ext4: fix xattr deadlock (4d20c685) · Commits · 戴 / test

ext4_xattr_set_handle() eventually ends up calling ext4_mark_inode_dirty() which tries to expand the inode by shifting the EAs. This leads to the xattr_sem being downed again and leading to a deadlock. This patch makes sure that if ext4_xattr_set_handle() is in the call-chain, ext4_mark_inode_dirty() will not expand the inode. Signed-off-by:

Kalpak Shah <kalpak.shah@sun.com> Signed-off-by:

"Theodore Ts'o" <tytso@mit.edu>

fs/ext4/xattr.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -959,6 +959,7 @@ ext4_xattr_set_handle(handle_t handle, struct inode inode, int name_index,
		struct ext4_xattr_block_find bs = {
		.s = { .not_found = -ENODATA, },
		};
		unsigned long no_expand;
		int error;

		if (!name)
		@@ -966,6 +967,9 @@ ext4_xattr_set_handle(handle_t handle, struct inode inode, int name_index,
		if (strlen(name) > 255)
		return -ERANGE;
		down_write(&EXT4_I(inode)->xattr_sem);
		no_expand = EXT4_I(inode)->i_state & EXT4_STATE_NO_EXPAND;
		EXT4_I(inode)->i_state \|= EXT4_STATE_NO_EXPAND;

		error = ext4_get_inode_loc(inode, &is.iloc);
		if (error)
		goto cleanup;
		@@ -1042,6 +1046,8 @@ ext4_xattr_set_handle(handle_t handle, struct inode inode, int name_index,
		cleanup:
		brelse(is.iloc.bh);
		brelse(bs.bh);
		if (no_expand == 0)
		EXT4_I(inode)->i_state &= ~EXT4_STATE_NO_EXPAND;
		up_write(&EXT4_I(inode)->xattr_sem);
		return error;
		}

Admin message