Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1568311

[PATCH 3.12 012/235] Btrfs: fix tree search logic when replaying directory entry deletes

Show all headers | View raw

From: Robbie Ko <robbieko@synology.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 2a7bf53f577e49c43de4ffa7776056de26db65d9 upstream.

If a log tree has a layout like the following:

leaf N:
        ...
        item 240 key (282 DIR_LOG_ITEM 0) itemoff 8189 itemsize 8
                dir log end 1275809046
leaf N + 1:
        item 0 key (282 DIR_LOG_ITEM 3936149215) itemoff 16275 itemsize 8
                dir log end 18446744073709551615
        ...

When we pass the value 1275809046 + 1 as the parameter start_ret to the
function tree-log.c:find_dir_range() (done by replay_dir_deletes()), we
end up with path->slots[0] having the value 239 (points to the last item
of leaf N, item 240). Because the dir log item in that position has an
offset value smaller than *start_ret (1275809046 + 1) we need to move on
to the next leaf, however the logic for that is wrong since it compares
the current slot to the number of items in the leaf, which is smaller
and therefore we don't lookup for the next leaf but instead we set the
slot to point to an item that does not exist, at slot 240, and we later
operate on that slot which has unexpected content or in the worst case
can result in an invalid memory access (accessing beyond the last page
of leaf N's extent buffer).

So fix the logic that checks when we need to lookup at the next leaf
by first incrementing the slot and only after to check if that slot
is beyond the last item of the current leaf.

Signed-off-by: Robbie Ko <robbieko@synology.com>
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Fixes: e02119d5a7b4 (Btrfs: Add a write ahead tree log to optimize synchronous operations)
Signed-off-by: Filipe Manana <fdmanana@suse.com>
[Modified changelog for clarity and correctness]
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 fs/btrfs/tree-log.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index be3bf0be13c7..4c56a5028786 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -1739,12 +1739,11 @@ static noinline int find_dir_range(struct btrfs_root *root,
 next:
 	/* check the next slot in the tree to see if it is a valid item */
 	nritems = btrfs_header_nritems(path->nodes[0]);
+	path->slots[0]++;
 	if (path->slots[0] >= nritems) {
 		ret = btrfs_next_leaf(root, path);
 		if (ret)
 			goto out;
-	} else {
-		path->slots[0]++;
 	}
 
 	btrfs_item_key_to_cpu(path->nodes[0], &key, path->slots[0]);
-- 
2.11.0

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.12 001/235] driver core: Delete an unnecessary check before the function call "put_device" Jiri Slaby <jslaby@suse.cz> - 2017-01-27 13:10 +0100
  [PATCH 3.12 015/235] USB: serial: kl5kusb105: fix open error path Jiri Slaby <jslaby@suse.cz> - 2017-01-27 13:10 +0100
  [PATCH 3.12 018/235] usb: gadget: composite: correctly initialize ep->maxpacket Jiri Slaby <jslaby@suse.cz> - 2017-01-27 13:10 +0100
  [PATCH 3.12 023/235] Btrfs: fix memory leak in reading btree blocks Jiri Slaby <jslaby@suse.cz> - 2017-01-27 13:10 +0100
  [PATCH 3.12 012/235] Btrfs: fix tree search logic when replaying directory entry deletes Jiri Slaby <jslaby@suse.cz> - 2017-01-27 13:10 +0100
  [PATCH 3.12 010/235] hotplug: Make register and unregister notifier API symmetric Jiri Slaby <jslaby@suse.cz> - 2017-01-27 13:10 +0100
  [PATCH 3.12 003/235] ext4: fix data exposure after a crash Jiri Slaby <jslaby@suse.cz> - 2017-01-27 13:10 +0100
  [PATCH 3.12 019/235] USB: UHCI: report non-PME wakeup signalling for Intel hardware Jiri Slaby <jslaby@suse.cz> - 2017-01-27 13:10 +0100
  [PATCH 3.12 024/235] block_dev: don't test bdev->bd_contains when it is not stable Jiri Slaby <jslaby@suse.cz> - 2017-01-27 13:10 +0100
  [PATCH 3.12 004/235] locking/rtmutex: Prevent dequeue vs. unlock race Jiri Slaby <jslaby@suse.cz> - 2017-01-27 13:10 +0100
  [PATCH 3.12 030/235] ext4: add sanity checking to count_overhead() Jiri Slaby <jslaby@suse.cz> - 2017-01-27 13:10 +0100
  [PATCH 3.12 009/235] m68k: Fix ndelay() macro Jiri Slaby <jslaby@suse.cz> - 2017-01-27 13:10 +0100
  [PATCH 3.12 008/235] can: peak: fix bad memory access and free sequence Jiri Slaby <jslaby@suse.cz> - 2017-01-27 13:10 +0100
  [PATCH 3.12 014/235] USB: serial: option: add dlink dwm-158 Jiri Slaby <jslaby@suse.cz> - 2017-01-27 13:10 +0100
  [PATCH 3.12 013/235] USB: serial: option: add support for Telit LE922A PIDs 0x1040, 0x1041 Jiri Slaby <jslaby@suse.cz> - 2017-01-27 13:10 +0100
  [PATCH 3.12 005/235] locking/rtmutex: Use READ_ONCE() in rt_mutex_owner() Jiri Slaby <jslaby@suse.cz> - 2017-01-27 13:10 +0100

csiph-web