ext4: fix race when setting bitmap_uptodate flag

In ext4_read_{inode,block}_bitmap() we were setting bitmap_uptodate()
before submitting the buffer for read.  The is bad, since we check
bitmap_uptodate() without locking the buffer, and so if another
process is racing with us, it's possible that they will think the
bitmap is uptodate even though the read has not completed yet,
resulting in inodes and blocks potentially getting allocated more than
once if we get really unlucky.

Addresses-Google-Bug: 2828254

Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>

1 files changed, 18 insertions, 8 deletions

diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index 84e6e9a3986b..b2685992fb2d 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -92,6 +92,16 @@ static unsigned ext4_init_inode_bitmap(struct super_block *sb,
         return EXT4_INODES_PER_GROUP(sb);
 }
 
+void ext4_end_bitmap_read(struct buffer_head *bh, int uptodate)
+{
+        if (uptodate) {
+                set_buffer_uptodate(bh);
+                set_bitmap_uptodate(bh);
+        }
+        unlock_buffer(bh);
+        put_bh(bh);
+}
+
 /*
  * Read the inode allocation bitmap for a given block_group, reading
  * into the specified slot in the superblock's bitmap cache.
@@ -147,18 +157,18 @@ ext4_read_inode_bitmap(struct super_block *sb, ext4_group_t block_group)
                 return bh;
         }
         /*
-         * submit the buffer_head for read. We can
-         * safely mark the bitmap as uptodate now.
-         * We do it here so the bitmap uptodate bit
-         * get set with buffer lock held.
+         * submit the buffer_head for reading
          */
         trace_ext4_load_inode_bitmap(sb, block_group);
-        set_bitmap_uptodate(bh);
-        if (bh_submit_read(bh) < 0) {
+        bh->b_end_io = ext4_end_bitmap_read;
+        get_bh(bh);
+        submit_bh(READ, bh);
+        wait_on_buffer(bh);
+        if (!buffer_uptodate(bh)) {
                 put_bh(bh);
                 ext4_error(sb, "Cannot read inode bitmap - "
-                            "block_group = %u, inode_bitmap = %llu",
-                            block_group, bitmap_blk);
+                           "block_group = %u, inode_bitmap = %llu",
+                           block_group, bitmap_blk);
                 return NULL;
         }
         return bh;