXLCODES; symbol++)
lengths[symbol] = 8;
puff_construct(&lencode, lengths, FIXLCODES);
for (symbol = 0; symbol < MAXDCODES; symbol++)
lengths[symbol] = 5;
puff_construct(&distcode, lengths, MAXDCODES);
virgin = 0;
}
return puff_codes(s, &lencode, &distcode);
}
static int puff_dynamic(struct puff_state* s)
{
static const short order[19] =
{16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15};
int nlen = puff_bits(s, 5) + 257;
int ndist = puff_bits(s, 5) + 1;
int ncode = puff_bits(s, 4) + 4;
if (nlen > MAXLCODES || ndist > MAXDCODES)
return -3;
short lengths[MAXCODES];
int index;
for (index = 0; index < ncode; index++)
lengths[order[index]] = puff_bits(s, 3);
for (; index < 19; index++)
lengths[order[index]] = 0;
short lencnt[MAXBITS + 1], lensym[MAXLCODES];
struct puff_huffman lencode = {lencnt, lensym};
int err = puff_construct(&lencode, lengths, 19);
if (err != 0)
return -4;
index = 0;
while (index < nlen + ndist) {
int symbol;
int len;
symbol = puff_decode(s, &lencode);
if (symbol < 0)
return symbol;
if (symbol < 16)
lengths[index++] = symbol;
else {
len = 0;
if (symbol == 16) {
if (index == 0)
return -5;
len = lengths[index - 1];
symbol = 3 + puff_bits(s, 2);
} else if (symbol == 17)
symbol = 3 + puff_bits(s, 3);
else
symbol = 11 + puff_bits(s, 7);
if (index + symbol > nlen + ndist)
return -6;
while (symbol--)
lengths[index++] = len;
}
}
if (lengths[256] == 0)
return -9;
err = puff_construct(&lencode, lengths, nlen);
if (err && (err < 0 || nlen != lencode.count[0] + lencode.count[1]))
return -7;
short distcnt[MAXBITS + 1], distsym[MAXDCODES];
struct puff_huffman distcode = {distcnt, distsym};
err = puff_construct(&distcode, lengths + nlen, ndist);
if (err && (err < 0 || ndist != distcode.count[0] + distcode.count[1]))
return -8;
return puff_codes(s, &lencode, &distcode);
}
static int puff(
unsigned char* dest,
unsigned long* destlen,
const unsigned char* source,
unsigned long sourcelen)
{
struct puff_state s = {
.out = dest,
.outlen = *destlen,
.outcnt = 0,
.in = source,
.inlen = sourcelen,
.incnt = 0,
.bitbuf = 0,
.bitcnt = 0,
};
int err;
if (setjmp(s.env) != 0)
err = 2;
else {
int last;
do {
last = puff_bits(&s, 1);
int type = puff_bits(&s, 2);
err = type == 0 ? puff_stored(&s) : (type == 1 ? puff_fixed(&s) : (type == 2 ? puff_dynamic(&s) : -1));
if (err != 0)
break;
} while (!last);
}
*destlen = s.outcnt;
return err;
}
//% END CODE DERIVED FROM puff.{c,h}
#define ZLIB_HEADER_WIDTH 2
static int puff_zlib_to_file(const unsigned char* source, unsigned long sourcelen, int dest_fd)
{
if (sourcelen < ZLIB_HEADER_WIDTH)
return 0;
source += ZLIB_HEADER_WIDTH;
sourcelen -= ZLIB_HEADER_WIDTH;
const unsigned long max_destlen = 132 << 20;
void* ret = mmap(0, max_destlen, PROT_WRITE | PROT_READ, MAP_PRIVATE | MAP_ANON, -1, 0);
if (ret == MAP_FAILED)
return -1;
unsigned char* dest = (unsigned char*)ret;
unsigned long destlen = max_destlen;
int err = puff(dest, &destlen, source, sourcelen);
if (err) {
munmap(dest, max_destlen);
errno = -err;
return -1;
}
if (write(dest_fd, dest, destlen) != (ssize_t)destlen) {
munmap(dest, max_destlen);
return -1;
}
return munmap(dest, max_destlen);
}
static int setup_loop_device(unsigned char* data, unsigned long size, const char* loopname, int* loopfd_p)
{
int err = 0, loopfd = -1;
int memfd = syscall(__NR_memfd_create, "syzkaller", 0);
if (memfd == -1) {
err = errno;
goto error;
}
if (puff_zlib_to_file(data, size, memfd)) {
err = errno;
goto error_close_memfd;
}
loopfd = open(loopname, O_RDWR);
if (loopfd == -1) {
err = errno;
goto error_close_memfd;
}
if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
if (errno != EBUSY) {
err = errno;
goto error_close_loop;
}
ioctl(loopfd, LOOP_CLR_FD, 0);
usleep(1000);
if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
err = errno;
goto error_close_loop;
}
}
close(memfd);
*loopfd_p = loopfd;
return 0;
error_close_loop:
close(loopfd);
error_close_memfd:
close(memfd);
error:
errno = err;
return -1;
}
static void reset_loop_device(const char* loopname)
{
int loopfd = open(loopname, O_RDWR);
if (loopfd == -1) {
return;
}
if (ioctl(loopfd, LOOP_CLR_FD, 0)) {
}
close(loopfd);
}
static long syz_mount_image(
volatile long fsarg,
volatile long dir,
volatile long flags,
volatile long optsarg,
volatile long change_dir,
volatile unsigned long size,
volatile long image)
{
unsigned char* data = (unsigned char*)image;
int res = -1, err = 0, need_loop_device = !!size;
char* mount_opts = (char*)optsarg;
char* target = (char*)dir;
char* fs = (char*)fsarg;
char* source = NULL;
char loopname[64];
if (need_loop_device) {
int loopfd;
memset(loopname, 0, sizeof(loopname));
snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid);
if (setup_loop_device(data, size, loopname, &loopfd) == -1)
return -1;
close(loopfd);
source = loopname;
}
mkdir(target, 0777);
char opts[256];
memset(opts, 0, sizeof(opts));
if (strlen(mount_opts) > (sizeof(opts) - 32)) {
}
strncpy(opts, mount_opts, sizeof(opts) - 32);
if (strcmp(fs, "iso9660") == 0) {
flags |= MS_RDONLY;
} else if (strncmp(fs, "ext", 3) == 0) {
bool has_remount_ro = false;
char* remount_ro_start = strstr(opts, "errors=remount-ro");
if (remount_ro_start != NULL) {
char after = *(remount_ro_start + strlen("errors=remount-ro"));
char before = remount_ro_start == opts ? '\0' : *(remount_ro_start - 1);
has_remount_ro = ((before == '\0' || before == ',') && (after == '\0' || after == ','));
}
if (strstr(opts, "errors=panic") || !has_remount_ro)
strcat(opts, ",errors=continue");
} else if (strcmp(fs, "xfs") == 0) {
strcat(opts, ",nouuid");
} else if (strncmp(fs, "gfs2", 4) == 0 && (strstr(opts, "errors=panic") || strstr(opts, "debug"))) {
strcat(opts, ",errors=withdraw");
}
res = mount(source, target, fs, flags, opts);
if (res == -1) {
err = errno;
goto error_clear_loop;
}
res = open(target, O_RDONLY | O_DIRECTORY);
if (res == -1) {
err = errno;
goto error_clear_loop;
}
if (change_dir) {
res = chdir(target);
if (res == -1) {
err = errno;
}
}
error_clear_loop:
if (need_loop_device)
reset_loop_device(loopname);
errno = err;
return res;
}
uint64_t r[1] = {0xffffffffffffffff};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// syz_mount_image$ext4 arguments: [
// fs: ptr[in, buffer] {
// buffer: {65 78 74 34 00} (length 0x5)
// }
// dir: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 31 00} (length 0x8)
// }
// flags: mount_flags = 0x0 (8 bytes)
// opts: ptr[in, fs_options[ext4_options]] {
// fs_options[ext4_options] {
// elems: array[fs_opt_elem[ext4_options]] {
// fs_opt_elem[ext4_options] {
// elem: union ext4_options {
// data_err_ignore: buffer: {64 61 74 61 5f 65 72 72 3d 69 67 6e 6f 72 65} (length 0xf)
// }
// comma: const = 0x2c (1 bytes)
// }
// fs_opt_elem[ext4_options] {
// elem: union ext4_options {
// dioread_nolock: buffer: {64 69 6f 72 65 61 64 5f 6e 6f 6c 6f 63 6b} (length 0xe)
// }
// comma: const = 0x2c (1 bytes)
// }
// fs_opt_elem[ext4_options] {
// elem: union ext4_options {
// debug_want_extra_isize: fs_opt["debug_want_extra_isize", fmt[hex, int32]] {
// name: buffer: {64 65 62 75 67 5f 77 61 6e 74 5f 65 78 74 72 61 5f 69 73 69 7a 65} (length 0x16)
// eq: const = 0x3d (1 bytes)
// val: int32 = 0x5a (18 bytes)
// }
// }
// comma: const = 0x2c (1 bytes)
// }
// fs_opt_elem[ext4_options] {
// elem: union ext4_options {
// prjquota: buffer: {70 72 6a 71 75 6f 74 61} (length 0x8)
// }
// comma: const = 0x2c (1 bytes)
// }
// fs_opt_elem[ext4_options] {
// elem: union ext4_options {
// max_dir_size_kb: fs_opt["max_dir_size_kb", fmt[hex, int32]] {
// name: buffer: {6d 61 78 5f 64 69 72 5f 73 69 7a 65 5f 6b 62} (length 0xf)
// eq: const = 0x3d (1 bytes)
// val: int32 = 0x4 (18 bytes)
// }
// }
// comma: const = 0x2c (1 bytes)
// }
// fs_opt_elem[ext4_options] {
// elem: union ext4_options {
// debug_want_extra_isize: fs_opt["debug_want_extra_isize", fmt[hex, int32]] {
// name: buffer: {64 65 62 75 67 5f 77 61 6e 74 5f 65 78 74 72 61 5f 69 73 69 7a 65} (length 0x16)
// eq: const = 0x3d (1 bytes)
// val: int32 = 0x3a (18 bytes)
// }
// }
// comma: const = 0x2c (1 bytes)
// }
// fs_opt_elem[ext4_options] {
// elem: union ext4_options {
// min_batch_time: fs_opt["min_batch_time", fmt[hex, int32]] {
// name: buffer: {6d 69 6e 5f 62 61 74 63 68 5f 74 69 6d 65} (length 0xe)
// eq: const = 0x3d (1 bytes)
// val: int32 = 0x3 (18 bytes)
// }
// }
// comma: const = 0x2c (1 bytes)
// }
// }
// common: array[fs_opt_elem[fs_options_common]] {
// }
// null: const = 0x0 (1 bytes)
// }
// }
// chdir: int8 = 0x1 (1 bytes)
// size: len = 0x47a (8 bytes)
// img: ptr[in, buffer] {
// buffer: (compressed buffer with length 0x47a)
// }
// ]
// returns fd_dir
memcpy((void*)0x200000000180, "ext4\000", 5);
memcpy((void*)0x200000000000, "./file1\000", 8);
memcpy((void*)0x200000000b40, "data_err=ignore", 15);
*(uint8_t*)0x200000000b4f = 0x2c;
memcpy((void*)0x200000000b50, "dioread_nolock", 14);
*(uint8_t*)0x200000000b5e = 0x2c;
memcpy((void*)0x200000000b5f, "debug_want_extra_isize", 22);
*(uint8_t*)0x200000000b75 = 0x3d;
sprintf((char*)0x200000000b76, "0x%016llx", (long long)0x5a);
*(uint8_t*)0x200000000b88 = 0x2c;
memcpy((void*)0x200000000b89, "prjquota", 8);
*(uint8_t*)0x200000000b91 = 0x2c;
memcpy((void*)0x200000000b92, "max_dir_size_kb", 15);
*(uint8_t*)0x200000000ba1 = 0x3d;
sprintf((char*)0x200000000ba2, "0x%016llx", (long long)4);
*(uint8_t*)0x200000000bb4 = 0x2c;
memcpy((void*)0x200000000bb5, "debug_want_extra_isize", 22);
*(uint8_t*)0x200000000bcb = 0x3d;
sprintf((char*)0x200000000bcc, "0x%016llx", (long long)0x3a);
*(uint8_t*)0x200000000bde = 0x2c;
memcpy((void*)0x200000000bdf, "min_batch_time", 14);
*(uint8_t*)0x200000000bed = 0x3d;
sprintf((char*)0x200000000bee, "0x%016llx", (long long)3);
*(uint8_t*)0x200000000c00 = 0x2c;
*(uint8_t*)0x200000000c01 = 0;
memcpy((void*)0x2000000001c0, "... [truncated large byte array] ...", 1146);
syz_mount_image(/*fs=*/0x200000000180, /*dir=*/0x200000000000, /*flags=*/0, /*opts=*/0x200000000b40, /*chdir=*/1, /*size=*/0x47a, /*img=*/0x2000000001c0);
// syz_mount_image$ext4 arguments: [
// fs: ptr[in, buffer] {
// buffer: {65 78 74 34 00} (length 0x5)
// }
// dir: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 31 00} (length 0x8)
// }
// flags: mount_flags = 0x21081e (8 bytes)
// opts: ptr[in, fs_options[ext4_options]] {
// fs_options[ext4_options] {
// elems: array[fs_opt_elem[ext4_options]] {
// fs_opt_elem[ext4_options] {
// elem: union ext4_options {
// grpquota: buffer: {67 72 70 71 75 6f 74 61} (length 0x8)
// }
// comma: const = 0x2c (1 bytes)
// }
// fs_opt_elem[ext4_options] {
// elem: union ext4_options {
// nogrpid: buffer: {6e 6f 67 72 70 69 64} (length 0x7)
// }
// comma: const = 0x2c (1 bytes)
// }
// fs_opt_elem[ext4_options] {
// elem: union ext4_options {
// quota: buffer: {71 75 6f 74 61} (length 0x5)
// }
// comma: const = 0x2c (1 bytes)
// }
// }
// common: array[fs_opt_elem[fs_options_common]] {
// }
// null: const = 0x0 (1 bytes)
// }
// }
// chdir: int8 = 0x1 (1 bytes)
// size: len = 0x4fa (8 bytes)
// img: ptr[in, buffer] {
// buffer: (compressed buffer with length 0x4fa)
// }
// ]
// returns fd_dir
memcpy((void*)0x200000000180, "ext4\000", 5);
memcpy((void*)0x200000000040, "./file1\000", 8);
memcpy((void*)0x2000000001c0, "grpquota", 8);
*(uint8_t*)0x2000000001c8 = 0x2c;
memcpy((void*)0x2000000001c9, "nogrpid", 7);
*(uint8_t*)0x2000000001d0 = 0x2c;
memcpy((void*)0x2000000001d1, "quota", 5);
*(uint8_t*)0x2000000001d6 = 0x2c;
*(uint8_t*)0x2000000001d7 = 0;
memcpy((void*)0x2000000005c0, "... [truncated large byte array] ...", 1274);
syz_mount_image(/*fs=*/0x200000000180, /*dir=*/0x200000000040, /*flags=MS_POSIXACL|MS_SYNCHRONOUS|MS_RELATIME|MS_NOSUID|0x80c*/0x21081e, /*opts=*/0x2000000001c0, /*chdir=*/1, /*size=*/0x4fa, /*img=*/0x2000000005c0);
// openat arguments: [
// fd: fd_dir (resource)
// file: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 31 00} (length 0x8)
// }
// flags: open_flags = 0x101e42 (4 bytes)
// mode: open_mode = 0x33 (2 bytes)
// ]
// returns fd
memcpy((void*)0x200000000040, "./file1\000", 8);
res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000040ul, /*flags=O_TRUNC|O_SYNC|O_NONBLOCK|O_CREAT|O_APPEND|O_RDWR*/0x101e42, /*mode=S_IXOTH|S_IWOTH|S_IWGRP|S_IRGRP*/0x33);
if (res != -1)
r[0] = res;
// ioctl$FS_IOC_SETFLAGS arguments: [
// fd: fd (resource)
// cmd: const = 0x40086602 (4 bytes)
// arg: ptr[in, fs_flags] {
// fs_flags = 0x4000 (4 bytes)
// }
// ]
*(uint32_t*)0x200000000340 = 0x4000;
syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x40086602, /*arg=*/0x200000000340ul);
// ioctl$EXT4_IOC_MIGRATE arguments: [
// fd: fd (resource)
// cmd: const = 0x6609 (4 bytes)
// ]
syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x6609, 0);
return 0;
}
]
|
| 2/1 |
2026/05/17 10:49 |
action |
kernel-checkouter |
2m
Results: map[KernelSrc:/app/workdir/cache/src/316e237849c78635c7c5ae4b5398d0fa5c963d95]
|
| 3/1 |
2026/05/17 10:51 |
action |
kernel-builder |
29m
Results: map[KernelObj:/app/workdir/cache/build/41fa0c243791648e2dc2754d3d9fa91174ddf425]
|
| 4/1 |
2026/05/17 11:21 |
action |
codesearch-prepare |
22m
Results: map[Index:codesearch-index]
|
| 5/1 |
2026/05/17 11:43 |
agent |
expert |
8m
Model:
Results: map[DenialOfService:false Exploitable:false FilesystemTrigger:true NetworkTrigger:false PeripheralTrigger:false RemoteTrigger:false Unprivileged:true UserNamespace:false VMGuestTrigger:false VMHostTrigger:false]
Instruction:
You are an experienced Linux kernel security engineer. Your task is to analyze given kernel bug report
and determine its security impact based on the following dimensions.
Use the provided tools to examine the source code, check for capability checks (e.g., capable(), ns_capable()),
and understand the nature of the bug. Analyze the given kernel build and configuration.
You can check the kernel config by grepping ".config" file; you can check kernel cmdline by greeping
".config" file for "CONFIG_CMDLINE=". Assume sysctl parameters have default values.
But analyze for the corresponding production build w/o debugging tools enabled (like KASAN, KMSAN, UBSAN).
Don't make assumptions; verify them with source code access. Try different strategies when analyzing the bug:
- think of ways in which the vulnerable code is unreachable
- or the other way around: try to come up with different ideas of how an unprivileged user can reach the bug
If still unsure err on the side of the bug being non-exploitable/not-accessible.
In the final reply, provide a reasoning for your assessment.
Analysis dimensions:
* Exploitable:
Determine if the bug can result in memory corruption or elevated privileges.
Memory safety issues are almost always exploitable (KASAN or UBSAN reports for use-after-free, out-of-bounds;
refcounting issues, corrupted lists, etc). When kernel is crashing on a completly wild pointer access
(e.g. user-space address, or non-canonical address, but not on NULL or address corresponding to KASAN shadow
for NULL address), including both data accesses and control tranfers, that's also usually implies possibility
of exploitation. Such reports usually say "unable to handle kernel paging request".
Uses of uninitialized values detected by KMSAN may be exploitable b/c attacker frequently can affect uninit
values with spraying techniques. However, for these exploitabability depends on how exactly the uninit value
is used in the code, and what it affects.
Think of what happens after the bug is triggered. Some bugs cause kernel panic and halt execution,
they are harder to exploit. For example, BUG reports halts the kernel. However, WARNING reports don't halt
execution in production builds. Debug bug detection tools (like KASAN, KMSAN, KCSAN, UBSAN) are also not enabled
in production builds, so attacker can freely exploit these bugs w/o being detected by these tools.
If you see an integer overflow, think how the overflowed value used later (if it's used as allocation size,
or an array index). If you see an out-of-bounds read, think if it's followed by an out-of-bounds write as well.
Some KCSAN data-races may be exploitable by skilled attackers as well. Think what data structures got corrupted
as the result of data races and how. However, note that kernel has lots of "benign" data races that don't lead
to any runtime misbehavior at all.
* Denial Of Service:
Determine if the bug can result in denial-of-service. Most bugs can, since they cause system crash,
hangs, deadlocks, or resource leaks. This is mostly applicable to WARNING bugs that won't cause system crash
in production. For these think what will be consequences of the violation of the kernel assumptions flagged
by the WARNING. In some cases the unexpected condition is also properly handled by the normal control flow
(e.g. with "if (WARN_ON(...))"), these won't cause denial-of-service. If the condition is not handled,
then it may or may not cause denial-of-service.
* Accessible From Unprivileged Processes:
Determine if the bug can be reached from a typical (non-root) user process that does NOT have any special capabilities
(like CAP_SYS_ADMIN, CAP_NET_ADMIN, CAP_NET_RAW, CAP_PERFMON) or access to device nodes restricted to root.
Assume that unprivileged_bpf_disabled=1, that is eBPF loading is not accessible. However, cBPF (classical BPF)
is still accessible to non-root processes.
Assume that user namespaces are not accessible, that is, the process cannot get the mentioned capabilities even
within a new user namespace (checked by ns_capable() function in the kernel sources).
* Accessible From User Namespaces:
Determine if the bug can be reached within a user-namespace where the process has all capabilities
(including CAP_SYS_ADMIN, CAP_NET_ADMIN, CAP_NET_RAW, CAP_PERFMON). Such capabilities are checked with ns_capable()
function in the kernel sources.
* VM Guest Trigger:
Determine if the bug can be triggered from the context of a typical KVM guest (e.g., set up by a QEMU VMM).
Consider accesses to standard Linux host paravirtualized features (virtio-blk, virtio-net, etc.),
and handling of VM exits in the KVM code.
* VM Host Trigger in The Confidetial Computing Context:
Determine if the bug can be triggered in a confidential computing guest kernel from the context of a KVM host.
Consider access to standard Linux guest paravirtualized features (virtio-blk, virtio-net, etc.).
* Ethernet Network Trigger:
Determine if the bug can be triggered by processing ingress network Ethernet traffic, either directly (network stack)
or via drivers exposed to network data.
* Other Remote Trigger:
Determine if the bug can be triggered by processing remote traffic other than Ethernet (Wifi, Bluetooth, NFC, etc).
* Peripheral Trigger:
Determine if the bug can be triggered via an untrusted peripheral device that can be physically plugged
into a system, such as a USB device or a niche hardware driver handling external hardware inputs.
This is particularly important for mobile and desktop environments where users can plug in unknown devices.
* Malicious Filesystem Trigger:
Determine if the bug can be triggered by the kernel mounting and parsing a malicious filesystem image.
This is highly critical for Desktop and Mobile environments where external media or downloaded images
might be auto-mounted.
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt:
The kernel bug report is:
EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
ext4 filesystem being mounted at /24/file1 supports timestamps until 2038-01-19 (0x7fffffff)
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.0.41/5967 is trying to acquire lock:
ffff888044935368 (&ei->xattr_sem){++++}-{4:4}, at: ext4_write_lock_xattr fs/ext4/xattr.h:157 [inline]
ffff888044935368 (&ei->xattr_sem){++++}-{4:4}, at: ext4_xattr_set_handle+0x19c/0x14c0 fs/ext4/xattr.c:2374
but task is already holding lock:
ffff8880247d4cd8 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages_down_write fs/ext4/ext4.h:1823 [inline]
ffff8880247d4cd8 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_ext_migrate+0x308/0x1130 fs/ext4/migrate.c:438
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&sbi->s_writepages_rwsem){++++}-{0:0}:
percpu_down_read_internal+0x48/0x1d0 include/linux/percpu-rwsem.h:53
percpu_down_read include/linux/percpu-rwsem.h:77 [inline]
ext4_writepages_down_read fs/ext4/ext4.h:1811 [inline]
ext4_writepages+0x205/0x3b0 fs/ext4/inode.c:3041
do_writepages+0x32e/0x550 mm/page-writeback.c:2575
__writeback_single_inode+0x133/0x10e0 fs/fs-writeback.c:1764
writeback_single_inode+0x488/0xd60 fs/fs-writeback.c:1883
write_inode_now+0x1c2/0x290 fs/fs-writeback.c:2974
iput_final fs/inode.c:1950 [inline]
iput+0x8c1/0xe80 fs/inode.c:2009
ext4_xattr_block_set+0x2359/0x2ad0 fs/ext4/xattr.c:2153
ext4_xattr_move_to_block fs/ext4/xattr.c:2671 [inline]
ext4_xattr_make_inode_space fs/ext4/xattr.c:2746 [inline]
ext4_expand_extra_isize_ea+0x12cf/0x1ea0 fs/ext4/xattr.c:2834
__ext4_expand_extra_isize+0x30d/0x400 fs/ext4/inode.c:6434
ext4_try_to_expand_extra_isize fs/ext4/inode.c:6477 [inline]
__ext4_mark_inode_dirty+0x45c/0x710 fs/ext4/inode.c:6555
ext4_evict_inode+0x986/0x10e0 fs/ext4/inode.c:267
evict+0x61e/0xb10 fs/inode.c:841
ext4_orphan_cleanup+0xc38/0x1470 fs/ext4/orphan.c:472
__ext4_fill_super fs/ext4/super.c:5701 [inline]
ext4_fill_super+0x59bb/0x62d0 fs/ext4/super.c:5824
get_tree_bdev_flags+0x431/0x4f0 fs/super.c:1694
vfs_get_tree+0x92/0x2a0 fs/super.c:1754
fc_mount fs/namespace.c:1193 [inline]
do_new_mount_fc fs/namespace.c:3758 [inline]
do_new_mount+0x341/0xd30 fs/namespace.c:3834
do_mount fs/namespace.c:4167 [inline]
__do_sys_mount fs/namespace.c:4383 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4360
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (&ei->xattr_sem){++++}-{4:4}:
check_prev_add kernel/locking/lockdep.c:3165 [inline]
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain kernel/locking/lockdep.c:3908 [inline]
__lock_acquire+0x15a5/0x2cf0 kernel/locking/lockdep.c:5237
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868
down_write+0x3a/0x50 kernel/locking/rwsem.c:1625
ext4_write_lock_xattr fs/ext4/xattr.h:157 [inline]
ext4_xattr_set_handle+0x19c/0x14c0 fs/ext4/xattr.c:2374
ext4_initxattrs+0x9f/0x110 fs/ext4/xattr_security.c:44
security_inode_init_security+0x296/0x3d0 security/security.c:1370
__ext4_new_inode+0x3319/0x3ce0 fs/ext4/ialloc.c:1330
ext4_ext_migrate+0x71d/0x1130 fs/ext4/migrate.c:462
__ext4_ioctl fs/ext4/ioctl.c:1693 [inline]
ext4_ioctl+0x2355/0x4b40 fs/ext4/ioctl.c:1922
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xff/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&sbi->s_writepages_rwsem);
lock(&ei->xattr_sem);
lock(&sbi->s_writepages_rwsem);
lock(&ei->xattr_sem);
*** DEADLOCK ***
3 locks held by syz.0.41/5967:
#0: ffff88802ac52480 (sb_writers#4){.+.+}-{0:0}, at: mnt_want_write_file+0x63/0x210 fs/namespace.c:537
#1: ffff8880448f56d0 (&sb->s_type->i_mutex_key#10){++++}-{4:4}, at: inode_lock include/linux/fs.h:1029 [inline]
#1: ffff8880448f56d0 (&sb->s_type->i_mutex_key#10){++++}-{4:4}, at: __ext4_ioctl fs/ext4/ioctl.c:1692 [inline]
#1: ffff8880448f56d0 (&sb->s_type->i_mutex_key#10){++++}-{4:4}, at: ext4_ioctl+0x234d/0x4b40 fs/ext4/ioctl.c:1922
#2: ffff8880247d4cd8 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages_down_write fs/ext4/ext4.h:1823 [inline]
#2: ffff8880247d4cd8 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_ext_migrate+0x308/0x1130 fs/ext4/migrate.c:438
stack backtrace:
CPU: 1 UID: 0 PID: 5967 Comm: syz.0.41 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_circular_bug+0x2e1/0x300 kernel/locking/lockdep.c:2043
check_noncircular+0x12e/0x150 kernel/locking/lockdep.c:2175
check_prev_add kernel/locking/lockdep.c:3165 [inline]
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain kernel/locking/lockdep.c:3908 [inline]
__lock_acquire+0x15a5/0x2cf0 kernel/locking/lockdep.c:5237
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868
down_write+0x3a/0x50 kernel/locking/rwsem.c:1625
ext4_write_lock_xattr fs/ext4/xattr.h:157 [inline]
ext4_xattr_set_handle+0x19c/0x14c0 fs/ext4/xattr.c:2374
ext4_initxattrs+0x9f/0x110 fs/ext4/xattr_security.c:44
security_inode_init_security+0x296/0x3d0 security/security.c:1370
__ext4_new_inode+0x3319/0x3ce0 fs/ext4/ialloc.c:1330
ext4_ext_migrate+0x71d/0x1130 fs/ext4/migrate.c:462
__ext4_ioctl fs/ext4/ioctl.c:1693 [inline]
ext4_ioctl+0x2355/0x4b40 fs/ext4/ioctl.c:1922
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xff/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f617509cdd9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffec3753a08 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f6175315fa0 RCX: 00007f617509cdd9
RDX: 0000000000000000 RSI: 0000000000006609 RDI: 0000000000000004
RBP: 00007f6175132d69 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6175315fac R14: 00007f6175315fa0 R15: 00007f6175315fa0
</TASK>
EXT4-fs error (device loop0): ext4_do_update_inode:5690: inode #18: comm syz.0.41: corrupted inode contents
EXT4-fs error (device loop0): ext4_dirty_inode:6587: inode #18: comm syz.0.41: mark_inode_dirty error
EXT4-fs error (device loop0): ext4_do_update_inode:5690: inode #18: comm syz.0.41: corrupted inode contents
EXT4-fs error (device loop0): ext4_xattr_delete_inode:3001: inode #18: comm syz.0.41: mark_inode_dirty error
EXT4-fs error (device loop0): ext4_xattr_delete_inode:3004: inode #18: comm syz.0.41: mark inode dirty (error -117)
EXT4-fs warning (device loop0): ext4_evict_inode:287: xattr delete (err -117)
It is reproducible with the followint program.
Keep in mind that it may lack the precise threading, sandboxing, and some arguments of a working reproducer.
But it should give an idea of the involved syscalls.
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <setjmp.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#include <linux/loop.h>
#ifndef __NR_memfd_create
#define __NR_memfd_create 319
#endif
static unsigned long long procid;
//% This code is derived from puff.{c,h}, found in the zlib development. The
//% original files come with the following copyright notice:
//% Copyright (C) 2002-2013 Mark Adler, all rights reserved
//% version 2.3, 21 Jan 2013
//% This software is provided 'as-is', without any express or implied
//% warranty. In no event will the author be held liable for any damages
//% arising from the use of this software.
//% Permission is granted to anyone to use this software for any purpose,
//% including commercial applications, and to alter it and redistribute it
//% freely, subject to the following restrictions:
//% 1. The origin of this software must not be misrepresented; you must not
//% claim that you wrote the original software. If you use this software
//% in a product, an acknowledgment in the product documentation would be
//% appreciated but is not required.
//% 2. Altered source versions must be plainly marked as such, and must not be
//% misrepresented as being the original software.
//% 3. This notice may not be removed or altered from any source distribution.
//% Mark Adler madler@alumni.caltech.edu
//% BEGIN CODE DERIVED FROM puff.{c,h}
#define MAXBITS 15
#define MAXLCODES 286
#define MAXDCODES 30
#define MAXCODES (MAXLCODES + MAXDCODES)
#define FIXLCODES 288
struct puff_state {
unsigned char* out;
unsigned long outlen;
unsigned long outcnt;
const unsigned char* in;
unsigned long inlen;
unsigned long incnt;
int bitbuf;
int bitcnt;
jmp_buf env;
};
static int puff_bits(struct puff_state* s, int need)
{
long val = s->bitbuf;
while (s->bitcnt < need) {
if (s->incnt == s->inlen)
longjmp(s->env, 1);
val |= (long)(s->in[s->incnt++]) << s->bitcnt;
s->bitcnt += 8;
}
s->bitbuf = (int)(val >> need);
s->bitcnt -= need;
return (int)(val & ((1L << need) - 1));
}
static int puff_stored(struct puff_state* s)
{
s->bitbuf = 0;
s->bitcnt = 0;
if (s->incnt + 4 > s->inlen)
return 2;
unsigned len = s->in[s->incnt++];
len |= s->in[s->incnt++] << 8;
if (s->in[s->incnt++] != (~len & 0xff) ||
s->in[s->incnt++] != ((~len >> 8) & 0xff))
return -2;
if (s->incnt + len > s->inlen)
return 2;
if (s->outcnt + len > s->outlen)
return 1;
for (; len--; s->outcnt++, s->incnt++) {
if (s->in[s->incnt])
s->out[s->outcnt] = s->in[s->incnt];
}
return 0;
}
struct puff_huffman {
short* count;
short* symbol;
};
static int puff_decode(struct puff_state* s, const struct puff_huffman* h)
{
int first = 0;
int index = 0;
int bitbuf = s->bitbuf;
int left = s->bitcnt;
int code = first = index = 0;
int len = 1;
short* next = h->count + 1;
while (1) {
while (left--) {
code |= bitbuf & 1;
bitbuf >>= 1;
int count = *next++;
if (code - count < first) {
s->bitbuf = bitbuf;
s->bitcnt = (s->bitcnt - len) & 7;
return h->symbol[index + (code - first)];
}
index += count;
first += count;
first <<= 1;
code <<= 1;
len++;
}
left = (MAXBITS + 1) - len;
if (left == 0)
break;
if (s->incnt == s->inlen)
longjmp(s->env, 1);
bitbuf = s->in[s->incnt++];
if (left > 8)
left = 8;
}
return -10;
}
static int puff_construct(struct puff_huffman* h, const short* length, int n)
{
int len;
for (len = 0; len <= MAXBITS; len++)
h->count[len] = 0;
int symbol;
for (symbol = 0; symbol < n; symbol++)
(h->count[length[symbol]])++;
if (h->count[0] == n)
return 0;
int left = 1;
for (len = 1; len <= MAXBITS; len++) {
left <<= 1;
left -= h->count[len];
if (left < 0)
return left;
}
short offs[MAXBITS + 1];
offs[1] = 0;
for (len = 1; len < MAXBITS; len++)
offs[len + 1] = offs[len] + h->count[len];
for (symbol = 0; symbol < n; symbol++)
if (length[symbol] != 0)
h->symbol[offs[length[symbol]]++] = symbol;
return left;
}
static int puff_codes(struct puff_state* s,
const struct puff_huffman* lencode,
const struct puff_huffman* distcode)
{
static const short lens[29] = {
3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17, 19, 23, 27, 31,
35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258};
static const short lext[29] = {
0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2,
3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0};
static const short dists[30] = {
1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193,
257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145,
8193, 12289, 16385, 24577};
static const short dext[30] = {
0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6,
7, 7, 8, 8, 9, 9, 10, 10, 11, 11,
12, 12, 13, 13};
int symbol;
do {
symbol = puff_decode(s, lencode);
if (symbol < 0)
return symbol;
if (symbol < 256) {
if (s->outcnt == s->outlen)
return 1;
if (symbol)
s->out[s->outcnt] = symbol;
s->outcnt++;
} else if (symbol > 256) {
symbol -= 257;
if (symbol >= 29)
return -10;
int len = lens[symbol] + puff_bits(s, lext[symbol]);
symbol = puff_decode(s, distcode);
if (symbol < 0)
return symbol;
unsigned dist = dists[symbol] + puff_bits(s, dext[symbol]);
if (dist > s->outcnt)
return -11;
if (s->outcnt + len > s->outlen)
return 1;
while (len--) {
if (dist <= s->outcnt && s->out[s->outcnt - dist])
s->out[s->outcnt] = s->out[s->outcnt - dist];
s->outcnt++;
}
}
} while (symbol != 256);
return 0;
}
static int puff_fixed(struct puff_state* s)
{
static int virgin = 1;
static short lencnt[MAXBITS + 1], lensym[FIXLCODES];
static short distcnt[MAXBITS + 1], distsym[MAXDCODES];
static struct puff_huffman lencode, distcode;
if (virgin) {
lencode.count = lencnt;
lencode.symbol = lensym;
distcode.count = distcnt;
distcode.symbol = distsym;
short lengths[FIXLCODES];
int symbol;
for (symbol = 0; symbol < 144; symbol++)
lengths[symbol] = 8;
for (; symbol < 256; symbol++)
lengths[symbol] = 9;
for (; symbol < 280; symbol++)
lengths[symbol] = 7;
for (; symbol < FIXLCODES; symbol++)
lengths[symbol] = 8;
puff_construct(&lencode, lengths, FIXLCODES);
for (symbol = 0; symbol < MAXDCODES; symbol++)
lengths[symbol] = 5;
puff_construct(&distcode, lengths, MAXDCODES);
virgin = 0;
}
return puff_codes(s, &lencode, &distcode);
}
static int puff_dynamic(struct puff_state* s)
{
static const short order[19] =
{16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15};
int nlen = puff_bits(s, 5) + 257;
int ndist = puff_bits(s, 5) + 1;
int ncode = puff_bits(s, 4) + 4;
if (nlen > MAXLCODES || ndist > MAXDCODES)
return -3;
short lengths[MAXCODES];
int index;
for (index = 0; index < ncode; index++)
lengths[order[index]] = puff_bits(s, 3);
for (; index < 19; index++)
lengths[order[index]] = 0;
short lencnt[MAXBITS + 1], lensym[MAXLCODES];
struct puff_huffman lencode = {lencnt, lensym};
int err = puff_construct(&lencode, lengths, 19);
if (err != 0)
return -4;
index = 0;
while (index < nlen + ndist) {
int symbol;
int len;
symbol = puff_decode(s, &lencode);
if (symbol < 0)
return symbol;
if (symbol < 16)
lengths[index++] = symbol;
else {
len = 0;
if (symbol == 16) {
if (index == 0)
return -5;
len = lengths[index - 1];
symbol = 3 + puff_bits(s, 2);
} else if (symbol == 17)
symbol = 3 + puff_bits(s, 3);
else
symbol = 11 + puff_bits(s, 7);
if (index + symbol > nlen + ndist)
return -6;
while (symbol--)
lengths[index++] = len;
}
}
if (lengths[256] == 0)
return -9;
err = puff_construct(&lencode, lengths, nlen);
if (err && (err < 0 || nlen != lencode.count[0] + lencode.count[1]))
return -7;
short distcnt[MAXBITS + 1], distsym[MAXDCODES];
struct puff_huffman distcode = {distcnt, distsym};
err = puff_construct(&distcode, lengths + nlen, ndist);
if (err && (err < 0 || ndist != distcode.count[0] + distcode.count[1]))
return -8;
return puff_codes(s, &lencode, &distcode);
}
static int puff(
unsigned char* dest,
unsigned long* destlen,
const unsigned char* source,
unsigned long sourcelen)
{
struct puff_state s = {
.out = dest,
.outlen = *destlen,
.outcnt = 0,
.in = source,
.inlen = sourcelen,
.incnt = 0,
.bitbuf = 0,
.bitcnt = 0,
};
int err;
if (setjmp(s.env) != 0)
err = 2;
else {
int last;
do {
last = puff_bits(&s, 1);
int type = puff_bits(&s, 2);
err = type == 0 ? puff_stored(&s) : (type == 1 ? puff_fixed(&s) : (type == 2 ? puff_dynamic(&s) : -1));
if (err != 0)
break;
} while (!last);
}
*destlen = s.outcnt;
return err;
}
//% END CODE DERIVED FROM puff.{c,h}
#define ZLIB_HEADER_WIDTH 2
static int puff_zlib_to_file(const unsigned char* source, unsigned long sourcelen, int dest_fd)
{
if (sourcelen < ZLIB_HEADER_WIDTH)
return 0;
source += ZLIB_HEADER_WIDTH;
sourcelen -= ZLIB_HEADER_WIDTH;
const unsigned long max_destlen = 132 << 20;
void* ret = mmap(0, max_destlen, PROT_WRITE | PROT_READ, MAP_PRIVATE | MAP_ANON, -1, 0);
if (ret == MAP_FAILED)
return -1;
unsigned char* dest = (unsigned char*)ret;
unsigned long destlen = max_destlen;
int err = puff(dest, &destlen, source, sourcelen);
if (err) {
munmap(dest, max_destlen);
errno = -err;
return -1;
}
if (write(dest_fd, dest, destlen) != (ssize_t)destlen) {
munmap(dest, max_destlen);
return -1;
}
return munmap(dest, max_destlen);
}
static int setup_loop_device(unsigned char* data, unsigned long size, const char* loopname, int* loopfd_p)
{
int err = 0, loopfd = -1;
int memfd = syscall(__NR_memfd_create, "syzkaller", 0);
if (memfd == -1) {
err = errno;
goto error;
}
if (puff_zlib_to_file(data, size, memfd)) {
err = errno;
goto error_close_memfd;
}
loopfd = open(loopname, O_RDWR);
if (loopfd == -1) {
err = errno;
goto error_close_memfd;
}
if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
if (errno != EBUSY) {
err = errno;
goto error_close_loop;
}
ioctl(loopfd, LOOP_CLR_FD, 0);
usleep(1000);
if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
err = errno;
goto error_close_loop;
}
}
close(memfd);
*loopfd_p = loopfd;
return 0;
error_close_loop:
close(loopfd);
error_close_memfd:
close(memfd);
error:
errno = err;
return -1;
}
static void reset_loop_device(const char* loopname)
{
int loopfd = open(loopname, O_RDWR);
if (loopfd == -1) {
return;
}
if (ioctl(loopfd, LOOP_CLR_FD, 0)) {
}
close(loopfd);
}
static long syz_mount_image(
volatile long fsarg,
volatile long dir,
volatile long flags,
volatile long optsarg,
volatile long change_dir,
volatile unsigned long size,
volatile long image)
{
unsigned char* data = (unsigned char*)image;
int res = -1, err = 0, need_loop_device = !!size;
char* mount_opts = (char*)optsarg;
char* target = (char*)dir;
char* fs = (char*)fsarg;
char* source = NULL;
char loopname[64];
if (need_loop_device) {
int loopfd;
memset(loopname, 0, sizeof(loopname));
snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid);
if (setup_loop_device(data, size, loopname, &loopfd) == -1)
return -1;
close(loopfd);
source = loopname;
}
mkdir(target, 0777);
char opts[256];
memset(opts, 0, sizeof(opts));
if (strlen(mount_opts) > (sizeof(opts) - 32)) {
}
strncpy(opts, mount_opts, sizeof(opts) - 32);
if (strcmp(fs, "iso9660") == 0) {
flags |= MS_RDONLY;
} else if (strncmp(fs, "ext", 3) == 0) {
bool has_remount_ro = false;
char* remount_ro_start = strstr(opts, "errors=remount-ro");
if (remount_ro_start != NULL) {
char after = *(remount_ro_start + strlen("errors=remount-ro"));
char before = remount_ro_start == opts ? '\0' : *(remount_ro_start - 1);
has_remount_ro = ((before == '\0' || before == ',') && (after == '\0' || after == ','));
}
if (strstr(opts, "errors=panic") || !has_remount_ro)
strcat(opts, ",errors=continue");
} else if (strcmp(fs, "xfs") == 0) {
strcat(opts, ",nouuid");
} else if (strncmp(fs, "gfs2", 4) == 0 && (strstr(opts, "errors=panic") || strstr(opts, "debug"))) {
strcat(opts, ",errors=withdraw");
}
res = mount(source, target, fs, flags, opts);
if (res == -1) {
err = errno;
goto error_clear_loop;
}
res = open(target, O_RDONLY | O_DIRECTORY);
if (res == -1) {
err = errno;
goto error_clear_loop;
}
if (change_dir) {
res = chdir(target);
if (res == -1) {
err = errno;
}
}
error_clear_loop:
if (need_loop_device)
reset_loop_device(loopname);
errno = err;
return res;
}
uint64_t r[1] = {0xffffffffffffffff};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// syz_mount_image$ext4 arguments: [
// fs: ptr[in, buffer] {
// buffer: {65 78 74 34 00} (length 0x5)
// }
// dir: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 31 00} (length 0x8)
// }
// flags: mount_flags = 0x0 (8 bytes)
// opts: ptr[in, fs_options[ext4_options]] {
// fs_options[ext4_options] {
// elems: array[fs_opt_elem[ext4_options]] {
// fs_opt_elem[ext4_options] {
// elem: union ext4_options {
// data_err_ignore: buffer: {64 61 74 61 5f 65 72 72 3d 69 67 6e 6f 72 65} (length 0xf)
// }
// comma: const = 0x2c (1 bytes)
// }
// fs_opt_elem[ext4_options] {
// elem: union ext4_options {
// dioread_nolock: buffer: {64 69 6f 72 65 61 64 5f 6e 6f 6c 6f 63 6b} (length 0xe)
// }
// comma: const = 0x2c (1 bytes)
// }
// fs_opt_elem[ext4_options] {
// elem: union ext4_options {
// debug_want_extra_isize: fs_opt["debug_want_extra_isize", fmt[hex, int32]] {
// name: buffer: {64 65 62 75 67 5f 77 61 6e 74 5f 65 78 74 72 61 5f 69 73 69 7a 65} (length 0x16)
// eq: const = 0x3d (1 bytes)
// val: int32 = 0x5a (18 bytes)
// }
// }
// comma: const = 0x2c (1 bytes)
// }
// fs_opt_elem[ext4_options] {
// elem: union ext4_options {
// prjquota: buffer: {70 72 6a 71 75 6f 74 61} (length 0x8)
// }
// comma: const = 0x2c (1 bytes)
// }
// fs_opt_elem[ext4_options] {
// elem: union ext4_options {
// max_dir_size_kb: fs_opt["max_dir_size_kb", fmt[hex, int32]] {
// name: buffer: {6d 61 78 5f 64 69 72 5f 73 69 7a 65 5f 6b 62} (length 0xf)
// eq: const = 0x3d (1 bytes)
// val: int32 = 0x4 (18 bytes)
// }
// }
// comma: const = 0x2c (1 bytes)
// }
// fs_opt_elem[ext4_options] {
// elem: union ext4_options {
// debug_want_extra_isize: fs_opt["debug_want_extra_isize", fmt[hex, int32]] {
// name: buffer: {64 65 62 75 67 5f 77 61 6e 74 5f 65 78 74 72 61 5f 69 73 69 7a 65} (length 0x16)
// eq: const = 0x3d (1 bytes)
// val: int32 = 0x3a (18 bytes)
// }
// }
// comma: const = 0x2c (1 bytes)
// }
// fs_opt_elem[ext4_options] {
// elem: union ext4_options {
// min_batch_time: fs_opt["min_batch_time", fmt[hex, int32]] {
// name: buffer: {6d 69 6e 5f 62 61 74 63 68 5f 74 69 6d 65} (length 0xe)
// eq: const = 0x3d (1 bytes)
// val: int32 = 0x3 (18 bytes)
// }
// }
// comma: const = 0x2c (1 bytes)
// }
// }
// common: array[fs_opt_elem[fs_options_common]] {
// }
// null: const = 0x0 (1 bytes)
// }
// }
// chdir: int8 = 0x1 (1 bytes)
// size: len = 0x47a (8 bytes)
// img: ptr[in, buffer] {
// buffer: (compressed buffer with length 0x47a)
// }
// ]
// returns fd_dir
memcpy((void*)0x200000000180, "ext4\000", 5);
memcpy((void*)0x200000000000, "./file1\000", 8);
memcpy((void*)0x200000000b40, "data_err=ignore", 15);
*(uint8_t*)0x200000000b4f = 0x2c;
memcpy((void*)0x200000000b50, "dioread_nolock", 14);
*(uint8_t*)0x200000000b5e = 0x2c;
memcpy((void*)0x200000000b5f, "debug_want_extra_isize", 22);
*(uint8_t*)0x200000000b75 = 0x3d;
sprintf((char*)0x200000000b76, "0x%016llx", (long long)0x5a);
*(uint8_t*)0x200000000b88 = 0x2c;
memcpy((void*)0x200000000b89, "prjquota", 8);
*(uint8_t*)0x200000000b91 = 0x2c;
memcpy((void*)0x200000000b92, "max_dir_size_kb", 15);
*(uint8_t*)0x200000000ba1 = 0x3d;
sprintf((char*)0x200000000ba2, "0x%016llx", (long long)4);
*(uint8_t*)0x200000000bb4 = 0x2c;
memcpy((void*)0x200000000bb5, "debug_want_extra_isize", 22);
*(uint8_t*)0x200000000bcb = 0x3d;
sprintf((char*)0x200000000bcc, "0x%016llx", (long long)0x3a);
*(uint8_t*)0x200000000bde = 0x2c;
memcpy((void*)0x200000000bdf, "min_batch_time", 14);
*(uint8_t*)0x200000000bed = 0x3d;
sprintf((char*)0x200000000bee, "0x%016llx", (long long)3);
*(uint8_t*)0x200000000c00 = 0x2c;
*(uint8_t*)0x200000000c01 = 0;
memcpy((void*)0x2000000001c0, "... [truncated large byte array] ...", 1146);
syz_mount_image(/*fs=*/0x200000000180, /*dir=*/0x200000000000, /*flags=*/0, /*opts=*/0x200000000b40, /*chdir=*/1, /*size=*/0x47a, /*img=*/0x2000000001c0);
// syz_mount_image$ext4 arguments: [
// fs: ptr[in, buffer] {
// buffer: {65 78 74 34 00} (length 0x5)
// }
// dir: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 31 00} (length 0x8)
// }
// flags: mount_flags = 0x21081e (8 bytes)
// opts: ptr[in, fs_options[ext4_options]] {
// fs_options[ext4_options] {
// elems: array[fs_opt_elem[ext4_options]] {
// fs_opt_elem[ext4_options] {
// elem: union ext4_options {
// grpquota: buffer: {67 72 70 71 75 6f 74 61} (length 0x8)
// }
// comma: const = 0x2c (1 bytes)
// }
// fs_opt_elem[ext4_options] {
// elem: union ext4_options {
// nogrpid: buffer: {6e 6f 67 72 70 69 64} (length 0x7)
// }
// comma: const = 0x2c (1 bytes)
// }
// fs_opt_elem[ext4_options] {
// elem: union ext4_options {
// quota: buffer: {71 75 6f 74 61} (length 0x5)
// }
// comma: const = 0x2c (1 bytes)
// }
// }
// common: array[fs_opt_elem[fs_options_common]] {
// }
// null: const = 0x0 (1 bytes)
// }
// }
// chdir: int8 = 0x1 (1 bytes)
// size: len = 0x4fa (8 bytes)
// img: ptr[in, buffer] {
// buffer: (compressed buffer with length 0x4fa)
// }
// ]
// returns fd_dir
memcpy((void*)0x200000000180, "ext4\000", 5);
memcpy((void*)0x200000000040, "./file1\000", 8);
memcpy((void*)0x2000000001c0, "grpquota", 8);
*(uint8_t*)0x2000000001c8 = 0x2c;
memcpy((void*)0x2000000001c9, "nogrpid", 7);
*(uint8_t*)0x2000000001d0 = 0x2c;
memcpy((void*)0x2000000001d1, "quota", 5);
*(uint8_t*)0x2000000001d6 = 0x2c;
*(uint8_t*)0x2000000001d7 = 0;
memcpy((void*)0x2000000005c0, "... [truncated large byte array] ...", 1274);
syz_mount_image(/*fs=*/0x200000000180, /*dir=*/0x200000000040, /*flags=MS_POSIXACL|MS_SYNCHRONOUS|MS_RELATIME|MS_NOSUID|0x80c*/0x21081e, /*opts=*/0x2000000001c0, /*chdir=*/1, /*size=*/0x4fa, /*img=*/0x2000000005c0);
// openat arguments: [
// fd: fd_dir (resource)
// file: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 31 00} (length 0x8)
// }
// flags: open_flags = 0x101e42 (4 bytes)
// mode: open_mode = 0x33 (2 bytes)
// ]
// returns fd
memcpy((void*)0x200000000040, "./file1\000", 8);
res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000040ul, /*flags=O_TRUNC|O_SYNC|O_NONBLOCK|O_CREAT|O_APPEND|O_RDWR*/0x101e42, /*mode=S_IXOTH|S_IWOTH|S_IWGRP|S_IRGRP*/0x33);
if (res != -1)
r[0] = res;
// ioctl$FS_IOC_SETFLAGS arguments: [
// fd: fd (resource)
// cmd: const = 0x40086602 (4 bytes)
// arg: ptr[in, fs_flags] {
// fs_flags = 0x4000 (4 bytes)
// }
// ]
*(uint32_t*)0x200000000340 = 0x4000;
syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x40086602, /*arg=*/0x200000000340ul);
// ioctl$EXT4_IOC_MIGRATE arguments: [
// fd: fd (resource)
// cmd: const = 0x6609 (4 bytes)
// ]
syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x6609, 0);
return 0;
}
Reply: Based on the analysis of the bug report and the kernel source code, here is the assessment of the security impact:
**Analysis:**
The bug report is a `WARNING: possible circular locking dependency detected` from lockdep, involving two locks in the ext4 filesystem: `sbi->s_writepages_rwsem` and `ei->xattr_sem`.
Lockdep detected the following two locking chains:
1. **`ei->xattr_sem` -> `sbi->s_writepages_rwsem`**:
This occurs during inode eviction (`ext4_evict_inode`). If the inode requires extra isize expansion (`ext4_try_to_expand_extra_isize`), it acquires the `ei->xattr_sem` of the inode. It then attempts to move extended attributes to an external block, which may drop the reference to an existing EA inode (`iput(ea_inode)`). Dropping the last reference triggers `iput_final` -> `write_inode_now` -> `ext4_writepages`, which acquires `sbi->s_writepages_rwsem`.
2. **`sbi->s_writepages_rwsem` -> `ei->xattr_sem`**:
This occurs during the `EXT4_IOC_MIGRATE` ioctl (`ext4_ext_migrate`). The function first acquires `sbi->s_writepages_rwsem` to prevent races with writeback. It then creates a new temporary inode (`ext4_new_inode`), which initializes its security attributes (`security_inode_init_security` -> `ext4_initxattrs`). Setting the initial xattrs acquires the `ei->xattr_sem` of this newly created temporary inode.
**Conclusion:**
This is a **false positive** lockdep warning. Lockdep groups locks by their initialization class. It sees that a lock of class `xattr_sem` is acquired before `s_writepages_rwsem` (Chain 1), and later `s_writepages_rwsem` is acquired before a lock of class `xattr_sem` (Chain 2). However, in Chain 2, the `xattr_sem` belongs to a *newly allocated, temporary inode* that is not yet visible to any other thread. Because no other thread can possibly hold the `xattr_sem` of this new inode, a deadlock can never actually occur.
Since this is a false positive lockdep warning, it has **no security impact**. Lockdep is a debugging tool and is disabled in production kernel builds. Even if it were enabled, a lockdep warning merely prints a stack trace and disables further lock debugging; it does not halt the system or cause memory corruption.
An unprivileged user can trigger this warning on any standard ext4 filesystem because they can create/delete files with xattrs (triggering Chain 1) and call `EXT4_IOC_MIGRATE` on files they own (triggering Chain 2). It can also be triggered by mounting a crafted filesystem image (as the syzkaller reproducer does). However, due to the lack of any real deadlock or memory safety issue, it is not exploitable and does not cause a Denial of Service.
|
| 6/2 |
2026/05/17 11:43 |
llm |
expert |
0m
Model:
Tokens:
input: 18061
output: 41
thoughts: 1793
Thoughts: **Circular Locking Dependency Detected in ext4**
Okay, here's what I'm seeing. We've got a syzkaller report flagging a potential circular locking dependency within the ext4 filesystem. The kernel's complaining about a "WARNING: possible circular locking dependency detected." Let's dive in.
The stack trace reveals the crux of the issue. A specific task, indicated by "syz.0.41/5967", is attempting to acquire a lock, `(&ei->xattr_sem)`, which is associated with extended attributes. But, crucially, this task *already* holds another lock, `(&sbi->s_writepages_rwsem)`. The trace clearly shows the order of acquisition is problematic: the task attempts to acquire the xattr semaphore, but it already has the writepages semaphore. Furthermore, the writepages semaphore acquisition path *itself* already depends on the xattr semaphore, creating a circular dependency. This is a classic deadlock scenario waiting to happen.
The existing dependency chain, in reverse order, is quite long, and shows the path to the writepages semaphore starting from mount all the way down to inode operations, the ext4 inode dirtying and finally writes.
Going the other way, from the xattr semaphore, it looks like a path from file creation through security initialization is followed, including the inode allocation path.
The syzkaller repro uses a loop device to mount a crafted ext4 image. Then, it goes through a specific sequence: opening a file, setting flags using `FS_IOC_SETFLAGS`, and finally triggering `EXT4_IOC_MIGRATE`. I need to check what `EXT4_IOC_MIGRATE` is doing. This ioctl appears to be the trigger for this issue. Let's start by looking at `fs/ext4/ioctl.c` to see the code path of this ioctl, starting from `ext4_ioctl`.
|
| 7/2 |
2026/05/17 11:43 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:fs/ext4/ioctl.c IncludeLines:true Name:ext4_ioctl]
Results: map[SourceCode:1920: long ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
1921: {
1922: return __ext4_ioctl(filp, cmd, arg);
1923: }
SourceFile:fs/ext4/ioctl.c]
|
| 8/2 |
2026/05/17 11:43 |
llm |
expert |
0m
Model:
Tokens:
input: 20397
output: 42
thoughts: 11
Thoughts: Here's a summary of my thought process:
**Diving into the `__ext4_ioctl` Function**
Okay, time to dig into the `__ext4_ioctl` function. This is where the magic happens, the point where user-space programs interface with the ext4 filesystem directly through ioctls. I need to understand what's happening here, specifically the interaction between the user's request and the kernel's ext4 implementation. I suspect this is going to be the central point for a range of filesystem operations: everything from setting attributes and managing quotas to handling more esoteric tasks like defragmentation or accessing extended attributes. I'll need to trace the control flow carefully. I'll be looking for potential vulnerabilities, particularly those that relate to input validation, resource limits, and error handling. I'll focus on how arguments are interpreted and where they are used. Are there any potential integer overflows or buffer overflows lurking within? And, most importantly, is this function safely handling all the possible ioctl codes it receives? I'll probably start by looking at the switch statement and the individual handlers for each ioctl request. From there, I'll drill down into the implementation of each relevant handler function, considering how each code path might be exploited. Ultimately, my goal is to assess whether or not this function provides a stable and secure bridge between user space and the ext4 file system.
|
| 9/2 |
2026/05/17 11:43 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:fs/ext4/ioctl.c IncludeLines:true Name:__ext4_ioctl]
Results: map[SourceCode:1532: static long __ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
1533: {
1534: struct inode *inode = file_inode(filp);
1535: struct super_block *sb = inode->i_sb;
1536: struct mnt_idmap *idmap = file_mnt_idmap(filp);
1537:
1538: ext4_debug("cmd = %u, arg = %lu\n", cmd, arg);
1539:
1540: switch (cmd) {
1541: case FS_IOC_GETFSMAP:
1542: return ext4_ioc_getfsmap(sb, (void __user *)arg);
1543: case EXT4_IOC_GETVERSION:
1544: case EXT4_IOC_GETVERSION_OLD:
1545: return put_user(inode->i_generation, (int __user *) arg);
1546: case EXT4_IOC_SETVERSION:
1547: case EXT4_IOC_SETVERSION_OLD: {
1548: handle_t *handle;
1549: struct ext4_iloc iloc;
1550: __u32 generation;
1551: int err;
1552:
1553: if (!inode_owner_or_capable(idmap, inode))
1554: return -EPERM;
1555:
1556: if (ext4_has_feature_metadata_csum(inode->i_sb)) {
1557: ext4_warning(sb, "Setting inode version is not "
1558: "supported with metadata_csum enabled.");
1559: return -ENOTTY;
1560: }
1561:
1562: err = mnt_want_write_file(filp);
1563: if (err)
1564: return err;
1565: if (get_user(generation, (int __user *) arg)) {
1566: err = -EFAULT;
1567: goto setversion_out;
1568: }
1569:
1570: inode_lock(inode);
1571: handle = ext4_journal_start(inode, EXT4_HT_INODE, 1);
1572: if (IS_ERR(handle)) {
1573: err = PTR_ERR(handle);
1574: goto unlock_out;
1575: }
1576: err = ext4_reserve_inode_write(handle, inode, &iloc);
1577: if (err == 0) {
1578: inode_set_ctime_current(inode);
1579: inode_inc_iversion(inode);
1580: inode->i_generation = generation;
1581: err = ext4_mark_iloc_dirty(handle, inode, &iloc);
1582: }
1583: ext4_journal_stop(handle);
1584:
1585: unlock_out:
1586: inode_unlock(inode);
1587: setversion_out:
1588: mnt_drop_write_file(filp);
1589: return err;
1590: }
1591: case EXT4_IOC_GROUP_EXTEND: {
1592: ext4_fsblk_t n_blocks_count;
1593: int err, err2=0;
1594:
1595: err = ext4_resize_begin(sb);
1596: if (err)
1597: return err;
1598:
1599: if (get_user(n_blocks_count, (__u32 __user *)arg)) {
1600: err = -EFAULT;
1601: goto group_extend_out;
1602: }
1603:
1604: if (ext4_has_feature_bigalloc(sb)) {
1605: ext4_msg(sb, KERN_ERR,
1606: "Online resizing not supported with bigalloc");
1607: err = -EOPNOTSUPP;
1608: goto group_extend_out;
1609: }
1610:
1611: err = mnt_want_write_file(filp);
1612: if (err)
1613: goto group_extend_out;
1614:
1615: err = ext4_group_extend(sb, EXT4_SB(sb)->s_es, n_blocks_count);
1616: if (EXT4_SB(sb)->s_journal) {
1617: ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_RESIZE,
1618: NULL);
1619: jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);
1620: err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal, 0);
1621: jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
1622: }
1623: if (err == 0)
1624: err = err2;
1625: mnt_drop_write_file(filp);
1626: group_extend_out:
1627: err2 = ext4_resize_end(sb, false);
1628: if (err == 0)
1629: err = err2;
1630: return err;
1631: }
1632:
1633: case EXT4_IOC_MOVE_EXT: {
1634: struct move_extent me;
1635: int err;
1636:
1637: if (!(filp->f_mode & FMODE_READ) ||
1638: !(filp->f_mode & FMODE_WRITE))
1639: return -EBADF;
1640:
1641: if (copy_from_user(&me,
1642: (struct move_extent __user *)arg, sizeof(me)))
1643: return -EFAULT;
1644: me.moved_len = 0;
1645:
1646: CLASS(fd, donor)(me.donor_fd);
1647: if (fd_empty(donor))
1648: return -EBADF;
1649:
1650: if (!(fd_file(donor)->f_mode & FMODE_WRITE))
1651: return -EBADF;
1652:
1653: err = mnt_want_write_file(filp);
1654: if (err)
1655: return err;
1656:
1657: err = ext4_move_extents(filp, fd_file(donor), me.orig_start,
1658: me.donor_start, me.len, &me.moved_len);
1659: mnt_drop_write_file(filp);
1660:
1661: if (copy_to_user((struct move_extent __user *)arg,
1662: &me, sizeof(me)))
1663: err = -EFAULT;
1664: return err;
1665: }
1666:
1667: case EXT4_IOC_GROUP_ADD: {
1668: struct ext4_new_group_data input;
1669:
1670: if (copy_from_user(&input, (struct ext4_new_group_input __user *)arg,
1671: sizeof(input)))
1672: return -EFAULT;
1673:
1674: return ext4_ioctl_group_add(filp, &input);
1675: }
1676:
1677: case EXT4_IOC_MIGRATE:
1678: {
1679: int err;
1680: if (!inode_owner_or_capable(idmap, inode))
1681: return -EACCES;
1682:
1683: err = mnt_want_write_file(filp);
1684: if (err)
1685: return err;
1686: /*
1687: * inode_mutex prevent write and truncate on the file.
1688: * Read still goes through. We take i_data_sem in
1689: * ext4_ext_swap_inode_data before we switch the
1690: * inode format to prevent read.
1691: */
1692: inode_lock((inode));
1693: err = ext4_ext_migrate(inode);
1694: inode_unlock((inode));
1695: mnt_drop_write_file(filp);
1696: return err;
1697: }
1698:
1699: case EXT4_IOC_ALLOC_DA_BLKS:
1700: {
1701: int err;
1702: if (!inode_owner_or_capable(idmap, inode))
1703: return -EACCES;
1704:
1705: err = mnt_want_write_file(filp);
1706: if (err)
1707: return err;
1708: err = ext4_alloc_da_blocks(inode);
1709: mnt_drop_write_file(filp);
1710: return err;
1711: }
1712:
1713: case EXT4_IOC_SWAP_BOOT:
1714: {
1715: int err;
1716: if (!(filp->f_mode & FMODE_WRITE))
1717: return -EBADF;
1718: err = mnt_want_write_file(filp);
1719: if (err)
1720: return err;
1721: err = swap_inode_boot_loader(sb, idmap, inode);
1722: mnt_drop_write_file(filp);
1723: return err;
1724: }
1725:
1726: case EXT4_IOC_RESIZE_FS: {
1727: ext4_fsblk_t n_blocks_count;
1728: int err = 0, err2 = 0;
1729: ext4_group_t o_group = EXT4_SB(sb)->s_groups_count;
1730:
1731: if (copy_from_user(&n_blocks_count, (__u64 __user *)arg,
1732: sizeof(__u64))) {
1733: return -EFAULT;
1734: }
1735:
1736: err = ext4_resize_begin(sb);
1737: if (err)
1738: return err;
1739:
1740: err = mnt_want_write_file(filp);
1741: if (err)
1742: goto resizefs_out;
1743:
1744: err = ext4_resize_fs(sb, n_blocks_count);
1745: if (EXT4_SB(sb)->s_journal) {
1746: ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_RESIZE, NULL);
1747: jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);
1748: err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal, 0);
1749: jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
1750: }
1751: if (err == 0)
1752: err = err2;
1753: mnt_drop_write_file(filp);
1754: if (!err && (o_group < EXT4_SB(sb)->s_groups_count) &&
1755: ext4_has_group_desc_csum(sb) &&
1756: test_opt(sb, INIT_INODE_TABLE))
1757: err = ext4_register_li_request(sb, o_group);
1758:
1759: resizefs_out:
1760: err2 = ext4_resize_end(sb, true);
1761: if (err == 0)
1762: err = err2;
1763: return err;
1764: }
1765:
1766: case FITRIM:
1767: {
1768: struct fstrim_range range;
1769: int ret = 0;
1770:
1771: if (!capable(CAP_SYS_ADMIN))
1772: return -EPERM;
1773:
1774: if (!bdev_max_discard_sectors(sb->s_bdev))
1775: return -EOPNOTSUPP;
1776:
1777: /*
1778: * We haven't replayed the journal, so we cannot use our
1779: * block-bitmap-guided storage zapping commands.
1780: */
1781: if (test_opt(sb, NOLOAD) && ext4_has_feature_journal(sb))
1782: return -EROFS;
1783:
1784: if (copy_from_user(&range, (struct fstrim_range __user *)arg,
1785: sizeof(range)))
1786: return -EFAULT;
1787:
1788: ret = ext4_trim_fs(sb, &range);
1789: if (ret < 0)
1790: return ret;
1791:
1792: if (copy_to_user((struct fstrim_range __user *)arg, &range,
1793: sizeof(range)))
1794: return -EFAULT;
1795:
1796: return 0;
1797: }
1798: case EXT4_IOC_PRECACHE_EXTENTS:
1799: {
1800: int ret;
1801:
1802: inode_lock_shared(inode);
1803: ret = ext4_ext_precache(inode);
1804: inode_unlock_shared(inode);
1805: return ret;
1806: }
1807: case FS_IOC_SET_ENCRYPTION_POLICY:
1808: if (!ext4_has_feature_encrypt(sb))
1809: return -EOPNOTSUPP;
1810: return fscrypt_ioctl_set_policy(filp, (const void __user *)arg);
1811:
1812: case FS_IOC_GET_ENCRYPTION_PWSALT:
1813: return ext4_ioctl_get_encryption_pwsalt(filp, (void __user *)arg);
1814:
1815: case FS_IOC_GET_ENCRYPTION_POLICY:
1816: if (!ext4_has_feature_encrypt(sb))
1817: return -EOPNOTSUPP;
1818: return fscrypt_ioctl_get_policy(filp, (void __user *)arg);
1819:
1820: case FS_IOC_GET_ENCRYPTION_POLICY_EX:
1821: if (!ext4_has_feature_encrypt(sb))
1822: return -EOPNOTSUPP;
1823: return fscrypt_ioctl_get_policy_ex(filp, (void __user *)arg);
1824:
1825: case FS_IOC_ADD_ENCRYPTION_KEY:
1826: if (!ext4_has_feature_encrypt(sb))
1827: return -EOPNOTSUPP;
1828: return fscrypt_ioctl_add_key(filp, (void __user *)arg);
1829:
1830: case FS_IOC_REMOVE_ENCRYPTION_KEY:
1831: if (!ext4_has_feature_encrypt(sb))
1832: return -EOPNOTSUPP;
1833: return fscrypt_ioctl_remove_key(filp, (void __user *)arg);
1834:
1835: case FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS:
1836: if (!ext4_has_feature_encrypt(sb))
1837: return -EOPNOTSUPP;
1838: return fscrypt_ioctl_remove_key_all_users(filp,
1839: (void __user *)arg);
1840: case FS_IOC_GET_ENCRYPTION_KEY_STATUS:
1841: if (!ext4_has_feature_encrypt(sb))
1842: return -EOPNOTSUPP;
1843: return fscrypt_ioctl_get_key_status(filp, (void __user *)arg);
1844:
1845: case FS_IOC_GET_ENCRYPTION_NONCE:
1846: if (!ext4_has_feature_encrypt(sb))
1847: return -EOPNOTSUPP;
1848: return fscrypt_ioctl_get_nonce(filp, (void __user *)arg);
1849:
1850: case EXT4_IOC_CLEAR_ES_CACHE:
1851: {
1852: if (!inode_owner_or_capable(idmap, inode))
1853: return -EACCES;
1854: ext4_clear_inode_es(inode);
1855: return 0;
1856: }
1857:
1858: case EXT4_IOC_GETSTATE:
1859: {
1860: __u32 state = 0;
1861:
1862: if (ext4_test_inode_state(inode, EXT4_STATE_EXT_PRECACHED))
1863: state |= EXT4_STATE_FLAG_EXT_PRECACHED;
1864: if (ext4_test_inode_state(inode, EXT4_STATE_NEW))
1865: state |= EXT4_STATE_FLAG_NEW;
1866: if (ext4_test_inode_state(inode, EXT4_STATE_NEWENTRY))
1867: state |= EXT4_STATE_FLAG_NEWENTRY;
1868: if (ext4_test_inode_state(inode, EXT4_STATE_DA_ALLOC_CLOSE))
1869: state |= EXT4_STATE_FLAG_DA_ALLOC_CLOSE;
1870:
1871: return put_user(state, (__u32 __user *) arg);
1872: }
1873:
1874: case EXT4_IOC_GET_ES_CACHE:
1875: return ext4_ioctl_get_es_cache(filp, arg);
1876:
1877: case EXT4_IOC_SHUTDOWN:
1878: return ext4_ioctl_shutdown(sb, arg);
1879:
1880: case FS_IOC_ENABLE_VERITY:
1881: if (!ext4_has_feature_verity(sb))
1882: return -EOPNOTSUPP;
1883: return fsverity_ioctl_enable(filp, (const void __user *)arg);
1884:
1885: case FS_IOC_MEASURE_VERITY:
1886: if (!ext4_has_feature_verity(sb))
1887: return -EOPNOTSUPP;
1888: return fsverity_ioctl_measure(filp, (void __user *)arg);
1889:
1890: case FS_IOC_READ_VERITY_METADATA:
1891: if (!ext4_has_feature_verity(sb))
1892: return -EOPNOTSUPP;
1893: return fsverity_ioctl_read_metadata(filp,
1894: (const void __user *)arg);
1895:
1896: case EXT4_IOC_CHECKPOINT:
1897: return ext4_ioctl_checkpoint(filp, arg);
1898:
1899: case FS_IOC_GETFSLABEL:
1900: return ext4_ioctl_getlabel(EXT4_SB(sb), (void __user *)arg);
1901:
1902: case FS_IOC_SETFSLABEL:
1903: return ext4_ioctl_setlabel(filp,
1904: (const void __user *)arg);
1905:
1906: case EXT4_IOC_GETFSUUID:
1907: return ext4_ioctl_getuuid(EXT4_SB(sb), (void __user *)arg);
1908: case EXT4_IOC_SETFSUUID:
1909: return ext4_ioctl_setuuid(filp, (const void __user *)arg);
1910: case EXT4_IOC_GET_TUNE_SB_PARAM:
1911: return ext4_ioctl_get_tune_sb(EXT4_SB(sb),
1912: (void __user *)arg);
1913: case EXT4_IOC_SET_TUNE_SB_PARAM:
1914: return ext4_ioctl_set_tune_sb(filp, (void __user *)arg);
1915: default:
1916: return -ENOTTY;
1917: }
1918: }
SourceFile:fs/ext4/ioctl.c]
|
| 10/2 |
2026/05/17 11:43 |
llm |
expert |
0m
Model:
Tokens:
input: 26806
output: 49
thoughts: 1033
Thoughts: **Analyzing the EXT4_IOC_MIGRATE Vulnerability**
Okay, so I'm looking at this `EXT4_IOC_MIGRATE` ioctl. The code says it needs `inode_owner_or_capable(idmap, inode)`, meaning the file owner can call it. The reproducer creates a file and then calls `EXT4_IOC_MIGRATE` on it. That sounds like a potential avenue for unprivileged users, if they can get access to the filesystem. The reproducer mounts a crafted ext4 image, which initially seems like the tricky part, since that usually requires `CAP_SYS_ADMIN` in the initial user namespace. However, can it be done in a user namespace with `FS_USERNS_MOUNT` set for ext4? No, EXT4 doesn't have `FS_USERNS_MOUNT`, so that mount step requires `CAP_SYS_ADMIN`.
However, if an unprivileged user can create a file on an existing ext4 filesystem and call `EXT4_IOC_MIGRATE`, this could be an attack vector. The code says `EXT4_IOC_MIGRATE` is a standard ioctl.
But the root cause is a circular locking dependency: `sbi->s_writepages_rwsem` and `ei->xattr_sem` being taken in opposing orders on two CPUs. The reproducer triggers this.
I should check the stack traces to see how these locks are being used.
Looking at stack 1: `ext4_writepages_down_read` calls `ext4_writepages`, which then calls `do_writepages`, which calls `__writeback_single_inode`, which calls `writeback_single_inode`. `write_inode_now`, which then calls `iput`.
Within `iput`, we get to the potential culprit, which is that `ext4_xattr_block_set` is called, which calls `ext4_xattr_make_inode_space`. Hmmm, `ext4_xattr_make_inode_space` takes `xattr_sem`? That's interesting, I need to check the code there.
|
| 11/2 |
2026/05/17 11:44 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:fs/ext4/xattr.c IncludeLines:true Name:ext4_xattr_make_inode_space]
Results: map[SourceCode:2694: static int ext4_xattr_make_inode_space(handle_t *handle, struct inode *inode,
2695: struct ext4_inode *raw_inode,
2696: int isize_diff, size_t ifree,
2697: size_t bfree, int *total_ino)
2698: {
2699: struct ext4_xattr_ibody_header *header = IHDR(inode, raw_inode);
2700: struct ext4_xattr_entry *small_entry;
2701: struct ext4_xattr_entry *entry;
2702: struct ext4_xattr_entry *last;
2703: unsigned int entry_size; /* EA entry size */
2704: unsigned int total_size; /* EA entry size + value size */
2705: unsigned int min_total_size;
2706: int error;
2707:
2708: while (isize_diff > ifree) {
2709: entry = NULL;
2710: small_entry = NULL;
2711: min_total_size = ~0U;
2712: last = IFIRST(header);
2713: /* Find the entry best suited to be pushed into EA block */
2714: for (; !IS_LAST_ENTRY(last); last = EXT4_XATTR_NEXT(last)) {
2715: /* never move system.data out of the inode */
2716: if ((last->e_name_len == 4) &&
2717: (last->e_name_index == EXT4_XATTR_INDEX_SYSTEM) &&
2718: !memcmp(last->e_name, "data", 4))
2719: continue;
2720: total_size = EXT4_XATTR_LEN(last->e_name_len);
2721: if (!last->e_value_inum)
2722: total_size += EXT4_XATTR_SIZE(
2723: le32_to_cpu(last->e_value_size));
2724: if (total_size <= bfree &&
2725: total_size < min_total_size) {
2726: if (total_size + ifree < isize_diff) {
2727: small_entry = last;
2728: } else {
2729: entry = last;
2730: min_total_size = total_size;
2731: }
2732: }
2733: }
2734:
2735: if (entry == NULL) {
2736: if (small_entry == NULL)
2737: return -ENOSPC;
2738: entry = small_entry;
2739: }
2740:
2741: entry_size = EXT4_XATTR_LEN(entry->e_name_len);
2742: total_size = entry_size;
2743: if (!entry->e_value_inum)
2744: total_size += EXT4_XATTR_SIZE(
2745: le32_to_cpu(entry->e_value_size));
2746: error = ext4_xattr_move_to_block(handle, inode, raw_inode,
2747: entry);
2748: if (error)
2749: return error;
2750:
2751: *total_ino -= entry_size;
2752: ifree += total_size;
2753: bfree -= total_size;
2754: }
2755:
2756: return 0;
2757: }
SourceFile:fs/ext4/xattr.c]
|
| 12/2 |
2026/05/17 11:44 |
llm |
expert |
0m
Model:
Tokens:
input: 29410
output: 49
thoughts: 17
Thoughts: Okay, let's dive into this. Here's my take on those thoughts, as if they're my own:
**Analyzing `ext4_expand_extra_isize_ea`**
Alright, I'm looking at `ext4_expand_extra_isize_ea`. My initial focus is on understanding what this function does within the ext4 filesystem context. The name itself suggests we're dealing with expanding something related to "extra i_size" and extended attributes (EAs). I need to figure out the exact mechanisms here. Is it about handling changes in i_size due to the presence of EAs? Or does it adjust metadata sizes to accomodate growing EAs? I'm already anticipating some complexities, especially considering how i_size and block allocation interact. I wonder if there are any race conditions to be concerned about during the expansion process. I need to keep in mind how this function integrates with the rest of the ext4 codebase. How does this fit with the broader picture of managing file metadata and data blocks? I'll probably start by looking at the function's parameters and return value to start to piece it together. Then, I'll trace through the code and figure out what it actually does.
|
| 13/2 |
2026/05/17 11:44 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:fs/ext4/xattr.c IncludeLines:true Name:ext4_expand_extra_isize_ea]
Results: map[SourceCode:2759: /*
2760: * Expand an inode by new_extra_isize bytes when EAs are present.
2761: * Returns 0 on success or negative error number on failure.
2762: */
2763: int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,
2764: struct ext4_inode *raw_inode, handle_t *handle)
2765: {
2766: struct ext4_xattr_ibody_header *header;
2767: struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
2768: static unsigned int mnt_count;
2769: size_t min_offs;
2770: size_t ifree, bfree;
2771: int total_ino;
2772: void *base, *end;
2773: int error = 0, tried_min_extra_isize = 0;
2774: int s_min_extra_isize = le16_to_cpu(sbi->s_es->s_min_extra_isize);
2775: int isize_diff; /* How much do we need to grow i_extra_isize */
2776:
2777: retry:
2778: isize_diff = new_extra_isize - EXT4_I(inode)->i_extra_isize;
2779: if (EXT4_I(inode)->i_extra_isize >= new_extra_isize)
2780: return 0;
2781:
2782: header = IHDR(inode, raw_inode);
2783:
2784: /*
2785: * Check if enough free space is available in the inode to shift the
2786: * entries ahead by new_extra_isize.
2787: */
2788:
2789: base = IFIRST(header);
2790: end = ITAIL(inode, raw_inode);
2791: min_offs = end - base;
2792: total_ino = sizeof(struct ext4_xattr_ibody_header) + sizeof(u32);
2793:
2794: ifree = ext4_xattr_free_space(base, &min_offs, base, &total_ino);
2795: if (ifree >= isize_diff)
2796: goto shift;
2797:
2798: /*
2799: * Enough free space isn't available in the inode, check if
2800: * EA block can hold new_extra_isize bytes.
2801: */
2802: if (EXT4_I(inode)->i_file_acl) {
2803: struct buffer_head *bh;
2804:
2805: bh = ext4_sb_bread(inode->i_sb, EXT4_I(inode)->i_file_acl, REQ_PRIO);
2806: if (IS_ERR(bh)) {
2807: error = PTR_ERR(bh);
2808: goto cleanup;
2809: }
2810: error = ext4_xattr_check_block(inode, bh);
2811: if (error) {
2812: brelse(bh);
2813: goto cleanup;
2814: }
2815: base = BHDR(bh);
2816: end = bh->b_data + bh->b_size;
2817: min_offs = end - base;
2818: bfree = ext4_xattr_free_space(BFIRST(bh), &min_offs, base,
2819: NULL);
2820: brelse(bh);
2821: if (bfree + ifree < isize_diff) {
2822: if (!tried_min_extra_isize && s_min_extra_isize) {
2823: tried_min_extra_isize++;
2824: new_extra_isize = s_min_extra_isize;
2825: goto retry;
2826: }
2827: error = -ENOSPC;
2828: goto cleanup;
2829: }
2830: } else {
2831: bfree = inode->i_sb->s_blocksize;
2832: }
2833:
2834: error = ext4_xattr_make_inode_space(handle, inode, raw_inode,
2835: isize_diff, ifree, bfree,
2836: &total_ino);
2837: if (error) {
2838: if (error == -ENOSPC && !tried_min_extra_isize &&
2839: s_min_extra_isize) {
2840: tried_min_extra_isize++;
2841: new_extra_isize = s_min_extra_isize;
2842: goto retry;
2843: }
2844: goto cleanup;
2845: }
2846: shift:
2847: /* Adjust the offsets and shift the remaining entries ahead */
2848: ext4_xattr_shift_entries(IFIRST(header), EXT4_I(inode)->i_extra_isize
2849: - new_extra_isize, (void *)raw_inode +
2850: EXT4_GOOD_OLD_INODE_SIZE + new_extra_isize,
2851: (void *)header, total_ino);
2852: EXT4_I(inode)->i_extra_isize = new_extra_isize;
2853:
2854: if (ext4_has_inline_data(inode))
2855: error = ext4_find_inline_data_nolock(inode);
2856:
2857: cleanup:
2858: if (error && (mnt_count != le16_to_cpu(sbi->s_es->s_mnt_count))) {
2859: ext4_warning(inode->i_sb, "Unable to expand inode %llu. Delete some EAs or run e2fsck.",
2860: inode->i_ino);
2861: mnt_count = le16_to_cpu(sbi->s_es->s_mnt_count);
2862: }
2863: return error;
2864: }
SourceFile:fs/ext4/xattr.c]
|
| 14/2 |
2026/05/17 11:44 |
llm |
expert |
0m
Model:
Tokens:
input: 31553
output: 47
thoughts: 58
Thoughts: Here's my summary, as if I were thinking it:
**Digging into the XATTR Implementation**
Okay, so I'm tracing through this extended attribute (XATTR) implementation in ext4, and I've hit a specific point where things are getting interesting. I remember `ext4_xattr_make_inode_space` being the starting point, and I'm pretty sure it then calls `ext4_xattr_move_to_block`. Yep, that's it. And *that* function, `ext4_xattr_move_to_block`, is where things are actually moved to a block, which I suspect will be the critical stage. So that calls `ext4_xattr_block_set`. Alright, let's stop and take a look at `ext4_xattr_block_set` and see what's actually happening at the block level. I need to get a clear picture of how those XATTRs are physically laid out.
|
| 15/2 |
2026/05/17 11:44 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:fs/ext4/xattr.c IncludeLines:true Name:ext4_xattr_block_set]
Results: map[SourceCode:1898: static int
1899: ext4_xattr_block_set(handle_t *handle, struct inode *inode,
1900: struct ext4_xattr_info *i,
1901: struct ext4_xattr_block_find *bs)
1902: {
1903: struct super_block *sb = inode->i_sb;
1904: struct buffer_head *new_bh = NULL;
1905: struct ext4_xattr_search s_copy = bs->s;
1906: struct ext4_xattr_search *s = &s_copy;
1907: struct mb_cache_entry *ce = NULL;
1908: int error = 0;
1909: struct mb_cache *ea_block_cache = EA_BLOCK_CACHE(inode);
1910: struct inode *ea_inode = NULL, *tmp_inode;
1911: size_t old_ea_inode_quota = 0;
1912: unsigned int ea_ino;
1913:
1914: #define header(x) ((struct ext4_xattr_header *)(x))
1915:
1916: /* If we need EA inode, prepare it before locking the buffer */
1917: if (i->value && i->in_inode) {
1918: WARN_ON_ONCE(!i->value_len);
1919:
1920: ea_inode = ext4_xattr_inode_lookup_create(handle, inode,
1921: i->value, i->value_len);
1922: if (IS_ERR(ea_inode)) {
1923: error = PTR_ERR(ea_inode);
1924: ea_inode = NULL;
1925: goto cleanup;
1926: }
1927: }
1928:
1929: if (s->base) {
1930: int offset = (char *)s->here - bs->bh->b_data;
1931:
1932: BUFFER_TRACE(bs->bh, "get_write_access");
1933: error = ext4_journal_get_write_access(handle, sb, bs->bh,
1934: EXT4_JTR_NONE);
1935: if (error)
1936: goto cleanup;
1937:
1938: lock_buffer(bs->bh);
1939:
1940: if (header(s->base)->h_refcount == cpu_to_le32(1)) {
1941: __u32 hash = le32_to_cpu(BHDR(bs->bh)->h_hash);
1942:
1943: /*
1944: * This must happen under buffer lock for
1945: * ext4_xattr_block_set() to reliably detect modified
1946: * block
1947: */
1948: if (ea_block_cache) {
1949: struct mb_cache_entry *oe;
1950:
1951: oe = mb_cache_entry_delete_or_get(ea_block_cache,
1952: hash, bs->bh->b_blocknr);
1953: if (oe) {
1954: /*
1955: * Xattr block is getting reused. Leave
1956: * it alone.
1957: */
1958: mb_cache_entry_put(ea_block_cache, oe);
1959: goto clone_block;
1960: }
1961: }
1962: ea_bdebug(bs->bh, "modifying in-place");
1963: error = ext4_xattr_set_entry(i, s, handle, inode,
1964: ea_inode, true /* is_block */);
1965: ext4_xattr_block_csum_set(inode, bs->bh);
1966: unlock_buffer(bs->bh);
1967: if (error == -EFSCORRUPTED)
1968: goto bad_block;
1969: if (!error)
1970: error = ext4_handle_dirty_metadata(handle,
1971: inode,
1972: bs->bh);
1973: if (error)
1974: goto cleanup;
1975: goto inserted;
1976: }
1977: clone_block:
1978: unlock_buffer(bs->bh);
1979: ea_bdebug(bs->bh, "cloning");
1980: s->base = kmemdup(BHDR(bs->bh), bs->bh->b_size, GFP_NOFS);
1981: error = -ENOMEM;
1982: if (s->base == NULL)
1983: goto cleanup;
1984: s->first = ENTRY(header(s->base)+1);
1985: header(s->base)->h_refcount = cpu_to_le32(1);
1986: s->here = ENTRY(s->base + offset);
1987: s->end = s->base + bs->bh->b_size;
1988:
1989: /*
1990: * If existing entry points to an xattr inode, we need
1991: * to prevent ext4_xattr_set_entry() from decrementing
1992: * ref count on it because the reference belongs to the
1993: * original block. In this case, make the entry look
1994: * like it has an empty value.
1995: */
1996: if (!s->not_found && s->here->e_value_inum) {
1997: ea_ino = le32_to_cpu(s->here->e_value_inum);
1998: error = ext4_xattr_inode_iget(inode, ea_ino,
1999: le32_to_cpu(s->here->e_hash),
2000: &tmp_inode);
2001: if (error)
2002: goto cleanup;
2003:
2004: if (!ext4_test_inode_state(tmp_inode,
2005: EXT4_STATE_LUSTRE_EA_INODE)) {
2006: /*
2007: * Defer quota free call for previous
2008: * inode until success is guaranteed.
2009: */
2010: old_ea_inode_quota = le32_to_cpu(
2011: s->here->e_value_size);
2012: }
2013: iput(tmp_inode);
2014:
2015: s->here->e_value_inum = 0;
2016: s->here->e_value_size = 0;
2017: }
2018: } else {
2019: /* Allocate a buffer where we construct the new block. */
2020: s->base = kzalloc(sb->s_blocksize, GFP_NOFS);
2021: error = -ENOMEM;
2022: if (s->base == NULL)
2023: goto cleanup;
2024: header(s->base)->h_magic = cpu_to_le32(EXT4_XATTR_MAGIC);
2025: header(s->base)->h_blocks = cpu_to_le32(1);
2026: header(s->base)->h_refcount = cpu_to_le32(1);
2027: s->first = ENTRY(header(s->base)+1);
2028: s->here = ENTRY(header(s->base)+1);
2029: s->end = s->base + sb->s_blocksize;
2030: }
2031:
2032: error = ext4_xattr_set_entry(i, s, handle, inode, ea_inode,
2033: true /* is_block */);
2034: if (error == -EFSCORRUPTED)
2035: goto bad_block;
2036: if (error)
2037: goto cleanup;
2038:
2039: inserted:
2040: if (!IS_LAST_ENTRY(s->first)) {
2041: new_bh = ext4_xattr_block_cache_find(inode, header(s->base), &ce);
2042: if (IS_ERR(new_bh)) {
2043: error = PTR_ERR(new_bh);
2044: new_bh = NULL;
2045: goto cleanup;
2046: }
2047:
2048: if (new_bh) {
2049: /* We found an identical block in the cache. */
2050: if (new_bh == bs->bh)
2051: ea_bdebug(new_bh, "keeping");
2052: else {
2053: u32 ref;
2054:
2055: #ifdef EXT4_XATTR_DEBUG
2056: WARN_ON_ONCE(dquot_initialize_needed(inode));
2057: #endif
2058: /* The old block is released after updating
2059: the inode. */
2060: error = dquot_alloc_block(inode,
2061: EXT4_C2B(EXT4_SB(sb), 1));
2062: if (error)
2063: goto cleanup;
2064: BUFFER_TRACE(new_bh, "get_write_access");
2065: error = ext4_journal_get_write_access(
2066: handle, sb, new_bh,
2067: EXT4_JTR_NONE);
2068: if (error)
2069: goto cleanup_dquot;
2070: lock_buffer(new_bh);
2071: /*
2072: * We have to be careful about races with
2073: * adding references to xattr block. Once we
2074: * hold buffer lock xattr block's state is
2075: * stable so we can check the additional
2076: * reference fits.
2077: */
2078: ref = le32_to_cpu(BHDR(new_bh)->h_refcount) + 1;
2079: if (ref > EXT4_XATTR_REFCOUNT_MAX) {
2080: /*
2081: * Undo everything and check mbcache
2082: * again.
2083: */
2084: unlock_buffer(new_bh);
2085: dquot_free_block(inode,
2086: EXT4_C2B(EXT4_SB(sb),
2087: 1));
2088: brelse(new_bh);
2089: mb_cache_entry_put(ea_block_cache, ce);
2090: ce = NULL;
2091: new_bh = NULL;
2092: goto inserted;
2093: }
2094: BHDR(new_bh)->h_refcount = cpu_to_le32(ref);
2095: if (ref == EXT4_XATTR_REFCOUNT_MAX)
2096: clear_bit(MBE_REUSABLE_B, &ce->e_flags);
2097: ea_bdebug(new_bh, "reusing; refcount now=%d",
2098: ref);
2099: ext4_xattr_block_csum_set(inode, new_bh);
2100: unlock_buffer(new_bh);
2101: error = ext4_handle_dirty_metadata(handle,
2102: inode,
2103: new_bh);
2104: if (error)
2105: goto cleanup_dquot;
2106: }
2107: mb_cache_entry_touch(ea_block_cache, ce);
2108: mb_cache_entry_put(ea_block_cache, ce);
2109: ce = NULL;
2110: } else if (bs->bh && s->base == bs->bh->b_data) {
2111: /* We were modifying this block in-place. */
2112: ea_bdebug(bs->bh, "keeping this block");
2113: ext4_xattr_block_cache_insert(ea_block_cache, bs->bh);
2114: new_bh = bs->bh;
2115: get_bh(new_bh);
2116: } else {
2117: /* We need to allocate a new block */
2118: ext4_fsblk_t goal, block;
2119:
2120: #ifdef EXT4_XATTR_DEBUG
2121: WARN_ON_ONCE(dquot_initialize_needed(inode));
2122: #endif
2123: goal = ext4_group_first_block_no(sb,
2124: EXT4_I(inode)->i_block_group);
2125: block = ext4_new_meta_blocks(handle, inode, goal, 0,
2126: NULL, &error);
2127: if (error)
2128: goto cleanup;
2129:
2130: ea_idebug(inode, "creating block %llu",
2131: (unsigned long long)block);
2132:
2133: new_bh = sb_getblk(sb, block);
2134: if (unlikely(!new_bh)) {
2135: error = -ENOMEM;
2136: getblk_failed:
2137: ext4_free_blocks(handle, inode, NULL, block, 1,
2138: EXT4_FREE_BLOCKS_METADATA);
2139: goto cleanup;
2140: }
2141: error = ext4_xattr_inode_inc_ref_all(handle, inode,
2142: ENTRY(header(s->base)+1));
2143: if (error)
2144: goto getblk_failed;
2145: if (ea_inode) {
2146: /* Drop the extra ref on ea_inode. */
2147: error = ext4_xattr_inode_dec_ref(handle,
2148: ea_inode);
2149: if (error)
2150: ext4_warning_inode(ea_inode,
2151: "dec ref error=%d",
2152: error);
2153: iput(ea_inode);
2154: ea_inode = NULL;
2155: }
2156:
2157: lock_buffer(new_bh);
2158: error = ext4_journal_get_create_access(handle, sb,
2159: new_bh, EXT4_JTR_NONE);
2160: if (error) {
2161: unlock_buffer(new_bh);
2162: error = -EIO;
2163: goto getblk_failed;
2164: }
2165: memcpy(new_bh->b_data, s->base, new_bh->b_size);
2166: ext4_xattr_block_csum_set(inode, new_bh);
2167: set_buffer_uptodate(new_bh);
2168: unlock_buffer(new_bh);
2169: ext4_xattr_block_cache_insert(ea_block_cache, new_bh);
2170: error = ext4_handle_dirty_metadata(handle, inode,
2171: new_bh);
2172: if (error)
2173: goto cleanup;
2174: }
2175: }
2176:
2177: if (old_ea_inode_quota)
2178: ext4_xattr_inode_free_quota(inode, NULL, old_ea_inode_quota);
2179:
2180: /* Update the inode. */
2181: EXT4_I(inode)->i_file_acl = new_bh ? new_bh->b_blocknr : 0;
2182:
2183: /* Drop the previous xattr block. */
2184: if (bs->bh && bs->bh != new_bh) {
2185: struct ext4_xattr_inode_array *ea_inode_array = NULL;
2186:
2187: ext4_xattr_release_block(handle, inode, bs->bh,
2188: &ea_inode_array,
2189: 0 /* extra_credits */);
2190: ext4_xattr_inode_array_free(ea_inode_array);
2191: }
2192: error = 0;
2193:
2194: cleanup:
2195: if (ea_inode) {
2196: if (error) {
2197: int error2;
2198:
2199: error2 = ext4_xattr_inode_dec_ref(handle, ea_inode);
2200: if (error2)
2201: ext4_warning_inode(ea_inode, "dec ref error=%d",
2202: error2);
2203: ext4_xattr_inode_free_quota(inode, ea_inode,
2204: i_size_read(ea_inode));
2205: }
2206: iput(ea_inode);
2207: }
2208: if (ce)
2209: mb_cache_entry_put(ea_block_cache, ce);
2210: brelse(new_bh);
2211: if (!(bs->bh && s->base == bs->bh->b_data))
2212: kfree(s->base);
2213:
2214: return error;
2215:
2216: cleanup_dquot:
2217: dquot_free_block(inode, EXT4_C2B(EXT4_SB(sb), 1));
2218: goto cleanup;
2219:
2220: bad_block:
2221: EXT4_ERROR_INODE(inode, "bad block %llu",
2222: EXT4_I(inode)->i_file_acl);
2223: goto cleanup;
2224:
2225: #undef header
2226: }
SourceFile:fs/ext4/xattr.c]
|
| 16/2 |
2026/05/17 11:44 |
llm |
expert |
0m
Model:
Tokens:
input: 37077
output: 50
thoughts: 1366
Thoughts: **Analyzing a Potential Deadlock in ext4 Xattr Handling During Mount**
Okay, so here's what I've got so far. I'm seeing a possible deadlock scenario within the ext4 filesystem code, specifically related to extended attributes (xattrs) and the mount process. It appears that `ext4_xattr_block_set` is involved, and I need to understand its interaction with the inode lifecycle and potential locking conflicts.
Initially, I noted that `ext4_xattr_block_set` calls `iput` on both a temporary inode and the xattr inode (`ea_inode`). That `iput` call is crucial because it can trigger the eviction process through `iput_final` which calls `evict`, which then eventually hits `ext4_evict_inode`. I thought I was looking at a possible race involving `ext4_orphan_cleanup`, but I quickly realized that's not the critical path, based on the stack traces I've pulled.
My analysis started by examining the flow from `ext4_xattr_block_set`. The crucial part is that `iput(ea_inode)` ultimately calls `ext4_writepages` through `write_inode_now`, which then calls `do_writepages` and then `ext4_writepages`. The important part here is that `ext4_writepages` takes the `sbi->s_writepages_rwsem` semaphore down_read.
Now, I've traced the call path to `ext4_writepages` and I see this path: `ext4_evict_inode` calls `__ext4_mark_inode_dirty`, which in turn leads to `ext4_try_to_expand_extra_isize`. From there, it dives into `ext4_xattr_make_inode_space`, calls `ext4_xattr_move_to_block`, and finally, calls `ext4_xattr_block_set`. This ultimately calls `iput(ea_inode)`, which ends up in `ext4_writepages`.
The lightbulb moment came when I realized that `ext4_evict_inode` is called from `evict` which is called from `ext4_orphan_cleanup`, which is called during mount by `__ext4_fill_super`. This means that during the filesystem mount process, orphan cleanup can trigger the xattr expansion and writeback logic, which is the source of the problem.
This means that during mount, when `ext4_orphan_cleanup` calls `iput` on an orphan inode, this triggers the eviction process. This calls `ext4_evict_inode` which tries to expand the xattr inode size. However, this eventually calls `ext4_xattr_block_set` through the chain I've described, and `ext4_xattr_block_set` calls `iput` on an inode, which ultimately calls `ext4_writepages` and acquires `sbi->s_writepages_rwsem` in read mode.
The critical question is, does this eviction process hold any locks that could conflict with `sbi->s_writepages_rwsem`? I'm now looking for any place where `ei->xattr_sem` is acquired in the chain of calls, as this would indicate a potential conflict with the writeback semaphore. I need to know if the xattr code serializes access properly.
|
| 17/2 |
2026/05/17 11:45 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:fs/ext4/inode.c IncludeLines:true Name:ext4_try_to_expand_extra_isize]
Results: map[SourceCode:6446: /*
6447: * Expand an inode by new_extra_isize bytes.
6448: * Returns 0 on success or negative error number on failure.
6449: */
6450: static int ext4_try_to_expand_extra_isize(struct inode *inode,
6451: unsigned int new_extra_isize,
6452: struct ext4_iloc iloc,
6453: handle_t *handle)
6454: {
6455: int no_expand;
6456: int error;
6457:
6458: if (ext4_test_inode_state(inode, EXT4_STATE_NO_EXPAND))
6459: return -EOVERFLOW;
6460:
6461: /*
6462: * In nojournal mode, we can immediately attempt to expand
6463: * the inode. When journaled, we first need to obtain extra
6464: * buffer credits since we may write into the EA block
6465: * with this same handle. If journal_extend fails, then it will
6466: * only result in a minor loss of functionality for that inode.
6467: * If this is felt to be critical, then e2fsck should be run to
6468: * force a large enough s_min_extra_isize.
6469: */
6470: if (ext4_journal_extend(handle,
6471: EXT4_DATA_TRANS_BLOCKS(inode->i_sb), 0) != 0)
6472: return -ENOSPC;
6473:
6474: if (ext4_write_trylock_xattr(inode, &no_expand) == 0)
6475: return -EBUSY;
6476:
6477: error = __ext4_expand_extra_isize(inode, new_extra_isize, &iloc,
6478: handle, &no_expand);
6479: ext4_write_unlock_xattr(inode, &no_expand);
6480:
6481: return error;
6482: }
SourceFile:fs/ext4/inode.c]
|
| 18/2 |
2026/05/17 11:45 |
llm |
expert |
0m
Model:
Tokens:
input: 39857
output: 43
thoughts: 658
Thoughts: **Analyzing a Potential Lock Ordering Issue in ext4**
Okay, so I'm looking at this code and trying to trace a potential lock ordering issue within the ext4 filesystem. My initial thought process is starting with `ext4_try_to_expand_extra_isize`, which I see calls `ext4_write_trylock_xattr`. Aha, right, `ext4_write_trylock_xattr` *acquires* `ei->xattr_sem`! That's the critical first lock.
Now, if I follow this chain, `ext4_try_to_expand_extra_isize` gets `ei->xattr_sem` (specifically, the `xattr_sem` of the orphan inode, if I'm understanding it correctly). From there, we go through `__ext4_expand_extra_isize`, then into `ext4_expand_extra_isize_ea`, which, I believe, leads to `ext4_xattr_make_inode_space`, then `ext4_xattr_move_to_block`, and finally `ext4_xattr_block_set`.
And here is the critical part, `ext4_xattr_block_set` calls `iput(ea_inode)`. This, in turn, calls `iput_final`, which eventually calls `write_inode_now` which should trigger `ext4_writepages`. Importantly, `ext4_writepages` takes `sbi->s_writepages_rwsem`.
Therefore, the observed lock order within the first chain is `ei->xattr_sem` (of orphan inode) -> `sbi->s_writepages_rwsem`. I can see from the lockdep output that this is, indeed, what's recorded: `&ei->xattr_sem` -> `&sbi->s_writepages_rwsem`.
Now, the lockdep warning triggered by the second chain, that looks something like this:
```
-> #0 (&ei->xattr_sem){++++}-{4:4}:
down_write+0x3a/0x50 kernel/locking/rwsem.c:1625
ext4_write_lock_xattr fs/ext4/xattr.h:157 [inline]
ext4_xattr_set_handle+0x19c/0x14c0 fs/ext4/xattr.c:2374
ext4_initxattrs+0x9f/0x110 fs/ext4/xattr_security.c:44
security_inode_init_security+0x296/0x3d0 security/security.c:1370
__ext4_new_inode+0x3319/0x3ce0 fs/ext4/ialloc.c:1330
ext4_ext_migrate+0x71d/0x1130 fs/ext4/migrate.c:462
__ext4_ioctl fs/ext4/ioctl.c:1693 [inline]
ext4_ioctl+0x2355/0x4b40 fs/ext4/ioctl.c:1922
```
Given this second call chain, let me examine `ext4_ext_migrate` and see what the lock acquisition order looks like there. I can see that `ext4_ext_migrate` calls `ext4_xattr_set_handle`. This calls `ext4_write_lock_xattr`. I need to figure out the full picture, since the code snippet doesn't show me.
|
| 19/2 |
2026/05/17 11:45 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:fs/ext4/migrate.c IncludeLines:true Name:ext4_ext_migrate]
Results: map[SourceCode: 410: int ext4_ext_migrate(struct inode *inode)
411: {
412: handle_t *handle;
413: int retval = 0, i;
414: __le32 *i_data;
415: struct ext4_inode_info *ei;
416: struct inode *tmp_inode = NULL;
417: struct migrate_struct lb;
418: unsigned long max_entries;
419: __u32 goal, tmp_csum_seed;
420: uid_t owner[2];
421: int alloc_ctx;
422:
423: /*
424: * If the filesystem does not support extents, or the inode
425: * already is extent-based, error out.
426: */
427: if (!ext4_has_feature_extents(inode->i_sb) ||
428: ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS) ||
429: ext4_has_inline_data(inode))
430: return -EINVAL;
431:
432: if (S_ISLNK(inode->i_mode) && inode->i_blocks == 0)
433: /*
434: * don't migrate fast symlink
435: */
436: return retval;
437:
438: alloc_ctx = ext4_writepages_down_write(inode->i_sb);
439:
440: /*
441: * Worst case we can touch the allocation bitmaps and a block
442: * group descriptor block. We do need to worry about
443: * credits for modifying the quota inode.
444: */
445: handle = ext4_journal_start(inode, EXT4_HT_MIGRATE,
446: 3 + EXT4_MAXQUOTAS_TRANS_BLOCKS(inode->i_sb));
447:
448: if (IS_ERR(handle)) {
449: retval = PTR_ERR(handle);
450: goto out_unlock;
451: }
452: /*
453: * This operation rewrites the inode's block mapping layout
454: * (indirect to extents) and is not tracked in the fast commit
455: * log, so disable fast commits for this transaction.
456: */
457: ext4_fc_mark_ineligible(inode->i_sb, EXT4_FC_REASON_MIGRATE, handle);
458: goal = ((((u32)inode->i_ino - 1) / EXT4_INODES_PER_GROUP(inode->i_sb)) *
459: EXT4_INODES_PER_GROUP(inode->i_sb)) + 1;
460: owner[0] = i_uid_read(inode);
461: owner[1] = i_gid_read(inode);
462: tmp_inode = ext4_new_inode(handle, d_inode(inode->i_sb->s_root),
463: S_IFREG, NULL, goal, owner, 0);
464: if (IS_ERR(tmp_inode)) {
465: retval = PTR_ERR(tmp_inode);
466: ext4_journal_stop(handle);
467: goto out_unlock;
468: }
469: /*
470: * Use the correct seed for checksum (i.e. the seed from 'inode'). This
471: * is so that the metadata blocks will have the correct checksum after
472: * the migration.
473: */
474: ei = EXT4_I(inode);
475: tmp_csum_seed = EXT4_I(tmp_inode)->i_csum_seed;
476: EXT4_I(tmp_inode)->i_csum_seed = ei->i_csum_seed;
477: i_size_write(tmp_inode, i_size_read(inode));
478: /*
479: * Set the i_nlink to zero so it will be deleted later
480: * when we drop inode reference.
481: */
482: clear_nlink(tmp_inode);
483:
484: ext4_ext_tree_init(handle, tmp_inode);
485: ext4_journal_stop(handle);
486:
487: /*
488: * start with one credit accounted for
489: * superblock modification.
490: *
491: * For the tmp_inode we already have committed the
492: * transaction that created the inode. Later as and
493: * when we add extents we extent the journal
494: */
495: /*
496: * Even though we take i_rwsem we can still cause block
497: * allocation via mmap write to holes. If we have allocated
498: * new blocks we fail migrate. New block allocation will
499: * clear EXT4_STATE_EXT_MIGRATE flag. The flag is updated
500: * with i_data_sem held to prevent racing with block
501: * allocation.
502: */
503: down_read(&EXT4_I(inode)->i_data_sem);
504: ext4_set_inode_state(inode, EXT4_STATE_EXT_MIGRATE);
505: up_read((&EXT4_I(inode)->i_data_sem));
506:
507: handle = ext4_journal_start(inode, EXT4_HT_MIGRATE, 1);
508: if (IS_ERR(handle)) {
509: retval = PTR_ERR(handle);
510: goto out_tmp_inode;
511: }
512:
513: i_data = ei->i_data;
514: memset(&lb, 0, sizeof(lb));
515:
516: /* 32 bit block address 4 bytes */
517: max_entries = inode->i_sb->s_blocksize >> 2;
518: for (i = 0; i < EXT4_NDIR_BLOCKS; i++) {
519: if (i_data[i]) {
520: retval = update_extent_range(handle, tmp_inode,
521: le32_to_cpu(i_data[i]), &lb);
522: if (retval)
523: goto err_out;
524: } else
525: lb.curr_block++;
526: }
527: if (i_data[EXT4_IND_BLOCK]) {
528: retval = update_ind_extent_range(handle, tmp_inode,
529: le32_to_cpu(i_data[EXT4_IND_BLOCK]), &lb);
530: if (retval)
531: goto err_out;
532: } else
533: lb.curr_block += max_entries;
534: if (i_data[EXT4_DIND_BLOCK]) {
535: retval = update_dind_extent_range(handle, tmp_inode,
536: le32_to_cpu(i_data[EXT4_DIND_BLOCK]), &lb);
537: if (retval)
538: goto err_out;
539: } else
540: lb.curr_block += max_entries * max_entries;
541: if (i_data[EXT4_TIND_BLOCK]) {
542: retval = update_tind_extent_range(handle, tmp_inode,
543: le32_to_cpu(i_data[EXT4_TIND_BLOCK]), &lb);
544: if (retval)
545: goto err_out;
546: }
547: /*
548: * Build the last extent
549: */
550: retval = finish_range(handle, tmp_inode, &lb);
551: err_out:
552: if (retval)
553: /*
554: * Failure case delete the extent information with the
555: * tmp_inode
556: */
557: free_ext_block(handle, tmp_inode);
558: else {
559: retval = ext4_ext_swap_inode_data(handle, inode, tmp_inode);
560: if (retval)
561: /*
562: * if we fail to swap inode data free the extent
563: * details of the tmp inode
564: */
565: free_ext_block(handle, tmp_inode);
566: }
567:
568: /* We mark the tmp_inode dirty via ext4_ext_tree_init. */
569: retval = ext4_journal_ensure_credits(handle, 1, 0);
570: if (retval < 0)
571: goto out_stop;
572: /*
573: * Mark the tmp_inode as of size zero
574: */
575: i_size_write(tmp_inode, 0);
576:
577: /*
578: * set the i_blocks count to zero
579: * so that the ext4_evict_inode() does the
580: * right job
581: *
582: * We don't need to take the i_lock because
583: * the inode is not visible to user space.
584: */
585: tmp_inode->i_blocks = 0;
586: EXT4_I(tmp_inode)->i_csum_seed = tmp_csum_seed;
587:
588: /* Reset the extent details */
589: ext4_ext_tree_init(handle, tmp_inode);
590: out_stop:
591: ext4_journal_stop(handle);
592: out_tmp_inode:
593: unlock_new_inode(tmp_inode);
594: iput(tmp_inode);
595: out_unlock:
596: ext4_writepages_up_write(inode->i_sb, alloc_ctx);
597: return retval;
598: }
SourceFile:fs/ext4/migrate.c]
|
| 20/2 |
2026/05/17 11:45 |
llm |
expert |
0m
Model:
Tokens:
input: 44399
output: 27
thoughts: 753
Thoughts: **Analyzing a Potential Lockdep False Positive in ext4's Migration Code**
Okay, let's break this down. I'm looking at `ext4_ext_migrate` and how it interacts with locking. The key here is the `sbi->s_writepages_rwsem` and `ei->xattr_sem` locks, and how `lockdep` flags a potential circular dependency.
First, I see that within `ext4_ext_migrate` at line 438, a call to `ext4_writepages_down_write(inode->i_sb)` takes `sbi->s_writepages_rwsem` down_write. Then, the function calls `ext4_new_inode` at line 462. `ext4_new_inode` leads to a chain of calls: `security_inode_init_security`, then `ext4_initxattrs`, and finally `ext4_xattr_set_handle`, which then calls `ext4_write_lock_xattr`, which takes `ei->xattr_sem` down_write.
So, in essence, I'm seeing this:
1. `ext4_ext_migrate` grabs `sbi->s_writepages_rwsem`.
2. It then calls `ext4_new_inode`, which subsequently tries to acquire the `ei->xattr_sem` lock on the new `tmp_inode` that has been created.
Now, let's step back. I realize the *first* chain I was thinking about involves `ei->xattr_sem` (of an orphan inode) going to `sbi->s_writepages_rwsem`. But now I'm also seeing `sbi->s_writepages_rwsem` going to `ei->xattr_sem` (of the *tmp_inode*).
Lockdep is flagging this as a circular dependency: `xattr_sem` -> `s_writepages_rwsem` and `s_writepages_rwsem` -> `xattr_sem`. The tricky part is, these are *different* `xattr_sem` instances. One is for the "orphan" inode, the other is for this newly created `tmp_inode`. However, since lockdep groups locks by *class* and these are both `ei->xattr_sem`, it's reporting the dependency.
Here's the question: is this a real deadlock? I need to think this through.
Chain 1: Thread A holds `ei->xattr_sem` of inode X (the orphan). Thread A then attempts to acquire `sbi->s_writepages_rwsem`.
Chain 2: Thread B holds `sbi->s_writepages_rwsem`. Thread B tries to acquire `ei->xattr_sem` of inode Y (the `tmp_inode`).
If it were possible for Thread A to hold `xattr_sem` on an existing inode while waiting for `s_writepages_rwsem`, AND simultaneously, Thread B holds `s_writepages_rwsem` and is waiting for the *same* `xattr_sem` on that *same* inode, then deadlock would result.
But hang on⦠Thread B is acquiring `xattr_sem` *of a newly created inode Y* (the `tmp_inode`). Since this inode is new, no other thread *could possibly* hold its `xattr_sem`. This means Thread B will *never* block when trying to acquire the new inode's `xattr_sem`. Thus, this is a false positive!
Wait, am I being too quick here? Is it *possible* for Thread B to acquire an `xattr_sem` on an existing inode while holding `s_writepages_rwsem`? I need to check for other code paths where this combination of held lock and acquired lock could occur. Let's see if there are other places where `s_writepages_rwsem` is held and then an `xattr_sem` is acquired. In `ext4_ext_migrate` I see it holds `s_writepages_rwsem` and calls `ext4_new_inode`. Are there others? I'll check `ext4_writepages_down_write`.
|
| 21/2 |
2026/05/17 11:46 |
tool |
codesearch-find-references |
0m
Args: map[Name:ext4_writepages_down_write]
Results: map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__ext4_remount SourceFile:fs/ext4/super.c SourceLine:6617] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__ext4_remount SourceFile:fs/ext4/super.c SourceLine:6850] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ext4_change_inode_journal_flag SourceFile:fs/ext4/inode.c SourceLine:6634] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ext4_ext_migrate SourceFile:fs/ext4/migrate.c SourceLine:438] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:ext4_ind_migrate SourceFile:fs/ext4/migrate.c SourceLine:632]] TruncatedOutput:false]
|
| 22/2 |
2026/05/17 11:46 |
llm |
expert |
0m
Model:
Tokens:
input: 46388
output: 47
thoughts: 16
Thoughts: Okay, here's my attempt at summarizing that thought process, tailored for an expert audience:
**Examining `ext4_change_inode_journal_flag`**
Alright, let's dive into this. I'm taking a look at `ext4_change_inode_journal_flag`. This likely means I'm either reviewing the code, debugging an issue related to journaling behavior in the ext4 filesystem, or perhaps analyzing the implementation of a specific feature that interacts with journaling. Immediately, I'm thinking about the implications for data integrity and performance. I know this function will be critical in managing the inode flags related to the journaling feature and how those changes cascade to the journal. My understanding tells me that this function likely has implications in areas like: ensuring that flags are set correctly on the inode, handling the allocation of journal blocks and metadata correctly, and managing the transitions that affect the inode's journal participation. My mind is already considering the potential edge cases: What happens if there's a power failure mid-update? How are concurrent modifications handled? What kind of locking is employed here? Are there any potential race conditions? I'll need to pay close attention to the interaction with other key functions within the ext4 codebase, particularly those dealing with the journal itself and inode operations. I'm already anticipating the typical debugging questions: Is the flag being set/cleared correctly? Is the associated metadata being updated consistently? Are there any inconsistencies reflected in the journal? This examination is going to be complex. I'm ready.
|
| 23/2 |
2026/05/17 11:46 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:fs/ext4/inode.c IncludeLines:true Name:ext4_change_inode_journal_flag]
Results: map[SourceCode:6591: int ext4_change_inode_journal_flag(struct inode *inode, int val)
6592: {
6593: journal_t *journal;
6594: handle_t *handle;
6595: int err;
6596: int alloc_ctx;
6597:
6598: /*
6599: * We have to be very careful here: changing a data block's
6600: * journaling status dynamically is dangerous. If we write a
6601: * data block to the journal, change the status and then delete
6602: * that block, we risk forgetting to revoke the old log record
6603: * from the journal and so a subsequent replay can corrupt data.
6604: * So, first we make sure that the journal is empty and that
6605: * nobody is changing anything.
6606: */
6607:
6608: journal = EXT4_JOURNAL(inode);
6609: if (!journal)
6610: return 0;
6611: if (is_journal_aborted(journal))
6612: return -EROFS;
6613:
6614: /* Wait for all existing dio workers */
6615: inode_dio_wait(inode);
6616:
6617: /*
6618: * Before flushing the journal and switching inode's aops, we have
6619: * to flush all dirty data the inode has. There can be outstanding
6620: * delayed allocations, there can be unwritten extents created by
6621: * fallocate or buffered writes in dioread_nolock mode covered by
6622: * dirty data which can be converted only after flushing the dirty
6623: * data (and journalled aops don't know how to handle these cases).
6624: */
6625: filemap_invalidate_lock(inode->i_mapping);
6626: err = filemap_write_and_wait(inode->i_mapping);
6627: if (err < 0) {
6628: filemap_invalidate_unlock(inode->i_mapping);
6629: return err;
6630: }
6631: /* Before switch the inode journalling mode evict all the page cache. */
6632: truncate_pagecache(inode, 0);
6633:
6634: alloc_ctx = ext4_writepages_down_write(inode->i_sb);
6635: jbd2_journal_lock_updates(journal);
6636:
6637: /*
6638: * OK, there are no updates running now, and all cached data is
6639: * synced to disk. We are now in a completely consistent state
6640: * which doesn't have anything in the journal, and we know that
6641: * no filesystem updates are running, so it is safe to modify
6642: * the inode's in-core data-journaling state flag now.
6643: */
6644:
6645: if (val)
6646: ext4_set_inode_flag(inode, EXT4_INODE_JOURNAL_DATA);
6647: else {
6648: err = jbd2_journal_flush(journal, 0);
6649: if (err < 0) {
6650: jbd2_journal_unlock_updates(journal);
6651: ext4_writepages_up_write(inode->i_sb, alloc_ctx);
6652: filemap_invalidate_unlock(inode->i_mapping);
6653: return err;
6654: }
6655: ext4_clear_inode_flag(inode, EXT4_INODE_JOURNAL_DATA);
6656: }
6657: ext4_set_aops(inode);
6658: ext4_set_inode_mapping_order(inode);
6659:
6660: jbd2_journal_unlock_updates(journal);
6661: ext4_writepages_up_write(inode->i_sb, alloc_ctx);
6662: filemap_invalidate_unlock(inode->i_mapping);
6663:
6664: /* Finally we can mark the inode as dirty. */
6665:
6666: handle = ext4_journal_start(inode, EXT4_HT_INODE, 1);
6667: if (IS_ERR(handle))
6668: return PTR_ERR(handle);
6669:
6670: ext4_fc_mark_ineligible(inode->i_sb,
6671: EXT4_FC_REASON_JOURNAL_FLAG_CHANGE, handle);
6672: err = ext4_mark_inode_dirty(handle, inode);
6673: ext4_handle_sync(handle);
6674: ext4_journal_stop(handle);
6675: ext4_std_error(inode->i_sb, err);
6676:
6677: return err;
6678: }
SourceFile:fs/ext4/inode.c]
|
| 24/2 |
2026/05/17 11:46 |
llm |
expert |
0m
Model:
Tokens:
input: 48197
output: 43
thoughts: 35
Thoughts: Okay, here's my take on those thoughts, framed as my own:
**Investigating Potential Synchronization Issues in ext4**
Right, let me see... I'm looking at `ext4_change_inode_journal_flag`. My initial concern is whether this function adequately handles synchronization, particularly regarding extended attributes. Specifically, it doesn't appear that it explicitly acquires the `xattr_sem` semaphore. That's a potential area for race conditions, isn't it? If concurrent operations modify xattrs while the journal flag is being altered, we could end up with some nasty data corruption. This warrants a deeper dive, of course. We need to understand the full context of how this flag is used and what other operations might be interacting with the same inode's xattrs at the same time.
My next step should be to check how `__ext4_remount` interacts. Does it handle acquiring the semaphore when changing journal flags during a remount? I need to check its implementation very carefully. This seems like a likely place for potential issues to manifest. Maybe `__ext4_remount` is safe, but what about other scenarios? Is there anything else that touches the journal flag while also possibly affecting xattrs without acquiring the semaphore?
This requires a systematic review of the related code paths and possibly some quick testing scenarios. I need to make sure the data integrity is sound!
|
| 25/2 |
2026/05/17 11:46 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:fs/ext4/super.c IncludeLines:true Name:__ext4_remount]
Results: map[SourceCode:6551: static int __ext4_remount(struct fs_context *fc, struct super_block *sb)
6552: {
6553: struct ext4_fs_context *ctx = fc->fs_private;
6554: struct ext4_super_block *es;
6555: struct ext4_sb_info *sbi = EXT4_SB(sb);
6556: unsigned long old_sb_flags;
6557: struct ext4_mount_options old_opts;
6558: ext4_group_t g;
6559: int err = 0;
6560: int alloc_ctx;
6561: #ifdef CONFIG_QUOTA
6562: int enable_quota = 0;
6563: int i, j;
6564: char *to_free[EXT4_MAXQUOTAS];
6565: #endif
6566:
6567:
6568: /* Store the original options */
6569: old_sb_flags = sb->s_flags;
6570: old_opts.s_mount_opt = sbi->s_mount_opt;
6571: old_opts.s_mount_opt2 = sbi->s_mount_opt2;
6572: old_opts.s_resuid = sbi->s_resuid;
6573: old_opts.s_resgid = sbi->s_resgid;
6574: old_opts.s_commit_interval = sbi->s_commit_interval;
6575: old_opts.s_min_batch_time = sbi->s_min_batch_time;
6576: old_opts.s_max_batch_time = sbi->s_max_batch_time;
6577: #ifdef CONFIG_QUOTA
6578: old_opts.s_jquota_fmt = sbi->s_jquota_fmt;
6579: for (i = 0; i < EXT4_MAXQUOTAS; i++)
6580: if (sbi->s_qf_names[i]) {
6581: char *qf_name = get_qf_name(sb, sbi, i);
6582:
6583: old_opts.s_qf_names[i] = kstrdup(qf_name, GFP_KERNEL);
6584: if (!old_opts.s_qf_names[i]) {
6585: for (j = 0; j < i; j++)
6586: kfree(old_opts.s_qf_names[j]);
6587: return -ENOMEM;
6588: }
6589: } else
6590: old_opts.s_qf_names[i] = NULL;
6591: #endif
6592: if (!(ctx->spec & EXT4_SPEC_JOURNAL_IOPRIO)) {
6593: if (sbi->s_journal && sbi->s_journal->j_task->io_context)
6594: ctx->journal_ioprio =
6595: sbi->s_journal->j_task->io_context->ioprio;
6596: else
6597: ctx->journal_ioprio = EXT4_DEF_JOURNAL_IOPRIO;
6598:
6599: }
6600:
6601: if ((ctx->spec & EXT4_SPEC_s_stripe) &&
6602: ext4_is_stripe_incompatible(sb, ctx->s_stripe)) {
6603: ext4_msg(sb, KERN_WARNING,
6604: "stripe (%lu) is not aligned with cluster size (%u), "
6605: "stripe is disabled",
6606: ctx->s_stripe, sbi->s_cluster_ratio);
6607: ctx->s_stripe = 0;
6608: }
6609:
6610: /*
6611: * Changing the DIOREAD_NOLOCK or DELALLOC mount options may cause
6612: * two calls to ext4_should_dioread_nolock() to return inconsistent
6613: * values, triggering WARN_ON in ext4_add_complete_io(). we grab
6614: * here s_writepages_rwsem to avoid race between writepages ops and
6615: * remount.
6616: */
6617: alloc_ctx = ext4_writepages_down_write(sb);
6618: ext4_apply_options(fc, sb);
6619: ext4_writepages_up_write(sb, alloc_ctx);
6620:
6621: if ((old_opts.s_mount_opt & EXT4_MOUNT_JOURNAL_CHECKSUM) ^
6622: test_opt(sb, JOURNAL_CHECKSUM)) {
6623: ext4_msg(sb, KERN_ERR, "changing journal_checksum "
6624: "during remount not supported; ignoring");
6625: sbi->s_mount_opt ^= EXT4_MOUNT_JOURNAL_CHECKSUM;
6626: }
6627:
6628: if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA) {
6629: if (test_opt2(sb, EXPLICIT_DELALLOC)) {
6630: ext4_msg(sb, KERN_ERR, "can't mount with "
6631: "both data=journal and delalloc");
6632: err = -EINVAL;
6633: goto restore_opts;
6634: }
6635: if (test_opt(sb, DIOREAD_NOLOCK)) {
6636: ext4_msg(sb, KERN_ERR, "can't mount with "
6637: "both data=journal and dioread_nolock");
6638: err = -EINVAL;
6639: goto restore_opts;
6640: }
6641: } else if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_ORDERED_DATA) {
6642: if (test_opt(sb, JOURNAL_ASYNC_COMMIT)) {
6643: ext4_msg(sb, KERN_ERR, "can't mount with "
6644: "journal_async_commit in data=ordered mode");
6645: err = -EINVAL;
6646: goto restore_opts;
6647: }
6648: }
6649:
6650: if ((sbi->s_mount_opt ^ old_opts.s_mount_opt) & EXT4_MOUNT_NO_MBCACHE) {
6651: ext4_msg(sb, KERN_ERR, "can't enable nombcache during remount");
6652: err = -EINVAL;
6653: goto restore_opts;
6654: }
6655:
6656: if ((old_opts.s_mount_opt & EXT4_MOUNT_DELALLOC) &&
6657: !test_opt(sb, DELALLOC)) {
6658: ext4_msg(sb, KERN_ERR, "can't disable delalloc during remount");
6659: err = -EINVAL;
6660: goto restore_opts;
6661: }
6662:
6663: sb->s_flags = (sb->s_flags & ~SB_POSIXACL) |
6664: (test_opt(sb, POSIX_ACL) ? SB_POSIXACL : 0);
6665:
6666: es = sbi->s_es;
6667:
6668: if (sbi->s_journal) {
6669: ext4_init_journal_params(sb, sbi->s_journal);
6670: set_task_ioprio(sbi->s_journal->j_task, ctx->journal_ioprio);
6671: }
6672:
6673: /* Flush outstanding errors before changing fs state */
6674: flush_work(&sbi->s_sb_upd_work);
6675:
6676: if ((bool)(fc->sb_flags & SB_RDONLY) != sb_rdonly(sb)) {
6677: if (ext4_emergency_state(sb)) {
6678: err = -EROFS;
6679: goto restore_opts;
6680: }
6681:
6682: if (fc->sb_flags & SB_RDONLY) {
6683: err = sync_filesystem(sb);
6684: if (err < 0)
6685: goto restore_opts;
6686: err = dquot_suspend(sb, -1);
6687: if (err < 0)
6688: goto restore_opts;
6689:
6690: /*
6691: * First of all, the unconditional stuff we have to do
6692: * to disable replay of the journal when we next remount
6693: */
6694: sb->s_flags |= SB_RDONLY;
6695:
6696: /*
6697: * OK, test if we are remounting a valid rw partition
6698: * readonly, and if so set the rdonly flag and then
6699: * mark the partition as valid again.
6700: */
6701: if (!(es->s_state & cpu_to_le16(EXT4_VALID_FS)) &&
6702: (sbi->s_mount_state & EXT4_VALID_FS))
6703: es->s_state = cpu_to_le16(sbi->s_mount_state);
6704:
6705: if (sbi->s_journal) {
6706: /*
6707: * We let remount-ro finish even if marking fs
6708: * as clean failed...
6709: */
6710: ext4_mark_recovery_complete(sb, es);
6711: }
6712: } else {
6713: /* Make sure we can mount this feature set readwrite */
6714: if (ext4_has_feature_readonly(sb) ||
6715: !ext4_feature_set_ok(sb, 0)) {
6716: err = -EROFS;
6717: goto restore_opts;
6718: }
6719: /*
6720: * Make sure the group descriptor checksums
6721: * are sane. If they aren't, refuse to remount r/w.
6722: */
6723: for (g = 0; g < sbi->s_groups_count; g++) {
6724: struct ext4_group_desc *gdp =
6725: ext4_get_group_desc(sb, g, NULL);
6726:
6727: if (!ext4_group_desc_csum_verify(sb, g, gdp)) {
6728: ext4_msg(sb, KERN_ERR,
6729: "ext4_remount: Checksum for group %u failed (%u!=%u)",
6730: g, le16_to_cpu(ext4_group_desc_csum(sb, g, gdp)),
6731: le16_to_cpu(gdp->bg_checksum));
6732: err = -EFSBADCRC;
6733: goto restore_opts;
6734: }
6735: }
6736:
6737: /*
6738: * If we have an unprocessed orphan list hanging
6739: * around from a previously readonly bdev mount,
6740: * require a full umount/remount for now.
6741: */
6742: if (es->s_last_orphan || !ext4_orphan_file_empty(sb)) {
6743: ext4_msg(sb, KERN_WARNING, "Couldn't "
6744: "remount RDWR because of unprocessed "
6745: "orphan inode list. Please "
6746: "umount/remount instead");
6747: err = -EINVAL;
6748: goto restore_opts;
6749: }
6750:
6751: /*
6752: * Mounting a RDONLY partition read-write, so reread
6753: * and store the current valid flag. (It may have
6754: * been changed by e2fsck since we originally mounted
6755: * the partition.)
6756: */
6757: if (sbi->s_journal) {
6758: err = ext4_clear_journal_err(sb, es);
6759: if (err)
6760: goto restore_opts;
6761: }
6762: sbi->s_mount_state = (le16_to_cpu(es->s_state) &
6763: ~EXT4_FC_REPLAY);
6764:
6765: err = ext4_setup_super(sb, es, 0);
6766: if (err)
6767: goto restore_opts;
6768:
6769: sb->s_flags &= ~SB_RDONLY;
6770: if (ext4_has_feature_mmp(sb)) {
6771: err = ext4_multi_mount_protect(sb,
6772: le64_to_cpu(es->s_mmp_block));
6773: if (err)
6774: goto restore_opts;
6775: }
6776: #ifdef CONFIG_QUOTA
6777: enable_quota = 1;
6778: #endif
6779: }
6780: }
6781:
6782: /*
6783: * Handle creation of system zone data early because it can fail.
6784: * Releasing of existing data is done when we are sure remount will
6785: * succeed.
6786: */
6787: if (test_opt(sb, BLOCK_VALIDITY) && !sbi->s_system_blks) {
6788: err = ext4_setup_system_zone(sb);
6789: if (err)
6790: goto restore_opts;
6791: }
6792:
6793: if (sbi->s_journal == NULL && !(old_sb_flags & SB_RDONLY)) {
6794: err = ext4_commit_super(sb);
6795: if (err)
6796: goto restore_opts;
6797: }
6798:
6799: #ifdef CONFIG_QUOTA
6800: if (enable_quota) {
6801: if (sb_any_quota_suspended(sb))
6802: dquot_resume(sb, -1);
6803: else if (ext4_has_feature_quota(sb)) {
6804: err = ext4_enable_quotas(sb);
6805: if (err)
6806: goto restore_opts;
6807: }
6808: }
6809: /* Release old quota file names */
6810: for (i = 0; i < EXT4_MAXQUOTAS; i++)
6811: kfree(old_opts.s_qf_names[i]);
6812: #endif
6813: if (!test_opt(sb, BLOCK_VALIDITY) && sbi->s_system_blks)
6814: ext4_release_system_zone(sb);
6815:
6816: /*
6817: * Reinitialize lazy itable initialization thread based on
6818: * current settings
6819: */
6820: if (sb_rdonly(sb) || !test_opt(sb, INIT_INODE_TABLE))
6821: ext4_unregister_li_request(sb);
6822: else {
6823: ext4_group_t first_not_zeroed;
6824: first_not_zeroed = ext4_has_uninit_itable(sb);
6825: ext4_register_li_request(sb, first_not_zeroed);
6826: }
6827:
6828: if (!ext4_has_feature_mmp(sb) || sb_rdonly(sb))
6829: ext4_stop_mmpd(sbi);
6830:
6831: /*
6832: * Handle aborting the filesystem as the last thing during remount to
6833: * avoid obsure errors during remount when some option changes fail to
6834: * apply due to shutdown filesystem.
6835: */
6836: if (test_opt2(sb, ABORT))
6837: ext4_abort(sb, ESHUTDOWN, "Abort forced by user");
6838:
6839: return 0;
6840:
6841: restore_opts:
6842: /*
6843: * If there was a failing r/w to ro transition, we may need to
6844: * re-enable quota
6845: */
6846: if (sb_rdonly(sb) && !(old_sb_flags & SB_RDONLY) &&
6847: sb_any_quota_suspended(sb))
6848: dquot_resume(sb, -1);
6849:
6850: alloc_ctx = ext4_writepages_down_write(sb);
6851: sb->s_flags = old_sb_flags;
6852: sbi->s_mount_opt = old_opts.s_mount_opt;
6853: sbi->s_mount_opt2 = old_opts.s_mount_opt2;
6854: sbi->s_resuid = old_opts.s_resuid;
6855: sbi->s_resgid = old_opts.s_resgid;
6856: sbi->s_commit_interval = old_opts.s_commit_interval;
6857: sbi->s_min_batch_time = old_opts.s_min_batch_time;
6858: sbi->s_max_batch_time = old_opts.s_max_batch_time;
6859: ext4_writepages_up_write(sb, alloc_ctx);
6860:
6861: if (!test_opt(sb, BLOCK_VALIDITY) && sbi->s_system_blks)
6862: ext4_release_system_zone(sb);
6863: #ifdef CONFIG_QUOTA
6864: sbi->s_jquota_fmt = old_opts.s_jquota_fmt;
6865: for (i = 0; i < EXT4_MAXQUOTAS; i++) {
6866: to_free[i] = get_qf_name(sb, sbi, i);
6867: rcu_assign_pointer(sbi->s_qf_names[i], old_opts.s_qf_names[i]);
6868: }
6869: synchronize_rcu();
6870: for (i = 0; i < EXT4_MAXQUOTAS; i++)
6871: kfree(to_free[i]);
6872: #endif
6873: if (!ext4_has_feature_mmp(sb) || sb_rdonly(sb))
6874: ext4_stop_mmpd(sbi);
6875: return err;
6876: }
SourceFile:fs/ext4/super.c]
|
| 26/2 |
2026/05/17 11:46 |
llm |
expert |
0m
Model:
Tokens:
input: 54067
output: 43
thoughts: 96
Thoughts: **Analyzing the ext4 Remount Process**
Okay, let's break down this `__ext4_remount` function. I see it starts with a call to `ext4_writepages_down_write(sb)` at line 6617. That's immediately followed by `ext4_apply_options`, and then `ext4_writepages_up_write(sb, alloc_ctx)`. My immediate question is, does `ext4_apply_options` acquire the `xattr_sem` semaphore? I need to know how it handles concurrency. No, after a quick check, it looks like it's just a simple options parser, so the semaphore isn't touched. Alright, good. That simplifies things. Next, I should consider how `ext4_ind_migrate` would affect things and see if that is called in this sequence.
|
| 27/2 |
2026/05/17 11:47 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:fs/ext4/migrate.c IncludeLines:true Name:ext4_ind_migrate]
Results: map[SourceCode: 600: /*
601: * Migrate a simple extent-based inode to use the i_blocks[] array
602: */
603: int ext4_ind_migrate(struct inode *inode)
604: {
605: struct ext4_extent_header *eh;
606: struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
607: struct ext4_super_block *es = sbi->s_es;
608: struct ext4_inode_info *ei = EXT4_I(inode);
609: struct ext4_extent *ex;
610: unsigned int i, len;
611: ext4_lblk_t start, end;
612: ext4_fsblk_t blk;
613: handle_t *handle;
614: int ret, ret2 = 0;
615: int alloc_ctx;
616:
617: if (!ext4_has_feature_extents(inode->i_sb) ||
618: (!ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
619: return -EINVAL;
620:
621: if (ext4_has_feature_bigalloc(inode->i_sb))
622: return -EOPNOTSUPP;
623:
624: /*
625: * In order to get correct extent info, force all delayed allocation
626: * blocks to be allocated, otherwise delayed allocation blocks may not
627: * be reflected and bypass the checks on extent header.
628: */
629: if (test_opt(inode->i_sb, DELALLOC))
630: ext4_alloc_da_blocks(inode);
631:
632: alloc_ctx = ext4_writepages_down_write(inode->i_sb);
633:
634: handle = ext4_journal_start(inode, EXT4_HT_MIGRATE, 1);
635: if (IS_ERR(handle)) {
636: ret = PTR_ERR(handle);
637: goto out_unlock;
638: }
639: /*
640: * This operation rewrites the inode's block mapping layout
641: * (extents to indirect blocks) and is not tracked in the fast
642: * commit log, so disable fast commits for this transaction.
643: */
644: ext4_fc_mark_ineligible(inode->i_sb, EXT4_FC_REASON_MIGRATE, handle);
645:
646: down_write(&EXT4_I(inode)->i_data_sem);
647: ret = ext4_ext_check_inode(inode);
648: if (ret)
649: goto errout;
650:
651: eh = ext_inode_hdr(inode);
652: ex = EXT_FIRST_EXTENT(eh);
653: if (ext4_blocks_count(es) > EXT4_MAX_BLOCK_FILE_PHYS ||
654: eh->eh_depth != 0 || le16_to_cpu(eh->eh_entries) > 1) {
655: ret = -EOPNOTSUPP;
656: goto errout;
657: }
658: if (eh->eh_entries == 0)
659: blk = len = start = end = 0;
660: else {
661: len = le16_to_cpu(ex->ee_len);
662: blk = ext4_ext_pblock(ex);
663: start = le32_to_cpu(ex->ee_block);
664: end = start + len - 1;
665: if (end >= EXT4_NDIR_BLOCKS) {
666: ret = -EOPNOTSUPP;
667: goto errout;
668: }
669: }
670:
671: ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS);
672: memset(ei->i_data, 0, sizeof(ei->i_data));
673: for (i = start; i <= end; i++)
674: ei->i_data[i] = cpu_to_le32(blk++);
675: ret2 = ext4_mark_inode_dirty(handle, inode);
676: if (unlikely(ret2 && !ret))
677: ret = ret2;
678: errout:
679: up_write(&EXT4_I(inode)->i_data_sem);
680: ext4_journal_stop(handle);
681: out_unlock:
682: ext4_writepages_up_write(inode->i_sb, alloc_ctx);
683: return ret;
684: }
SourceFile:fs/ext4/migrate.c]
|
| 28/2 |
2026/05/17 11:47 |
llm |
expert |
0m
Model:
Tokens:
input: 55846
output: 44
thoughts: 3198
Thoughts: **False Positive Lockdep Warning in ext4: A Deep Dive**
Okay, so I've been digging into this lockdep report, and it seems like we've got a classic false positive. The core of the issue is that `ext4_ind_migrate` *doesn't* acquire `xattr_sem`. The only place where we see the `s_writepages_rwsem` -> `xattr_sem` order is in `ext4_ext_migrate`, specifically when it's creating a *new* inode. This new inode then gets its `xattr_sem` acquired during initialization. Now, because this inode is brand new and not yet visible to any other threads, no other thread *could* be holding its `xattr_sem` and then waiting for `s_writepages_rwsem`. So, lockdep flags it as a circular dependency because it doesn't understand the nuance of the new inode. Lockdep, in its class-based tracking, sees `xattr_sem` -> `s_writepages_rwsem` on a sort of orphan inode, plus `s_writepages_rwsem` -> `xattr_sem` on the new inode, and yells circular dependency.
I started digging deeper, asking: is there any other way this could happen? Could `ext4_ext_migrate` be called, hold `s_writepages_rwsem`, and then call `ext4_new_inode` on *somehow* re-used inode with an acquired `xattr_sem`? But no, `ext4_new_inode` initializes the lock itself. And that's verified by looking at the call stack: `ext4_new_inode` -> `inode_init_always` -> `security_inode_init_security` -> `ext4_initxattrs` -> `ext4_xattr_set_handle`, and the `xattr_sem` is taken there on this newly allocated inode.
So it's a false positive. Now, if it's a false positive, it's not a real deadlock. But lockdep *will* print a warning, and then disable itself. Hmm, is this exploitable? A warning in lockdep isn't a vulnerability. It just gives a message. Could it cause a denial of service? No, because lockdep is disabled in production. Even if it *was* enabled, it just emits a warning and disables. So there's no DoS here.
But, I got concerned, and asked myself: could this be a real deadlock that I'm missing? I had to double check, so I did a thorough walk-through of the code with a hypothetical scenario. Thread 1: `ext4_evict_inode` (on inode A) -> `ext4_try_to_expand_extra_isize` -> `ext4_write_trylock_xattr` (acquires `xattr_sem` of inode A). This then calls `ext4_xattr_make_inode_space` -> `ext4_xattr_block_set` -> `iput(ea_inode)` (inode B). And `iput(ea_inode B)` -> `evict` -> `ext4_evict_inode`? No, more like `iput_final` -> `write_inode_now` -> `ext4_writepages` -> `ext4_writepages_down_read(sb)`. So Thread 1 holds the `xattr_sem` of inode A and is waiting on `s_writepages_rwsem`.
Thread 2: `ext4_ext_migrate` (on inode C) -> `ext4_writepages_down_write(sb)`. And then this calls `ext4_new_inode` -> `security_inode_init_security` -> `ext4_initxattrs` -> `ext4_xattr_set_handle` -> `ext4_write_lock_xattr` (acquires `xattr_sem` of inode D). This means Thread 2 holds `s_writepages_rwsem` and is waiting for `xattr_sem` of inode D.
For a real deadlock, Inode A must be the same as Inode D, right? But inode D is a *newly allocated* inode in `ext4_new_inode`, it's not visible to any other thread. Thread 1 holds the `xattr_sem` of inode A and Inode A is an *orphan* inode being evicted. So Inode A *cannot* be the same as Inode D. So Thread 2 will *never* block on the `xattr_sem` of inode D. It will simply acquire it, finish its work,
|
| 29/2 |
2026/05/17 11:48 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:fs/ext4/ioctl.c IncludeLines:true Name:ext4_ioctl_setflags]
Results: map[SourceCode: 590: static int ext4_ioctl_setflags(struct inode *inode,
591: unsigned int flags)
592: {
593: struct ext4_inode_info *ei = EXT4_I(inode);
594: handle_t *handle = NULL;
595: int err = -EPERM, migrate = 0;
596: struct ext4_iloc iloc;
597: unsigned int oldflags, mask, i;
598: struct super_block *sb = inode->i_sb;
599:
600: /* Is it quota file? Do not allow user to mess with it */
601: if (ext4_is_quota_file(inode))
602: goto flags_out;
603:
604: oldflags = ei->i_flags;
605: /*
606: * The JOURNAL_DATA flag can only be changed by
607: * the relevant capability.
608: */
609: if ((flags ^ oldflags) & (EXT4_JOURNAL_DATA_FL)) {
610: if (!capable(CAP_SYS_RESOURCE))
611: goto flags_out;
612: }
613:
614: if (!dax_compatible(inode, oldflags, flags)) {
615: err = -EOPNOTSUPP;
616: goto flags_out;
617: }
618:
619: if ((flags ^ oldflags) & EXT4_EXTENTS_FL)
620: migrate = 1;
621:
622: if ((flags ^ oldflags) & EXT4_CASEFOLD_FL) {
623: if (!ext4_has_feature_casefold(sb)) {
624: err = -EOPNOTSUPP;
625: goto flags_out;
626: }
627:
628: if (!S_ISDIR(inode->i_mode)) {
629: err = -ENOTDIR;
630: goto flags_out;
631: }
632:
633: if (!ext4_empty_dir(inode)) {
634: err = -ENOTEMPTY;
635: goto flags_out;
636: }
637: }
638:
639: /*
640: * Wait for all pending directio and then flush all the dirty pages
641: * for this file. The flush marks all the pages readonly, so any
642: * subsequent attempt to write to the file (particularly mmap pages)
643: * will come through the filesystem and fail.
644: */
645: if (S_ISREG(inode->i_mode) && !IS_IMMUTABLE(inode) &&
646: (flags & EXT4_IMMUTABLE_FL)) {
647: inode_dio_wait(inode);
648: err = filemap_write_and_wait(inode->i_mapping);
649: if (err)
650: goto flags_out;
651: }
652:
653: handle = ext4_journal_start(inode, EXT4_HT_INODE, 1);
654: if (IS_ERR(handle)) {
655: err = PTR_ERR(handle);
656: goto flags_out;
657: }
658: if (IS_SYNC(inode))
659: ext4_handle_sync(handle);
660: err = ext4_reserve_inode_write(handle, inode, &iloc);
661: if (err)
662: goto flags_err;
663:
664: ext4_dax_dontcache(inode, flags);
665:
666: for (i = 0, mask = 1; i < 32; i++, mask <<= 1) {
667: if (!(mask & EXT4_FL_USER_MODIFIABLE))
668: continue;
669: /* These flags get special treatment later */
670: if (mask == EXT4_JOURNAL_DATA_FL || mask == EXT4_EXTENTS_FL)
671: continue;
672: if (mask & flags)
673: ext4_set_inode_flag(inode, i);
674: else
675: ext4_clear_inode_flag(inode, i);
676: }
677:
678: ext4_set_inode_flags(inode, false);
679:
680: inode_set_ctime_current(inode);
681: inode_inc_iversion(inode);
682:
683: err = ext4_mark_iloc_dirty(handle, inode, &iloc);
684: flags_err:
685: ext4_journal_stop(handle);
686: if (err)
687: goto flags_out;
688:
689: if ((flags ^ oldflags) & (EXT4_JOURNAL_DATA_FL)) {
690: /*
691: * Changes to the journaling mode can cause unsafe changes to
692: * S_DAX if the inode is DAX
693: */
694: if (IS_DAX(inode)) {
695: err = -EBUSY;
696: goto flags_out;
697: }
698:
699: err = ext4_change_inode_journal_flag(inode,
700: flags & EXT4_JOURNAL_DATA_FL);
701: if (err)
702: goto flags_out;
703: }
704: if (migrate) {
705: if (flags & EXT4_EXTENTS_FL)
706: err = ext4_ext_migrate(inode);
707: else
708: err = ext4_ind_migrate(inode);
709: }
710:
711: flags_out:
712: return err;
713: }
SourceFile:fs/ext4/ioctl.c]
|
| 30/2 |
2026/05/17 11:48 |
llm |
expert |
0m
Model:
Tokens:
input: 61916
output: 48
thoughts: 109
Thoughts: **Analyzing EXT4 Filesystem Flag Manipulation**
Okay, so I'm looking at `ext4_ioctl_setflags`. It seems I can modify the `EXT4_EXTENTS_FL` flag using this. Interesting! If the flag `EXT4_EXTENTS_FL` is set, the code calls `ext4_ext_migrate`. Conversely, if it's cleared, it uses `ext4_ind_migrate`. Now, I need to confirm something. Isn't `EXT4_EXTENTS_FL` part of the `EXT4_FL_USER_MODIFIABLE` set? Yes, that's right. I'll quickly double-check the definition of `EXT4_FL_USER_MODIFIABLE` to be absolutely certain.
|
| 31/2 |
2026/05/17 11:48 |
tool |
codesearch-definition-source |
0m
Error:
Args: map[ContextFile:fs/ext4/ext4.h IncludeLines:true Name:EXT4_FL_USER_MODIFIABLE]
Results: map[SourceCode: SourceFile:]
|
| 32/2 |
2026/05/17 11:48 |
llm |
expert |
0m
Model:
Tokens:
input: 62258
output: 26
thoughts: 17
Thoughts: Here's my attempt at summarizing the thought process, tailored for an expert audience:
**Investigating User-Modifiable Filesystem Flags**
Okay, so I'm thinking about file system flags, specifically the ones related to user modification. The task at hand probably involves understanding or manipulating a file's attributes at a low level. My immediate instinct is to dive into the kernel source, specifically the EXT4 filesystem implementation, given the likely context. The most likely flag I'm looking for is named `EXT4_FL_USER_MODIFIABLE`. I expect this to be a bit flag that, when set or unset, affects what modifications a regular user can make to a file's attributes or extended attributes. Iβll start by using `grep` to quickly locate where this constant is defined and used within the kernel source. This should give me a good jumping-off point to explore related code and the underlying logic. Once I've found where this is defined, I'll start checking how this flag interacts with the other flags. This will let me figure out how it works and what kind of protections or permissions it is tied to.
|
| 33/2 |
2026/05/17 11:49 |
tool |
grepper |
0m
Args: map[Expression:#define EXT4_FL_USER_MODIFIABLE]
Results: map[Output:fs/ext4/ext4.h=440=struct flex_groups {
--
fs/ext4/ext4.h-515-/* User modifiable flags */
fs/ext4/ext4.h:516:#define EXT4_FL_USER_MODIFIABLE (EXT4_SECRM_FL | \
fs/ext4/ext4.h-517- EXT4_UNRM_FL | \
]
|
| 34/2 |
2026/05/17 11:49 |
llm |
expert |
0m
Model:
Tokens:
input: 62655
output: 24
thoughts: 22
Thoughts: Here's my attempt at summarizing the thought process, tailored for an expert audience:
**Diving into ext4.h: Locating the Key Structures**
Okay, time to get my hands dirty. I need to get a better grasp on something specific in the ext4 code. I'm going to start by pulling up `fs/ext4/ext4.h` β that's the usual starting point for digging into the core structures. Let's zero in on around line 516. It's likely we'll find some critical struct definitions or macros there that relate to the specific area I'm interested in. I'm guessing it might contain data structures related to inode operations or block allocation, or maybe even something related to journaling. Let's see what we've got.
|
| 35/2 |
2026/05/17 11:49 |
tool |
read-file |
0m
Args:
Results: map[Contents:// SPDX-License-Identifier: GPL-2.0
/*
* ext4.h
*
* Copyright (C) 1992, 1993, 1994, 1995
* Remy Card (card@masi.ibp.fr)
* Laboratoire MASI - Institut Blaise Pascal
* Universite Pierre et Marie Curie (Paris VI)
*
* from
*
* linux/include/linux/minix_fs.h
*
* Copyright (C) 1991, 1992 Linus Torvalds
*/
#ifndef _EXT4_H
#define _EXT4_H
#include <linux/refcount.h>
#include <linux/types.h>
#include <linux/blkdev.h>
#include <linux/magic.h>
#include <linux/jbd2.h>
#include <linux/quota.h>
#include <linux/rwsem.h>
#include <linux/rbtree.h>
#include <linux/seqlock.h>
#include <linux/mutex.h>
#include <linux/timer.h>
#include <linux/sched/signal.h>
#include <linux/blockgroup_lock.h>
#include <linux/percpu_counter.h>
#include <linux/ratelimit.h>
#include <linux/crc32c.h>
#include <linux/falloc.h>
#include <linux/percpu-rwsem.h>
#include <linux/fiemap.h>
#ifdef __KERNEL__
#include <linux/compat.h>
#endif
#include <uapi/linux/ext4.h>
#include <linux/fscrypt.h>
#include <linux/fsverity.h>
#include <linux/compiler.h>
/*
* The fourth extended filesystem constants/structures
*/
/*
* with AGGRESSIVE_CHECK allocator runs consistency checks over
* structures. these checks slow things down a lot
*/
#define AGGRESSIVE_CHECK__
/*
* with DOUBLE_CHECK defined mballoc creates persistent in-core
* bitmaps, maintains and uses them to check for double allocations
*/
#define DOUBLE_CHECK__
/*
* Define EXT4FS_DEBUG to produce debug messages
*/
#undef EXT4FS_DEBUG
/*
* Debug code
*/
#ifdef EXT4FS_DEBUG
#define ext4_debug(f, a...) \
do { \
printk(KERN_DEBUG "EXT4-fs DEBUG (%s, %d): %s:", \
__FILE__, __LINE__, __func__); \
printk(KERN_DEBUG f, ## a); \
} while (0)
#else
#define ext4_debug(fmt, ...) no_printk(fmt, ##__VA_ARGS__)
#endif
/*
* Turn on EXT_DEBUG to enable ext4_ext_show_path/leaf/move in extents.c
*/
#define EXT_DEBUG__
/*
* Dynamic printk for controlled extents debugging.
*/
#ifdef CONFIG_EXT4_DEBUG
#define ext_debug(ino, fmt, ...) \
pr_debug("[%s/%d] EXT4-fs (%s): ino %llu: (%s, %d): %s:" fmt, \
current->comm, task_pid_nr(current), \
ino->i_sb->s_id, ino->i_ino, __FILE__, __LINE__, \
__func__, ##__VA_ARGS__)
#else
#define ext_debug(ino, fmt, ...) no_printk(fmt, ##__VA_ARGS__)
#endif
#define ASSERT(assert) \
do { \
if (unlikely(!(assert))) { \
printk(KERN_EMERG \
"Assertion failure in %s() at %s:%d: '%s'\n", \
__func__, __FILE__, __LINE__, #assert); \
BUG(); \
} \
} while (0)
/* data type for block offset of block group */
typedef int ext4_grpblk_t;
/* data type for filesystem-wide blocks number */
typedef unsigned long long ext4_fsblk_t;
/* data type for file logical block number */
typedef __u32 ext4_lblk_t;
/* data type for block group number */
typedef unsigned int ext4_group_t;
enum SHIFT_DIRECTION {
SHIFT_LEFT = 0,
SHIFT_RIGHT,
};
/*
* For each criteria, mballoc has slightly different way of finding
* the required blocks nad usually, higher the criteria the slower the
* allocation. We start at lower criterias and keep falling back to
* higher ones if we are not able to find any blocks. Lower (earlier)
* criteria are faster.
*/
enum criteria {
/*
* Used when number of blocks needed is a power of 2. This
* doesn't trigger any disk IO except prefetch and is the
* fastest criteria.
*/
CR_POWER2_ALIGNED,
/*
* Tries to lookup in-memory data structures to find the most
* suitable group that satisfies goal request. No disk IO
* except block prefetch.
*/
CR_GOAL_LEN_FAST,
/*
* Same as CR_GOAL_LEN_FAST but is allowed to reduce the goal
* length to the best available length for faster allocation.
*/
CR_BEST_AVAIL_LEN,
/*
* Reads each block group sequentially, performing disk IO if
* necessary, to find suitable block group. Tries to
* allocate goal length but might trim the request if nothing
* is found after enough tries.
*/
CR_GOAL_LEN_SLOW,
/*
* Finds the first free set of blocks and allocates
* those. This is only used in rare cases when
* CR_GOAL_LEN_SLOW also fails to allocate anything.
*/
CR_ANY_FREE,
/*
* Number of criterias defined.
*/
EXT4_MB_NUM_CRS
};
/*
* Flags used in mballoc's allocation_context flags field.
*
* Also used to show what's going on for debugging purposes when the
* flag field is exported via the traceport interface
*/
/* prefer goal again. length */
#define EXT4_MB_HINT_MERGE 0x0001
/* first blocks in the file */
#define EXT4_MB_HINT_FIRST 0x0008
/* data is being allocated */
#define EXT4_MB_HINT_DATA 0x0020
/* don't preallocate (for tails) */
#define EXT4_MB_HINT_NOPREALLOC 0x0040
/* allocate for locality group */
#define EXT4_MB_HINT_GROUP_ALLOC 0x0080
/* allocate goal blocks or none */
#define EXT4_MB_HINT_GOAL_ONLY 0x0100
/* goal is meaningful */
#define EXT4_MB_HINT_TRY_GOAL 0x0200
/* blocks already pre-reserved by delayed allocation */
#define EXT4_MB_DELALLOC_RESERVED 0x0400
/* We are doing stream allocation */
#define EXT4_MB_STREAM_ALLOC 0x0800
/* Use reserved root blocks if needed */
#define EXT4_MB_USE_ROOT_BLOCKS 0x1000
/* Use blocks from reserved pool */
#define EXT4_MB_USE_RESERVED 0x2000
/* Do strict check for free blocks while retrying block allocation */
#define EXT4_MB_STRICT_CHECK 0x4000
struct ext4_allocation_request {
/* target inode for block we're allocating */
struct inode *inode;
/* how many blocks we want to allocate */
unsigned int len;
/* logical block in target inode */
ext4_lblk_t logical;
/* the closest logical allocated block to the left */
ext4_lblk_t lleft;
/* the closest logical allocated block to the right */
ext4_lblk_t lright;
/* phys. target (a hint) */
ext4_fsblk_t goal;
/* phys. block for the closest logical allocated block to the left */
ext4_fsblk_t pleft;
/* phys. block for the closest logical allocated block to the right */
ext4_fsblk_t pright;
/* flags. see above EXT4_MB_HINT_* */
unsigned int flags;
};
/*
* Logical to physical block mapping, used by ext4_map_blocks()
*
* This structure is used to pass requests into ext4_map_blocks() as
* well as to store the information returned by ext4_map_blocks(). It
* takes less room on the stack than a struct buffer_head.
*/
#define EXT4_MAP_NEW BIT(BH_New)
#define EXT4_MAP_MAPPED BIT(BH_Mapped)
#define EXT4_MAP_UNWRITTEN BIT(BH_Unwritten)
#define EXT4_MAP_BOUNDARY BIT(BH_Boundary)
#define EXT4_MAP_DELAYED BIT(BH_Delay)
/*
* This is for use in ext4_map_query_blocks() for a special case where we can
* have a physically and logically contiguous blocks split across two leaf
* nodes instead of a single extent. This is required in case of atomic writes
* to know whether the returned extent is last in leaf. If yes, then lookup for
* next in leaf block in ext4_map_query_blocks_next_in_leaf().
* - This is never going to be added to any buffer head state.
* - We use the next available bit after BH_BITMAP_UPTODATE.
*/
#define EXT4_MAP_QUERY_LAST_IN_LEAF BIT(BH_BITMAP_UPTODATE + 1)
#define EXT4_MAP_FLAGS (EXT4_MAP_NEW | EXT4_MAP_MAPPED |\
EXT4_MAP_UNWRITTEN | EXT4_MAP_BOUNDARY |\
EXT4_MAP_DELAYED | EXT4_MAP_QUERY_LAST_IN_LEAF)
struct ext4_map_blocks {
ext4_fsblk_t m_pblk;
ext4_lblk_t m_lblk;
unsigned int m_len;
unsigned int m_flags;
u64 m_seq;
};
/*
* Block validity checking, system zone rbtree.
*/
struct ext4_system_blocks {
struct rb_root root;
struct rcu_head rcu;
};
/*
* Flags for ext4_io_end->flags
*/
#define EXT4_IO_END_UNWRITTEN 0x0001
#define EXT4_IO_END_FAILED 0x0002
#define EXT4_IO_END_DEFER_COMPLETION (EXT4_IO_END_UNWRITTEN | EXT4_IO_END_FAILED)
struct ext4_io_end_vec {
struct list_head list; /* list of io_end_vec */
loff_t offset; /* offset in the file */
ssize_t size; /* size of the extent */
};
/*
* For converting unwritten extents on a work queue. 'handle' is used for
* buffered writeback.
*/
typedef struct ext4_io_end {
struct list_head list; /* per-file finished IO list */
handle_t *handle; /* handle reserved for extent
* conversion */
struct inode *inode; /* file being written to */
struct bio *bio; /* Linked list of completed
* bios covering the extent */
unsigned int flag; /* unwritten or not */
refcount_t count; /* reference counter */
struct list_head list_vec; /* list of ext4_io_end_vec */
} ext4_io_end_t;
struct ext4_io_submit {
struct writeback_control *io_wbc;
struct bio *io_bio;
ext4_io_end_t *io_end;
sector_t io_next_block;
};
/*
* Special inodes numbers
*/
#define EXT4_BAD_INO 1 /* Bad blocks inode */
#define EXT4_ROOT_INO 2 /* Root inode */
#define EXT4_USR_QUOTA_INO 3 /* User quota inode */
#define EXT4_GRP_QUOTA_INO 4 /* Group quota inode */
#define EXT4_BOOT_LOADER_INO 5 /* Boot loader inode */
#define EXT4_UNDEL_DIR_INO 6 /* Undelete directory inode */
#define EXT4_RESIZE_INO 7 /* Reserved group descriptors inode */
#define EXT4_JOURNAL_INO 8 /* Journal inode */
/* First non-reserved inode for old ext4 filesystems */
#define EXT4_GOOD_OLD_FIRST_INO 11
/*
* Maximal count of links to a file
*/
#define EXT4_LINK_MAX 65000
/*
* Macro-instructions used to manage several block sizes
*/
#define EXT4_MIN_BLOCK_SIZE 1024
#define EXT4_MAX_BLOCK_SIZE 65536
#define EXT4_MIN_BLOCK_LOG_SIZE 10
#define EXT4_MAX_BLOCK_LOG_SIZE 16
#define EXT4_MAX_CLUSTER_LOG_SIZE 30
#ifdef __KERNEL__
# define EXT4_BLOCK_SIZE(s) ((s)->s_blocksize)
#else
# define EXT4_BLOCK_SIZE(s) (EXT4_MIN_BLOCK_SIZE << (s)->s_log_block_size)
#endif
#define EXT4_ADDR_PER_BLOCK(s) (EXT4_BLOCK_SIZE(s) / sizeof(__u32))
#define EXT4_CLUSTER_SIZE(s) (EXT4_BLOCK_SIZE(s) << \
EXT4_SB(s)->s_cluster_bits)
#ifdef __KERNEL__
# define EXT4_BLOCK_SIZE_BITS(s) ((s)->s_blocksize_bits)
# define EXT4_CLUSTER_BITS(s) (EXT4_SB(s)->s_cluster_bits)
#else
# define EXT4_BLOCK_SIZE_BITS(s) ((s)->s_log_block_size + 10)
#endif
#ifdef __KERNEL__
#define EXT4_ADDR_PER_BLOCK_BITS(s) (EXT4_SB(s)->s_addr_per_block_bits)
#define EXT4_INODE_SIZE(s) (EXT4_SB(s)->s_inode_size)
#define EXT4_FIRST_INO(s) (EXT4_SB(s)->s_first_ino)
#else
#define EXT4_INODE_SIZE(s) (((s)->s_rev_level == EXT4_GOOD_OLD_REV) ? \
EXT4_GOOD_OLD_INODE_SIZE : \
(s)->s_inode_size)
#define EXT4_FIRST_INO(s) (((s)->s_rev_level == EXT4_GOOD_OLD_REV) ? \
EXT4_GOOD_OLD_FIRST_INO : \
(s)->s_first_ino)
#endif
#define EXT4_BLOCK_ALIGN(size, blkbits) ALIGN((size), (1 << (blkbits)))
#define EXT4_MAX_BLOCKS(size, offset, blkbits) \
((EXT4_BLOCK_ALIGN(size + offset, blkbits) >> blkbits) - (offset >> \
blkbits))
#define EXT4_B_TO_LBLK(inode, offset) \
(round_up((offset), i_blocksize(inode)) >> (inode)->i_blkbits)
#define EXT4_LBLK_TO_B(inode, lblk) ((loff_t)(lblk) << (inode)->i_blkbits)
/* Translate a block number to a page index */
#define EXT4_LBLK_TO_PG(inode, lblk) (EXT4_LBLK_TO_B((inode), (lblk)) >> \
PAGE_SHIFT)
/* Translate a page index to a block number */
#define EXT4_PG_TO_LBLK(inode, pnum) (((loff_t)(pnum) << PAGE_SHIFT) >> \
(inode)->i_blkbits)
/* Translate a block number to a cluster number */
#define EXT4_B2C(sbi, blk) ((blk) >> (sbi)->s_cluster_bits)
/* Translate a cluster number to a block number */
#define EXT4_C2B(sbi, cluster) ((cluster) << (sbi)->s_cluster_bits)
/* Translate # of blks to # of clusters */
#define EXT4_NUM_B2C(sbi, blks) (((blks) + (sbi)->s_cluster_ratio - 1) >> \
(sbi)->s_cluster_bits)
/* Mask out the low bits to get the starting block of the cluster */
#define EXT4_PBLK_CMASK(s, pblk) ((pblk) & \
~((ext4_fsblk_t) (s)->s_cluster_ratio - 1))
#define EXT4_LBLK_CMASK(s, lblk) ((lblk) & \
~((ext4_lblk_t) (s)->s_cluster_ratio - 1))
/* Fill in the low bits to get the last block of the cluster */
#define EXT4_LBLK_CFILL(sbi, lblk) ((lblk) | \
((ext4_lblk_t) (sbi)->s_cluster_ratio - 1))
/* Get the cluster offset */
#define EXT4_PBLK_COFF(s, pblk) ((pblk) & \
((ext4_fsblk_t) (s)->s_cluster_ratio - 1))
#define EXT4_LBLK_COFF(s, lblk) ((lblk) & \
((ext4_lblk_t) (s)->s_cluster_ratio - 1))
/*
* Structure of a blocks group descriptor
*/
struct ext4_group_desc
{
__le32 bg_block_bitmap_lo; /* Blocks bitmap block */
__le32 bg_inode_bitmap_lo; /* Inodes bitmap block */
__le32 bg_inode_table_lo; /* Inodes table block */
__le16 bg_free_blocks_count_lo;/* Free blocks count */
__le16 bg_free_inodes_count_lo;/* Free inodes count */
__le16 bg_used_dirs_count_lo; /* Directories count */
__le16 bg_flags; /* EXT4_BG_flags (INODE_UNINIT, etc) */
__le32 bg_exclude_bitmap_lo; /* Exclude bitmap for snapshots */
__le16 bg_block_bitmap_csum_lo;/* crc32c(s_uuid+grp_num+bbitmap) LE */
__le16 bg_inode_bitmap_csum_lo;/* crc32c(s_uuid+grp_num+ibitmap) LE */
__le16 bg_itable_unused_lo; /* Unused inodes count */
__le16 bg_checksum; /* crc16(sb_uuid+group+desc) */
__le32 bg_block_bitmap_hi; /* Blocks bitmap block MSB */
__le32 bg_inode_bitmap_hi; /* Inodes bitmap block MSB */
__le32 bg_inode_table_hi; /* Inodes table block MSB */
__le16 bg_free_blocks_count_hi;/* Free blocks count MSB */
__le16 bg_free_inodes_count_hi;/* Free inodes count MSB */
__le16 bg_used_dirs_count_hi; /* Directories count MSB */
__le16 bg_itable_unused_hi; /* Unused inodes count MSB */
__le32 bg_exclude_bitmap_hi; /* Exclude bitmap block MSB */
__le16 bg_block_bitmap_csum_hi;/* crc32c(s_uuid+grp_num+bbitmap) BE */
__le16 bg_inode_bitmap_csum_hi;/* crc32c(s_uuid+grp_num+ibitmap) BE */
__u32 bg_reserved;
};
#define EXT4_BG_INODE_BITMAP_CSUM_HI_END \
(offsetof(struct ext4_group_desc, bg_inode_bitmap_csum_hi) + \
sizeof(__le16))
#define EXT4_BG_BLOCK_BITMAP_CSUM_HI_END \
(offsetof(struct ext4_group_desc, bg_block_bitmap_csum_hi) + \
sizeof(__le16))
/*
* Structure of a flex block group info
*/
struct flex_groups {
atomic64_t free_clusters;
atomic_t free_inodes;
atomic_t used_dirs;
};
#define EXT4_BG_INODE_UNINIT 0x0001 /* Inode table/bitmap not in use */
#define EXT4_BG_BLOCK_UNINIT 0x0002 /* Block bitmap not in use */
#define EXT4_BG_INODE_ZEROED 0x0004 /* On-disk itable initialized to zero */
/*
* Macro-instructions used to manage group descriptors
*/
#define EXT4_MIN_DESC_SIZE 32
#define EXT4_MIN_DESC_SIZE_64BIT 64
#define EXT4_MAX_DESC_SIZE EXT4_MIN_BLOCK_SIZE
#define EXT4_DESC_SIZE(s) (EXT4_SB(s)->s_desc_size)
#ifdef __KERNEL__
# define EXT4_BLOCKS_PER_GROUP(s) (EXT4_SB(s)->s_blocks_per_group)
# define EXT4_CLUSTERS_PER_GROUP(s) (EXT4_SB(s)->s_clusters_per_group)
# define EXT4_DESC_PER_BLOCK(s) (EXT4_SB(s)->s_desc_per_block)
# define EXT4_INODES_PER_GROUP(s) (EXT4_SB(s)->s_inodes_per_group)
# define EXT4_DESC_PER_BLOCK_BITS(s) (EXT4_SB(s)->s_desc_per_block_bits)
#else
# define EXT4_BLOCKS_PER_GROUP(s) ((s)->s_blocks_per_group)
# define EXT4_DESC_PER_BLOCK(s) (EXT4_BLOCK_SIZE(s) / EXT4_DESC_SIZE(s))
# define EXT4_INODES_PER_GROUP(s) ((s)->s_inodes_per_group)
#endif
/*
* Constants relative to the data blocks
*/
#define EXT4_NDIR_BLOCKS 12
#define EXT4_IND_BLOCK EXT4_NDIR_BLOCKS
#define EXT4_DIND_BLOCK (EXT4_IND_BLOCK + 1)
#define EXT4_TIND_BLOCK (EXT4_DIND_BLOCK + 1)
#define EXT4_N_BLOCKS (EXT4_TIND_BLOCK + 1)
/*
* Inode flags
*/
#define EXT4_SECRM_FL 0x00000001 /* Secure deletion */
#define EXT4_UNRM_FL 0x00000002 /* Undelete */
#define EXT4_COMPR_FL 0x00000004 /* Compress file */
#define EXT4_SYNC_FL 0x00000008 /* Synchronous updates */
#define EXT4_IMMUTABLE_FL 0x00000010 /* Immutable file */
#define EXT4_APPEND_FL 0x00000020 /* writes to file may only append */
#define EXT4_NODUMP_FL 0x00000040 /* do not dump file */
#define EXT4_NOATIME_FL 0x00000080 /* do not update atime */
/* Reserved for compression usage... */
#define EXT4_DIRTY_FL 0x00000100
#define EXT4_COMPRBLK_FL 0x00000200 /* One or more compressed clusters */
#define EXT4_NOCOMPR_FL 0x00000400 /* Don't compress */
/* nb: was previously EXT2_ECOMPR_FL */
#define EXT4_ENCRYPT_FL 0x00000800 /* encrypted file */
/* End compression flags --- maybe not all used */
#define EXT4_INDEX_FL 0x00001000 /* hash-indexed directory */
#define EXT4_IMAGIC_FL 0x00002000 /* AFS directory */
#define EXT4_JOURNAL_DATA_FL 0x00004000 /* file data should be journaled */
#define EXT4_NOTAIL_FL 0x00008000 /* file tail should not be merged */
#define EXT4_DIRSYNC_FL 0x00010000 /* dirsync behaviour (directories only) */
#define EXT4_TOPDIR_FL 0x00020000 /* Top of directory hierarchies*/
#define EXT4_HUGE_FILE_FL 0x00040000 /* Set to each huge file */
#define EXT4_EXTENTS_FL 0x00080000 /* Inode uses extents */
#define EXT4_VERITY_FL 0x00100000 /* Verity protected inode */
#define EXT4_EA_INODE_FL 0x00200000 /* Inode used for large EA */
/* 0x00400000 was formerly EXT4_EOFBLOCKS_FL */
#define EXT4_DAX_FL 0x02000000 /* Inode is DAX */
#define EXT4_INLINE_DATA_FL 0x10000000 /* Inode has inline data. */
#define EXT4_PROJINHERIT_FL 0x20000000 /* Create with parents projid */
#define EXT4_CASEFOLD_FL 0x40000000 /* Casefolded directory */
#define EXT4_RESERVED_FL 0x80000000 /* reserved for ext4 lib */
/* User modifiable flags */
#define EXT4_FL_USER_MODIFIABLE (EXT4_SECRM_FL | \
EXT4_UNRM_FL | \
EXT4_COMPR_FL | \
EXT4_SYNC_FL | \
EXT4_IMMUTABLE_FL | \
EXT4_APPEND_FL | \
EXT4_NODUMP_FL | \
EXT4_NOATIME_FL | \
EXT4_JOURNAL_DATA_FL | \
EXT4_NOTAIL_FL | \
EXT4_DIRSYNC_FL | \
EXT4_TOPDIR_FL | \
EXT4_EXTENTS_FL | \
0x00400000 /* EXT4_EOFBLOCKS_FL */ | \
EXT4_DAX_FL | \
EXT4_PROJINHERIT_FL | \
EXT4_CASEFOLD_FL)
/* User visible flags */
#define EXT4_FL_USER_VISIBLE (EXT4_FL_USER_MODIFIABLE | \
EXT4_DIRTY_FL | \
EXT4_COMPRBLK_FL | \
EXT4_NOCOMPR_FL | \
EXT4_ENCRYPT_FL | \
EXT4_INDEX_FL | \
EXT4_VERITY_FL | \
EXT4_INLINE_DATA_FL)
/* Flags that should be inherited by new inodes from their parent. */
#define EXT4_FL_INHERITED (EXT4_SECRM_FL | EXT4_UNRM_FL | EXT4_COMPR_FL |\
EXT4_SYNC_FL | EXT4_NODUMP_FL | EXT4_NOATIME_FL |\
EXT4_NOCOMPR_FL | EXT4_JOURNAL_DATA_FL |\
EXT4_NOTAIL_FL | EXT4_DIRSYNC_FL |\
EXT4_PROJINHERIT_FL | EXT4_CASEFOLD_FL |\
EXT4_DAX_FL)
/* Flags that are appropriate for regular files (all but dir-specific ones). */
#define EXT4_REG_FLMASK (~(EXT4_DIRSYNC_FL | EXT4_TOPDIR_FL | EXT4_CASEFOLD_FL |\
EXT4_PROJINHERIT_FL))
/* Flags that are appropriate for non-directories/regular files. */
#define EXT4_OTHER_FLMASK (EXT4_NODUMP_FL | EXT4_NOATIME_FL)
/* The only flags that should be swapped */
#define EXT4_FL_SHOULD_SWAP (EXT4_HUGE_FILE_FL | EXT4_EXTENTS_FL)
/* Flags which are mutually exclusive to DAX */
#define EXT4_DAX_MUT_EXCL (EXT4_VERITY_FL | EXT4_ENCRYPT_FL |\
EXT4_JOURNAL_DATA_FL | EXT4_INLINE_DATA_FL)
/* Mask out flags that are inappropriate for the given type of inode. */
static inline __u32 ext4_mask_flags(umode_t mode, __u32 flags)
{
if (S_ISDIR(mode))
return flags;
else if (S_ISREG(mode))
return flags & EXT4_REG_FLMASK;
else
return flags & EXT4_OTHER_FLMASK;
}
/*
* Inode flags used for atomic set/get
*/
enum {
EXT4_INODE_SECRM = 0, /* Secure deletion */
EXT4_INODE_UNRM = 1, /* Undelete */
EXT4_INODE_COMPR = 2, /* Compress file */
EXT4_INODE_SYNC = 3, /* Synchronous updates */
EXT4_INODE_IMMUTABLE = 4, /* Immutable file */
EXT4_INODE_APPEND = 5, /* writes to file may only append */
EXT4_INODE_NODUMP = 6, /* do not dump file */
EXT4_INODE_NOATIME = 7, /* do not update atime */
/* Reserved for compression usage... */
EXT4_INODE_DIRTY = 8,
EXT4_INODE_COMPRBLK = 9, /* One or more compressed clusters */
EXT4_INODE_NOCOMPR = 10, /* Don't compress */
EXT4_INODE_ENCRYPT = 11, /* Encrypted file */
/* End compression flags --- maybe not all used */
EXT4_INODE_INDEX = 12, /* hash-indexed directory */
EXT4_INODE_IMAGIC = 13, /* AFS directory */
EXT4_INODE_JOURNAL_DATA = 14, /* file data should be journaled */
EXT4_INODE_NOTAIL = 15, /* file tail should not be merged */
EXT4_INODE_DIRSYNC = 16, /* dirsync behaviour (directories only) */
EXT4_INODE_TOPDIR = 17, /* Top of directory hierarchies*/
EXT4_INODE_HUGE_FILE = 18, /* Set to each huge file */
EXT4_INODE_EXTENTS = 19, /* Inode uses extents */
EXT4_INODE_VERITY = 20, /* Verity protected inode */
EXT4_INODE_EA_INODE = 21, /* Inode used for large EA */
/* 22 was formerly EXT4_INODE_EOFBLOCKS */
EXT4_INODE_DAX = 25, /* Inode is DAX */
EXT4_INODE_INLINE_DATA = 28, /* Data in inode. */
EXT4_INODE_PROJINHERIT = 29, /* Create with parents projid */
EXT4_INODE_CASEFOLD = 30, /* Casefolded directory */
EXT4_INODE_RESERVED = 31, /* reserved for ext4 lib */
};
/*
* Since it's pretty easy to mix up bit numbers and hex values, we use a
* build-time check to make sure that EXT4_XXX_FL is consistent with respect to
* EXT4_INODE_XXX. If all is well, the macros will be dropped, so, it won't cost
* any extra space in the compiled kernel image, otherwise, the build will fail.
* It's important that these values are the same, since we are using
* EXT4_INODE_XXX to test for flag values, but EXT4_XXX_FL must be consistent
* with the values of FS_XXX_FL defined in include/linux/fs.h and the on-disk
* values found in ext2, ext3 and ext4 filesystems, and of course the values
* defined in e2fsprogs.
*
* It's not paranoia if the Murphy's Law really *is* out to get you. :-)
*/
#define TEST_FLAG_VALUE(FLAG) (EXT4_##FLAG##_FL == (1U << EXT4_INODE_##FLAG))
#define CHECK_FLAG_VALUE(FLAG) BUILD_BUG_ON(!TEST_FLAG_VALUE(FLAG))
static inline void ext4_check_flag_values(void)
{
CHECK_FLAG_VALUE(SECRM);
CHECK_FLAG_VALUE(UNRM);
CHECK_FLAG_VALUE(COMPR);
CHECK_FLAG_VALUE(SYNC);
CHECK_FLAG_VALUE(IMMUTABLE);
CHECK_FLAG_VALUE(APPEND);
CHECK_FLAG_VALUE(NODUMP);
CHECK_FLAG_VALUE(NOATIME);
CHECK_FLAG_VALUE(DIRTY);
CHECK_FLAG_VALUE(COMPRBLK);
CHECK_FLAG_VALUE(NOCOMPR);
CHECK_FLAG_VALUE(ENCRYPT);
CHECK_FLAG_VALUE(INDEX);
CHECK_FLAG_VALUE(IMAGIC);
CHECK_FLAG_VALUE(JOURNAL_DATA);
CHECK_FLAG_VALUE(NOTAIL);
CHECK_FLAG_VALUE(DIRSYNC);
CHECK_FLAG_VALUE(TOPDIR);
CHECK_FLAG_VALUE(HUGE_FILE);
CHECK_FLAG_VALUE(EXTENTS);
CHECK_FLAG_VALUE(VERITY);
CHECK_FLAG_VALUE(EA_INODE);
CHECK_FLAG_VALUE(INLINE_DATA);
CHECK_FLAG_VALUE(PROJINHERIT);
CHECK_FLAG_VALUE(CASEFOLD);
CHECK_FLAG_VALUE(RESERVED);
}
#if defined(__KERNEL__) && defined(CONFIG_COMPAT)
struct compat_ext4_new_group_input {
u32 group;
compat_u64 block_bitmap;
compat_u64 inode_bitmap;
compat_u64 inode_table;
u32 blocks_count;
u16 reserved_blocks;
u16 unused;
};
#endif
/* The struct ext4_new_group_input in kernel space, with free_blocks_count */
struct ext4_new_group_data {
__u32 group;
__u64 block_bitmap;
__u64 inode_bitmap;
__u64 inode_table;
__u32 blocks_count;
__u16 reserved_blocks;
__u16 mdata_blocks;
__u32 free_clusters_count;
};
/* Indexes used to index group tables in ext4_new_group_data */
enum {
BLOCK_BITMAP = 0, /* block bitmap */
INODE_BITMAP, /* inode bitmap */
INODE_TABLE, /* inode tables */
GROUP_TABLE_COUNT,
};
/*
* Flags used by ext4_map_blocks()
*/
/* Allocate any needed blocks and/or convert an unwritten
extent to be an initialized ext4 */
#define EXT4_GET_BLOCKS_CREATE 0x0001
/* Request the creation of an unwritten extent */
#define EXT4_GET_BLOCKS_UNWRIT_EXT 0x0002
#define EXT4_GET_BLOCKS_CREATE_UNWRIT_EXT (EXT4_GET_BLOCKS_UNWRIT_EXT|\
EXT4_GET_BLOCKS_CREATE)
/* Caller is from the delayed allocation writeout path
* finally doing the actual allocation of delayed blocks */
#define EXT4_GET_BLOCKS_DELALLOC_RESERVE 0x0004
/*
* This means that we cannot merge newly allocated extents, and if we
* found an unwritten extent, we need to split it.
*/
#define EXT4_GET_BLOCKS_SPLIT_NOMERGE 0x0008
/* Convert unwritten extent to initialized. */
#define EXT4_GET_BLOCKS_CONVERT 0x0010
/* Eventual metadata allocation (due to growing extent tree)
* should not fail, so try to use reserved blocks for that.*/
#define EXT4_GET_BLOCKS_METADATA_NOFAIL 0x0020
/* Don't normalize allocation size (used for fallocate) */
#define EXT4_GET_BLOCKS_NO_NORMALIZE 0x0040
/* Convert written extents to unwritten */
#define EXT4_GET_BLOCKS_CONVERT_UNWRITTEN 0x0100
/* Write zeros to newly created written extents */
#define EXT4_GET_BLOCKS_ZERO 0x0200
#define EXT4_GET_BLOCKS_CREATE_ZERO (EXT4_GET_BLOCKS_CREATE |\
EXT4_GET_BLOCKS_ZERO)
/* Caller is in the context of data submission, such as writeback,
* fsync, etc. Especially, in the generic writeback path, caller will
* submit data before dropping transaction handle. This allows jbd2
* to avoid submitting data before commit. */
#define EXT4_GET_BLOCKS_IO_SUBMIT 0x0400
/* Convert extent to initialized after IO complete */
#define EXT4_GET_BLOCKS_IO_CONVERT_EXT (EXT4_GET_BLOCKS_CONVERT |\
EXT4_GET_BLOCKS_CREATE_UNWRIT_EXT |\
EXT4_GET_BLOCKS_IO_SUBMIT)
/* Caller is in the atomic contex, find extent if it has been cached */
#define EXT4_GET_BLOCKS_CACHED_NOWAIT 0x0800
/*
* Atomic write caller needs this to query in the slow path of mixed mapping
* case, when a contiguous extent can be split across two adjacent leaf nodes.
* Look EXT4_MAP_QUERY_LAST_IN_LEAF.
*/
#define EXT4_GET_BLOCKS_QUERY_LAST_IN_LEAF 0x1000
/*
* The bit position of these flags must not overlap with any of the
* EXT4_GET_BLOCKS_*. They are used by ext4_find_extent(),
* read_extent_tree_block(), ext4_split_extent_at(),
* ext4_ext_insert_extent(), and ext4_ext_create_new_leaf().
* EXT4_EX_NOCACHE is used to indicate that the we shouldn't be
* caching the extents when reading from the extent tree while a
* truncate or punch hole operation is in progress.
*/
#define EXT4_EX_NOCACHE 0x40000000
#define EXT4_EX_FORCE_CACHE 0x20000000
#define EXT4_EX_NOFAIL 0x10000000
/*
* ext4_map_query_blocks() uses this filter mask to filter the flags needed to
* pass while lookup/querying of on disk extent tree.
*/
#define EXT4_EX_QUERY_FILTER (EXT4_EX_NOCACHE | EXT4_EX_FORCE_CACHE |\
EXT4_EX_NOFAIL |\
EXT4_GET_BLOCKS_QUERY_LAST_IN_LEAF)
/*
* Flags used by ext4_free_blocks
*/
#define EXT4_FREE_BLOCKS_METADATA 0x0001
#define EXT4_FREE_BLOCKS_FORGET 0x0002
#define EXT4_FREE_BLOCKS_VALIDATED 0x0004
#define EXT4_FREE_BLOCKS_NO_QUOT_UPDATE 0x0008
#define EXT4_FREE_BLOCKS_NOFREE_FIRST_CLUSTER 0x0010
#define EXT4_FREE_BLOCKS_NOFREE_LAST_CLUSTER 0x0020
#define EXT4_FREE_BLOCKS_RERESERVE_CLUSTER 0x0040
#if defined(__KERNEL__) && defined(CONFIG_COMPAT)
/*
* ioctl commands in 32 bit emulation
*/
#define EXT4_IOC32_GETVERSION _IOR('f', 3, int)
#define EXT4_IOC32_SETVERSION _IOW('f', 4, int)
#define EXT4_IOC32_GETRSVSZ _IOR('f', 5, int)
#define EXT4_IOC32_SETRSVSZ _IOW('f', 6, int)
#define EXT4_IOC32_GROUP_EXTEND _IOW('f', 7, unsigned int)
#define EXT4_IOC32_GROUP_ADD _IOW('f', 8, struct compat_ext4_new_group_input)
#define EXT4_IOC32_GETVERSION_OLD FS_IOC32_GETVERSION
#define EXT4_IOC32_SETVERSION_OLD FS_IOC32_SETVERSION
#endif
/* Max physical block we can address w/o extents */
#define EXT4_MAX_BLOCK_FILE_PHYS 0xFFFFFFFF
/* Max logical block we can support */
#define EXT4_MAX_LOGICAL_BLOCK 0xFFFFFFFE
/*
* Structure of an inode on the disk
*/
struct ext4_inode {
__le16 i_mode; /* File mode */
__le16 i_uid; /* Low 16 bits of Owner Uid */
__le32 i_size_lo; /* Size in bytes */
__le32 i_atime; /* Access time */
__le32 i_ctime; /* Inode Change time */
__le32 i_mtime; /* Modification time */
__le32 i_dtime; /* Deletion Time */
__le16 i_gid; /* Low 16 bits of Group Id */
__le16 i_links_count; /* Links count */
__le32 i_blocks_lo; /* Blocks count */
__le32 i_flags; /* File flags */
union {
struct {
__le32 l_i_version;
} linux1;
struct {
__u32 h_i_translator;
} hurd1;
struct {
__u32 m_i_reserved1;
} masix1;
} osd1; /* OS dependent 1 */
__le32 i_block[EXT4_N_BLOCKS];/* Pointers to blocks */
__le32 i_generation; /* File version (for NFS) */
__le32 i_file_acl_lo; /* File ACL */
__le32 i_size_high;
__le32 i_obso_faddr; /* Obsoleted fragment address */
union {
struct {
__le16 l_i_blocks_high; /* were l_i_reserved1 */
__le16 l_i_file_acl_high;
__le16 l_i_uid_high; /* these 2 fields */
__le16 l_i_gid_high; /* were reserved2[0] */
__le16 l_i_checksum_lo;/* crc32c(uuid+inum+inode) LE */
__le16 l_i_reserved;
} linux2;
struct {
__le16 h_i_reserved1; /* Obsoleted fragment number/size which are removed in ext4 */
__u16 h_i_mode_high;
__u16 h_i_uid_high;
__u16 h_i_gid_high;
__u32 h_i_author;
} hurd2;
struct {
__le16 h_i_reserved1; /* Obsoleted fragment number/size which are removed in ext4 */
__le16 m_i_file_acl_high;
__u32 m_i_reserved2[2];
} masix2;
} osd2; /* OS dependent 2 */
__le16 i_extra_isize;
__le16 i_checksum_hi; /* crc32c(uuid+inum+inode) BE */
__le32 i_ctime_extra; /* extra Change time (nsec << 2 | epoch) */
__le32 i_mtime_extra; /* extra Modification time(nsec << 2 | epoch) */
__le32 i_atime_extra; /* extra Access time (nsec << 2 | epoch) */
__le32 i_crtime; /* File Creation time */
__le32 i_crtime_extra; /* extra FileCreationtime (nsec << 2 | epoch) */
__le32 i_version_hi; /* high 32 bits for 64-bit version */
__le32 i_projid; /* Project ID */
};
#define EXT4_EPOCH_BITS 2
#define EXT4_EPOCH_MASK ((1 << EXT4_EPOCH_BITS) - 1)
#define EXT4_NSEC_MASK (~0UL << EXT4_EPOCH_BITS)
/*
* Extended fields will fit into an inode if the filesystem was formatted
* with large inodes (-I 256 or larger) and there are not currently any EAs
* consuming all of the available space. For new inodes we always reserve
* enough space for the kernel's known extended fields, but for inodes
* created with an old kernel this might not have been the case. None of
* the extended inode fields is critical for correct filesystem operation.
* This macro checks if a certain field fits in the inode. Note that
* inode-size = GOOD_OLD_INODE_SIZE + i_extra_isize
*/
#define EXT4_FITS_IN_INODE(ext4_inode, einode, field) \
((offsetof(typeof(*ext4_inode), field) + \
sizeof((ext4_inode)->field)) \
<= (EXT4_GOOD_OLD_INODE_SIZE + \
(einode)->i_extra_isize)) \
/*
* We use an encoding that preserves the times for extra epoch "00":
*
* extra msb of adjust for signed
* epoch 32-bit 32-bit tv_sec to
* bits time decoded 64-bit tv_sec 64-bit tv_sec valid time range
* 0 0 1 -0x80000000..-0x00000001 0x000000000 1901-12-13..1969-12-31
* 0 0 0 0x000000000..0x07fffffff 0x000000000 1970-01-01..2038-01-19
* 0 1 1 0x080000000..0x0ffffffff 0x100000000 2038-01-19..2106-02-07
* 0 1 0 0x100000000..0x17fffffff 0x100000000 2106-02-07..2174-02-25
* 1 0 1 0x180000000..0x1ffffffff 0x200000000 2174-02-25..2242-03-16
* 1 0 0 0x200000000..0x27fffffff 0x200000000 2242-03-16..2310-04-04
* 1 1 1 0x280000000..0x2ffffffff 0x300000000 2310-04-04..2378-04-22
* 1 1 0 0x300000000..0x37fffffff 0x300000000 2378-04-22..2446-05-10
*
* Note that previous versions of the kernel on 64-bit systems would
* incorrectly use extra epoch bits 1,1 for dates between 1901 and
* 1970. e2fsck will correct this, assuming that it is run on the
* affected filesystem before 2242.
*/
static inline __le32 ext4_encode_extra_time(struct timespec64 ts)
{
u32 extra = ((ts.tv_sec - (s32)ts.tv_sec) >> 32) & EXT4_EPOCH_MASK;
return cpu_to_le32(extra | (ts.tv_nsec << EXT4_EPOCH_BITS));
}
static inline struct timespec64 ext4_decode_extra_time(__le32 base,
__le32 extra)
{
struct timespec64 ts = { .tv_sec = (signed)le32_to_cpu(base) };
if (unlikely(extra & cpu_to_le32(EXT4_EPOCH_MASK)))
ts.tv_sec += (u64)(le32_to_cpu(extra) & EXT4_EPOCH_MASK) << 32;
ts.tv_nsec = (le32_to_cpu(extra) & EXT4_NSEC_MASK) >> EXT4_EPOCH_BITS;
return ts;
}
#define EXT4_INODE_SET_XTIME_VAL(xtime, inode, raw_inode, ts) \
do { \
if (EXT4_FITS_IN_INODE(raw_inode, EXT4_I(inode), xtime ## _extra)) { \
(raw_inode)->xtime = cpu_to_le32((ts).tv_sec); \
(raw_inode)->xtime ## _extra = ext4_encode_extra_time(ts); \
} else \
(raw_inode)->xtime = cpu_to_le32(clamp_t(int32_t, (ts).tv_sec, S32_MIN, S32_MAX)); \
} while (0)
#define EXT4_INODE_SET_ATIME(inode, raw_inode) \
EXT4_INODE_SET_XTIME_VAL(i_atime, inode, raw_inode, inode_get_atime(inode))
#define EXT4_INODE_SET_MTIME(inode, raw_inode) \
EXT4_INODE_SET_XTIME_VAL(i_mtime, inode, raw_inode, inode_get_mtime(inode))
#define EXT4_INODE_SET_CTIME(inode, raw_inode) \
EXT4_INODE_SET_XTIME_VAL(i_ctime, inode, raw_inode, inode_get_ctime(inode))
#define EXT4_EINODE_SET_XTIME(xtime, einode, raw_inode) \
if (EXT4_FITS_IN_INODE(raw_inode, einode, xtime)) \
EXT4_INODE_SET_XTIME_VAL(xtime, &((einode)->vfs_inode), \
raw_inode, (einode)->xtime)
#define EXT4_INODE_GET_XTIME_VAL(xtime, inode, raw_inode) \
(EXT4_FITS_IN_INODE(raw_inode, EXT4_I(inode), xtime ## _extra) ? \
ext4_decode_extra_time((raw_inode)->xtime, \
(raw_inode)->xtime ## _extra) : \
(struct timespec64) { \
.tv_sec = (signed)le32_to_cpu((raw_inode)->xtime) \
})
#define EXT4_INODE_GET_ATIME(inode, raw_inode) \
do { \
inode_set_atime_to_ts(inode, \
EXT4_INODE_GET_XTIME_VAL(i_atime, inode, raw_inode)); \
} while (0)
#define EXT4_INODE_GET_MTIME(inode, raw_inode) \
do { \
inode_set_mtime_to_ts(inode, \
EXT4_INODE_GET_XTIME_VAL(i_mtime, inode, raw_inode)); \
} while (0)
#define EXT4_INODE_GET_CTIME(inode, raw_inode) \
do { \
inode_set_ctime_to_ts(inode, \
EXT4_INODE_GET_XTIME_VAL(i_ctime, inode, raw_inode)); \
} while (0)
#define EXT4_EINODE_GET_XTIME(xtime, einode, raw_inode) \
do { \
if (EXT4_FITS_IN_INODE(raw_inode, einode, xtime)) \
(einode)->xtime = \
EXT4_INODE_GET_XTIME_VAL(xtime, &(einode->vfs_inode), \
raw_inode); \
else \
(einode)->xtime = (struct timespec64){0, 0}; \
} while (0)
#define i_disk_version osd1.linux1.l_i_version
#if defined(__KERNEL__) || defined(__linux__)
#define i_reserved1 osd1.linux1.l_i_reserved1
#define i_file_acl_high osd2.linux2.l_i_file_acl_high
#define i_blocks_high osd2.linux2.l_i_blocks_high
#define i_uid_low i_uid
#define i_gid_low i_gid
#define i_uid_high osd2.linux2.l_i_uid_high
#define i_gid_high osd2.linux2.l_i_gid_high
#define i_checksum_lo osd2.linux2.l_i_checksum_lo
#elif defined(__GNU__)
#define i_translator osd1.hurd1.h_i_translator
#define i_uid_high osd2.hurd2.h_i_uid_high
#define i_gid_high osd2.hurd2.h_i_gid_high
#define i_author osd2.hurd2.h_i_author
#elif defined(__masix__)
#define i_reserved1 osd1.masix1.m_i_reserved1
#define i_file_acl_high osd2.masix2.m_i_file_acl_high
#define i_reserved2 osd2.masix2.m_i_reserved2
#endif /* defined(__KERNEL__) || defined(__linux__) */
#include "extents_status.h"
#include "fast_commit.h"
/*
* Lock subclasses for i_data_sem in the ext4_inode_info structure.
*
* These are needed to avoid lockdep false positives when we need to
* allocate blocks to the quota inode during ext4_map_blocks(), while
* holding i_data_sem for a normal (non-quota) inode. Since we don't
* do quota tracking for the quota inode, this avoids deadlock (as
* well as infinite recursion, since it isn't turtles all the way
* down...)
*
* I_DATA_SEM_NORMAL - Used for most inodes
* I_DATA_SEM_OTHER - Used by move_inode.c for the second normal inode
* where the second inode has larger inode number
* than the first
* I_DATA_SEM_QUOTA - Used for quota inodes only
* I_DATA_SEM_EA - Used for ea_inodes only
*/
enum {
I_DATA_SEM_NORMAL = 0,
I_DATA_SEM_OTHER,
I_DATA_SEM_QUOTA,
I_DATA_SEM_EA
};
/*
* fourth extended file system inode data in memory
*/
struct ext4_inode_info {
__le32 i_data[15]; /* unconverted */
__u32 i_dtime;
ext4_fsblk_t i_file_acl;
/*
* i_block_group is the number of the block group which contains
* this file's inode. Constant across the lifetime of the inode,
* it is used for making block allocation decisions - we try to
* place a file's data blocks near its inode block, and new inodes
* near to their parent directory's inode.
*/
ext4_group_t i_block_group;
ext4_lblk_t i_dir_start_lookup;
#if (BITS_PER_LONG < 64)
unsigned long i_state_flags; /* Dynamic state flags */
#endif
unsigned long i_flags;
/*
* Extended attributes can be read independently of the main file
* data. Taking i_rwsem even when reading would cause contention
* between readers of EAs and writers of regular file data, so
* instead we synchronize on xattr_sem when reading or changing
* EAs.
*/
struct rw_semaphore xattr_sem;
/*
* Inodes with EXT4_STATE_ORPHAN_FILE use i_orphan_idx. Otherwise
* i_orphan is used.
*/
union {
struct list_head i_orphan; /* unlinked but open inodes */
unsigned int i_orphan_idx; /* Index in orphan file */
};
/* Fast commit related info */
/* For tracking dentry create updates */
struct list_head i_fc_dilist;
struct list_head i_fc_list; /*
* inodes that need fast commit
* protected by sbi->s_fc_lock.
*/
/* Start of lblk range that needs to be committed in this fast commit */
ext4_lblk_t i_fc_lblk_start;
/* End of lblk range that needs to be committed in this fast commit */
ext4_lblk_t i_fc_lblk_len;
spinlock_t i_raw_lock; /* protects updates to the raw inode */
/*
* Protect concurrent accesses on i_fc_lblk_start, i_fc_lblk_len
* and inode's EXT4_FC_STATE_COMMITTING state bit.
*/
spinlock_t i_fc_lock;
/*
* i_disksize keeps track of what the inode size is ON DISK, not
* in memory. During truncate, i_size is set to the new size by
* the VFS prior to calling ext4_truncate(), but the filesystem won't
* set i_disksize to 0 until the truncate is actually under way.
*
* The intent is that i_disksize always represents the blocks which
* are used by this file. This allows recovery to restart truncate
* on orphans if we crash during truncate. We actually write i_disksize
* into the on-disk inode when writing inodes out, instead of i_size.
*
* The only time when i_disksize and i_size may be different is when
* a truncate is in progress. The only things which change i_disksize
* are ext4_get_block (growth) and ext4_truncate (shrinkth).
*/
loff_t i_disksize;
/*
* i_data_sem is for serialising ext4_truncate() against
* ext4_getblock(). In the 2.4 ext2 design, great chunks of inode's
* data tree are chopped off during truncate. We can't do that in
* ext4 because whenever we perform intermediate commits during
* truncate, the inode and all the metadata blocks *must* be in a
* consistent state which allows truncation of the orphans to restart
* during recovery. Hence we must fix the get_block-vs-truncate race
* by other means, so we have i_data_sem.
*/
struct rw_semaphore i_data_sem;
struct inode vfs_inode;
struct jbd2_inode *jinode;
struct mapping_metadata_bhs i_metadata_bhs;
/*
* File creation time. Its function is same as that of
* struct timespec64 i_{a,c,m}time in the generic inode.
*/
struct timespec64 i_crtime;
/* mballoc */
atomic_t i_prealloc_active;
/* allocation reservation info for delalloc */
/* In case of bigalloc, this refer to clusters rather than blocks */
unsigned int i_reserved_data_blocks;
struct rb_root i_prealloc_node;
rwlock_t i_prealloc_lock;
/* extents status tree */
struct ext4_es_tree i_es_tree;
rwlock_t i_es_lock;
struct list_head i_es_list;
unsigned int i_es_all_nr; /* protected by i_es_lock */
unsigned int i_es_shk_nr; /* protected by i_es_lock */
ext4_lblk_t i_es_shrink_lblk; /* Offset where we start searching for
extents to shrink. Protected by
i_es_lock */
u64 i_es_seq; /* Change counter for extents.
Protected by i_es_lock */
/* ialloc */
ext4_group_t i_last_alloc_group;
/* pending cluster reservations for bigalloc file systems */
struct ext4_pending_tree i_pending_tree;
/* on-disk additional length */
__u16 i_extra_isize;
/* Indicate the inline data space. */
u16 i_inline_off;
u16 i_inline_size;
#ifdef CONFIG_QUOTA
/* quota space reservation, managed internally by quota code */
qsize_t i_reserved_quota;
#endif
spinlock_t i_block_reservation_lock;
/* Lock protecting lists below */
spinlock_t i_completed_io_lock;
/*
* Completed IOs that need unwritten extents handling and have
* transaction reserved
*/
struct list_head i_rsv_conversion_list;
struct work_struct i_rsv_conversion_work;
/*
* Transactions that contain inode's metadata needed to complete
* fsync and fdatasync, respectively.
*/
tid_t i_sync_tid;
tid_t i_datasync_tid;
#ifdef CONFIG_QUOTA
struct dquot __rcu *i_dquot[MAXQUOTAS];
#endif
/* Precomputed uuid+inum+igen checksum for seeding inode checksums */
__u32 i_csum_seed;
kprojid_t i_projid;
#ifdef CONFIG_FS_ENCRYPTION
struct fscrypt_inode_info *i_crypt_info;
#endif
};
/*
* File system states
*/
#define EXT4_VALID_FS 0x0001 /* Unmounted cleanly */
#define EXT4_ERROR_FS 0x0002 /* Errors detected */
#define EXT4_ORPHAN_FS 0x0004 /* Orphans being recovered */
#define EXT4_FC_REPLAY 0x0020 /* Fast commit replay ongoing */
/*
* Misc. filesystem flags
*/
#define EXT2_FLAGS_SIGNED_HASH 0x0001 /* Signed dirhash in use */
#define EXT2_FLAGS_UNSIGNED_HASH 0x0002 /* Unsigned dirhash in use */
#define EXT2_FLAGS_TEST_FILESYS 0x0004 /* to test development code */
/*
* Mount flags set via mount options or defaults
*/
#define EXT4_MOUNT_NO_MBCACHE 0x00001 /* Do not use mbcache */
#define EXT4_MOUNT_GRPID 0x00004 /* Create files with directory's group */
#define EXT4_MOUNT_DEBUG 0x00008 /* Some debugging messages */
#define EXT4_MOUNT_ERRORS_CONT 0x00010 /* Continue on errors */
#define EXT4_MOUNT_ERRORS_RO 0x00020 /* Remount fs ro on errors */
#define EXT4_MOUNT_ERRORS_PANIC 0x00040 /* Panic on errors */
#define EXT4_MOUNT_ERRORS_MASK 0x00070
#define EXT4_MOUNT_MINIX_DF 0x00080 /* Mimics the Minix statfs */
#define EXT4_MOUNT_NOLOAD 0x00100 /* Don't use existing journal*/
#ifdef CONFIG_FS_DAX
#define EXT4_MOUNT_DAX_ALWAYS 0x00200 /* Direct Access */
#else
#define EXT4_MOUNT_DAX_ALWAYS 0
#endif
#define EXT4_MOUNT_DATA_FLAGS 0x00C00 /* Mode for data writes: */
#define EXT4_MOUNT_JOURNAL_DATA 0x00400 /* Write data to journal */
#define EXT4_MOUNT_ORDERED_DATA 0x00800 /* Flush data before commit */
#define EXT4_MOUNT_WRITEBACK_DATA 0x00C00 /* No data ordering */
#define EXT4_MOUNT_UPDATE_JOURNAL 0x01000 /* Update the journal format */
#define EXT4_MOUNT_NO_UID32 0x02000 /* Disable 32-bit UIDs */
#define EXT4_MOUNT_XATTR_USER 0x04000 /* Extended user attributes */
#define EXT4_MOUNT_POSIX_ACL 0x08000 /* POSIX Access Control Lists */
#define EXT4_MOUNT_NO_AUTO_DA_ALLOC 0x10000 /* No auto delalloc mapping */
#define EXT4_MOUNT_BARRIER 0x20000 /* Use block barriers */
#define EXT4_MOUNT_QUOTA 0x40000 /* Some quota option set */
#define EXT4_MOUNT_USRQUOTA 0x80000 /* "old" user quota,
* enable enforcement for hidden
* quota files */
#define EXT4_MOUNT_GRPQUOTA 0x100000 /* "old" group quota, enable
* enforcement for hidden quota
* files */
#define EXT4_MOUNT_PRJQUOTA 0x200000 /* Enable project quota
* enforcement */
#define EXT4_MOUNT_DIOREAD_NOLOCK 0x400000 /* Enable support for dio read nolocking */
#define EXT4_MOUNT_JOURNAL_CHECKSUM 0x800000 /* Journal checksums */
#define EXT4_MOUNT_JOURNAL_ASYNC_COMMIT 0x1000000 /* Journal Async Commit */
#define EXT4_MOUNT_WARN_ON_ERROR 0x2000000 /* Trigger WARN_ON on error */
#define EXT4_MOUNT_NO_PREFETCH_BLOCK_BITMAPS 0x4000000
#define EXT4_MOUNT_DELALLOC 0x8000000 /* Delalloc support */
#define EXT4_MOUNT_DATA_ERR_ABORT 0x10000000 /* Abort on file data write */
#define EXT4_MOUNT_BLOCK_VALIDITY 0x20000000 /* Block validity checking */
#define EXT4_MOUNT_DISCARD 0x40000000 /* Issue DISCARD requests */
#define EXT4_MOUNT_INIT_INODE_TABLE 0x80000000 /* Initialize uninitialized itables */
/*
* Mount flags set either automatically (could not be set by mount option)
* based on per file system feature or property or in special cases such as
* distinguishing between explicit mount option definition and default.
*/
#define EXT4_MOUNT2_EXPLICIT_DELALLOC 0x00000001 /* User explicitly
specified delalloc */
#define EXT4_MOUNT2_STD_GROUP_SIZE 0x00000002 /* We have standard group
size of blocksize * 8
blocks */
#define EXT4_MOUNT2_HURD_COMPAT 0x00000004 /* Support HURD-castrated
file systems */
#define EXT4_MOUNT2_EXPLICIT_JOURNAL_CHECKSUM 0x00000008 /* User explicitly
specified journal checksum */
#define EXT4_MOUNT2_JOURNAL_FAST_COMMIT 0x00000010 /* Journal fast commit */
#define EXT4_MOUNT2_DAX_NEVER 0x00000020 /* Do not allow Direct Access */
#define EXT4_MOUNT2_DAX_INODE 0x00000040 /* For printing options only */
#define EXT4_MOUNT2_MB_OPTIMIZE_SCAN 0x00000080 /* Optimize group
* scanning in mballoc
*/
#define EXT4_MOUNT2_ABORT 0x00000100 /* Abort filesystem */
#define clear_opt(sb, opt) EXT4_SB(sb)->s_mount_opt &= \
~EXT4_MOUNT_##opt
#define set_opt(sb, opt) EXT4_SB(sb)->s_mount_opt |= \
EXT4_MOUNT_##opt
#define test_opt(sb, opt) (EXT4_SB(sb)->s_mount_opt & \
EXT4_MOUNT_##opt)
#define clear_opt2(sb, opt) EXT4_SB(sb)->s_mount_opt2 &= \
~EXT4_MOUNT2_##opt
#define set_opt2(sb, opt) EXT4_SB(sb)->s_mount_opt2 |= \
EXT4_MOUNT2_##opt
#define test_opt2(sb, opt) (EXT4_SB(sb)->s_mount_opt2 & \
EXT4_MOUNT2_##opt)
#define ext4_test_and_set_bit __test_and_set_bit_le
#define ext4_set_bit __set_bit_le
#define ext4_test_and_clear_bit __test_and_clear_bit_le
#define ext4_clear_bit __clear_bit_le
#define ext4_test_bit test_bit_le
#define ext4_find_next_zero_bit find_next_zero_bit_le
#define ext4_find_next_bit find_next_bit_le
extern void mb_set_bits(void *bm, int cur, int len);
/*
* Maximal mount counts between two filesystem checks
*/
#define EXT4_DFL_MAX_MNT_COUNT 20 /* Allow 20 mounts */
#define EXT4_DFL_CHECKINTERVAL 0 /* Don't use interval check */
/*
* Behaviour when detecting errors
*/
#define EXT4_ERRORS_CONTINUE 1 /* Continue execution */
#define EXT4_ERRORS_RO 2 /* Remount fs read-only */
#define EXT4_ERRORS_PANIC 3 /* Panic */
#define EXT4_ERRORS_DEFAULT EXT4_ERRORS_CONTINUE
/* Metadata checksum algorithm codes */
#define EXT4_CRC32C_CHKSUM 1
#define EXT4_LABEL_MAX 16
/*
* Structure of the super block
*/
struct ext4_super_block {
/*00*/ __le32 s_inodes_count; /* Inodes count */
__le32 s_blocks_count_lo; /* Blocks count */
__le32 s_r_blocks_count_lo; /* Reserved blocks count */
__le32 s_free_blocks_count_lo; /* Free blocks count */
/*10*/ __le32 s_free_inodes_count; /* Free inodes count */
__le32 s_first_data_block; /* First Data Block */
__le32 s_log_block_size; /* Block size */
__le32 s_log_cluster_size; /* Allocation cluster size */
/*20*/ __le32 s_blocks_per_group; /* # Blocks per group */
__le32 s_clusters_per_group; /* # Clusters per group */
__le32 s_inodes_per_group; /* # Inodes per group */
__le32 s_mtime; /* Mount time */
/*30*/ __le32 s_wtime; /* Write time */
__le16 s_mnt_count; /* Mount count */
__le16 s_max_mnt_count; /* Maximal mount count */
__le16 s_magic; /* Magic signature */
__le16 s_state; /* File system state */
__le16 s_errors; /* Behaviour when detecting errors */
__le16 s_minor_rev_level; /* minor revision level */
/*40*/ __le32 s_lastcheck; /* time of last check */
__le32 s_checkinterval; /* max. time between checks */
__le32 s_creator_os; /* OS */
__le32 s_rev_level; /* Revision level */
/*50*/ __le16 s_def_resuid; /* Default uid for reserved blocks */
__le16 s_def_resgid; /* Default gid for reserved blocks */
/*
* These fields are for EXT4_DYNAMIC_REV superblocks only.
*
* Note: the difference between the compatible feature set and
* the incompatible feature set is that if there is a bit set
* in the incompatible feature set that the kernel doesn't
* know about, it should refuse to mount the filesystem.
*
* e2fsck's requirements are more strict; if it doesn't know
* about a feature in either the compatible or incompatible
* feature set, it must abort and not try to meddle with
* things it doesn't understand...
*/
__le32 s_first_ino; /* First non-reserved inode */
__le16 s_inode_size; /* size of inode structure */
__le16 s_block_group_nr; /* block group # of this superblock */
__le32 s_feature_compat; /* compatible feature set */
/*60*/ __le32 s_feature_incompat; /* incompatible feature set */
__le32 s_feature_ro_compat; /* readonly-compatible feature set */
/*68*/ __u8 s_uuid[16]; /* 128-bit uuid for volume */
/*78*/ char s_volume_name[EXT4_LABEL_MAX] __nonstring; /* volume name */
/*88*/ char s_last_mounted[64] __nonstring; /* directory where last mounted */
/*C8*/ __le32 s_algorithm_usage_bitmap; /* For compression */
/*
* Performance hints. Directory preallocation should only
* happen if the EXT4_FEATURE_COMPAT_DIR_PREALLOC flag is on.
*/
__u8 s_prealloc_blocks; /* Nr of blocks to try to preallocate*/
__u8 s_prealloc_dir_blocks; /* Nr to preallocate for dirs */
__le16 s_reserved_gdt_blocks; /* Per group desc for online growth */
/*
* Journaling support valid if EXT4_FEATURE_COMPAT_HAS_JOURNAL set.
*/
/*D0*/ __u8 s_journal_uuid[16]; /* uuid of journal superblock */
/*E0*/ __le32 s_journal_inum; /* inode number of journal file */
__le32 s_journal_dev; /* device number of journal file */
__le32 s_last_orphan; /* start of list of inodes to delete */
__le32 s_hash_seed[4]; /* HTREE hash seed */
__u8 s_def_hash_version; /* Default hash version to use */
__u8 s_jnl_backup_type;
__le16 s_desc_size; /* size of group descriptor */
/*100*/ __le32 s_default_mount_opts;
__le32 s_first_meta_bg; /* First metablock block group */
__le32 s_mkfs_time; /* When the filesystem was created */
__le32 s_jnl_blocks[17]; /* Backup of the journal inode */
/* 64bit support valid if EXT4_FEATURE_INCOMPAT_64BIT */
/*150*/ __le32 s_blocks_count_hi; /* Blocks count */
__le32 s_r_blocks_count_hi; /* Reserved blocks count */
__le32 s_free_blocks_count_hi; /* Free blocks count */
__le16 s_min_extra_isize; /* All inodes have at least # bytes */
__le16 s_want_extra_isize; /* New inodes should reserve # bytes */
__le32 s_flags; /* Miscellaneous flags */
__le16 s_raid_stride; /* RAID stride */
__le16 s_mmp_update_interval; /* # seconds to wait in MMP checking */
__le64 s_mmp_block; /* Block for multi-mount protection */
__le32 s_raid_stripe_width; /* blocks on all data disks (N*stride)*/
__u8 s_log_groups_per_flex; /* FLEX_BG group size */
__u8 s_checksum_type; /* metadata checksum algorithm used */
__u8 s_encryption_level; /* versioning level for encryption */
__u8 s_reserved_pad; /* Padding to next 32bits */
__le64 s_kbytes_written; /* nr of lifetime kilobytes written */
__le32 s_snapshot_inum; /* Inode number of active snapshot */
__le32 s_snapshot_id; /* sequential ID of active snapshot */
__le64 s_snapshot_r_blocks_count; /* reserved blocks for active
snapshot's future use */
__le32 s_snapshot_list; /* inode number of the head of the
on-disk snapshot list */
#define EXT4_S_ERR_START offsetof(struct ext4_super_block, s_error_count)
__le32 s_error_count; /* number of fs errors */
__le32 s_first_error_time; /* first time an error happened */
__le32 s_first_error_ino; /* inode involved in first error */
__le64 s_first_error_block; /* block involved of first error */
__u8 s_first_error_func[32] __nonstring; /* function where the error happened */
__le32 s_first_error_line; /* line number where error happened */
__le32 s_last_error_time; /* most recent time of an error */
__le32 s_last_error_ino; /* inode involved in last error */
__le32 s_last_error_line; /* line number where error happened */
__le64 s_last_error_block; /* block involved of last error */
__u8 s_last_error_func[32] __nonstring; /* function where the error happened */
#define EXT4_S_ERR_END offsetof(struct ext4_super_block, s_mount_opts)
__u8 s_mount_opts[64];
__le32 s_usr_quota_inum; /* inode for tracking user quota */
__le32 s_grp_quota_inum; /* inode for tracking group quota */
__le32 s_overhead_clusters; /* overhead blocks/clusters in fs */
__le32 s_backup_bgs[2]; /* groups with sparse_super2 SBs */
__u8 s_encrypt_algos[4]; /* Encryption algorithms in use */
__u8 s_encrypt_pw_salt[16]; /* Salt used for string2key algorithm */
__le32 s_lpf_ino; /* Location of the lost+found inode */
__le32 s_prj_quota_inum; /* inode for tracking project quota */
__le32 s_checksum_seed; /* crc32c(uuid) if csum_seed set */
__u8 s_wtime_hi;
__u8 s_mtime_hi;
__u8 s_mkfs_time_hi;
__u8 s_lastcheck_hi;
__u8 s_first_error_time_hi;
__u8 s_last_error_time_hi;
__u8 s_first_error_errcode;
__u8 s_last_error_errcode;
__le16 s_encoding; /* Filename charset encoding */
__le16 s_encoding_flags; /* Filename charset encoding flags */
__le32 s_orphan_file_inum; /* Inode for tracking orphan inodes */
__le16 s_def_resuid_hi;
__le16 s_def_resgid_hi;
__le32 s_reserved[93]; /* Padding to the end of the block */
__le32 s_checksum; /* crc32c(superblock) */
};
#define EXT4_S_ERR_LEN (EXT4_S_ERR_END - EXT4_S_ERR_START)
#ifdef __KERNEL__
/* Number of quota types we support */
#define EXT4_MAXQUOTAS 3
#define EXT4_ENC_UTF8_12_1 1
/* Types of ext4 journal triggers */
enum ext4_journal_trigger_type {
EXT4_JTR_ORPHAN_FILE,
EXT4_JTR_NONE /* This must be the last entry for indexing to work! */
};
#define EXT4_JOURNAL_TRIGGER_COUNT EXT4_JTR_NONE
struct ext4_journal_trigger {
struct jbd2_buffer_trigger_type tr_triggers;
struct super_block *sb;
};
static inline struct ext4_journal_trigger *EXT4_TRIGGER(
struct jbd2_buffer_trigger_type *trigger)
{
return container_of(trigger, struct ext4_journal_trigger, tr_triggers);
}
#define EXT4_ORPHAN_BLOCK_MAGIC 0x0b10ca04
/* Structure at the tail of orphan block */
struct ext4_orphan_block_tail {
__le32 ob_magic;
__le32 ob_checksum;
};
static inline int ext4_inodes_per_orphan_block(struct super_block *sb)
{
return (sb->s_blocksize - sizeof(struct ext4_orphan_block_tail)) /
sizeof(u32);
}
struct ext4_orphan_block {
atomic_t ob_free_entries; /* Number of free orphan entries in block */
struct buffer_head *ob_bh; /* Buffer for orphan block */
};
/*
* Info about orphan file.
*/
struct ext4_orphan_info {
int of_blocks; /* Number of orphan blocks in a file */
__u32 of_csum_seed; /* Checksum seed for orphan file */
struct ext4_orphan_block *of_binfo; /* Array with info about orphan
* file blocks */
};
/*
* fourth extended-fs super-block data in memory
*/
struct ext4_sb_info {
unsigned long s_desc_size; /* Size of a group descriptor in bytes */
unsigned long s_inodes_per_block;/* Number of inodes per block */
unsigned long s_blocks_per_group;/* Number of blocks in a group */
unsigned long s_clusters_per_group; /* Number of clusters in a group */
unsigned long s_inodes_per_group;/* Number of inodes in a group */
unsigned long s_itb_per_group; /* Number of inode table blocks per group */
unsigned long s_gdb_count; /* Number of group descriptor blocks */
unsigned long s_desc_per_block; /* Number of group descriptors per block */
ext4_group_t s_groups_count; /* Number of groups in the fs */
ext4_group_t s_blockfile_groups;/* Groups acceptable for non-extent files */
unsigned long s_overhead; /* # of fs overhead clusters */
unsigned int s_cluster_ratio; /* Number of blocks per cluster */
unsigned int s_cluster_bits; /* log2 of s_cluster_ratio */
loff_t s_bitmap_maxbytes; /* max bytes for bitmap files */
struct buffer_head * s_sbh; /* Buffer containing the super block */
struct ext4_super_block *s_es; /* Pointer to the super block in the buffer */
/* Array of bh's for the block group descriptors */
struct buffer_head * __rcu *s_group_desc;
unsigned int s_mount_opt;
unsigned int s_mount_opt2;
unsigned long s_mount_flags;
unsigned int s_def_mount_opt;
unsigned int s_def_mount_opt2;
ext4_fsblk_t s_sb_block;
atomic64_t s_resv_clusters;
kuid_t s_resuid;
kgid_t s_resgid;
unsigned short s_mount_state;
unsigned short s_pad;
int s_addr_per_block_bits;
int s_desc_per_block_bits;
int s_inode_size;
int s_first_ino;
unsigned int s_inode_readahead_blks;
unsigned int s_inode_goal;
u32 s_hash_seed[4];
int s_def_hash_version;
int s_hash_unsigned; /* 3 if hash should be unsigned, 0 if not */
struct percpu_counter s_freeclusters_counter;
struct percpu_counter s_freeinodes_counter;
struct percpu_counter s_dirs_counter;
struct percpu_counter s_dirtyclusters_counter;
struct percpu_counter s_sra_exceeded_retry_limit;
struct blockgroup_lock *s_blockgroup_lock;
struct proc_dir_entry *s_proc;
struct kobject s_kobj;
struct completion s_kobj_unregister;
struct mutex s_error_notify_mutex; /* protects sysfs_notify vs kobject_del */
struct super_block *s_sb;
struct buffer_head *s_mmp_bh;
/* Journaling */
struct journal_s *s_journal;
unsigned long s_ext4_flags; /* Ext4 superblock flags */
struct mutex s_orphan_lock; /* Protects on disk list changes */
struct list_head s_orphan; /* List of orphaned inodes in on disk
list */
struct ext4_orphan_info s_orphan_info;
unsigned long s_commit_interval;
u32 s_max_batch_time;
u32 s_min_batch_time;
struct file *s_journal_bdev_file;
#ifdef CONFIG_QUOTA
/* Names of quota files with journalled quota */
char __rcu *s_qf_names[EXT4_MAXQUOTAS];
int s_jquota_fmt; /* Format of quota to use */
#endif
unsigned int s_want_extra_isize; /* New inodes should reserve # bytes */
struct ext4_system_blocks __rcu *s_system_blks;
#ifdef EXTENTS_STATS
/* ext4 extents stats */
unsigned long s_ext_min;
unsigned long s_ext_max;
unsigned long s_depth_max;
spinlock_t s_ext_stats_lock;
unsigned long s_ext_blocks;
unsigned long s_ext_extents;
#endif
/* for buddy allocator */
struct ext4_group_info ** __rcu *s_group_info;
struct inode *s_buddy_cache;
spinlock_t s_md_lock;
unsigned short *s_mb_offsets;
unsigned int *s_mb_maxs;
unsigned int s_group_info_size;
atomic_t s_mb_free_pending;
struct list_head s_freed_data_list[2]; /* List of blocks to be freed
after commit completed */
struct list_head s_discard_list;
struct work_struct s_discard_work;
atomic_t s_retry_alloc_pending;
struct xarray *s_mb_avg_fragment_size;
struct xarray *s_mb_largest_free_orders;
/* tunables */
unsigned long s_stripe;
unsigned int s_mb_max_linear_groups;
unsigned int s_mb_stream_request;
unsigned int s_mb_max_to_scan;
unsigned int s_mb_min_to_scan;
unsigned int s_mb_stats;
unsigned int s_mb_order2_reqs;
unsigned int s_mb_group_prealloc;
unsigned int s_max_dir_size_kb;
unsigned int s_mb_prefetch;
unsigned int s_mb_prefetch_limit;
unsigned int s_mb_best_avail_max_trim_order;
unsigned int s_sb_update_sec;
unsigned int s_sb_update_kb;
/* where last allocation was done - for stream allocation */
ext4_group_t *s_mb_last_groups;
unsigned int s_mb_nr_global_goals;
/* stats for buddy allocator */
atomic_t s_bal_reqs; /* number of reqs with len > 1 */
atomic_t s_bal_success; /* we found long enough chunks */
atomic_t s_bal_allocated; /* in blocks */
atomic_t s_bal_ex_scanned; /* total extents scanned */
atomic_t s_bal_cX_ex_scanned[EXT4_MB_NUM_CRS]; /* total extents scanned */
atomic_t s_bal_groups_scanned; /* number of groups scanned */
atomic_t s_bal_goals; /* goal hits */
atomic_t s_bal_stream_goals; /* stream allocation global goal hits */
atomic_t s_bal_len_goals; /* len goal hits */
atomic_t s_bal_breaks; /* too long searches */
atomic_t s_bal_2orders; /* 2^order hits */
atomic64_t s_bal_cX_groups_considered[EXT4_MB_NUM_CRS];
atomic64_t s_bal_cX_hits[EXT4_MB_NUM_CRS];
atomic64_t s_bal_cX_failed[EXT4_MB_NUM_CRS]; /* cX loop didn't find blocks */
atomic_t s_mb_buddies_generated; /* number of buddies generated */
atomic64_t s_mb_generation_time;
atomic_t s_mb_lost_chunks;
atomic_t s_mb_preallocated;
atomic_t s_mb_discarded;
atomic_t s_lock_busy;
/* locality groups */
struct ext4_locality_group __percpu *s_locality_groups;
/* for write statistics */
unsigned long s_sectors_written_start;
u64 s_kbytes_written;
/* the size of zero-out chunk */
unsigned int s_extent_max_zeroout_kb;
unsigned int s_log_groups_per_flex;
struct flex_groups * __rcu *s_flex_groups;
ext4_group_t s_flex_groups_allocated;
/* workqueue for reserved extent conversions (buffered io) */
struct workqueue_struct *rsv_conversion_wq;
/* timer for periodic error stats printing */
struct timer_list s_err_report;
/* timeout in seconds for s_err_report; 0 disables the timer. */
unsigned long s_err_report_sec;
/* Lazy inode table initialization info */
struct ext4_li_request *s_li_request;
/* Wait multiplier for lazy initialization thread */
unsigned int s_li_wait_mult;
/* Kernel thread for multiple mount protection */
struct task_struct *s_mmp_tsk;
/* record the last minlen when FITRIM is called. */
unsigned long s_last_trim_minblks;
/* minimum folio order of a page cache allocation */
u16 s_min_folio_order;
/* supported maximum folio order, 0 means not supported */
u16 s_max_folio_order;
/* Precomputed FS UUID checksum for seeding other checksums */
__u32 s_csum_seed;
/* Reclaim extents from extent status tree */
struct shrinker *s_es_shrinker;
struct list_head s_es_list; /* List of inodes with reclaimable extents */
long s_es_nr_inode;
struct ext4_es_stats s_es_stats;
struct mb_cache *s_ea_block_cache;
struct mb_cache *s_ea_inode_cache;
spinlock_t s_es_lock ____cacheline_aligned_in_smp;
/* Journal triggers for checksum computation */
struct ext4_journal_trigger s_journal_triggers[EXT4_JOURNAL_TRIGGER_COUNT];
/* Ratelimit ext4 messages. */
struct ratelimit_state s_err_ratelimit_state;
struct ratelimit_state s_warning_ratelimit_state;
struct ratelimit_state s_msg_ratelimit_state;
atomic_t s_warning_count;
atomic_t s_msg_count;
/* Encryption policy for '-o test_dummy_encryption' */
struct fscrypt_dummy_policy s_dummy_enc_policy;
/*
* Barrier between writepages ops and changing any inode's JOURNAL_DATA
* or EXTENTS flag or between writepages ops and changing DELALLOC or
* DIOREAD_NOLOCK mount options on remount.
*/
struct percpu_rw_semaphore s_writepages_rwsem;
struct dax_device *s_daxdev;
u64 s_dax_part_off;
#ifdef CONFIG_EXT4_DEBUG
unsigned long s_simulate_fail;
#endif
/* Record the errseq of the backing block device */
errseq_t s_bdev_wb_err;
spinlock_t s_bdev_wb_lock;
/* Information about errors that happened during this mount */
spinlock_t s_error_lock;
int s_add_error_count;
int s_first_error_code;
__u32 s_first_error_line;
__u32 s_first_error_ino;
__u64 s_first_error_block;
const char *s_first_error_func;
time64_t s_first_error_time;
int s_last_error_code;
__u32 s_last_error_line;
__u32 s_last_error_ino;
__u64 s_last_error_block;
const char *s_last_error_func;
time64_t s_last_error_time;
/*
* If we are in a context where we cannot update the on-disk
* superblock, we queue the work here. This is used to update
* the error information in the superblock, and for periodic
* updates of the superblock called from the commit callback
* function.
*/
struct work_struct s_sb_upd_work;
/* Atomic write unit values in bytes */
unsigned int s_awu_min;
unsigned int s_awu_max;
/* Ext4 fast commit sub transaction ID */
atomic_t s_fc_subtid;
/*
* After commit starts, the main queue gets locked, and the further
* updates get added in the staging queue.
*/
#define FC_Q_MAIN 0
#define FC_Q_STAGING 1
struct list_head s_fc_q[2]; /* Inodes staged for fast commit
* that have data changes in them.
*/
struct list_head s_fc_dentry_q[2]; /* directory entry updates */
unsigned int s_fc_bytes;
/*
* Main fast commit lock. This lock protects accesses to the
* following fields:
* ei->i_fc_list, s_fc_dentry_q, s_fc_q, s_fc_bytes, s_fc_bh.
*
* s_fc_lock can be taken from reclaim context (inode eviction) and is
* thus reclaim unsafe. Use ext4_fc_lock()/ext4_fc_unlock() helpers
* when acquiring / releasing the lock.
*/
struct mutex s_fc_lock;
struct buffer_head *s_fc_bh;
struct ext4_fc_stats s_fc_stats;
tid_t s_fc_ineligible_tid;
#ifdef CONFIG_EXT4_DEBUG
int s_fc_debug_max_replay;
#endif
struct ext4_fc_replay_state s_fc_replay_state;
};
static inline struct ext4_sb_info *EXT4_SB(struct super_block *sb)
{
return sb->s_fs_info;
}
static inline struct ext4_inode_info *EXT4_I(struct inode *inode)
{
return container_of(inode, struct ext4_inode_info, vfs_inode);
}
static inline int ext4_writepages_down_read(struct super_block *sb)
{
percpu_down_read(&EXT4_SB(sb)->s_writepages_rwsem);
return memalloc_nofs_save();
}
static inline void ext4_writepages_up_read(struct super_block *sb, int ctx)
{
memalloc_nofs_restore(ctx);
percpu_up_read(&EXT4_SB(sb)->s_writepages_rwsem);
}
static inline int ext4_writepages_down_write(struct super_block *sb)
{
percpu_down_write(&EXT4_SB(sb)->s_writepages_rwsem);
return memalloc_nofs_save();
}
static inline void ext4_writepages_up_write(struct super_block *sb, int ctx)
{
memalloc_nofs_restore(ctx);
percpu_up_write(&EXT4_SB(sb)->s_writepages_rwsem);
}
static inline int ext4_fc_lock(struct super_block *sb)
{
mutex_lock(&EXT4_SB(sb)->s_fc_lock);
return memalloc_nofs_save();
}
static inline void ext4_fc_unlock(struct super_block *sb, int ctx)
{
memalloc_nofs_restore(ctx);
mutex_unlock(&EXT4_SB(sb)->s_fc_lock);
}
static inline int ext4_valid_inum(struct super_block *sb, unsigned long ino)
{
return ino == EXT4_ROOT_INO ||
(ino >= EXT4_FIRST_INO(sb) &&
ino <= le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count));
}
static inline int ext4_get_resuid(struct ext4_super_block *es)
{
return le16_to_cpu(es->s_def_resuid) |
le16_to_cpu(es->s_def_resuid_hi) << 16;
}
static inline int ext4_get_resgid(struct ext4_super_block *es)
{
return le16_to_cpu(es->s_def_resgid) |
le16_to_cpu(es->s_def_resgid_hi) << 16;
}
/*
* Returns: sbi->field[index]
* Used to access an array element from the following sbi fields which require
* rcu protection to avoid dereferencing an invalid pointer due to reassignment
* - s_group_desc
* - s_group_info
* - s_flex_group
*/
#define sbi_array_rcu_deref(sbi, field, index) \
({ \
typeof(*((sbi)->field)) _v; \
rcu_read_lock(); \
_v = ((typeof(_v)*)rcu_dereference((sbi)->field))[index]; \
rcu_read_unlock(); \
_v; \
})
/*
* run-time mount flags
*/
enum {
EXT4_MF_MNTDIR_SAMPLED,
EXT4_MF_FC_INELIGIBLE, /* Fast commit ineligible */
EXT4_MF_JOURNAL_DESTROY /* Journal is in process of destroying */
};
static inline void ext4_set_mount_flag(struct super_block *sb, int bit)
{
set_bit(bit, &EXT4_SB(sb)->s_mount_flags);
}
static inline void ext4_clear_mount_flag(struct super_block *sb, int bit)
{
clear_bit(bit, &EXT4_SB(sb)->s_mount_flags);
}
static inline int ext4_test_mount_flag(struct super_block *sb, int bit)
{
return test_bit(bit, &EXT4_SB(sb)->s_mount_flags);
}
/*
* Simulate_fail codes
*/
#define EXT4_SIM_BBITMAP_EIO 1
#define EXT4_SIM_BBITMAP_CRC 2
#define EXT4_SIM_IBITMAP_EIO 3
#define EXT4_SIM_IBITMAP_CRC 4
#define EXT4_SIM_INODE_EIO 5
#define EXT4_SIM_INODE_CRC 6
#define EXT4_SIM_DIRBLOCK_EIO 7
#define EXT4_SIM_DIRBLOCK_CRC 8
static inline bool ext4_simulate_fail(struct super_block *sb,
unsigned long code)
{
#ifdef CONFIG_EXT4_DEBUG
struct ext4_sb_info *sbi = EXT4_SB(sb);
if (unlikely(sbi->s_simulate_fail == code)) {
sbi->s_simulate_fail = 0;
return true;
}
#endif
return false;
}
/*
* Error number codes for s_{first,last}_error_errno
*
* Linux errno numbers are architecture specific, so we need to translate
* them into something which is architecture independent. We don't define
* codes for all errno's; just the ones which are most likely to be the cause
* of an ext4_error() call.
*/
#define EXT4_ERR_UNKNOWN 1
#define EXT4_ERR_EIO 2
#define EXT4_ERR_ENOMEM 3
#define EXT4_ERR_EFSBADCRC 4
#define EXT4_ERR_EFSCORRUPTED 5
#define EXT4_ERR_ENOSPC 6
#define EXT4_ERR_ENOKEY 7
#define EXT4_ERR_EROFS 8
#define EXT4_ERR_EFBIG 9
#define EXT4_ERR_EEXIST 10
#define EXT4_ERR_ERANGE 11
#define EXT4_ERR_EOVERFLOW 12
#define EXT4_ERR_EBUSY 13
#define EXT4_ERR_ENOTDIR 14
#define EXT4_ERR_ENOTEMPTY 15
#define EXT4_ERR_ESHUTDOWN 16
#define EXT4_ERR_EFAULT 17
/*
* Inode dynamic state flags
*/
enum {
EXT4_STATE_NEW, /* inode is newly created */
EXT4_STATE_XATTR, /* has in-inode xattrs */
EXT4_STATE_NO_EXPAND, /* No space for expansion */
EXT4_STATE_DA_ALLOC_CLOSE, /* Alloc DA blks on close */
EXT4_STATE_EXT_MIGRATE, /* Inode is migrating */
EXT4_STATE_NEWENTRY, /* File just added to dir */
EXT4_STATE_MAY_INLINE_DATA, /* may have in-inode data */
EXT4_STATE_EXT_PRECACHED, /* extents have been precached */
EXT4_STATE_LUSTRE_EA_INODE, /* Lustre-style ea_inode */
EXT4_STATE_VERITY_IN_PROGRESS, /* building fs-verity Merkle tree */
EXT4_STATE_FC_COMMITTING, /* Fast commit ongoing */
EXT4_STATE_FC_FLUSHING_DATA, /* Fast commit flushing data */
EXT4_STATE_ORPHAN_FILE, /* Inode orphaned in orphan file */
};
#define EXT4_INODE_BIT_FNS(name, field, offset) \
static inline int ext4_test_inode_##name(struct inode *inode, int bit) \
{ \
return test_bit(bit + (offset), &EXT4_I(inode)->i_##field); \
} \
static inline void ext4_set_inode_##name(struct inode *inode, int bit) \
{ \
set_bit(bit + (offset), &EXT4_I(inode)->i_##field); \
} \
static inline void ext4_clear_inode_##name(struct inode *inode, int bit) \
{ \
clear_bit(bit + (offset), &EXT4_I(inode)->i_##field); \
}
/* Add these declarations here only so that these functions can be
* found by name. Otherwise, they are very hard to locate. */
static inline int ext4_test_inode_flag(struct inode *inode, int bit);
static inline void ext4_set_inode_flag(struct inode *inode, int bit);
static inline void ext4_clear_inode_flag(struct inode *inode, int bit);
EXT4_INODE_BIT_FNS(flag, flags, 0)
/* Add these declarations here only so that these functions can be
* found by name. Otherwise, they are very hard to locate. */
static inline int ext4_test_inode_state(struct inode *inode, int bit);
static inline void ext4_set_inode_state(struct inode *inode, int bit);
static inline void ext4_clear_inode_state(struct inode *inode, int bit);
#if (BITS_PER_LONG < 64)
EXT4_INODE_BIT_FNS(state, state_flags, 0)
static inline void ext4_clear_state_flags(struct ext4_inode_info *ei)
{
(ei)->i_state_flags = 0;
}
#else
EXT4_INODE_BIT_FNS(state, flags, 32)
static inline void ext4_clear_state_flags(struct ext4_inode_info *ei)
{
/* We depend on the fact that callers will set i_flags */
}
#endif
#else
/* Assume that user mode programs are passing in an ext4fs superblock, not
* a kernel struct super_block. This will allow us to call the feature-test
* macros from user land. */
#define EXT4_SB(sb) (sb)
#endif
static inline bool ext4_verity_in_progress(struct inode *inode)
{
return IS_ENABLED(CONFIG_FS_VERITY) &&
ext4_test_inode_state(inode, EXT4_STATE_VERITY_IN_PROGRESS);
}
#define NEXT_ORPHAN(inode) EXT4_I(inode)->i_dtime
/*
* Check whether the inode is tracked as orphan (either in orphan file or
* orphan list).
*/
static inline bool ext4_inode_orphan_tracked(struct inode *inode)
{
return ext4_test_inode_state(inode, EXT4_STATE_ORPHAN_FILE) ||
!list_empty(&EXT4_I(inode)->i_orphan);
}
/*
* Codes for operating systems
*/
#define EXT4_OS_LINUX 0
#define EXT4_OS_HURD 1
#define EXT4_OS_MASIX 2
#define EXT4_OS_FREEBSD 3
#define EXT4_OS_LITES 4
/*
* Revision levels
*/
#define EXT4_GOOD_OLD_REV 0 /* The good old (original) format */
#define EXT4_DYNAMIC_REV 1 /* V2 format w/ dynamic inode sizes */
#define EXT4_MAX_SUPP_REV EXT4_DYNAMIC_REV
#define EXT4_GOOD_OLD_INODE_SIZE 128
#define EXT4_EXTRA_TIMESTAMP_MAX (((s64)1 << 34) - 1 + S32_MIN)
#define EXT4_NON_EXTRA_TIMESTAMP_MAX S32_MAX
#define EXT4_TIMESTAMP_MIN S32_MIN
/*
* Feature set definitions
*/
#define EXT4_FEATURE_COMPAT_DIR_PREALLOC 0x0001
#define EXT4_FEATURE_COMPAT_IMAGIC_INODES 0x0002
#define EXT4_FEATURE_COMPAT_HAS_JOURNAL 0x0004
#define EXT4_FEATURE_COMPAT_EXT_ATTR 0x0008
#define EXT4_FEATURE_COMPAT_RESIZE_INODE 0x0010
#define EXT4_FEATURE_COMPAT_DIR_INDEX 0x0020
#define EXT4_FEATURE_COMPAT_SPARSE_SUPER2 0x0200
/*
* The reason why "FAST_COMMIT" is a compat feature is that, FS becomes
* incompatible only if fast commit blocks are present in the FS. Since we
* clear the journal (and thus the fast commit blocks), we don't mark FS as
* incompatible. We also have a JBD2 incompat feature, which gets set when
* there are fast commit blocks present in the journal.
*/
#define EXT4_FEATURE_COMPAT_FAST_COMMIT 0x0400
#define EXT4_FEATURE_COMPAT_STABLE_INODES 0x0800
#define EXT4_FEATURE_COMPAT_ORPHAN_FILE 0x1000 /* Orphan file exists */
#define EXT4_FEATURE_RO_COMPAT_SPARSE_SUPER 0x0001
#define EXT4_FEATURE_RO_COMPAT_LARGE_FILE 0x0002
#define EXT4_FEATURE_RO_COMPAT_BTREE_DIR 0x0004
#define EXT4_FEATURE_RO_COMPAT_HUGE_FILE 0x0008
#define EXT4_FEATURE_RO_COMPAT_GDT_CSUM 0x0010
#define EXT4_FEATURE_RO_COMPAT_DIR_NLINK 0x0020
#define EXT4_FEATURE_RO_COMPAT_EXTRA_ISIZE 0x0040
#define EXT4_FEATURE_RO_COMPAT_QUOTA 0x0100
#define EXT4_FEATURE_RO_COMPAT_BIGALLOC 0x0200
/*
* METADATA_CSUM also enables group descriptor checksums (GDT_CSUM). When
* METADATA_CSUM is set, group descriptor checksums use the same algorithm as
* all other data structures' checksums. However, the METADATA_CSUM and
* GDT_CSUM bits are mutually exclusive.
*/
#define EXT4_FEATURE_RO_COMPAT_METADATA_CSUM 0x0400
#define EXT4_FEATURE_RO_COMPAT_READONLY 0x1000
#define EXT4_FEATURE_RO_COMPAT_PROJECT 0x2000
#define EXT4_FEATURE_RO_COMPAT_VERITY 0x8000
#define EXT4_FEATURE_RO_COMPAT_ORPHAN_PRESENT 0x10000 /* Orphan file may be
non-empty */
#define EXT4_FEATURE_INCOMPAT_COMPRESSION 0x0001
#define EXT4_FEATURE_INCOMPAT_FILETYPE 0x0002
#define EXT4_FEATURE_INCOMPAT_RECOVER 0x0004 /* Needs recovery */
#define EXT4_FEATURE_INCOMPAT_JOURNAL_DEV 0x0008 /* Journal device */
#define EXT4_FEATURE_INCOMPAT_META_BG 0x0010
#define EXT4_FEATURE_INCOMPAT_EXTENTS 0x0040 /* extents support */
#define EXT4_FEATURE_INCOMPAT_64BIT 0x0080
#define EXT4_FEATURE_INCOMPAT_MMP 0x0100
#define EXT4_FEATURE_INCOMPAT_FLEX_BG 0x0200
#define EXT4_FEATURE_INCOMPAT_EA_INODE 0x0400 /* EA in inode */
#define EXT4_FEATURE_INCOMPAT_DIRDATA 0x1000 /* data in dirent */
#define EXT4_FEATURE_INCOMPAT_CSUM_SEED 0x2000
#define EXT4_FEATURE_INCOMPAT_LARGEDIR 0x4000 /* >2GB or 3-lvl htree */
#define EXT4_FEATURE_INCOMPAT_INLINE_DATA 0x8000 /* data in inode */
#define EXT4_FEATURE_INCOMPAT_ENCRYPT 0x10000
#define EXT4_FEATURE_INCOMPAT_CASEFOLD 0x20000
extern void ext4_update_dynamic_rev(struct super_block *sb);
#define EXT4_FEATURE_COMPAT_FUNCS(name, flagname) \
static inline bool ext4_has_feature_##name(struct super_block *sb) \
{ \
return ((EXT4_SB(sb)->s_es->s_feature_compat & \
cpu_to_le32(EXT4_FEATURE_COMPAT_##flagname)) != 0); \
} \
static inline void ext4_set_feature_##name(struct super_block *sb) \
{ \
ext4_update_dynamic_rev(sb); \
EXT4_SB(sb)->s_es->s_feature_compat |= \
cpu_to_le32(EXT4_FEATURE_COMPAT_##flagname); \
} \
static inline void ext4_clear_feature_##name(struct super_block *sb) \
{ \
EXT4_SB(sb)->s_es->s_feature_compat &= \
~cpu_to_le32(EXT4_FEATURE_COMPAT_##flagname); \
}
#define EXT4_FEATURE_RO_COMPAT_FUNCS(name, flagname) \
static inline bool ext4_has_feature_##name(struct super_block *sb) \
{ \
return ((EXT4_SB(sb)->s_es->s_feature_ro_compat & \
cpu_to_le32(EXT4_FEATURE_RO_COMPAT_##flagname)) != 0); \
} \
static inline void ext4_set_feature_##name(struct super_block *sb) \
{ \
ext4_update_dynamic_rev(sb); \
EXT4_SB(sb)->s_es->s_feature_ro_compat |= \
cpu_to_le32(EXT4_FEATURE_RO_COMPAT_##flagname); \
} \
static inline void ext4_clear_feature_##name(struct super_block *sb) \
{ \
EXT4_SB(sb)->s_es->s_feature_ro_compat &= \
~cpu_to_le32(EXT4_FEATURE_RO_COMPAT_##flagname); \
}
#define EXT4_FEATURE_INCOMPAT_FUNCS(name, flagname) \
static inline bool ext4_has_feature_##name(struct super_block *sb) \
{ \
return ((EXT4_SB(sb)->s_es->s_feature_incompat & \
cpu_to_le32(EXT4_FEATURE_INCOMPAT_##flagname)) != 0); \
} \
static inline void ext4_set_feature_##name(struct super_block *sb) \
{ \
ext4_update_dynamic_rev(sb); \
EXT4_SB(sb)->s_es->s_feature_incompat |= \
cpu_to_le32(EXT4_FEATURE_INCOMPAT_##flagname); \
} \
static inline void ext4_clear_feature_##name(struct super_block *sb) \
{ \
EXT4_SB(sb)->s_es->s_feature_incompat &= \
~cpu_to_le32(EXT4_FEATURE_INCOMPAT_##flagname); \
}
EXT4_FEATURE_COMPAT_FUNCS(dir_prealloc, DIR_PREALLOC)
EXT4_FEATURE_COMPAT_FUNCS(imagic_inodes, IMAGIC_INODES)
EXT4_FEATURE_COMPAT_FUNCS(journal, HAS_JOURNAL)
EXT4_FEATURE_COMPAT_FUNCS(xattr, EXT_ATTR)
EXT4_FEATURE_COMPAT_FUNCS(resize_inode, RESIZE_INODE)
EXT4_FEATURE_COMPAT_FUNCS(dir_index, DIR_INDEX)
EXT4_FEATURE_COMPAT_FUNCS(sparse_super2, SPARSE_SUPER2)
EXT4_FEATURE_COMPAT_FUNCS(fast_commit, FAST_COMMIT)
EXT4_FEATURE_COMPAT_FUNCS(stable_inodes, STABLE_INODES)
EXT4_FEATURE_COMPAT_FUNCS(orphan_file, ORPHAN_FILE)
EXT4_FEATURE_RO_COMPAT_FUNCS(sparse_super, SPARSE_SUPER)
EXT4_FEATURE_RO_COMPAT_FUNCS(large_file, LARGE_FILE)
EXT4_FEATURE_RO_COMPAT_FUNCS(btree_dir, BTREE_DIR)
EXT4_FEATURE_RO_COMPAT_FUNCS(huge_file, HUGE_FILE)
EXT4_FEATURE_RO_COMPAT_FUNCS(gdt_csum, GDT_CSUM)
EXT4_FEATURE_RO_COMPAT_FUNCS(dir_nlink, DIR_NLINK)
EXT4_FEATURE_RO_COMPAT_FUNCS(extra_isize, EXTRA_ISIZE)
EXT4_FEATURE_RO_COMPAT_FUNCS(quota, QUOTA)
EXT4_FEATURE_RO_COMPAT_FUNCS(bigalloc, BIGALLOC)
EXT4_FEATURE_RO_COMPAT_FUNCS(metadata_csum, METADATA_CSUM)
EXT4_FEATURE_RO_COMPAT_FUNCS(readonly, READONLY)
EXT4_FEATURE_RO_COMPAT_FUNCS(project, PROJECT)
EXT4_FEATURE_RO_COMPAT_FUNCS(verity, VERITY)
EXT4_FEATURE_RO_COMPAT_FUNCS(orphan_present, ORPHAN_PRESENT)
EXT4_FEATURE_INCOMPAT_FUNCS(compression, COMPRESSION)
EXT4_FEATURE_INCOMPAT_FUNCS(filetype, FILETYPE)
EXT4_FEATURE_INCOMPAT_FUNCS(journal_needs_recovery, RECOVER)
EXT4_FEATURE_INCOMPAT_FUNCS(journal_dev, JOURNAL_DEV)
EXT4_FEATURE_INCOMPAT_FUNCS(meta_bg, META_BG)
EXT4_FEATURE_INCOMPAT_FUNCS(extents, EXTENTS)
EXT4_FEATURE_INCOMPAT_FUNCS(64bit, 64BIT)
EXT4_FEATURE_INCOMPAT_FUNCS(mmp, MMP)
EXT4_FEATURE_INCOMPAT_FUNCS(flex_bg, FLEX_BG)
EXT4_FEATURE_INCOMPAT_FUNCS(ea_inode, EA_INODE)
EXT4_FEATURE_INCOMPAT_FUNCS(dirdata, DIRDATA)
EXT4_FEATURE_INCOMPAT_FUNCS(csum_seed, CSUM_SEED)
EXT4_FEATURE_INCOMPAT_FUNCS(largedir, LARGEDIR)
EXT4_FEATURE_INCOMPAT_FUNCS(inline_data, INLINE_DATA)
EXT4_FEATURE_INCOMPAT_FUNCS(encrypt, ENCRYPT)
EXT4_FEATURE_INCOMPAT_FUNCS(casefold, CASEFOLD)
#define EXT2_FEATURE_COMPAT_SUPP EXT4_FEATURE_COMPAT_EXT_ATTR
#define EXT2_FEATURE_INCOMPAT_SUPP (EXT4_FEATURE_INCOMPAT_FILETYPE| \
EXT4_FEATURE_INCOMPAT_META_BG)
#define EXT2_FEATURE_RO_COMPAT_SUPP (EXT4_FEATURE_RO_COMPAT_SPARSE_SUPER| \
EXT4_FEATURE_RO_COMPAT_LARGE_FILE| \
EXT4_FEATURE_RO_COMPAT_BTREE_DIR)
#define EXT3_FEATURE_COMPAT_SUPP EXT4_FEATURE_COMPAT_EXT_ATTR
#define EXT3_FEATURE_INCOMPAT_SUPP (EXT4_FEATURE_INCOMPAT_FILETYPE| \
EXT4_FEATURE_INCOMPAT_RECOVER| \
EXT4_FEATURE_INCOMPAT_META_BG)
#define EXT3_FEATURE_RO_COMPAT_SUPP (EXT4_FEATURE_RO_COMPAT_SPARSE_SUPER| \
EXT4_FEATURE_RO_COMPAT_LARGE_FILE| \
EXT4_FEATURE_RO_COMPAT_BTREE_DIR)
#define EXT4_FEATURE_COMPAT_SUPP (EXT4_FEATURE_COMPAT_EXT_ATTR| \
EXT4_FEATURE_COMPAT_ORPHAN_FILE)
#define EXT4_FEATURE_INCOMPAT_SUPP (EXT4_FEATURE_INCOMPAT_FILETYPE| \
EXT4_FEATURE_INCOMPAT_RECOVER| \
EXT4_FEATURE_INCOMPAT_META_BG| \
EXT4_FEATURE_INCOMPAT_EXTENTS| \
EXT4_FEATURE_INCOMPAT_64BIT| \
EXT4_FEATURE_INCOMPAT_FLEX_BG| \
EXT4_FEATURE_INCOMPAT_EA_INODE| \
EXT4_FEATURE_INCOMPAT_MMP | \
EXT4_FEATURE_INCOMPAT_INLINE_DATA | \
EXT4_FEATURE_INCOMPAT_ENCRYPT | \
EXT4_FEATURE_INCOMPAT_CASEFOLD | \
EXT4_FEATURE_INCOMPAT_CSUM_SEED | \
EXT4_FEATURE_INCOMPAT_LARGEDIR)
#define EXT4_FEATURE_RO_COMPAT_SUPP (EXT4_FEATURE_RO_COMPAT_SPARSE_SUPER| \
EXT4_FEATURE_RO_COMPAT_LARGE_FILE| \
EXT4_FEATURE_RO_COMPAT_GDT_CSUM| \
EXT4_FEATURE_RO_COMPAT_DIR_NLINK | \
EXT4_FEATURE_RO_COMPAT_EXTRA_ISIZE | \
EXT4_FEATURE_RO_COMPAT_BTREE_DIR |\
EXT4_FEATURE_RO_COMPAT_HUGE_FILE |\
EXT4_FEATURE_RO_COMPAT_BIGALLOC |\
EXT4_FEATURE_RO_COMPAT_METADATA_CSUM|\
EXT4_FEATURE_RO_COMPAT_QUOTA |\
EXT4_FEATURE_RO_COMPAT_PROJECT |\
EXT4_FEATURE_RO_COMPAT_VERITY |\
EXT4_FEATURE_RO_COMPAT_ORPHAN_PRESENT)
#define EXTN_FEATURE_FUNCS(ver) \
static inline bool ext4_has_unknown_ext##ver##_compat_features(struct super_block *sb) \
{ \
return ((EXT4_SB(sb)->s_es->s_feature_compat & \
cpu_to_le32(~EXT##ver##_FEATURE_COMPAT_SUPP)) != 0); \
} \
static inline bool ext4_has_unknown_ext##ver##_ro_compat_features(struct super_block *sb) \
{ \
return ((EXT4_SB(sb)->s_es->s_feature_ro_compat & \
cpu_to_le32(~EXT##ver##_FEATURE_RO_COMPAT_SUPP)) != 0); \
} \
static inline bool ext4_has_unknown_ext##ver##_incompat_features(struct super_block *sb) \
{ \
return ((EXT4_SB(sb)->s_es->s_feature_incompat & \
cpu_to_le32(~EXT##ver##_FEATURE_INCOMPAT_SUPP)) != 0); \
}
EXTN_FEATURE_FUNCS(2)
EXTN_FEATURE_FUNCS(3)
EXTN_FEATURE_FUNCS(4)
static inline bool ext4_has_compat_features(struct super_block *sb)
{
return (EXT4_SB(sb)->s_es->s_feature_compat != 0);
}
static inline bool ext4_has_ro_compat_features(struct super_block *sb)
{
return (EXT4_SB(sb)->s_es->s_feature_ro_compat != 0);
}
static inline bool ext4_has_incompat_features(struct super_block *sb)
{
return (EXT4_SB(sb)->s_es->s_feature_incompat != 0);
}
extern int ext4_feature_set_ok(struct super_block *sb, int readonly);
/*
* Superblock flags
*/
enum {
EXT4_FLAGS_RESIZING, /* Avoid superblock update and resize race */
EXT4_FLAGS_SHUTDOWN, /* Prevent access to the file system */
EXT4_FLAGS_BDEV_IS_DAX, /* Current block device support DAX */
EXT4_FLAGS_EMERGENCY_RO,/* Emergency read-only due to fs errors */
};
static inline int ext4_forced_shutdown(struct super_block *sb)
{
return test_bit(EXT4_FLAGS_SHUTDOWN, &EXT4_SB(sb)->s_ext4_flags);
}
static inline int ext4_emergency_ro(struct super_block *sb)
{
return test_bit(EXT4_FLAGS_EMERGENCY_RO, &EXT4_SB(sb)->s_ext4_flags);
}
static inline int ext4_emergency_state(struct super_block *sb)
{
if (unlikely(ext4_forced_shutdown(sb)))
return -EIO;
if (unlikely(ext4_emergency_ro(sb)))
return -EROFS;
return 0;
}
/*
* Default values for user and/or group using reserved blocks
*/
#define EXT4_DEF_RESUID 0
#define EXT4_DEF_RESGID 0
/*
* Default project ID
*/
#define EXT4_DEF_PROJID 0
#define EXT4_DEF_INODE_READAHEAD_BLKS 32
/*
* Default mount options
*/
#define EXT4_DEFM_DEBUG 0x0001
#define EXT4_DEFM_BSDGROUPS 0x0002
#define EXT4_DEFM_XATTR_USER 0x0004
#define EXT4_DEFM_ACL 0x0008
#define EXT4_DEFM_UID16 0x0010
#define EXT4_DEFM_JMODE 0x0060
#define EXT4_DEFM_JMODE_DATA 0x0020
#define EXT4_DEFM_JMODE_ORDERED 0x0040
#define EXT4_DEFM_JMODE_WBACK 0x0060
#define EXT4_DEFM_NOBARRIER 0x0100
#define EXT4_DEFM_BLOCK_VALIDITY 0x0200
#define EXT4_DEFM_DISCARD 0x0400
#define EXT4_DEFM_NODELALLOC 0x0800
/*
* Default journal batch times and ioprio.
*/
#define EXT4_DEF_MIN_BATCH_TIME 0
#define EXT4_DEF_MAX_BATCH_TIME 15000 /* 15ms */
#define EXT4_DEF_JOURNAL_IOPRIO (IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 3))
/*
* Default values for superblock update
*/
#define EXT4_DEF_SB_UPDATE_INTERVAL_SEC (3600) /* seconds (1 hour) */
#define EXT4_DEF_SB_UPDATE_INTERVAL_KB (16384) /* kilobytes (16MB) */
/*
* Minimum number of groups in a flexgroup before we separate out
* directories into the first block group of a flexgroup
*/
#define EXT4_FLEX_SIZE_DIR_ALLOC_SCHEME 4
/*
* Structure of a directory entry
*/
#define EXT4_NAME_LEN 255
/*
* Base length of the ext4 directory entry excluding the name length
*/
#define EXT4_BASE_DIR_LEN (sizeof(struct ext4_dir_entry_2) - EXT4_NAME_LEN)
struct ext4_dir_entry {
__le32 inode; /* Inode number */
__le16 rec_len; /* Directory entry length */
__le16 name_len; /* Name length */
char name[EXT4_NAME_LEN]; /* File name */
};
/*
* Encrypted Casefolded entries require saving the hash on disk. This structure
* followed ext4_dir_entry_2's name[name_len] at the next 4 byte aligned
* boundary.
*/
struct ext4_dir_entry_hash {
__le32 hash;
__le32 minor_hash;
};
/*
* The new version of the directory entry. Since EXT4 structures are
* stored in intel byte order, and the name_len field could never be
* bigger than 255 chars, it's safe to reclaim the extra byte for the
* file_type field.
*/
struct ext4_dir_entry_2 {
__le32 inode; /* Inode number */
__le16 rec_len; /* Directory entry length */
__u8 name_len; /* Name length */
__u8 file_type; /* See file type macros EXT4_FT_* below */
char name[EXT4_NAME_LEN]; /* File name */
};
/*
* Access the hashes at the end of ext4_dir_entry_2
*/
#define EXT4_DIRENT_HASHES(entry) \
((struct ext4_dir_entry_hash *) \
(((void *)(entry)) + \
((8 + (entry)->name_len + EXT4_DIR_ROUND) & ~EXT4_DIR_ROUND)))
#define EXT4_DIRENT_HASH(entry) le32_to_cpu(EXT4_DIRENT_HASHES(entry)->hash)
#define EXT4_DIRENT_MINOR_HASH(entry) \
le32_to_cpu(EXT4_DIRENT_HASHES(entry)->minor_hash)
static inline bool ext4_hash_in_dirent(const struct inode *inode)
{
return IS_CASEFOLDED(inode) && IS_ENCRYPTED(inode);
}
/*
* This is a bogus directory entry at the end of each leaf block that
* records checksums.
*/
struct ext4_dir_entry_tail {
__le32 det_reserved_zero1; /* Pretend to be unused */
__le16 det_rec_len; /* 12 */
__u8 det_reserved_zero2; /* Zero name length */
__u8 det_reserved_ft; /* 0xDE, fake file type */
__le32 det_checksum; /* crc32c(uuid+inum+dirblock) */
};
#define EXT4_DIRENT_TAIL(block, blocksize) \
((struct ext4_dir_entry_tail *)(((void *)(block)) + \
((blocksize) - \
sizeof(struct ext4_dir_entry_tail))))
/*
* Ext4 directory file types. Only the low 3 bits are used. The
* other bits are reserved for now.
*/
#define EXT4_FT_UNKNOWN 0
#define EXT4_FT_REG_FILE 1
#define EXT4_FT_DIR 2
#define EXT4_FT_CHRDEV 3
#define EXT4_FT_BLKDEV 4
#define EXT4_FT_FIFO 5
#define EXT4_FT_SOCK 6
#define EXT4_FT_SYMLINK 7
#define EXT4_FT_MAX 8
#define EXT4_FT_DIR_CSUM 0xDE
/*
* EXT4_DIR_PAD defines the directory entries boundaries
*
* NOTE: It must be a multiple of 4
*/
#define EXT4_DIR_PAD 4
#define EXT4_DIR_ROUND (EXT4_DIR_PAD - 1)
#define EXT4_MAX_REC_LEN ((1<<16)-1)
/*
* The rec_len is dependent on the type of directory. Directories that are
* casefolded and encrypted need to store the hash as well, so we add room for
* ext4_extended_dir_entry_2. For all entries related to '.' or '..' you should
* pass NULL for dir, as those entries do not use the extra fields.
*/
static inline unsigned int ext4_dir_rec_len(__u8 name_len,
const struct inode *dir)
{
int rec_len = (name_len + 8 + EXT4_DIR_ROUND);
if (dir && ext4_hash_in_dirent(dir))
rec_len += sizeof(struct ext4_dir_entry_hash);
return (rec_len & ~EXT4_DIR_ROUND);
}
static inline unsigned int
ext4_rec_len_from_disk(__le16 dlen, unsigned blocksize)
{
unsigned len = le16_to_cpu(dlen);
if (len == EXT4_MAX_REC_LEN || len == 0)
return blocksize;
return (len & 65532) | ((len & 3) << 16);
}
static inline __le16 ext4_rec_len_to_disk(unsigned len, unsigned blocksize)
{
BUG_ON((len > blocksize) || (blocksize > (1 << 18)) || (len & 3));
if (len < 65536)
return cpu_to_le16(len);
if (len == blocksize) {
if (blocksize == 65536)
return cpu_to_le16(EXT4_MAX_REC_LEN);
else
return cpu_to_le16(0);
}
return cpu_to_le16((len & 65532) | ((len >> 16) & 3));
}
/*
* Hash Tree Directory indexing
* (c) Daniel Phillips, 2001
*/
#define is_dx(dir) (ext4_has_feature_dir_index((dir)->i_sb) && \
ext4_test_inode_flag((dir), EXT4_INODE_INDEX))
#define EXT4_DIR_LINK_MAX(dir) unlikely((dir)->i_nlink >= EXT4_LINK_MAX && \
!(ext4_has_feature_dir_nlink((dir)->i_sb) && is_dx(dir)))
#define EXT4_DIR_LINK_EMPTY(dir) ((dir)->i_nlink == 2 || (dir)->i_nlink == 1)
/* Legal values for the dx_root hash_version field: */
#define DX_HASH_LEGACY 0
#define DX_HASH_HALF_MD4 1
#define DX_HASH_TEA 2
#define DX_HASH_LEGACY_UNSIGNED 3
#define DX_HASH_HALF_MD4_UNSIGNED 4
#define DX_HASH_TEA_UNSIGNED 5
#define DX_HASH_SIPHASH 6
#define DX_HASH_LAST DX_HASH_SIPHASH
static inline u32 ext4_chksum(u32 crc, const void *address, unsigned int length)
{
return crc32c(crc, address, length);
}
#ifdef __KERNEL__
/* hash info structure used by the directory hash */
struct dx_hash_info
{
u32 hash;
u32 minor_hash;
int hash_version;
u32 *seed;
};
/* 32 and 64 bit signed EOF for dx directories */
#define EXT4_HTREE_EOF_32BIT ((1UL << (32 - 1)) - 1)
#define EXT4_HTREE_EOF_64BIT ((1ULL << (64 - 1)) - 1)
/*
* Control parameters used by ext4_htree_next_block
*/
#define HASH_NB_ALWAYS 1
struct ext4_filename {
const struct qstr *usr_fname;
struct fscrypt_str disk_name;
struct dx_hash_info hinfo;
#ifdef CONFIG_FS_ENCRYPTION
struct fscrypt_str crypto_buf;
#endif
#if IS_ENABLED(CONFIG_UNICODE)
struct qstr cf_name;
#endif
};
#define fname_name(p) ((p)->disk_name.name)
#define fname_usr_name(p) ((p)->usr_fname->name)
#define fname_len(p) ((p)->disk_name.len)
/*
* Describe an inode's exact location on disk and in memory
*/
struct ext4_iloc
{
struct buffer_head *bh;
unsigned long offset;
ext4_group_t block_group;
};
static inline struct ext4_inode *ext4_raw_inode(struct ext4_iloc *iloc)
{
return (struct ext4_inode *) (iloc->bh->b_data + iloc->offset);
}
static inline bool ext4_is_quota_file(struct inode *inode)
{
return IS_NOQUOTA(inode) &&
!(EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL);
}
/*
* This structure is stuffed into the struct file's private_data field
* for directories. It is where we put information so that we can do
* readdir operations in hash tree order.
*/
struct dir_private_info {
struct rb_root root;
struct rb_node *curr_node;
struct fname *extra_fname;
loff_t last_pos;
__u32 curr_hash;
__u32 curr_minor_hash;
__u32 next_hash;
u64 cookie;
bool initialized;
};
/* calculate the first block number of the group */
static inline ext4_fsblk_t
ext4_group_first_block_no(struct super_block *sb, ext4_group_t group_no)
{
return group_no * (ext4_fsblk_t)EXT4_BLOCKS_PER_GROUP(sb) +
le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block);
}
/*
* Special error return code only used by dx_probe() and its callers.
*/
#define ERR_BAD_DX_DIR (-(MAX_ERRNO - 1))
/* htree levels for ext4 */
#define EXT4_HTREE_LEVEL_COMPAT 2
#define EXT4_HTREE_LEVEL 3
static inline int ext4_dir_htree_level(struct super_block *sb)
{
return ext4_has_feature_largedir(sb) ?
EXT4_HTREE_LEVEL : EXT4_HTREE_LEVEL_COMPAT;
}
/*
* Timeout and state flag for lazy initialization inode thread.
*/
#define EXT4_DEF_LI_WAIT_MULT 10
#define EXT4_DEF_LI_MAX_START_DELAY 5
#define EXT4_LAZYINIT_QUIT 0x0001
#define EXT4_LAZYINIT_RUNNING 0x0002
/*
* Lazy inode table initialization info
*/
struct ext4_lazy_init {
unsigned long li_state;
struct list_head li_request_list;
struct mutex li_list_mtx;
};
enum ext4_li_mode {
EXT4_LI_MODE_PREFETCH_BBITMAP,
EXT4_LI_MODE_ITABLE,
};
struct ext4_li_request {
struct super_block *lr_super;
enum ext4_li_mode lr_mode;
ext4_group_t lr_first_not_zeroed;
ext4_group_t lr_next_group;
struct list_head lr_request;
unsigned long lr_next_sched;
unsigned long lr_timeout;
};
struct ext4_features {
struct kobject f_kobj;
struct completion f_kobj_unregister;
};
/*
* This structure will be used for multiple mount protection. It will be
* written into the block number saved in the s_mmp_block field in the
* superblock. Programs that check MMP should assume that if
* SEQ_FSCK (or any unknown code above SEQ_MAX) is present then it is NOT safe
* to use the filesystem, regardless of how old the timestamp is.
*/
#define EXT4_MMP_MAGIC 0x004D4D50U /* ASCII for MMP */
#define EXT4_MMP_SEQ_CLEAN 0xFF4D4D50U /* mmp_seq value for clean unmount */
#define EXT4_MMP_SEQ_FSCK 0xE24D4D50U /* mmp_seq value when being fscked */
#define EXT4_MMP_SEQ_MAX 0xE24D4D4FU /* maximum valid mmp_seq value */
struct mmp_struct {
__le32 mmp_magic; /* Magic number for MMP */
__le32 mmp_seq; /* Sequence no. updated periodically */
/*
* mmp_time, mmp_nodename & mmp_bdevname are only used for information
* purposes and do not affect the correctness of the algorithm
*/
__le64 mmp_time; /* Time last updated */
char mmp_nodename[64]; /* Node which last updated MMP block */
char mmp_bdevname[32]; /* Bdev which last updated MMP block */
/*
* mmp_check_interval is used to verify if the MMP block has been
* updated on the block device. The value is updated based on the
* maximum time to write the MMP block during an update cycle.
*/
__le16 mmp_check_interval;
__le16 mmp_pad1;
__le32 mmp_pad2[226];
__le32 mmp_checksum; /* crc32c(uuid+mmp_block) */
};
/* arguments passed to the mmp thread */
struct mmpd_data {
struct buffer_head *bh; /* bh from initial read_mmp_block() */
struct super_block *sb; /* super block of the fs */
};
/*
* Check interval multiplier
* The MMP block is written every update interval and initially checked every
* update interval x the multiplier (the value is then adapted based on the
* write latency). The reason is that writes can be delayed under load and we
* don't want readers to incorrectly assume that the filesystem is no longer
* in use.
*/
#define EXT4_MMP_CHECK_MULT 2UL
/*
* Minimum interval for MMP checking in seconds.
*/
#define EXT4_MMP_MIN_CHECK_INTERVAL 5UL
/*
* Maximum interval for MMP checking in seconds.
*/
#define EXT4_MMP_MAX_CHECK_INTERVAL 300UL
/*
* Function prototypes
*/
/*
* Ok, these declarations are also in <linux/kernel.h> but none of the
* ext4 source programs needs to include it so they are duplicated here.
*/
# define NORET_TYPE /**/
# define ATTRIB_NORET __attribute__((noreturn))
# define NORET_AND noreturn,
/* bitmap.c */
extern unsigned int ext4_count_free(char *bitmap, unsigned numchars);
void ext4_inode_bitmap_csum_set(struct super_block *sb,
struct ext4_group_desc *gdp,
struct buffer_head *bh);
int ext4_inode_bitmap_csum_verify(struct super_block *sb,
struct ext4_group_desc *gdp,
struct buffer_head *bh);
void ext4_block_bitmap_csum_set(struct super_block *sb,
struct ext4_group_desc *gdp,
struct buffer_head *bh);
int ext4_block_bitmap_csum_verify(struct super_block *sb,
struct ext4_group_desc *gdp,
struct buffer_head *bh);
/* balloc.c */
extern void ext4_get_group_no_and_offset(struct super_block *sb,
ext4_fsblk_t blocknr,
ext4_group_t *blockgrpp,
ext4_grpblk_t *offsetp);
extern ext4_group_t ext4_get_group_number(struct super_block *sb,
ext4_fsblk_t block);
extern int ext4_bg_has_super(struct super_block *sb, ext4_group_t group);
extern unsigned long ext4_bg_num_gdb(struct super_block *sb,
ext4_group_t group);
extern ext4_fsblk_t ext4_new_meta_blocks(handle_t *handle, struct inode *inode,
ext4_fsblk_t goal,
unsigned int flags,
unsigned long *count,
int *errp);
extern int ext4_claim_free_clusters(struct ext4_sb_info *sbi,
s64 nclusters, unsigned int flags);
extern ext4_fsblk_t ext4_count_free_clusters(struct super_block *);
extern struct ext4_group_desc * ext4_get_group_desc(struct super_block * sb,
ext4_group_t block_group,
struct buffer_head ** bh);
extern struct ext4_group_info *ext4_get_group_info(struct super_block *sb,
ext4_group_t group);
extern int ext4_should_retry_alloc(struct super_block *sb, int *retries);
extern struct buffer_head *ext4_read_block_bitmap_nowait(struct super_block *sb,
ext4_group_t block_group,
bool ignore_locked);
extern int ext4_wait_block_bitmap(struct super_block *sb,
ext4_group_t block_group,
struct buffer_head *bh);
extern struct buffer_head *ext4_read_block_bitmap(struct super_block *sb,
ext4_group_t block_group);
extern unsigned ext4_free_clusters_after_init(struct super_block *sb,
ext4_group_t block_group,
struct ext4_group_desc *gdp);
ext4_fsblk_t ext4_inode_to_goal_block(struct inode *);
#if IS_ENABLED(CONFIG_UNICODE)
extern int ext4_fname_setup_ci_filename(struct inode *dir,
const struct qstr *iname,
struct ext4_filename *fname);
static inline void ext4_fname_free_ci_filename(struct ext4_filename *fname)
{
kfree(fname->cf_name.name);
fname->cf_name.name = NULL;
}
#else
static inline int ext4_fname_setup_ci_filename(struct inode *dir,
const struct qstr *iname,
struct ext4_filename *fname)
{
return 0;
}
static inline void ext4_fname_free_ci_filename(struct ext4_filename *fname)
{
}
#endif
/* ext4 encryption related stuff goes here crypto.c */
#ifdef CONFIG_FS_ENCRYPTION
extern const struct fscrypt_operations ext4_cryptops;
int ext4_fname_setup_filename(struct inode *dir, const struct qstr *iname,
int lookup, struct ext4_filename *fname);
int ext4_fname_prepare_lookup(struct inode *dir, struct dentry *dentry,
struct ext4_filename *fname);
void ext4_fname_free_filename(struct ext4_filename *fname);
int ext4_ioctl_get_encryption_pwsalt(struct file *filp, void __user *arg);
#else /* !CONFIG_FS_ENCRYPTION */
static inline int ext4_fname_setup_filename(struct inode *dir,
const struct qstr *iname,
int lookup,
struct ext4_filename *fname)
{
fname->usr_fname = iname;
fname->disk_name.name = (unsigned char *) iname->name;
fname->disk_name.len = iname->len;
return ext4_fname_setup_ci_filename(dir, iname, fname);
}
static inline int ext4_fname_prepare_lookup(struct inode *dir,
struct dentry *dentry,
struct ext4_filename *fname)
{
return ext4_fname_setup_filename(dir, &dentry->d_name, 1, fname);
}
static inline void ext4_fname_free_filename(struct ext4_filename *fname)
{
ext4_fname_free_ci_filename(fname);
}
static inline int ext4_ioctl_get_encryption_pwsalt(struct file *filp,
void __user *arg)
{
return -EOPNOTSUPP;
}
#endif /* !CONFIG_FS_ENCRYPTION */
/* dir.c */
extern int __ext4_check_dir_entry(const char *, unsigned int, struct inode *,
struct file *,
struct ext4_dir_entry_2 *,
struct buffer_head *, char *, int,
unsigned int);
#define ext4_check_dir_entry(dir, filp, de, bh, buf, size, offset) \
unlikely(__ext4_check_dir_entry(__func__, __LINE__, (dir), (filp), \
(de), (bh), (buf), (size), (offset)))
extern int ext4_htree_store_dirent(struct file *dir_file, __u32 hash,
__u32 minor_hash,
struct ext4_dir_entry_2 *dirent,
struct fscrypt_str *ent_name);
extern void ext4_htree_free_dir_info(struct dir_private_info *p);
extern int ext4_find_dest_de(struct inode *dir, struct buffer_head *bh,
void *buf, int buf_size,
struct ext4_filename *fname,
struct ext4_dir_entry_2 **dest_de);
void ext4_insert_dentry(struct inode *dir, struct inode *inode,
struct ext4_dir_entry_2 *de,
int buf_size,
struct ext4_filename *fname);
static inline void ext4_update_dx_flag(struct inode *inode)
{
if (!ext4_has_feature_dir_index(inode->i_sb) &&
ext4_test_inode_flag(inode, EXT4_INODE_INDEX)) {
/* ext4_iget() should have caught this... */
WARN_ON_ONCE(ext4_has_feature_metadata_csum(inode->i_sb));
ext4_clear_inode_flag(inode, EXT4_INODE_INDEX);
}
}
static const unsigned char ext4_filetype_table[] = {
DT_UNKNOWN, DT_REG, DT_DIR, DT_CHR, DT_BLK, DT_FIFO, DT_SOCK, DT_LNK
};
static inline unsigned char get_dtype(struct super_block *sb, int filetype)
{
if (!ext4_has_feature_filetype(sb) || filetype >= EXT4_FT_MAX)
return DT_UNKNOWN;
return ext4_filetype_table[filetype];
}
extern int ext4_check_all_de(struct inode *dir, struct buffer_head *bh,
void *buf, int buf_size);
/* fsync.c */
extern int ext4_sync_file(struct file *, loff_t, loff_t, int);
/* hash.c */
extern int ext4fs_dirhash(const struct inode *dir, const char *name, int len,
struct dx_hash_info *hinfo);
/* ialloc.c */
extern int ext4_mark_inode_used(struct super_block *sb, int ino);
extern struct inode *__ext4_new_inode(struct mnt_idmap *, handle_t *,
struct inode *, umode_t,
const struct qstr *qstr, __u32 goal,
uid_t *owner, __u32 i_flags,
int handle_type, unsigned int line_no,
int nblocks);
#define ext4_new_inode(handle, dir, mode, qstr, goal, owner, i_flags) \
__ext4_new_inode(&nop_mnt_idmap, (handle), (dir), (mode), (qstr), \
(goal), (owner), i_flags, 0, 0, 0)
#define ext4_new_inode_start_handle(idmap, dir, mode, qstr, goal, owner, \
type, nblocks) \
__ext4_new_inode((idmap), NULL, (dir), (mode), (qstr), (goal), (owner), \
0, (type), __LINE__, (nblocks))
extern void ext4_free_inode(handle_t *, struct inode *);
extern struct inode * ext4_orphan_get(struct super_block *, unsigned long);
extern unsigned long ext4_count_free_inodes(struct super_block *);
extern unsigned long ext4_count_dirs(struct super_block *);
extern void ext4_mark_bitmap_end(int start_bit, int end_bit, char *bitmap);
extern int ext4_init_inode_table(struct super_block *sb,
ext4_group_t group, int barrier);
extern void ext4_end_bitmap_read(struct buffer_head *bh, int uptodate);
/* fast_commit.c */
int ext4_fc_info_show(struct seq_file *seq, void *v);
void ext4_fc_init(struct super_block *sb, journal_t *journal);
void ext4_fc_init_inode(struct inode *inode);
void ext4_fc_track_range(handle_t *handle, struct inode *inode, ext4_lblk_t start,
ext4_lblk_t end);
void __ext4_fc_track_unlink(handle_t *handle, struct inode *inode,
struct dentry *dentry);
void __ext4_fc_track_link(handle_t *handle, struct inode *inode,
struct dentry *dentry);
void ext4_fc_track_unlink(handle_t *handle, struct dentry *dentry);
void ext4_fc_track_link(handle_t *handle, struct inode *inode,
struct dentry *dentry);
void __ext4_fc_track_create(handle_t *handle, struct inode *inode,
struct dentry *dentry);
void ext4_fc_track_create(handle_t *handle, struct dentry *dentry);
void ext4_fc_track_inode(handle_t *handle, struct inode *inode);
void ext4_fc_mark_ineligible(struct super_block *sb, int reason, handle_t *handle);
void ext4_fc_del(struct inode *inode);
bool ext4_fc_replay_check_excluded(struct super_block *sb, ext4_fsblk_t block);
void ext4_fc_replay_cleanup(struct super_block *sb);
int ext4_fc_commit(journal_t *journal, tid_t commit_tid);
int __init ext4_fc_init_dentry_cache(void);
void ext4_fc_destroy_dentry_cache(void);
int ext4_fc_record_regions(struct super_block *sb, int ino,
ext4_lblk_t lblk, ext4_fsblk_t pblk,
int len, int replay);
/* mballoc.c */
extern const struct seq_operations ext4_mb_seq_groups_ops;
extern const struct seq_operations ext4_mb_seq_structs_summary_ops;
extern int ext4_seq_mb_stats_show(struct seq_file *seq, void *offset);
extern int ext4_mb_init(struct super_block *);
extern void ext4_mb_release(struct super_block *);
extern ext4_fsblk_t ext4_mb_new_blocks(handle_t *,
struct ext4_allocation_request *, int *);
extern void ext4_discard_preallocations(struct inode *);
extern int __init ext4_init_mballoc(void);
extern void ext4_exit_mballoc(void);
extern ext4_group_t ext4_mb_prefetch(struct super_block *sb,
ext4_group_t group,
unsigned int nr, int *cnt);
extern void ext4_mb_prefetch_fini(struct super_block *sb, ext4_group_t group,
unsigned int nr);
extern void ext4_free_blocks(handle_t *handle, struct inode *inode,
struct buffer_head *bh, ext4_fsblk_t block,
unsigned long count, int flags);
extern int ext4_mb_alloc_groupinfo(struct super_block *sb,
ext4_group_t ngroups);
extern int ext4_mb_add_groupinfo(struct super_block *sb,
ext4_group_t i, struct ext4_group_desc *desc);
extern int ext4_group_add_blocks(handle_t *handle, struct super_block *sb,
ext4_fsblk_t block, unsigned long count);
extern int ext4_trim_fs(struct super_block *, struct fstrim_range *);
extern void ext4_process_freed_data(struct super_block *sb, tid_t commit_tid);
extern void ext4_mb_mark_bb(struct super_block *sb, ext4_fsblk_t block,
int len, bool state);
static inline bool ext4_mb_cr_expensive(enum criteria cr)
{
return cr >= CR_GOAL_LEN_SLOW;
}
/* inode.c */
void ext4_inode_csum_set(struct inode *inode, struct ext4_inode *raw,
struct ext4_inode_info *ei);
int ext4_inode_is_fast_symlink(struct inode *inode);
void ext4_check_map_extents_env(struct inode *inode);
struct buffer_head *ext4_getblk(handle_t *, struct inode *, ext4_lblk_t, int);
struct buffer_head *ext4_bread(handle_t *, struct inode *, ext4_lblk_t, int);
int ext4_bread_batch(struct inode *inode, ext4_lblk_t block, int bh_count,
bool wait, struct buffer_head **bhs);
int ext4_get_block_unwritten(struct inode *inode, sector_t iblock,
struct buffer_head *bh_result, int create);
int ext4_get_block(struct inode *inode, sector_t iblock,
struct buffer_head *bh_result, int create);
int ext4_da_get_block_prep(struct inode *inode, sector_t iblock,
struct buffer_head *bh, int create);
int ext4_walk_page_buffers(handle_t *handle,
struct inode *inode,
struct buffer_head *head,
unsigned from,
unsigned to,
int *partial,
int (*fn)(handle_t *handle, struct inode *inode,
struct buffer_head *bh));
int do_journal_get_write_access(handle_t *handle, struct inode *inode,
struct buffer_head *bh);
void ext4_set_inode_mapping_order(struct inode *inode);
#define FALL_BACK_TO_NONDELALLOC 1
#define CONVERT_INLINE_DATA 2
typedef enum {
EXT4_IGET_NORMAL = 0,
EXT4_IGET_SPECIAL = 0x0001, /* OK to iget a system inode */
EXT4_IGET_HANDLE = 0x0002, /* Inode # is from a handle */
EXT4_IGET_BAD = 0x0004, /* Allow to iget a bad inode */
EXT4_IGET_EA_INODE = 0x0008 /* Inode should contain an EA value */
} ext4_iget_flags;
extern struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
ext4_iget_flags flags, const char *function,
unsigned int line);
#define ext4_iget(sb, ino, flags) \
__ext4_iget((sb), (ino), (flags), __func__, __LINE__)
extern int ext4_write_inode(struct inode *, struct writeback_control *);
extern int ext4_setattr(struct mnt_idmap *, struct dentry *,
struct iattr *);
extern u32 ext4_dio_alignment(struct inode *inode);
extern int ext4_getattr(struct mnt_idmap *, const struct path *,
struct kstat *, u32, unsigned int);
extern void ext4_evict_inode(struct inode *);
extern void ext4_clear_inode(struct inode *);
extern int ext4_file_getattr(struct mnt_idmap *, const struct path *,
struct kstat *, u32, unsigned int);
extern void ext4_dirty_inode(struct inode *, int);
extern int ext4_change_inode_journal_flag(struct inode *, int);
extern int ext4_get_inode_loc(struct inode *, struct ext4_iloc *);
extern int ext4_get_fc_inode_loc(struct super_block *sb, unsigned long ino,
struct ext4_iloc *iloc);
extern int ext4_inode_attach_jinode(struct inode *inode);
extern int ext4_can_truncate(struct inode *inode);
extern int ext4_truncate(struct inode *);
extern int ext4_break_layouts(struct inode *);
extern int ext4_truncate_page_cache_block_range(struct inode *inode,
loff_t start, loff_t end);
extern int ext4_punch_hole(struct file *file, loff_t offset, loff_t length);
extern void ext4_set_inode_flags(struct inode *, bool init);
extern int ext4_alloc_da_blocks(struct inode *inode);
extern void ext4_set_aops(struct inode *inode);
extern int ext4_normal_submit_inode_data_buffers(struct jbd2_inode *jinode);
extern int ext4_chunk_trans_blocks(struct inode *, int nrblocks);
extern int ext4_chunk_trans_extent(struct inode *inode, int nrblocks);
extern int ext4_meta_trans_blocks(struct inode *inode, int lblocks,
int pextents);
extern int ext4_block_zero_eof(struct inode *inode, loff_t from, loff_t end);
extern int ext4_zero_partial_blocks(struct inode *inode, loff_t lstart,
loff_t length, bool *did_zero);
extern vm_fault_t ext4_page_mkwrite(struct vm_fault *vmf);
extern qsize_t *ext4_get_reserved_space(struct inode *inode);
extern int ext4_get_projid(struct inode *inode, kprojid_t *projid);
extern void ext4_da_release_space(struct inode *inode, int to_free);
extern void ext4_da_update_reserve_space(struct inode *inode,
int used, int quota_claim);
extern int ext4_issue_zeroout(struct inode *inode, ext4_lblk_t lblk,
ext4_fsblk_t pblk, ext4_lblk_t len);
static inline bool is_special_ino(struct super_block *sb, unsigned long ino)
{
struct ext4_super_block *es = EXT4_SB(sb)->s_es;
return (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO) ||
ino == le32_to_cpu(es->s_usr_quota_inum) ||
ino == le32_to_cpu(es->s_grp_quota_inum) ||
ino == le32_to_cpu(es->s_prj_quota_inum) ||
ino == le32_to_cpu(es->s_orphan_file_inum);
}
/* indirect.c */
extern int ext4_ind_map_blocks(handle_t *handle, struct inode *inode,
struct ext4_map_blocks *map, int flags);
extern int ext4_ind_trans_blocks(struct inode *inode, int nrblocks);
extern void ext4_ind_truncate(handle_t *, struct inode *inode);
extern int ext4_ind_remove_space(handle_t *handle, struct inode *inode,
ext4_lblk_t start, ext4_lblk_t end);
/* ioctl.c */
extern long ext4_ioctl(struct file *, unsigned int, unsigned long);
extern long ext4_compat_ioctl(struct file *, unsigned int, unsigned long);
int ext4_fileattr_set(struct mnt_idmap *idmap,
struct dentry *dentry, struct file_kattr *fa);
int ext4_fileattr_get(struct dentry *dentry, struct file_kattr *fa);
extern void ext4_reset_inode_seed(struct inode *inode);
int ext4_update_overhead(struct super_block *sb, bool force);
int ext4_force_shutdown(struct super_block *sb, u32 flags);
/* migrate.c */
extern int ext4_ext_migrate(struct inode *);
extern int ext4_ind_migrate(struct inode *inode);
/* namei.c */
extern int ext4_init_new_dir(handle_t *handle, struct inode *dir,
struct inode *inode);
extern int ext4_dirblock_csum_verify(struct inode *inode,
struct buffer_head *bh);
extern int ext4_htree_fill_tree(struct file *dir_file, __u32 start_hash,
__u32 start_minor_hash, __u32 *next_hash);
extern int ext4_search_dir(struct buffer_head *bh,
char *search_buf,
int buf_size,
struct inode *dir,
struct ext4_filename *fname,
unsigned int offset,
struct ext4_dir_entry_2 **res_dir);
extern int ext4_generic_delete_entry(struct inode *dir,
struct ext4_dir_entry_2 *de_del,
struct buffer_head *bh,
void *entry_buf,
int buf_size,
int csum_size);
extern bool ext4_empty_dir(struct inode *inode);
/* resize.c */
extern void ext4_kvfree_array_rcu(void *to_free);
extern int ext4_group_add(struct super_block *sb,
struct ext4_new_group_data *input);
extern int ext4_group_extend(struct super_block *sb,
struct ext4_super_block *es,
ext4_fsblk_t n_blocks_count);
extern int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count);
extern unsigned int ext4_list_backups(struct super_block *sb,
unsigned int *three, unsigned int *five,
unsigned int *seven);
/* super.c */
extern struct buffer_head *ext4_sb_bread(struct super_block *sb,
sector_t block, blk_opf_t op_flags);
extern struct buffer_head *ext4_sb_bread_unmovable(struct super_block *sb,
sector_t block);
extern struct buffer_head *ext4_sb_bread_nofail(struct super_block *sb,
sector_t block);
extern void ext4_read_bh_nowait(struct buffer_head *bh, blk_opf_t op_flags,
bh_end_io_t *end_io, bool simu_fail);
extern int ext4_read_bh(struct buffer_head *bh, blk_opf_t op_flags,
bh_end_io_t *end_io, bool simu_fail);
extern int ext4_read_bh_lock(struct buffer_head *bh, blk_opf_t op_flags, bool wait);
extern void ext4_sb_breadahead_unmovable(struct super_block *sb, sector_t block);
extern int ext4_seq_options_show(struct seq_file *seq, void *offset);
extern int ext4_calculate_overhead(struct super_block *sb);
extern __le32 ext4_superblock_csum(struct ext4_super_block *es);
extern void ext4_superblock_csum_set(struct super_block *sb);
extern int ext4_alloc_flex_bg_array(struct super_block *sb,
ext4_group_t ngroup);
extern const char *ext4_decode_error(struct super_block *sb, int errno,
char nbuf[16]);
extern void ext4_mark_group_bitmap_corrupted(struct super_block *sb,
ext4_group_t block_group,
unsigned int flags);
extern unsigned int ext4_num_base_meta_blocks(struct super_block *sb,
ext4_group_t block_group);
extern void print_daily_error_info(struct timer_list *t);
extern __printf(7, 8)
void __ext4_error(struct super_block *, const char *, unsigned int, bool,
int, __u64, const char *, ...);
extern __printf(6, 7)
void __ext4_error_inode(struct inode *, const char *, unsigned int,
ext4_fsblk_t, int, const char *, ...);
extern __printf(5, 6)
void __ext4_error_file(struct file *, const char *, unsigned int, ext4_fsblk_t,
const char *, ...);
extern void __ext4_std_error(struct super_block *, const char *,
unsigned int, int);
extern __printf(4, 5)
void __ext4_warning(struct super_block *, const char *, unsigned int,
const char *, ...);
extern __printf(4, 5)
void __ext4_warning_inode(const struct inode *inode, const char *function,
unsigned int line, const char *fmt, ...);
extern __printf(3, 4)
void __ext4_msg(struct super_block *, const char *, const char *, ...);
extern void __dump_mmp_msg(struct super_block *, struct mmp_struct *mmp,
const char *, unsigned int, const char *);
extern __printf(7, 8)
void __ext4_grp_locked_error(const char *, unsigned int,
struct super_block *, ext4_group_t,
u64, ext4_fsblk_t,
const char *, ...);
#define EXT4_ERROR_INODE(inode, fmt, a...) \
ext4_error_inode((inode), __func__, __LINE__, 0, (fmt), ## a)
#define EXT4_ERROR_INODE_ERR(inode, err, fmt, a...) \
__ext4_error_inode((inode), __func__, __LINE__, 0, (err), (fmt), ## a)
#define ext4_error_inode_block(inode, block, err, fmt, a...) \
__ext4_error_inode((inode), __func__, __LINE__, (block), (err), \
(fmt), ## a)
#define EXT4_ERROR_FILE(file, block, fmt, a...) \
ext4_error_file((file), __func__, __LINE__, (block), (fmt), ## a)
#define ext4_abort(sb, err, fmt, a...) \
__ext4_error((sb), __func__, __LINE__, true, (err), 0, (fmt), ## a)
#ifdef CONFIG_PRINTK
#define ext4_error_inode(inode, func, line, block, fmt, ...) \
__ext4_error_inode(inode, func, line, block, 0, fmt, ##__VA_ARGS__)
#define ext4_error_inode_err(inode, func, line, block, err, fmt, ...) \
__ext4_error_inode((inode), (func), (line), (block), \
(err), (fmt), ##__VA_ARGS__)
#define ext4_error_file(file, func, line, block, fmt, ...) \
__ext4_error_file(file, func, line, block, fmt, ##__VA_ARGS__)
#define ext4_error(sb, fmt, ...) \
__ext4_error((sb), __func__, __LINE__, false, 0, 0, (fmt), \
##__VA_ARGS__)
#define ext4_error_err(sb, err, fmt, ...) \
__ext4_error((sb), __func__, __LINE__, false, (err), 0, (fmt), \
##__VA_ARGS__)
#define ext4_warning(sb, fmt, ...) \
__ext4_warning(sb, __func__, __LINE__, fmt, ##__VA_ARGS__)
#define ext4_warning_inode(inode, fmt, ...) \
__ext4_warning_inode(inode, __func__, __LINE__, fmt, ##__VA_ARGS__)
#define ext4_msg(sb, level, fmt, ...) \
__ext4_msg(sb, level, fmt, ##__VA_ARGS__)
#define dump_mmp_msg(sb, mmp, msg) \
__dump_mmp_msg(sb, mmp, __func__, __LINE__, msg)
#define ext4_grp_locked_error(sb, grp, ino, block, fmt, ...) \
__ext4_grp_locked_error(__func__, __LINE__, sb, grp, ino, block, \
fmt, ##__VA_ARGS__)
#else
#define ext4_error_inode(inode, func, line, block, fmt, ...) \
do { \
no_printk(fmt, ##__VA_ARGS__); \
__ext4_error_inode(inode, "", 0, block, 0, " "); \
} while (0)
#define ext4_error_inode_err(inode, func, line, block, err, fmt, ...) \
do { \
no_printk(fmt, ##__VA_ARGS__); \
__ext4_error_inode(inode, "", 0, block, err, " "); \
} while (0)
#define ext4_error_file(file, func, line, block, fmt, ...) \
do { \
no_printk(fmt, ##__VA_ARGS__); \
__ext4_error_file(file, "", 0, block, " "); \
} while (0)
#define ext4_error(sb, fmt, ...) \
do { \
no_printk(fmt, ##__VA_ARGS__); \
__ext4_error(sb, "", 0, false, 0, 0, " "); \
} while (0)
#define ext4_error_err(sb, err, fmt, ...) \
do { \
no_printk(fmt, ##__VA_ARGS__); \
__ext4_error(sb, "", 0, false, err, 0, " "); \
} while (0)
#define ext4_warning(sb, fmt, ...) \
do { \
no_printk(fmt, ##__VA_ARGS__); \
__ext4_warning(sb, "", 0, " "); \
} while (0)
#define ext4_warning_inode(inode, fmt, ...) \
do { \
no_printk(fmt, ##__VA_ARGS__); \
__ext4_warning_inode(inode, "", 0, " "); \
} while (0)
#define ext4_msg(sb, level, fmt, ...) \
do { \
no_printk(fmt, ##__VA_ARGS__); \
__ext4_msg(sb, "", " "); \
} while (0)
#define dump_mmp_msg(sb, mmp, msg) \
__dump_mmp_msg(sb, mmp, "", 0, "")
#define ext4_grp_locked_error(sb, grp, ino, block, fmt, ...) \
do { \
no_printk(fmt, ##__VA_ARGS__); \
__ext4_grp_locked_error("", 0, sb, grp, ino, block, " "); \
} while (0)
#endif
extern ext4_fsblk_t ext4_block_bitmap(struct super_block *sb,
struct ext4_group_desc *bg);
extern ext4_fsblk_t ext4_inode_bitmap(struct super_block *sb,
struct ext4_group_desc *bg);
extern ext4_fsblk_t ext4_inode_table(struct super_block *sb,
struct ext4_group_desc *bg);
extern __u32 ext4_free_group_clusters(struct super_block *sb,
struct ext4_group_desc *bg);
extern __u32 ext4_free_inodes_count(struct super_block *sb,
struct ext4_group_desc *bg);
extern __u32 ext4_used_dirs_count(struct super_block *sb,
struct ext4_group_desc *bg);
extern __u32 ext4_itable_unused_count(struct super_block *sb,
struct ext4_group_desc *bg);
extern void ext4_block_bitmap_set(struct super_block *sb,
struct ext4_group_desc *bg, ext4_fsblk_t blk);
extern void ext4_inode_bitmap_set(struct super_block *sb,
struct ext4_group_desc *bg, ext4_fsblk_t blk);
extern void ext4_inode_table_set(struct super_block *sb,
struct ext4_group_desc *bg, ext4_fsblk_t blk);
extern void ext4_free_group_clusters_set(struct super_block *sb,
struct ext4_group_desc *bg,
__u32 count);
extern void ext4_free_inodes_set(struct super_block *sb,
struct ext4_group_desc *bg, __u32 count);
extern void ext4_used_dirs_set(struct super_block *sb,
struct ext4_group_desc *bg, __u32 count);
extern void ext4_itable_unused_set(struct super_block *sb,
struct ext4_group_desc *bg, __u32 count);
extern int ext4_group_desc_csum_verify(struct super_block *sb, __u32 group,
struct ext4_group_desc *gdp);
extern void ext4_group_desc_csum_set(struct super_block *sb, __u32 group,
struct ext4_group_desc *gdp);
extern int ext4_register_li_request(struct super_block *sb,
ext4_group_t first_not_zeroed);
static inline int ext4_has_group_desc_csum(struct super_block *sb)
{
return ext4_has_feature_gdt_csum(sb) ||
ext4_has_feature_metadata_csum(sb);
}
#define ext4_read_incompat_64bit_val(es, name) \
(((es)->s_feature_incompat & cpu_to_le32(EXT4_FEATURE_INCOMPAT_64BIT) \
? (ext4_fsblk_t)le32_to_cpu(es->name##_hi) << 32 : 0) | \
le32_to_cpu(es->name##_lo))
static inline ext4_fsblk_t ext4_blocks_count(struct ext4_super_block *es)
{
return ext4_read_incompat_64bit_val(es, s_blocks_count);
}
static inline ext4_fsblk_t ext4_r_blocks_count(struct ext4_super_block *es)
{
return ext4_read_incompat_64bit_val(es, s_r_blocks_count);
}
static inline ext4_fsblk_t ext4_free_blocks_count(struct ext4_super_block *es)
{
return ext4_read_incompat_64bit_val(es, s_free_blocks_count);
}
static inline void ext4_blocks_count_set(struct ext4_super_block *es,
ext4_fsblk_t blk)
{
es->s_blocks_count_lo = cpu_to_le32((u32)blk);
es->s_blocks_count_hi = cpu_to_le32(blk >> 32);
}
static inline void ext4_free_blocks_count_set(struct ext4_super_block *es,
ext4_fsblk_t blk)
{
es->s_free_blocks_count_lo = cpu_to_le32((u32)blk);
es->s_free_blocks_count_hi = cpu_to_le32(blk >> 32);
}
static inline void ext4_r_blocks_count_set(struct ext4_super_block *es,
ext4_fsblk_t blk)
{
es->s_r_blocks_count_lo = cpu_to_le32((u32)blk);
es->s_r_blocks_count_hi = cpu_to_le32(blk >> 32);
}
static inline loff_t ext4_isize(struct super_block *sb,
struct ext4_inode *raw_inode)
{
if (ext4_has_feature_largedir(sb) ||
S_ISREG(le16_to_cpu(raw_inode->i_mode)))
return ((loff_t)le32_to_cpu(raw_inode->i_size_high) << 32) |
le32_to_cpu(raw_inode->i_size_lo);
return (loff_t) le32_to_cpu(raw_inode->i_size_lo);
}
static inline void ext4_isize_set(struct ext4_inode *raw_inode, loff_t i_size)
{
raw_inode->i_size_lo = cpu_to_le32(i_size);
raw_inode->i_size_high = cpu_to_le32(i_size >> 32);
}
/*
* Reading s_groups_count requires using smp_rmb() afterwards. See
* the locking protocol documented in the comments of ext4_group_add()
* in resize.c
*/
static inline ext4_group_t ext4_get_groups_count(struct super_block *sb)
{
ext4_group_t ngroups = EXT4_SB(sb)->s_groups_count;
smp_rmb();
return ngroups;
}
static inline ext4_group_t ext4_flex_group(struct ext4_sb_info *sbi,
ext4_group_t block_group)
{
return block_group >> sbi->s_log_groups_per_flex;
}
static inline unsigned int ext4_flex_bg_size(struct ext4_sb_info *sbi)
{
return 1 << sbi->s_log_groups_per_flex;
}
static inline loff_t ext4_get_maxbytes(struct inode *inode)
{
if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))
return inode->i_sb->s_maxbytes;
return EXT4_SB(inode->i_sb)->s_bitmap_maxbytes;
}
#define ext4_std_error(sb, errno) \
do { \
if ((errno)) \
__ext4_std_error((sb), __func__, __LINE__, (errno)); \
} while (0)
#ifdef CONFIG_SMP
/* Each CPU can accumulate percpu_counter_batch clusters in their local
* counters. So we need to make sure we have free clusters more
* than percpu_counter_batch * nr_cpu_ids. Also add a window of 4 times.
*/
#define EXT4_FREECLUSTERS_WATERMARK (4 * (percpu_counter_batch * nr_cpu_ids))
#else
#define EXT4_FREECLUSTERS_WATERMARK 0
#endif
/* Update i_disksize. Requires i_rwsem to avoid races with truncate */
static inline void ext4_update_i_disksize(struct inode *inode, loff_t newsize)
{
WARN_ON_ONCE(S_ISREG(inode->i_mode) &&
!inode_is_locked(inode));
down_write(&EXT4_I(inode)->i_data_sem);
if (newsize > EXT4_I(inode)->i_disksize)
WRITE_ONCE(EXT4_I(inode)->i_disksize, newsize);
up_write(&EXT4_I(inode)->i_data_sem);
}
/* Update i_size, i_disksize. Requires i_rwsem to avoid races with truncate */
static inline int ext4_update_inode_size(struct inode *inode, loff_t newsize)
{
int changed = 0;
if (newsize > inode->i_size) {
i_size_write(inode, newsize);
changed = 1;
}
if (newsize > EXT4_I(inode)->i_disksize) {
ext4_update_i_disksize(inode, newsize);
changed |= 2;
}
return changed;
}
int ext4_update_disksize_before_punch(struct inode *inode, loff_t offset,
loff_t len);
struct ext4_group_info {
unsigned long bb_state;
#ifdef AGGRESSIVE_CHECK
unsigned long bb_check_counter;
#endif
struct rb_root bb_free_root;
ext4_grpblk_t bb_first_free; /* first free block */
ext4_grpblk_t bb_free; /* total free blocks */
ext4_grpblk_t bb_fragments; /* nr of freespace fragments */
int bb_avg_fragment_size_order; /* order of average
fragment in BG */
ext4_grpblk_t bb_largest_free_order;/* order of largest frag in BG */
ext4_group_t bb_group; /* Group number */
struct list_head bb_prealloc_list;
#ifdef DOUBLE_CHECK
void *bb_bitmap;
#endif
struct rw_semaphore alloc_sem;
ext4_grpblk_t bb_counters[]; /* Nr of free power-of-two-block
* regions, index is order.
* bb_counters[3] = 5 means
* 5 free 8-block regions. */
};
#define EXT4_GROUP_INFO_NEED_INIT_BIT 0
#define EXT4_GROUP_INFO_WAS_TRIMMED_BIT 1
#define EXT4_GROUP_INFO_BBITMAP_CORRUPT_BIT 2
#define EXT4_GROUP_INFO_IBITMAP_CORRUPT_BIT 3
#define EXT4_GROUP_INFO_BBITMAP_CORRUPT \
(1 << EXT4_GROUP_INFO_BBITMAP_CORRUPT_BIT)
#define EXT4_GROUP_INFO_IBITMAP_CORRUPT \
(1 << EXT4_GROUP_INFO_IBITMAP_CORRUPT_BIT)
#define EXT4_GROUP_INFO_BBITMAP_READ_BIT 4
#define EXT4_MB_GRP_NEED_INIT(grp) \
(test_bit(EXT4_GROUP_INFO_NEED_INIT_BIT, &((grp)->bb_state)))
#define EXT4_MB_GRP_BBITMAP_CORRUPT(grp) \
(test_bit(EXT4_GROUP_INFO_BBITMAP_CORRUPT_BIT, &((grp)->bb_state)))
#define EXT4_MB_GRP_IBITMAP_CORRUPT(grp) \
(test_bit(EXT4_GROUP_INFO_IBITMAP_CORRUPT_BIT, &((grp)->bb_state)))
#define EXT4_MB_GRP_WAS_TRIMMED(grp) \
(test_bit(EXT4_GROUP_INFO_WAS_TRIMMED_BIT, &((grp)->bb_state)))
#define EXT4_MB_GRP_SET_TRIMMED(grp) \
(set_bit(EXT4_GROUP_INFO_WAS_TRIMMED_BIT, &((grp)->bb_state)))
#define EXT4_MB_GRP_CLEAR_TRIMMED(grp) \
(clear_bit(EXT4_GROUP_INFO_WAS_TRIMMED_BIT, &((grp)->bb_state)))
#define EXT4_MB_GRP_TEST_AND_SET_READ(grp) \
(test_and_set_bit(EXT4_GROUP_INFO_BBITMAP_READ_BIT, &((grp)->bb_state)))
#define EXT4_MAX_CONTENTION 8
#define EXT4_CONTENTION_THRESHOLD 2
static inline spinlock_t *ext4_group_lock_ptr(struct super_block *sb,
ext4_group_t group)
{
return bgl_lock_ptr(EXT4_SB(sb)->s_blockgroup_lock, group);
}
/*
* Returns true if the filesystem is busy enough that attempts to
* access the block group locks has run into contention.
*/
static inline int ext4_fs_is_busy(struct ext4_sb_info *sbi)
{
return (atomic_read(&sbi->s_lock_busy) > EXT4_CONTENTION_THRESHOLD);
}
static inline bool ext4_try_lock_group(struct super_block *sb, ext4_group_t group)
{
if (!spin_trylock(ext4_group_lock_ptr(sb, group)))
return false;
/*
* We're able to grab the lock right away, so drop the lock
* contention counter.
*/
atomic_add_unless(&EXT4_SB(sb)->s_lock_busy, -1, 0);
return true;
}
static inline void ext4_lock_group(struct super_block *sb, ext4_group_t group)
{
if (!ext4_try_lock_group(sb, group)) {
/*
* The lock is busy, so bump the contention counter,
* and then wait on the spin lock.
*/
atomic_add_unless(&EXT4_SB(sb)->s_lock_busy, 1,
EXT4_MAX_CONTENTION);
spin_lock(ext4_group_lock_ptr(sb, group));
}
}
static inline void ext4_unlock_group(struct super_block *sb,
ext4_group_t group)
{
spin_unlock(ext4_group_lock_ptr(sb, group));
}
#ifdef CONFIG_QUOTA
static inline bool ext4_quota_capable(struct super_block *sb)
{
return (test_opt(sb, QUOTA) || ext4_has_feature_quota(sb));
}
static inline bool ext4_is_quota_journalled(struct super_block *sb)
{
struct ext4_sb_info *sbi = EXT4_SB(sb);
return (ext4_has_feature_quota(sb) ||
sbi->s_qf_names[USRQUOTA] || sbi->s_qf_names[GRPQUOTA]);
}
int ext4_enable_quotas(struct super_block *sb);
#endif
/*
* Block validity checking
*/
#define ext4_check_indirect_blockref(inode, bh) \
ext4_check_blockref(__func__, __LINE__, inode, \
(__le32 *)(bh)->b_data, \
EXT4_ADDR_PER_BLOCK((inode)->i_sb))
#define ext4_ind_check_inode(inode) \
ext4_check_blockref(__func__, __LINE__, inode, \
EXT4_I(inode)->i_data, \
EXT4_NDIR_BLOCKS)
/*
* Inodes and files operations
*/
/* dir.c */
extern const struct file_operations ext4_dir_operations;
/* file.c */
extern const struct inode_operations ext4_file_inode_operations;
extern const struct file_operations ext4_file_operations;
extern loff_t ext4_llseek(struct file *file, loff_t offset, int origin);
/* inline.c */
extern int ext4_get_max_inline_size(struct inode *inode);
extern int ext4_find_inline_data_nolock(struct inode *inode);
extern int ext4_destroy_inline_data(handle_t *handle, struct inode *inode);
extern void ext4_update_final_de(void *de_buf, int old_size, int new_size);
int ext4_readpage_inline(struct inode *inode, struct folio *folio);
extern int ext4_try_to_write_inline_data(struct address_space *mapping,
struct inode *inode,
loff_t pos, unsigned len,
struct folio **foliop);
int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len,
unsigned copied, struct folio *folio);
extern int ext4_generic_write_inline_data(struct address_space *mapping,
struct inode *inode,
loff_t pos, unsigned len,
struct folio **foliop,
void **fsdata, bool da);
extern int ext4_try_add_inline_entry(handle_t *handle,
struct ext4_filename *fname,
struct inode *dir, struct inode *inode);
extern int ext4_try_create_inline_dir(handle_t *handle,
struct inode *parent,
struct inode *inode);
extern int ext4_read_inline_dir(struct file *filp,
struct dir_context *ctx,
int *has_inline_data);
extern int ext4_inlinedir_to_tree(struct file *dir_file,
struct inode *dir, ext4_lblk_t block,
struct dx_hash_info *hinfo,
__u32 start_hash, __u32 start_minor_hash,
int *has_inline_data);
extern struct buffer_head *ext4_find_inline_entry(struct inode *dir,
struct ext4_filename *fname,
struct ext4_dir_entry_2 **res_dir,
int *has_inline_data);
extern int ext4_delete_inline_entry(handle_t *handle,
struct inode *dir,
struct ext4_dir_entry_2 *de_del,
struct buffer_head *bh,
int *has_inline_data);
extern bool empty_inline_dir(struct inode *dir, int *has_inline_data);
extern struct buffer_head *ext4_get_first_inline_block(struct inode *inode,
struct ext4_dir_entry_2 **parent_de,
int *retval);
extern void *ext4_read_inline_link(struct inode *inode);
struct iomap;
extern int ext4_inline_data_iomap(struct inode *inode, struct iomap *iomap);
extern int ext4_inline_data_truncate(struct inode *inode, int *has_inline);
extern int ext4_convert_inline_data(struct inode *inode);
static inline int ext4_has_inline_data(struct inode *inode)
{
return ext4_test_inode_flag(inode, EXT4_INODE_INLINE_DATA) &&
EXT4_I(inode)->i_inline_off;
}
/* namei.c */
extern const struct inode_operations ext4_dir_inode_operations;
extern const struct inode_operations ext4_special_inode_operations;
extern struct dentry *ext4_get_parent(struct dentry *child);
extern int ext4_init_dirblock(handle_t *handle, struct inode *inode,
struct buffer_head *dir_block,
unsigned int parent_ino, void *inline_buf,
int inline_size);
extern void ext4_initialize_dirent_tail(struct buffer_head *bh,
unsigned int blocksize);
extern int ext4_handle_dirty_dirblock(handle_t *handle, struct inode *inode,
struct buffer_head *bh);
extern int __ext4_unlink(struct inode *dir, const struct qstr *d_name,
struct inode *inode, struct dentry *dentry);
extern int __ext4_link(struct inode *dir, struct inode *inode,
const struct qstr *d_name, struct dentry *dentry);
#define S_SHIFT 12
static const unsigned char ext4_type_by_mode[(S_IFMT >> S_SHIFT) + 1] = {
[S_IFREG >> S_SHIFT] = EXT4_FT_REG_FILE,
[S_IFDIR >> S_SHIFT] = EXT4_FT_DIR,
[S_IFCHR >> S_SHIFT] = EXT4_FT_CHRDEV,
[S_IFBLK >> S_SHIFT] = EXT4_FT_BLKDEV,
[S_IFIFO >> S_SHIFT] = EXT4_FT_FIFO,
[S_IFSOCK >> S_SHIFT] = EXT4_FT_SOCK,
[S_IFLNK >> S_SHIFT] = EXT4_FT_SYMLINK,
};
static inline void ext4_set_de_type(struct super_block *sb,
struct ext4_dir_entry_2 *de,
umode_t mode) {
if (ext4_has_feature_filetype(sb))
de->file_type = ext4_type_by_mode[(mode & S_IFMT)>>S_SHIFT];
}
/* readpages.c */
int ext4_read_folio(struct file *file, struct folio *folio);
void ext4_readahead(struct readahead_control *rac);
extern int __init ext4_init_post_read_processing(void);
extern void ext4_exit_post_read_processing(void);
/* symlink.c */
extern const struct inode_operations ext4_encrypted_symlink_inode_operations;
extern const struct inode_operations ext4_symlink_inode_operations;
extern const struct inode_operations ext4_fast_symlink_inode_operations;
/* sysfs.c */
extern void ext4_notify_error_sysfs(struct ext4_sb_info *sbi);
extern int ext4_register_sysfs(struct super_block *sb);
extern void ext4_unregister_sysfs(struct super_block *sb);
extern int __init ext4_init_sysfs(void);
extern void ext4_exit_sysfs(void);
/* block_validity */
extern void ext4_release_system_zone(struct super_block *sb);
extern int ext4_setup_system_zone(struct super_block *sb);
extern int __init ext4_init_system_zone(void);
extern void ext4_exit_system_zone(void);
extern int ext4_inode_block_valid(struct inode *inode,
ext4_fsblk_t start_blk,
unsigned int count);
extern int ext4_check_blockref(const char *, unsigned int,
struct inode *, __le32 *, unsigned int);
extern int ext4_sb_block_valid(struct super_block *sb, struct inode *inode,
ext4_fsblk_t start_blk, unsigned int count);
/* extents.c */
struct ext4_ext_path;
struct ext4_extent;
/*
* Maximum number of logical blocks in a file; ext4_extent's ee_block is
* __le32.
*/
#define EXT_MAX_BLOCKS 0xffffffff
extern void ext4_ext_tree_init(handle_t *handle, struct inode *inode);
extern int ext4_ext_index_trans_blocks(struct inode *inode, int extents);
extern int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
struct ext4_map_blocks *map, int flags);
extern int ext4_ext_truncate(handle_t *, struct inode *);
extern int ext4_ext_remove_space(struct inode *inode, ext4_lblk_t start,
ext4_lblk_t end);
extern void ext4_ext_init(struct super_block *);
extern void ext4_ext_release(struct super_block *);
extern long ext4_fallocate(struct file *file, int mode, loff_t offset,
loff_t len);
extern int ext4_convert_unwritten_extents(handle_t *handle, struct inode *inode,
loff_t offset, ssize_t len);
extern int ext4_convert_unwritten_extents_atomic(handle_t *handle,
struct inode *inode, loff_t offset, ssize_t len);
extern int ext4_convert_unwritten_io_end_vec(handle_t *handle,
ext4_io_end_t *io_end);
extern int ext4_map_blocks(handle_t *handle, struct inode *inode,
struct ext4_map_blocks *map, int flags);
extern int ext4_map_query_blocks(handle_t *handle, struct inode *inode,
struct ext4_map_blocks *map, int flags);
extern int ext4_map_create_blocks(handle_t *handle, struct inode *inode,
struct ext4_map_blocks *map, int flags);
extern int ext4_ext_calc_credits_for_single_extent(struct inode *inode,
int num,
struct ext4_ext_path *path);
extern struct ext4_ext_path *ext4_ext_insert_extent(
handle_t *handle, struct inode *inode,
struct ext4_ext_path *path,
struct ext4_extent *newext, int gb_flags);
extern struct ext4_ext_path *ext4_find_extent(struct inode *, ext4_lblk_t,
struct ext4_ext_path *,
int flags);
extern void ext4_free_ext_path(struct ext4_ext_path *);
extern int ext4_ext_check_inode(struct inode *inode);
extern ext4_lblk_t ext4_ext_next_allocated_block(struct ext4_ext_path *path);
extern int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
__u64 start, __u64 len);
extern int ext4_get_es_cache(struct inode *inode,
struct fiemap_extent_info *fieinfo,
__u64 start, __u64 len);
extern int ext4_ext_precache(struct inode *inode);
extern int ext4_swap_extents(handle_t *handle, struct inode *inode1,
struct inode *inode2, ext4_lblk_t lblk1,
ext4_lblk_t lblk2, ext4_lblk_t count,
int mark_unwritten,int *err);
extern int ext4_clu_mapped(struct inode *inode, ext4_lblk_t lclu);
extern int ext4_datasem_ensure_credits(handle_t *handle, struct inode *inode,
int check_cred, int restart_cred,
int revoke_cred);
extern void ext4_ext_replay_shrink_inode(struct inode *inode, ext4_lblk_t end);
extern int ext4_ext_replay_set_iblocks(struct inode *inode);
extern int ext4_ext_replay_update_ex(struct inode *inode, ext4_lblk_t start,
int len, int unwritten, ext4_fsblk_t pblk);
extern int ext4_ext_clear_bb(struct inode *inode);
/* move_extent.c */
extern void ext4_double_down_write_data_sem(struct inode *first,
struct inode *second);
extern void ext4_double_up_write_data_sem(struct inode *orig_inode,
struct inode *donor_inode);
extern int ext4_move_extents(struct file *o_filp, struct file *d_filp,
__u64 start_orig, __u64 start_donor,
__u64 len, __u64 *moved_len);
/* page-io.c */
extern int __init ext4_init_pageio(void);
extern void ext4_exit_pageio(void);
extern ext4_io_end_t *ext4_init_io_end(struct inode *inode, gfp_t flags);
extern ext4_io_end_t *ext4_get_io_end(ext4_io_end_t *io_end);
extern int ext4_put_io_end(ext4_io_end_t *io_end);
extern void ext4_put_io_end_defer(ext4_io_end_t *io_end);
extern void ext4_io_submit_init(struct ext4_io_submit *io,
struct writeback_control *wbc);
extern void ext4_end_io_rsv_work(struct work_struct *work);
extern void ext4_io_submit(struct ext4_io_submit *io);
int ext4_bio_write_folio(struct ext4_io_submit *io, struct folio *page,
size_t len);
extern struct ext4_io_end_vec *ext4_alloc_io_end_vec(ext4_io_end_t *io_end);
extern struct ext4_io_end_vec *ext4_last_io_end_vec(ext4_io_end_t *io_end);
/* mmp.c */
extern int ext4_multi_mount_protect(struct super_block *, ext4_fsblk_t);
/* mmp.c */
extern void ext4_stop_mmpd(struct ext4_sb_info *sbi);
/* verity.c */
extern const struct fsverity_operations ext4_verityops;
/* orphan.c */
extern int ext4_orphan_add(handle_t *, struct inode *);
extern int ext4_orphan_del(handle_t *, struct inode *);
extern void ext4_orphan_cleanup(struct super_block *sb,
struct ext4_super_block *es);
extern void ext4_release_orphan_info(struct super_block *sb);
extern int ext4_init_orphan_info(struct super_block *sb);
extern int ext4_orphan_file_empty(struct super_block *sb);
extern void ext4_orphan_file_block_trigger(
struct jbd2_buffer_trigger_type *triggers,
struct buffer_head *bh,
void *data, size_t size);
/*
* Add new method to test whether block and inode bitmaps are properly
* initialized. With uninit_bg reading the block from disk is not enough
* to mark the bitmap uptodate. We need to also zero-out the bitmap
*/
#define BH_BITMAP_UPTODATE BH_JBDPrivateStart
static inline int bitmap_uptodate(struct buffer_head *bh)
{
return (buffer_uptodate(bh) &&
test_bit(BH_BITMAP_UPTODATE, &(bh)->b_state));
}
static inline void set_bitmap_uptodate(struct buffer_head *bh)
{
set_bit(BH_BITMAP_UPTODATE, &(bh)->b_state);
}
extern int ext4_resize_begin(struct super_block *sb);
extern int ext4_resize_end(struct super_block *sb, bool update_backups);
static inline void ext4_set_io_unwritten_flag(struct ext4_io_end *io_end)
{
if (!(io_end->flag & EXT4_IO_END_UNWRITTEN))
io_end->flag |= EXT4_IO_END_UNWRITTEN;
}
static inline void ext4_clear_io_unwritten_flag(ext4_io_end_t *io_end)
{
if (io_end->flag & EXT4_IO_END_UNWRITTEN)
io_end->flag &= ~EXT4_IO_END_UNWRITTEN;
}
extern const struct iomap_ops ext4_iomap_ops;
extern const struct iomap_ops ext4_iomap_report_ops;
static inline int ext4_buffer_uptodate(struct buffer_head *bh)
{
/*
* If the buffer has the write error flag, we have failed
* to write out data in the block. In this case, we don't
* have to read the block because we may read the old data
* successfully.
*/
if (buffer_write_io_error(bh))
set_buffer_uptodate(bh);
return buffer_uptodate(bh);
}
static inline bool ext4_inode_can_atomic_write(struct inode *inode)
{
return S_ISREG(inode->i_mode) &&
ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS) &&
EXT4_SB(inode->i_sb)->s_awu_min > 0;
}
extern int ext4_block_write_begin(handle_t *handle, struct folio *folio,
loff_t pos, unsigned len,
get_block_t *get_block);
#if IS_ENABLED(CONFIG_EXT4_KUNIT_TESTS)
#define EXPORT_SYMBOL_FOR_EXT4_TEST(sym) \
EXPORT_SYMBOL_FOR_MODULES(sym, "ext4-test")
#endif
#endif /* __KERNEL__ */
#endif /* _EXT4_H */
]
|
| 36/2 |
2026/05/17 11:49 |
llm |
expert |
0m
Model:
Tokens:
input: 115994
output: 66
thoughts: 1702
Thoughts: **Analysis of Potential Vulnerability in ext4 Filesystem Flag Manipulation**
Okay, here's what I've got: I'm looking at how users interact with the `EXT4_EXTENTS_FL` flag on ext4 filesystems. It seems like `EXT4_FL_USER_MODIFIABLE` includes `EXT4_EXTENTS_FL`, which means a regular user *can* change this flag using `EXT4_IOC_SETFLAGS`. Now, the kernel code (`ext4_ioctl_setflags`) calls `ext4_ext_migrate` or `ext4_ind_migrate` if this flag is changed.
The tricky part? Both migration functions grab the `s_writepages_rwsem` semaphore for write access. This is a global filesystem lock! This would block `ext4_writepages` for the *entire* filesystem.
I started thinking about a potential denial-of-service (DoS) here. If a user creates a massive file, clears `EXT4_EXTENTS_FL` (triggering `ext4_ind_migrate` and, therefore `s_writepages_rwsem` contention), and then sets the flag again, they could conceivably block all writes.
Then, I looked at the implementation. The key to the DoS is `ext4_ext_migrate`. `ext4_ind_migrate` is only used for *very* small files. `ext4_ext_migrate`, however, iterates through the indirect blocks of a potentially large file. A user *would* need to create an indirect-block file in the first place, or be given one. And the implementation is not vulnerable to creation of massive indirect-block file.
However, the user could create an extent file, then write a lot of data, and then call `EXT4_IOC_SETFLAGS` to set `EXT4_EXTENTS_FL`, which will trigger `ext4_ext_migrate` on a large file.
Is this actually a vulnerability though? Well, the "bug" report is actually about a lockdep warning.
"WARNING: possible circular locking dependency detected"
This is a **false positive** lockdep warning. The warning is in `ext4_evict_inode` while `ext4_ext_migrate` tries to expand extra isize, which moves xattrs to an external block, which drops the reference to the EA inode, which triggers `iput_final` -> `write_inode_now` -> `ext4_writepages`.
The second path is also called during `ext4_ext_migrate`, which takes `s_writepages_rwsem` and then creates a new temporary inode, acquiring its `xattr_sem` during initialization.
Since the second chain acquires the lock of a newly created, invisible inode, it can never deadlock with the first chain. This is a false positive lockdep warning.
Essentially, there is no real security impact because a lockdep warning doesn't cause memory corruption or privilege escalation, and in production builds lockdep is disabled.
Let me summarize: an unprivileged user can trigger this lockdep warning on an existing ext4 filesystem by creating a file, adding extended attributes (xattrs), deleting it (to trigger the `ext4_evict_inode` path), and also calling either `EXT4_IOC_MIGRATE` or `EXT4_IOC_SETFLAGS` (with `EXT4_EXTENTS_FL`) on *another* file, but there is no security impact.
Here's my final assessment:
* Exploitable: False
* DenialOfService: False
* Unprivileged: True (it can be triggered by normal user operations on ext4)
* UserNamespace: False
* VMGuestTrigger: False
* VMHostTrigger: False
* NetworkTrigger: False
* RemoteTrigger: False
* PeripheralTrigger: False
* FilesystemTrigger: True (can be triggered by a malicious filesystem, or by normal operations)
* Accessible From Unprivileged Processes: Yes
* Malicious Filesystem Trigger: Yes
After further review, since an unprivileged user can call `EXT4_IOC_MIGRATE` and can trigger inode eviction. And after double-checking that `ext4_ext_migrate` can be called by an unprivileged user, my final assessment holds.
|
| 37/2 |
2026/05/17 11:50 |
tool |
set-results |
0m
Args: map[DenialOfService:false Exploitable:false FilesystemTrigger:true NetworkTrigger:false PeripheralTrigger:false RemoteTrigger:false Unprivileged:true UserNamespace:false VMGuestTrigger:false VMHostTrigger:false]
Results: map[DenialOfService:false Exploitable:false FilesystemTrigger:true NetworkTrigger:false PeripheralTrigger:false RemoteTrigger:false Unprivileged:true UserNamespace:false VMGuestTrigger:false VMHostTrigger:false]
|
| 38/2 |
2026/05/17 11:50 |
llm |
expert |
1m
Model:
Tokens:
input: 118757
output: 690
thoughts: 491
Thoughts: **My Analysis of the Lockdep Warning**
Okay, the results are in. Time to solidify my findings into the final response.
This lockdep warning is, thankfully, a false positive. I've traced the issue. It's flagging a circular dependency between `sbi->s_writepages_rwsem` and `ei->xattr_sem`, but the reality is more nuanced. Let me break it down as I see it.
Chain 1 reveals that `ext4_evict_inode` leads to a sequence that eventually acquires `ei->xattr_sem`. That is the `ext4_try_to_expand_extra_isize` -> `ext4_write_trylock_xattr` flow. The process goes on to `ext4_xattr_make_inode_space` -> `ext4_xattr_block_set` -> `iput(ea_inode)`. Now, this `iput` then cascades into `iput_final` -> `write_inode_now` -> `ext4_writepages`, which subsequently acquires `sbi->s_writepages_rwsem`. So the first chain appears to link `xattr_sem` to `s_writepages_rwsem`.
Chain 2, however, is where the illusion of a deadlock appears. `ext4_ext_migrate` grabs `sbi->s_writepages_rwsem`. From there we enter `ext4_new_inode` which proceeds to `security_inode_init_security` -> `ext4_initxattrs` -> `ext4_xattr_set_handle` -> `ext4_write_lock_xattr`. This final function tries to grab `ei->xattr_sem`. However, in this case, the `xattr_sem` being acquired belongs to a newly allocated *temporary* inode β an inode that hasn't been made visible to other processes. This crucial detail is what prevents a true deadlock. No other thread could possibly be holding or contending for this particular lock.
Lockdep, of course, isn't that smart. It sees a cycle and throws a warning. Because it groups locks by class, it sees what looks like a reciprocal dependency and raises the alarm, even though the context prevents it from being a problem.
The implications are minimal. Itβs a false positive, so no real security risk here. Production builds disable lockdep, so this won't be a denial of service. If someone really wanted to trigger the warning, an unprivileged user can create and delete files with xattrs and then run `EXT4_IOC_MIGRATE` on a file they own. That would force the system through those two code paths. Or, as the syzkaller reproducer demonstrates, a crafted filesystem image can also trigger it.
|
| 39/1 |
2026/05/17 11:51 |
action |
format-explanation |
0m
Results: map[Explanation:Based on the analysis of the bug report and the kernel source code, here is the
assessment of the security impact:
**Analysis:**
The bug report is a `WARNING: possible circular locking dependency detected`
from lockdep, involving two locks in the ext4 filesystem:
`sbi->s_writepages_rwsem` and `ei->xattr_sem`.
Lockdep detected the following two locking chains:
1. **`ei->xattr_sem` -> `sbi->s_writepages_rwsem`**:
This occurs during inode eviction (`ext4_evict_inode`). If the inode requires
extra isize expansion (`ext4_try_to_expand_extra_isize`), it acquires the
`ei->xattr_sem` of the inode. It then attempts to move extended attributes to
an external block, which may drop the reference to an existing EA inode
(`iput(ea_inode)`). Dropping the last reference triggers `iput_final` ->
`write_inode_now` -> `ext4_writepages`, which acquires
`sbi->s_writepages_rwsem`.
2. **`sbi->s_writepages_rwsem` -> `ei->xattr_sem`**:
This occurs during the `EXT4_IOC_MIGRATE` ioctl (`ext4_ext_migrate`). The
function first acquires `sbi->s_writepages_rwsem` to prevent races with
writeback. It then creates a new temporary inode (`ext4_new_inode`), which
initializes its security attributes (`security_inode_init_security` ->
`ext4_initxattrs`). Setting the initial xattrs acquires the `ei->xattr_sem`
of this newly created temporary inode.
**Conclusion:**
This is a **false positive** lockdep warning. Lockdep groups locks by their
initialization class. It sees that a lock of class `xattr_sem` is acquired
before `s_writepages_rwsem` (Chain 1), and later `s_writepages_rwsem` is
acquired before a lock of class `xattr_sem` (Chain 2). However, in Chain 2, the
`xattr_sem` belongs to a *newly allocated, temporary inode* that is not yet
visible to any other thread. Because no other thread can possibly hold the
`xattr_sem` of this new inode, a deadlock can never actually occur.
Since this is a false positive lockdep warning, it has **no security impact**.
Lockdep is a debugging tool and is disabled in production kernel builds. Even if
it were enabled, a lockdep warning merely prints a stack trace and disables
further lock debugging; it does not halt the system or cause memory corruption.
An unprivileged user can trigger this warning on any standard ext4 filesystem
because they can create/delete files with xattrs (triggering Chain 1) and call
`EXT4_IOC_MIGRATE` on files they own (triggering Chain 2). It can also be
triggered by mounting a crafted filesystem image (as the syzkaller reproducer
does). However, due to the lack of any real deadlock or memory safety issue, it
is not exploitable and does not cause a Denial of Service.]
|