[Devel] [PATCH RHEL7 COMMIT] ms/ext4: fix bug for rename with RENAME_WHITEOUT

[Vasily Averin]

The commit is pushed to "branch-rh7-3.10.0-1160.31.1.vz7.181.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-1160.31.1.vz7.181.8
------>
commit 298e1b6da8e1e343dc7b49268f33f8ffc0f638c8
Author: yangerkun <yangerkun at huawei.com>
Date:   Tue Jun 22 21:51:11 2021 +0300

    ms/ext4: fix bug for rename with RENAME_WHITEOUT
    
    ms commit 6b4b8e6b4ad8
    
    We got a "deleted inode referenced" warning cross our fsstress test. The
    bug can be reproduced easily with following steps:
    
    cd /dev/shm
    mkdir test/
    fallocate -l 128M img
    mkfs.ext4 -b 1024 img
    mount img test/
    dd if=/dev/zero of=test/foo bs=1M count=128
    mkdir test/dir/ && cd test/dir/
    for ((i=0;i<1000;i++)); do touch file$i; done # consume all block
    cd ~ && renameat2(AT_FDCWD, /dev/shm/test/dir/file1, AT_FDCWD,
    /dev/shm/test/dir/dst_file, RENAME_WHITEOUT) # ext4_add_entry in
    ext4_rename will return ENOSPC!!
    cd /dev/shm/ && umount test/ && mount img test/ && ls -li test/dir/file1
    We will get the output:
    "ls: cannot access 'test/dir/file1': Structure needs cleaning"
    and the dmesg show:
    "EXT4-fs error (device loop0): ext4_lookup:1626: inode #2049: comm ls:
    deleted inode referenced: 139"
    
    ext4_rename will create a special inode for whiteout and use this 'ino'
    to replace the source file's dir entry 'ino'. Once error happens
    latter(the error above was the ENOSPC return from ext4_add_entry in
    ext4_rename since all space has been consumed), the cleanup do drop the
    nlink for whiteout, but forget to restore 'ino' with source file. This
    will trigger the bug describle as above.
    
    Signed-off-by: yangerkun <yangerkun at huawei.com>
    Reviewed-by: Jan Kara <jack at suse.cz>
    Cc: stable at vger.kernel.org
    Fixes: cd808deced43 ("ext4: support RENAME_WHITEOUT")
    Link: https://lore.kernel.org/r/20210105062857.3566-1-yangerkun@huawei.com
    Signed-off-by: Theodore Ts'o <tytso at mit.edu>
    Signed-off-by: Kirill Tkhai <ktkhai at virtuozzo.com>
---
 fs/ext4/namei.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index e2dea0b..5279a83 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -3155,8 +3155,6 @@ static int ext4_setent(handle_t *handle, struct ext4_renament *ent,
 			return retval2;
 		}
 	}
-	brelse(ent->bh);
-	ent->bh = NULL;
 
 	return retval;
 }
@@ -3344,6 +3342,7 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
 		}
 	}
 
+	old_file_type = old.de->file_type;
 	if (IS_DIRSYNC(old.dir) || IS_DIRSYNC(new.dir))
 		ext4_handle_sync(handle);
 
@@ -3371,7 +3370,6 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
 	force_reread = (new.dir->i_ino == old.dir->i_ino &&
 			ext4_test_inode_flag(new.dir, EXT4_INODE_INLINE_DATA));
 
-	old_file_type = old.de->file_type;
 	if (whiteout) {
 		/*
 		 * Do this before adding a new entry, so the old entry is sure
@@ -3453,8 +3451,11 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
 
 end_rename:
 	if (whiteout) {
-		if (retval)
+		if (retval) {
+			ext4_setent(handle, &old,
+				old.inode->i_ino, old_file_type);
 			drop_nlink(whiteout);
+		}
 		unlock_new_inode(whiteout);
 		iput(whiteout);
 	}