From patchwork Fri Jan 2 00:50:49 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Simon Glass X-Patchwork-Id: 1183 Return-Path: X-Original-To: u-boot-concept@u-boot.org Delivered-To: u-boot-concept@u-boot.org DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=u-boot.org; s=default; t=1767315150; bh=mcIQHI7m16JvlQtS+vQ3Ej/u6U5gPSTc2l4dE0OFOwI=; h=From:To:Date:In-Reply-To:References:CC:Subject:List-Id: List-Archive:List-Help:List-Owner:List-Post:List-Subscribe: List-Unsubscribe:From; b=Tuns54BjAnX4I73qc7pYD78rXG8j+bqErjN0EOcvj3chbI6tDmvGSDtkBriV2AR6w bGFxVQjxXfphY9MNHfpUtq/mvJmvXktVFW5r2Ztn/DhrguY+PGjl5aycymS2ikFnv7 zHXUZ1dCuyDA1nT9xdO+MPoBeRht4c4axu7VHJ1eXHisjZYuY9v+0yeGH2t+JQ4crX y8JiyXG31DTwrQ2xyKhfEE38XpMcpHIVP8+frSlcGJI5KwS74lP6GUTAt5PUi3fMo5 sGGLbjWPuMsCdf1TtKXgMS551HC3g4tqrqXJOmSZHMbXSxERNPlDQeKBKmL4Cu3o1E fvxl6EDAskVBw== Received: from localhost (localhost [127.0.0.1]) by mail.u-boot.org (Postfix) with ESMTP id 8139069004 for ; Thu, 1 Jan 2026 17:52:30 -0700 (MST) X-Virus-Scanned: Debian amavis at Received: from mail.u-boot.org ([127.0.0.1]) by localhost (mail.u-boot.org [127.0.0.1]) (amavis, port 10024) with ESMTP id rO-Csodw2ht7 for ; Thu, 1 Jan 2026 17:52:30 -0700 (MST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=u-boot.org; s=default; t=1767315150; bh=mcIQHI7m16JvlQtS+vQ3Ej/u6U5gPSTc2l4dE0OFOwI=; h=From:To:Date:In-Reply-To:References:CC:Subject:List-Id: List-Archive:List-Help:List-Owner:List-Post:List-Subscribe: List-Unsubscribe:From; b=Tuns54BjAnX4I73qc7pYD78rXG8j+bqErjN0EOcvj3chbI6tDmvGSDtkBriV2AR6w bGFxVQjxXfphY9MNHfpUtq/mvJmvXktVFW5r2Ztn/DhrguY+PGjl5aycymS2ikFnv7 zHXUZ1dCuyDA1nT9xdO+MPoBeRht4c4axu7VHJ1eXHisjZYuY9v+0yeGH2t+JQ4crX y8JiyXG31DTwrQ2xyKhfEE38XpMcpHIVP8+frSlcGJI5KwS74lP6GUTAt5PUi3fMo5 sGGLbjWPuMsCdf1TtKXgMS551HC3g4tqrqXJOmSZHMbXSxERNPlDQeKBKmL4Cu3o1E fvxl6EDAskVBw== Received: from mail.u-boot.org (localhost [127.0.0.1]) by mail.u-boot.org (Postfix) with ESMTP id 699B968F56 for ; Thu, 1 Jan 2026 17:52:30 -0700 (MST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=u-boot.org; s=default; t=1767315148; bh=z3W7KOuCUW5T9mSfsvMBVbZ9/oyi6dRkDFSs/kD2FI0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AfwxdF/NOg7bpZ0Vh8p95mKWJyC1/kjYa34PLH1b3k8/e4zE/Pc13QDL9m8Cz7rwp Z19dNcVTR7Z10z1mrxFRDvWQdsSMYVBRg3J7Vjo17kuH6Omu96gBkY/7zjtcTr+Xhe 7KYuS7o/1xOsHPKCRG0sUST11mI9w7BNxkXb4F0MwOnfvE1UTmem/hQQR5qY0UrFgO tGyw/Jju7MFjXcPcfOOwr/Tuhni/Pntqvh1HetpZs/s2cIPnsba30QECoMrpkCO7nz cVodKVjAGOW62J1HSlt4bTJhuZtzHHyybDxwfs6WFTH9nOPwMKFvXltEyMxi1bzarZ 5Xi4mCDef4i5g== Received: from localhost (localhost [127.0.0.1]) by mail.u-boot.org (Postfix) with ESMTP id 7068E68F56; Thu, 1 Jan 2026 17:52:28 -0700 (MST) X-Virus-Scanned: Debian amavis at Received: from mail.u-boot.org ([127.0.0.1]) by localhost (mail.u-boot.org [127.0.0.1]) (amavis, port 10026) with ESMTP id ZTMF7T95fyGx; Thu, 1 Jan 2026 17:52:28 -0700 (MST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=u-boot.org; s=default; t=1767315142; bh=4ObZNFXPA5wp+F7hdLjecgnBN78v1Ae+jIW3diBWgO0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TXz+ugtq8GR0WbZS017H9pItc1TCT0B2uOb3mmH6xA/Bh1KoQ6hdzDc12HWqFrg1l TmA1T2M2+wCOD8B9RDh4UIrmnZLLq+8H3Z3oMbdZVbea/G2Gdg7+rgus1q/ZC9lPeG QTO249joRWN66aOrMwHbiqKDCNEfO0yss3QYj1zcnxJ02m0FhQQXFaD+m1TR0esWJI 50t2mgj8Wwoma7XCwZ75LtjEQvlqOvMZBB+3Fg+Ee5mhotQkgozSBwPAaIYSvGVLPT F9ko3QKt/zSK/1pjo7oDElM1sQJWx1utLUD+MattFh8Ia013bWKWXt+UE78aq0O3l9 gmlQS+t9sI7aQ== Received: from u-boot.org (unknown [73.34.74.121]) by mail.u-boot.org (Postfix) with ESMTPSA id 3D91D68F53; Thu, 1 Jan 2026 17:52:22 -0700 (MST) From: Simon Glass To: U-Boot Concept Date: Thu, 1 Jan 2026 17:50:49 -0700 Message-ID: <20260102005112.552256-20-sjg@u-boot.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260102005112.552256-1-sjg@u-boot.org> References: <20260102005112.552256-1-sjg@u-boot.org> MIME-Version: 1.0 Message-ID-Hash: IMBFF4UCPHR4RIWZQ5PLZBTXAFE47D3K X-Message-ID-Hash: IMBFF4UCPHR4RIWZQ5PLZBTXAFE47D3K X-MailFrom: sjg@u-boot.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Heinrich Schuchardt , Simon Glass , Claude X-Mailman-Version: 3.3.10 Precedence: list Subject: [Concept] [PATCH v2 19/30] ext4l: Add bh_cache_release_jbd() to clean up journal references List-Id: Discussion and patches related to U-Boot Concept Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: Simon Glass Add bh_cache_release_jbd() to forcibly release any journal_heads still attached to buffer_heads after journal destroy. This must be called after journal destroy but before bh_cache_clear() to ensure all journal_heads are properly released, even if journal destroy did not fully clean up (e.g., on abort). The function clears b_bh in each journal_head to prevent use-after-free when the buffer_head is later freed, and resets transaction pointers. Co-developed-by: Claude Signed-off-by: Simon Glass --- (no changes since v1) fs/ext4l/ext4_uboot.h | 1 + fs/ext4l/support.c | 36 ++++++++++++++++++++++++++++++++++++ 2 files changed, 37 insertions(+) diff --git a/fs/ext4l/ext4_uboot.h b/fs/ext4l/ext4_uboot.h index 1c87e2a1181..a5c0eba6f15 100644 --- a/fs/ext4l/ext4_uboot.h +++ b/fs/ext4l/ext4_uboot.h @@ -2901,6 +2901,7 @@ void free_buffer_head(struct buffer_head *bh); /* ext4l support functions (support.c) */ void ext4l_crc32c_init(void); +void bh_cache_release_jbd(void); void bh_cache_clear(void); int bh_cache_sync(void); int ext4l_read_block(sector_t block, size_t size, void *buffer); diff --git a/fs/ext4l/support.c b/fs/ext4l/support.c index 0d365e28265..71c906d9c88 100644 --- a/fs/ext4l/support.c +++ b/fs/ext4l/support.c @@ -335,6 +335,42 @@ void bh_cache_clear(void) } } +/** + * bh_cache_release_jbd() - Release all JBD references from buffer cache + * + * This must be called after journal destroy but before bh_cache_clear(). + * It ensures all journal_heads are properly released from buffer_heads + * even if the journal destroy didn't fully clean up (e.g., on abort). + */ +void bh_cache_release_jbd(void) +{ + int i; + struct bh_cache_entry *entry; + + for (i = 0; i < BH_CACHE_SIZE; i++) { + for (entry = bh_cache[i]; entry; entry = entry->next) { + if (entry->bh && buffer_jbd(entry->bh)) { + struct buffer_head *bh = entry->bh; + struct journal_head *jh = bh2jh(bh); + + /* + * Forcibly release the journal_head. + * Clear b_bh to prevent use-after-free when + * the buffer_head is later freed. + */ + if (jh) { + jh->b_bh = NULL; + jh->b_transaction = NULL; + jh->b_next_transaction = NULL; + jh->b_cp_transaction = NULL; + } + clear_buffer_jbd(bh); + bh->b_private = NULL; + } + } + } +} + /** * bh_cache_sync() - Sync all dirty buffers to disk *