)]}'
{
  "commit": "0c9169ccad4aed233fdd49e95da4eada2536a06d",
  "tree": "2c89c49f8aa48dd781747e4f9d801ad06e5517b9",
  "parents": [
    "e0d10bfa91b0a089a9e2c378b5c42f4e96171d95"
  ],
  "author": {
    "name": "Toshiyuki Okajima",
    "email": "toshi.okajima@jp.fujitsu.com",
    "time": "Wed Oct 27 21:30:07 2010 -0400"
  },
  "committer": {
    "name": "Theodore Ts\u0027o",
    "email": "tytso@mit.edu",
    "time": "Wed Oct 27 21:30:07 2010 -0400"
  },
  "message": "ext4: fix potential infinite loop in ext4_da_writepages()\n\nOn linux-2.6.36-rc2, if we execute the following script, we can hang\nthe system when the /bin/sync command is executed:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n#!/bin/sh\n\necho -n \"HANG UP TEST: \"\n/bin/dd if\u003d/dev/zero of\u003d/tmp/img bs\u003d1k count\u003d1 seek\u003d1M 2\u003e /dev/null\n/sbin/mkfs.ext4 -Fq /tmp/img\n/bin/mount -o loop -t ext4 /tmp/img /mnt\n/bin/dd if\u003d/dev/zero of\u003d/mnt/file bs\u003d1 count\u003d1 \\\nseek\u003d$((16*1024*1024*1024*1024-4096)) 2\u003e /dev/null\n/bin/sync\n/bin/umount /mnt\necho \"DONE\"\nexit 0\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nWe can see the following backtrace if we get the kdump when this\nhangup occurs:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nkthread()\n\u003d\u003e bdi_writeback_thread()\n   \u003d\u003e wb_do_writeback()\n      \u003d\u003e wb_writeback()\n         \u003d\u003e writeback_inodes_wb()\n            \u003d\u003e writeback_sb_inodes()\n               \u003d\u003e writeback_single_inode()\n                  \u003d\u003e ext4_da_writepages()  ---+ \n                                ^ infinite    |\n                                |   loop      |\n                                +-------------+\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nThe reason why this hangup happens is described as follows:\n1) We write the last extent block of the file whose size is the filesystem \n   maximum size.\n2) \"BH_Delay\" flag is set on the buffer_head of its block.\n3) - the member, \"m_lblk\" of struct mpage_da_data is 4294967295 (UINT_MAX)\n   - the member, \"m_len\" of struct mpage_da_data is 1\n  mpage_put_bnr_to_bhs() which is called via ext4_da_writepages()\n  cannot clear \"BH_Delay\" flag of the buffer_head because the type of\n  m_lblk is ext4_lblk_t and then m_lblk + m_len is overflow.\n\n  Therefore an infinite loop occurs because ext4_da_writepages()\n  cannot write the page (which corresponds to the block) since\n  \"BH_Delay\" flag isn\u0027t cleared.\n----------------------------------------------------------------------\nstatic void mpage_put_bnr_to_bhs(struct mpage_da_data *mpd,\n\t\t\t\tstruct ext4_map_blocks *map)\n{\n...\n\tint blocks \u003d map-\u003em_len;\n...\n\t\tdo {\n\t\t\t// cur_logical \u003d 4294967295\n\t\t\t// map-\u003em_lblk \u003d 4294967295\n\t\t\t// blocks \u003d 1\n\t\t\t// *** map-\u003em_lblk + blocks \u003d\u003d 0 (OVERFLOW!) ***\n\t\t\t// (cur_logical \u003e\u003d map-\u003em_lblk + blocks) \u003d\u003e true\n\t\t\tif (cur_logical \u003e\u003d map-\u003em_lblk + blocks)\n\t\t\t\tbreak;\n----------------------------------------------------------------------\n\nNOTE: Mounting with the nodelalloc option will avoid this codepath,\nand thus, avoid this hang\n\nSigned-off-by: Toshiyuki Okajima \u003ctoshi.okajima@jp.fujitsu.com\u003e\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "50f3bba68a2549e06b35f47bf81718dec01f1a4d",
      "old_mode": 33188,
      "old_path": "fs/ext4/inode.c",
      "new_id": "1e824a3ec53839f35c40c97a246c38fa32c65cc9",
      "new_mode": 33188,
      "new_path": "fs/ext4/inode.c"
    }
  ]
}