Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1572666

[PATCH 4.9 51/51] xfs: fix bmv_count confusion w/ shared extents

From Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups linux.kernel
Subject [PATCH 4.9 51/51] xfs: fix bmv_count confusion w/ shared extents
Date 2017-02-02 19:50 +0100
Message-ID <t6uCg-7FA-91@gated-at.bofh.it> (permalink)
References <t6usx-7Bs-3@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw


4.9-stable review patch.  If anyone has any objections, please let me know.

------------------


From: "Darrick J. Wong" <darrick.wong@oracle.com>

commit c364b6d0b6cda1cd5d9ab689489adda3e82529aa upstream.

In a bmapx call, bmv_count is the total size of the array, including the
zeroth element that userspace uses to supply the search key.  The output
array starts at offset 1 so that we can set up the user for the next
invocation.  Since we now can split an extent into multiple bmap records
due to shared/unshared status, we have to be careful that we don't
overflow the output array.

In the original patch f86f403794b ("xfs: teach get_bmapx about shared
extents and the CoW fork") I used cur_ext (the output index) to check
for overflows, albeit with an off-by-one error.  Since nexleft no longer
describes the number of unfilled slots in the output, we can rip all
that out and use cur_ext for the overflow check directly.

Failure to do this causes heap corruption in bmapx callers such as
xfs_io and xfs_scrub.  xfs/328 can reproduce this problem.

Reviewed-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/xfs/xfs_bmap_util.c |   28 ++++++++++++++++++----------
 1 file changed, 18 insertions(+), 10 deletions(-)

--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -528,7 +528,6 @@ xfs_getbmap(
 	xfs_bmbt_irec_t		*map;		/* buffer for user's data */
 	xfs_mount_t		*mp;		/* file system mount point */
 	int			nex;		/* # of user extents can do */
-	int			nexleft;	/* # of user extents left */
 	int			subnex;		/* # of bmapi's can do */
 	int			nmap;		/* number of map entries */
 	struct getbmapx		*out;		/* output structure */
@@ -686,10 +685,8 @@ xfs_getbmap(
 		goto out_free_map;
 	}
 
-	nexleft = nex;
-
 	do {
-		nmap = (nexleft > subnex) ? subnex : nexleft;
+		nmap = (nex> subnex) ? subnex : nex;
 		error = xfs_bmapi_read(ip, XFS_BB_TO_FSBT(mp, bmv->bmv_offset),
 				       XFS_BB_TO_FSB(mp, bmv->bmv_length),
 				       map, &nmap, bmapi_flags);
@@ -697,8 +694,8 @@ xfs_getbmap(
 			goto out_free_map;
 		ASSERT(nmap <= subnex);
 
-		for (i = 0; i < nmap && nexleft && bmv->bmv_length &&
-				cur_ext < bmv->bmv_count; i++) {
+		for (i = 0; i < nmap && bmv->bmv_length &&
+				cur_ext < bmv->bmv_count - 1; i++) {
 			out[cur_ext].bmv_oflags = 0;
 			if (map[i].br_state == XFS_EXT_UNWRITTEN)
 				out[cur_ext].bmv_oflags |= BMV_OF_PREALLOC;
@@ -760,16 +757,27 @@ xfs_getbmap(
 				continue;
 			}
 
+			/*
+			 * In order to report shared extents accurately,
+			 * we report each distinct shared/unshared part
+			 * of a single bmbt record using multiple bmap
+			 * extents.  To make that happen, we iterate the
+			 * same map array item multiple times, each
+			 * time trimming out the subextent that we just
+			 * reported.
+			 *
+			 * Because of this, we must check the out array
+			 * index (cur_ext) directly against bmv_count-1
+			 * to avoid overflows.
+			 */
 			if (inject_map.br_startblock != NULLFSBLOCK) {
 				map[i] = inject_map;
 				i--;
-			} else
-				nexleft--;
+			}
 			bmv->bmv_entries++;
 			cur_ext++;
 		}
-	} while (nmap && nexleft && bmv->bmv_length &&
-		 cur_ext < bmv->bmv_count);
+	} while (nmap && bmv->bmv_length && cur_ext < bmv->bmv_count - 1);
 
  out_free_map:
 	kmem_free(map);

Back to linux.kernel | Previous | NextPrevious in thread | Next in thread | Find similar | Unroll thread


Thread

[PATCH 4.9 00/51] 4.9.8-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:40 +0100
  [PATCH 4.9 35/51] xfs: adjust allocation length in xfs_alloc_space_available Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:40 +0100
  [PATCH 4.9 36/51] xfs: dont rely on ->total in xfs_alloc_space_available Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:40 +0100
  [PATCH 4.9 09/51] tcp: fix tcp_fastopen unaligned access complaints on sparc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:40 +0100
  [PATCH 4.9 05/51] mlxsw: pci: Fix EQE structure definition Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:40 +0100
  [PATCH 4.9 04/51] mlxsw: switchx2: Fix memory leak at skb reallocation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:40 +0100
  [PATCH 4.9 03/51] mlxsw: spectrum: Fix memory leak at skb reallocation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:40 +0100
  [PATCH 4.9 26/51] net: mpls: Fix multipath selection for LSR use case Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:40 +0100
  [PATCH 4.9 11/51] mlx4: do not call napi_schedule() without care Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 14/51] ax25: Fix segfault after sock connection timeout Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 47/51] xfs: verify dirblocklog correctly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 43/51] xfs: sanity check inode di_mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 39/51] xfs: sanity check directory inode di_size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 15/51] net sched actions: fix refcnt when GETing of action after bind Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 50/51] xfs: clear _XBF_PAGES from buffers when readahead page Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 22/51] ipv6: addrconf: Avoid addrconf_disable_change() using RCU read-side lock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 31/51] lwtunnel: Fix oops on state free after encap module unload Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 23/51] tcp: initialize max window for a new fastopen socket Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 49/51] xfs: extsize hints are not unlikely in xfs_bmap_btalloc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 24/51] net/mlx5e: Do not recycle pages from emergency reserve Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 08/51] net: systemport: Decouple flow control from __bcm_sysport_tx_reclaim Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 30/51] net: Specify the owning module for lwtunnel ops Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 20/51] net: phy: bcm63xx: Utilize correct config_intr function Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 27/51] r8152: dont execute runtime suspend if the tx is not empty Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 46/51] xfs: fix COW writeback race Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 44/51] xfs: dont wrap ID in xfs_dq_get_next_id Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 06/51] net: lwtunnel: Handle lwtunnel_fill_encap failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 42/51] xfs: sanity check inode mode when creating new dentry Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 32/51] net: dsa: Bring back device detaching in dsa_slave_suspend() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 41/51] xfs: replace xfs_mode_to_ftype table with switch statement Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 10/51] openvswitch: maintain correct checksum state in conntrack actions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 13/51] ip6_tunnel: Account for tunnel header in tunnel MTU Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 45/51] xfs: fix xfs_mode_to_ftype() prototype Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 28/51] af_unix: move unix_mknod() out of bindlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 25/51] bridge: netlink: call br_changelink() during br_dev_newlink() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 34/51] xfs: fix bogus minleft manipulations Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 37/51] xfs: dont print warnings when xfs_log_force fails Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 48/51] xfs: remove racy hasattr check from attr ops Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 12/51] ravb: do not use zero-length alignment DMA descriptor Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 51/51] xfs: fix bmv_count confusion w/ shared extents Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 33/51] xfs: bump up reserved blocks in xfs_alloc_set_aside Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 19:50 +0100
  [PATCH 4.9 02/51] netvsc: add rcu_read locking to netvsc callback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 20:00 +0100
  [PATCH 4.9 17/51] virtio-net: restore VIRTIO_HDR_F_DATA_VALID on receiving Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 20:00 +0100
  [PATCH 4.9 07/51] net: ipv4: fix table id in getroute response Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 20:00 +0100
  [PATCH 4.9 01/51] r8152: fix the sw rx checksum is unavailable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 20:00 +0100
  Re: [PATCH 4.9 00/51] 4.9.8-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-02-02 21:40 +0100
    Re: [PATCH 4.9 00/51] 4.9.8-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-02 22:00 +0100
  Re: [PATCH 4.9 00/51] 4.9.8-stable review Guenter Roeck <linux@roeck-us.net> - 2017-02-03 06:20 +0100
    Re: [PATCH 4.9 00/51] 4.9.8-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-02-03 08:20 +0100

csiph-web