[kernel] r17409 - in dists/lenny/linux-2.6/debian: . patches/bugfix/all patches/series

[Dann Frazier]

Author: dannf
Date: Mon May 16 00:57:45 2011
New Revision: 17409

Log:
ext2: Fix link count corruption under heavy link+rename load

Added:
   dists/lenny/linux-2.6/debian/patches/bugfix/all/ext2-fix-link-count-corruption-under-heavy-link+rename-load.patch
Modified:
   dists/lenny/linux-2.6/debian/changelog
   dists/lenny/linux-2.6/debian/patches/series/27

Modified: dists/lenny/linux-2.6/debian/changelog
==============================================================================
--- dists/lenny/linux-2.6/debian/changelog	Mon May 16 00:57:39 2011	(r17408)
+++ dists/lenny/linux-2.6/debian/changelog	Mon May 16 00:57:45 2011	(r17409)
@@ -19,6 +19,7 @@
     - [x86] acer-wmi: world-writable sysfs threeg file
     - [x86] tc1100-wmi: world-writable sysfs wireless and jogdial files
     - NFSD: memory corruption due to writing beyond the stat array
+    - ext2: Fix link count corruption under heavy link+rename load
 
  -- Ben Hutchings <ben at decadent.org.uk>  Mon, 29 Nov 2010 02:01:24 +0000
 

Added: dists/lenny/linux-2.6/debian/patches/bugfix/all/ext2-fix-link-count-corruption-under-heavy-link+rename-load.patch
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ dists/lenny/linux-2.6/debian/patches/bugfix/all/ext2-fix-link-count-corruption-under-heavy-link+rename-load.patch	Mon May 16 00:57:45 2011	(r17409)
@@ -0,0 +1,64 @@
+commit cd84420e6113dfd340ef8ae7f28a12347295748d
+Author: Josh Hunt <johunt at akamai.com>
+Date:   Thu Feb 24 11:48:22 2011 +0100
+
+    ext2: Fix link count corruption under heavy link+rename load
+    
+    commit e8a80c6f769dd4622d8b211b398452158ee60c0b upstream.
+    
+    vfs_rename_other() does not lock renamed inode with i_mutex. Thus changing
+    i_nlink in a non-atomic manner (which happens in ext2_rename()) can corrupt
+    it as reported and analyzed by Josh.
+    
+    In fact, there is no good reason to mess with i_nlink of the moved file.
+    We did it presumably to simulate linking into the new directory and unlinking
+    from an old one. But the practical effect of this is disputable because fsck
+    can possibly treat file as being properly linked into both directories without
+    writing any error which is confusing. So we just stop increment-decrement
+    games with i_nlink which also fixes the corruption.
+    
+    CC: Al Viro <viro at ZenIV.linux.org.uk>
+    Signed-off-by: Josh Hunt <johunt at akamai.com>
+    Signed-off-by: Jan Kara <jack at suse.cz>
+    Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+
+diff --git a/fs/ext2/namei.c b/fs/ext2/namei.c
+index 80c97fd..fba953d 100644
+--- a/fs/ext2/namei.c
++++ b/fs/ext2/namei.c
+@@ -322,7 +322,6 @@ static int ext2_rename (struct inode * old_dir, struct dentry * old_dentry,
+ 		new_de = ext2_find_entry (new_dir, new_dentry, &new_page);
+ 		if (!new_de)
+ 			goto out_dir;
+-		inode_inc_link_count(old_inode);
+ 		ext2_set_link(new_dir, new_de, new_page, old_inode);
+ 		new_inode->i_ctime = CURRENT_TIME_SEC;
+ 		if (dir_de)
+@@ -334,12 +333,9 @@ static int ext2_rename (struct inode * old_dir, struct dentry * old_dentry,
+ 			if (new_dir->i_nlink >= EXT2_LINK_MAX)
+ 				goto out_dir;
+ 		}
+-		inode_inc_link_count(old_inode);
+ 		err = ext2_add_link(new_dentry, old_inode);
+-		if (err) {
+-			inode_dec_link_count(old_inode);
++		if (err)
+ 			goto out_dir;
+-		}
+ 		if (dir_de)
+ 			inode_inc_link_count(new_dir);
+ 	}
+@@ -347,12 +343,11 @@ static int ext2_rename (struct inode * old_dir, struct dentry * old_dentry,
+ 	/*
+ 	 * Like most other Unix systems, set the ctime for inodes on a
+  	 * rename.
+-	 * inode_dec_link_count() will mark the inode dirty.
+ 	 */
+ 	old_inode->i_ctime = CURRENT_TIME_SEC;
++	mark_inode_dirty(old_inode);
+ 
+ 	ext2_delete_entry (old_de, old_page);
+-	inode_dec_link_count(old_inode);
+ 
+ 	if (dir_de) {
+ 		ext2_set_link(old_inode, dir_de, dir_page, new_dir);

Modified: dists/lenny/linux-2.6/debian/patches/series/27
==============================================================================
--- dists/lenny/linux-2.6/debian/patches/series/27	Mon May 16 00:57:39 2011	(r17408)
+++ dists/lenny/linux-2.6/debian/patches/series/27	Mon May 16 00:57:45 2011	(r17409)
@@ -10,3 +10,13 @@
 + bugfix/x86/acer-wmi-world-writable-sysfs-threeg-file.patch
 + bugfix/x86/tc1100-wmi-world-writable-sysfs-wireless-and-jogdial-files.patch
 + bugfix/all/nfsd-memory-corruption-due-to-writing-beyond-the-stat-array.patch
++ bugfix/all/ext2-fix-link-count-corruption-under-heavy-link+rename-load.patch
++ bugfix/x86/virtio-set-pci-bus-master-enable-bit.patch
++ bugfix/s390/keyboard-integer-underflow-bug.patch
++ bugfix/all/ocfs2_connection_find-returns-pointer-to-bad-structure.patch
++ bugfix/all/libsas-fix-runaway-error-handler-problem
++ bugfix/all/nfs-aio-fix-use-after-free.patch
++ bugfix/all/md-fix-bug-with-re-adding-of-partially-recovered-device.patch
++ bugfix/all/md-fix-bug-with-re-adding-of-partially-recovered-device-regression.patch
++ bugfix/x86/flush-tlb-if-pgd-entry-is-changed-in-pae-mode.patch
++ bugfix/all/ext3-skip-orphan-cleanup-on-rocompat-fs.patch