Jan Kara ceb5c560e2 ext4: fix data exposure after a crash ... commit 06bd3c36a733ac27962fea7d6f47168841376824 upstream. Huang has reported that in his powerfail testing he is seeing stale block contents in some of recently allocated blocks although he mounts ext4 in data=ordered mode. After some investigation I have found out that indeed when delayed allocation is used, we don't add inode to transaction's list of inodes needing flushing before commit. Originally we were doing that but commit f3b59291a6 removed the logic with a flawed argument that it is not needed. The problem is that although for delayed allocated blocks we write their contents immediately after allocating them, there is no guarantee that the IO scheduler or device doesn't reorder things and thus transaction allocating blocks and attaching them to inode can reach stable storage before actual block contents. Actually whenever we attach freshly allocated blocks to inode using a written extent, we should add inode to transaction's ordered inode list to make sure we properly wait for block contents to be written before committing the transaction. So that is what we do in this patch. This also handles other cases where stale data exposure was possible - like filling hole via mmap in data=ordered,nodelalloc mode. The only exception to the above rule are extending direct IO writes where blkdev_direct_IO() waits for IO to complete before increasing i_size and thus stale data exposure is not possible. For now we don't complicate the code with optimizing this special case since the overhead is pretty low. In case this is observed to be a performance problem we can always handle it using a special flag to ext4_map_blocks(). Fixes: f3b59291a6 Reported-by: "HUANG Weller (CM/ESW12-CN)" <Weller.Huang@cn.bosch.com> Tested-by: "HUANG Weller (CM/ESW12-CN)" <Weller.Huang@cn.bosch.com> Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: Theodore Ts'o <tytso@mit.edu> [bwh: Backported to 4.4: - Drop check for EXT4_GET_BLOCKS_ZERO flag - Adjust context] Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2017-11-21 09:21:17 +01:00
..
9p	9p: fix a potential acl leak	2017-05-14 13:32:54 +02:00
adfs
affs	affs: fix remount failure when there are no options changed	2016-06-07 18:14:32 -07:00
afs
autofs4	autofs: sanity check status reported with AUTOFS_DEV_IOCTL_FAIL	2017-06-29 12:48:50 +02:00
befs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2015-07-04 19:36:06 -07:00
bfs
btrfs	Btrfs: send, fix failure to rename top level inode due to name collision	2017-10-21 17:09:04 +02:00
cachefiles	FS-Cache: Add missing initialization of ret in cachefiles_write_page()	2015-11-16 20:38:43 -05:00
ceph	ceph: unlock dangling spinlock in try_flush_caps()	2017-11-02 09:40:49 +01:00
cifs	cifs: check MaxPathNameComponentLength != 0 before using it	2017-11-08 10:06:27 +01:00
coda	fs/coda: fix readlink buffer overflow	2015-09-10 13:29:01 -07:00
configfs	configfs: Fix race between create_link and configfs_rmdir	2017-06-26 07:13:08 +02:00
cramfs
debugfs	dentry name snapshots	2017-08-06 19:19:42 -07:00
devpts	devpts: clean up interface to pty drivers	2016-08-16 09:30:49 +02:00
dlm	dlm: avoid double-free on error path in dlm_device_{register,unregister}	2017-09-13 14:09:45 -07:00
ecryptfs	ecryptfs: fix dereference of NULL user_key_payload	2017-11-02 09:40:50 +01:00
efivarfs	efi: Make efivarfs entries immutable by default	2016-03-03 15:07:09 -08:00
efs
exofs	osd fs: __r4w_get_page rely on PageUptodate for uptodate	2015-12-12 10:15:34 -08:00
exportfs
ext2	posix_acl: Clear SGID bit when setting file permissions	2016-10-31 04:13:58 -06:00
ext4	ext4: fix data exposure after a crash	2017-11-21 09:21:17 +01:00
f2fs	fscrypto: require write access to mount to set encryption policy	2017-10-27 10:23:18 +02:00
fat	fat: fix using uninitialized fields of fat_inode/fsinfo_inode	2017-03-15 09:57:15 +08:00
freevxfs	freevxfs: Grammar s/an negative/a negative/	2015-08-07 13:59:24 +02:00
fscache	FS-Cache: fix dereference of NULL user_key_payload	2017-10-27 10:23:18 +02:00
fuse	fuse: fix READDIRPLUS skipping an entry	2017-11-02 09:40:49 +01:00
gfs2	GFS2: Fix reference to ERR_PTR in gfs2_glock_iter_next	2017-10-08 10:14:16 +02:00
hfs	hfs: fix B-tree corruption after insertion at position 0	2015-09-10 13:29:01 -07:00
hfsplus	posix_acl: Clear SGID bit when setting file permissions	2016-10-31 04:13:58 -06:00
hostfs	hostfs: Freeing an ERR_PTR in hostfs_fill_sb_common()	2016-09-30 10:18:39 +02:00
hpfs	hpfs: implement the show_options method	2016-06-01 12:15:54 -07:00
hugetlbfs	mm: larger stack guard gap, between vmas	2017-06-26 07:13:11 +02:00
isofs	isofs: Do not return EACCES for unknown filesystems	2016-10-28 03:01:34 -04:00
jbd2	jbd2: don't leak modified metadata buffers on an aborted journal	2017-03-12 06:37:26 +01:00
jffs2	posix_acl: Clear SGID bit when setting file permissions	2016-10-31 04:13:58 -06:00
jfs	fs: add i_blocksize()	2017-06-14 13:16:24 +02:00
kernfs	kernfs: don't depend on d_find_any_alias() when generating notifications	2016-09-24 10:07:36 +02:00
lockd	Mainly smaller bugfixes and cleanup. We're still finding some bugs from	2015-11-11 20:11:28 -08:00
logfs	mm, fs: introduce mapping_gfp_constraint()	2015-11-06 17:50:42 -08:00
minix	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2015-07-04 19:36:06 -07:00
ncpfs	ncpfs: fix a braino in OOM handling in ncp_fill_cache()	2016-03-16 08:42:59 -07:00
nfs	NFS: Fix 2 use after free issues in the I/O code	2017-09-13 14:09:46 -07:00
nfs_common	lockd: NLM grace period shouldn't block NFSv4 opens	2015-08-13 10:22:06 -04:00
nfsd	nfsd/callback: Cleanup callback cred on shutdown	2017-10-21 17:09:06 +02:00
nilfs2	fs: add i_blocksize()	2017-06-14 13:16:24 +02:00
nls
notify	dentry name snapshots	2017-08-06 19:19:42 -07:00
ntfs	mm, fs: introduce mapping_gfp_constraint()	2015-11-06 17:50:42 -08:00
ocfs2	ocfs2: fstrim: Fix start offset of first cluster group during fstrim	2017-11-08 10:06:28 +01:00
omfs
openpromfs
overlayfs	ovl: fsync after copy-up	2016-11-10 16:36:34 +01:00
proc	mm: larger stack guard gap, between vmas	2017-06-26 07:13:11 +02:00
pstore	pstore: Use dynamic spinlock initializer	2017-08-06 19:19:43 -07:00
qnx4
qnx6
quota	quota: Fix possible GPF due to uninitialised pointers	2016-04-12 09:08:56 -07:00
ramfs	mm, fs: obey gfp_mapping for add_to_page_cache()	2015-10-16 11:42:28 -07:00
reiserfs	fs: add i_blocksize()	2017-06-14 13:16:24 +02:00
romfs	romfs: use different way to generate fsid for BLOCK or MTD	2017-06-17 06:39:38 +02:00
squashfs	squashfs: xattr simplifications	2015-11-13 20:34:33 -05:00
sysfs	sysfs: be careful of error returns from ops->show()	2017-04-12 12:38:33 +02:00
sysv	fix sysvfs symlinks	2015-11-23 21:11:08 -05:00
tracefs	tracefs: Fix refcount imbalance in start_creating()	2015-11-04 22:13:45 -05:00
ubifs	ubifs: Fix journal replay wrt. xattr nodes	2017-01-26 08:23:48 +01:00
udf	udf: Fix deadlock between writeback and udf_setsize()	2017-07-27 15:06:09 -07:00
ufs	ufs_getfrag_block(): we only grab ->truncate_mutex on block creation path	2017-06-14 13:16:24 +02:00
xfs	xfs: remove kmem_zalloc_greedy	2017-10-08 10:14:20 +02:00
aio.c	aio: mark AIO pseudo-fs noexec	2016-10-07 15:23:47 +02:00
anon_inodes.c
attr.c	vfs: move permission checking into notify_change() for utimes(NULL)	2016-10-22 12:26:56 +02:00
bad_inode.c
binfmt_aout.c
binfmt_elf.c	binfmt_elf: use ELF_ET_DYN_BASE only for PIE	2017-07-21 07:44:57 +02:00
binfmt_elf_fdpic.c	libnvdimm for 4.4:	2015-11-10 12:07:22 -08:00
binfmt_em86.c
binfmt_flat.c
binfmt_misc.c
binfmt_script.c
block_dev.c	fs/block_dev: always invalidate cleancache in invalidate_bdev()	2017-05-20 14:27:01 +02:00
buffer.c	fs: add i_blocksize()	2017-06-14 13:16:24 +02:00
char_dev.c	fs/char_dev.c: fix incorrect documentation for unregister_chrdev_region	2015-08-05 13:49:35 -07:00
compat.c
compat_binfmt_elf.c
compat_ioctl.c	i2c-dev: Fix typo in ioctl name reference	2015-10-23 23:26:43 +02:00
coredump.c	coredump: Ensure proper size of sparse core files	2017-07-05 14:37:20 +02:00
dax.c	dax: disable pmd mappings	2015-11-16 23:54:45 -08:00
dcache.c	dentry name snapshots	2017-08-06 19:19:42 -07:00
dcookies.c
direct-io.c	direct-io: Prevent NULL pointer access in submit_page_section	2017-10-18 09:20:42 +02:00
drop_caches.c	inode: convert inode_sb_list_lock to per-sb	2015-08-17 18:39:46 -04:00
eventfd.c
eventpoll.c	epoll: fix race between ep_poll_callback(POLLFREE) and ep_free()/ep_remove()	2017-09-07 08:34:10 +02:00
exec.c	exec: Limit arg stack to at most 75% of _STK_LIM	2017-07-21 07:44:57 +02:00
fcntl.c	fs: add a VALID_OPEN_FLAGS	2017-07-15 11:57:44 +02:00
fhandle.c	fs/coredump: prevent fsuid=0 dumps into user-controlled directories	2016-04-12 09:08:58 -07:00
file.c	vfs: clear remainder of 'full_fds_bits' in dup_fd()	2015-11-05 23:05:32 -08:00
file_table.c	fs, file table: reinit files_stat.max_files after deferred memory initialisation	2015-08-07 04:39:40 +03:00
filesystems.c
fs-writeback.c	writeback, cgroup: fix use of the wrong bdi_writeback which mismatches the inode	2016-04-12 09:09:04 -07:00
fs_pin.c
fs_struct.c
inode.c	vfs: fix deadlock in file_remove_privs() on overlayfs	2016-08-10 11:49:30 +02:00
internal.h	inode: rename i_wb_list to i_io_list	2015-08-17 23:38:10 -04:00
ioctl.c
Kconfig	dax: disable pmd mappings	2015-11-16 23:54:45 -08:00
Kconfig.binfmt
libfs.c	fs: Set the size of empty dirs to 0.	2015-08-12 15:28:45 -05:00
locks.c	locks: use file_inode()	2016-08-10 11:49:27 +02:00
Makefile	ext4: promote ext4 over ext2 in the default probe order	2015-10-15 10:33:21 -04:00
mbcache.c
mount.h	mnt: In propgate_umount handle visiting mounts in any order	2017-07-21 07:44:57 +02:00
mpage.c	fs: add i_blocksize()	2017-06-14 13:16:24 +02:00
namei.c	dentry name snapshots	2017-08-06 19:19:42 -07:00
namespace.c	mnt: In propgate_umount handle visiting mounts in any order	2017-07-21 07:44:57 +02:00
no-block.c
nsfs.c	fs/seq_file: convert int seq_vprint/seq_printf/etc... returns to void	2015-09-11 15:21:34 -07:00
open.c	fs: completely ignore unknown open flags	2017-07-15 11:57:44 +02:00
pipe.c	pipe: limit the per-user amount of pages allocated in pipes	2016-06-07 18:14:35 -07:00
pnode.c	mnt: Make propagate_umount less slow for overlapping mount propagation trees	2017-07-21 07:44:58 +02:00
pnode.h	mnt: Add a per mount namespace limit on the number of mounts	2017-04-30 05:49:28 +02:00
posix_acl.c	tmpfs: clear S_ISGID when setting posix ACLs	2017-01-26 08:23:47 +01:00
proc_namespace.c	vfs: show_vfsstat: do not ignore errors from show_devname method	2016-04-12 09:08:55 -07:00
read_write.c	vfs: Return -ENXIO for negative SEEK_HOLE / SEEK_DATA offsets	2017-10-05 09:41:45 +02:00
readdir.c
select.c
seq_file.c	Make file credentials available to the seqfile interfaces	2017-08-06 19:19:42 -07:00
signalfd.c	signalfd: fix information leak in signalfd_copyinfo	2015-08-07 04:39:40 +03:00
splice.c	vfs: fix uninitialized flags in splice_to_pipe()	2017-02-23 17:43:09 +01:00
stack.c
stat.c	ufs: restore maintaining ->i_blocks	2017-06-14 13:16:24 +02:00
statfs.c
super.c	fs/super.c: fix race between freeze_super() and thaw_super()	2016-10-28 03:01:32 -04:00
sync.c	fs/sync.c: make sync_file_range(2) use WB_SYNC_NONE writeback	2015-11-06 17:50:42 -08:00
timerfd.c	timerfd: Protect the might cancel mechanism proper	2017-05-08 07:46:01 +02:00
userfaultfd.c	userfaultfd: don't block on the last VM updates at exit time	2016-03-16 08:43:01 -07:00
utimes.c	vfs: move permission checking into notify_change() for utimes(NULL)	2016-10-22 12:26:56 +02:00
xattr.c	lsm: fix smack_inode_removexattr and xattr_getsecurity memleak	2017-10-12 11:27:32 +02:00