Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 19993e73 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'xfs-4.13-fixes-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux 

Pull xfs fixes from Darrick Wong:

 - fix firstfsb variables that we left uninitialized, which could lead
   to locking problems.

 - check for NULL metadata buffer pointers before using them.

 - don't allow btree cursor manipulation if the btree block is corrupt.
   Better to just shut down.

 - fix infinite loop problems in quotacheck.

 - fix buffer overrun when validating directory blocks.

 - fix deadlock problem in bunmapi.

* tag 'xfs-4.13-fixes-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
  xfs: fix multi-AG deadlock in xfs_bunmapi
  xfs: check that dir block entries don't off the end of the buffer
  xfs: fix quotacheck dquot id overflow infinite loop
  xfs: check _alloc_read_agf buffer pointer before using
  xfs: set firstfsb to NULLFSBLOCK before feeding it to _bmapi_write
  xfs: check _btree_check_block value
parents 81554693 5b094d6d

fs/xfs/libxfs/xfs_bmap.c

+21 −0
Original line number Diff line number Diff line
@@ -5435,6 +5435,7 @@ __xfs_bunmapi( 
	xfs_fsblock_t		sum;

	xfs_filblks_t		len = *rlen;	/* length to unmap in file */

	xfs_fileoff_t		max_len;

	xfs_agnumber_t		prev_agno = NULLAGNUMBER, agno;



	trace_xfs_bunmap(ip, bno, len, flags, _RET_IP_);
@@ -5534,6 +5535,17 @@ __xfs_bunmapi( 
		 */

		del = got;

		wasdel = isnullstartblock(del.br_startblock);



		/*

		 * Make sure we don't touch multiple AGF headers out of order

		 * in a single transaction, as that could cause AB-BA deadlocks.

		 */

		if (!wasdel) {

			agno = XFS_FSB_TO_AGNO(mp, del.br_startblock);

			if (prev_agno != NULLAGNUMBER && prev_agno > agno)

				break;

			prev_agno = agno;

		}

		if (got.br_startoff < start) {

			del.br_startoff = start;

			del.br_blockcount -= start - got.br_startoff;
@@ -6499,6 +6511,15 @@ xfs_bmap_finish_one( 
	xfs_fsblock_t			firstfsb;

	int				error = 0;



	/*

	 * firstfsb is tied to the transaction lifetime and is used to

	 * ensure correct AG locking order and schedule work item

	 * continuations.  XFS_BUI_MAX_FAST_EXTENTS (== 1) restricts us

	 * to only making one bmap call per transaction, so it should

	 * be safe to have it as a local variable here.

	 */

	firstfsb = NULLFSBLOCK;



	trace_xfs_bmap_deferred(tp->t_mountp,

			XFS_FSB_TO_AGNO(tp->t_mountp, startblock), type,

			XFS_FSB_TO_AGBNO(tp->t_mountp, startblock),

fs/xfs/libxfs/xfs_btree.c

+4 −2
Original line number Diff line number Diff line
@@ -728,7 +728,8 @@ xfs_btree_firstrec( 
	 * Get the block pointer for this level.

	 */

	block = xfs_btree_get_block(cur, level, &bp);

	xfs_btree_check_block(cur, block, level, bp);

	if (xfs_btree_check_block(cur, block, level, bp))

		return 0;

	/*

	 * It's empty, there is no such record.

	 */
@@ -757,7 +758,8 @@ xfs_btree_lastrec( 
	 * Get the block pointer for this level.

	 */

	block = xfs_btree_get_block(cur, level, &bp);

	xfs_btree_check_block(cur, block, level, bp);

	if (xfs_btree_check_block(cur, block, level, bp))

		return 0;

	/*

	 * It's empty, there is no such record.

	 */

fs/xfs/libxfs/xfs_dir2_data.c

+4 −0
Original line number Diff line number Diff line
@@ -136,6 +136,8 @@ __xfs_dir3_data_check( 
		 */

		if (be16_to_cpu(dup->freetag) == XFS_DIR2_DATA_FREE_TAG) {

			XFS_WANT_CORRUPTED_RETURN(mp, lastfree == 0);

			XFS_WANT_CORRUPTED_RETURN(mp, endp >=

					p + be16_to_cpu(dup->length));

			XFS_WANT_CORRUPTED_RETURN(mp,

				be16_to_cpu(*xfs_dir2_data_unused_tag_p(dup)) ==

					       (char *)dup - (char *)hdr);
@@ -164,6 +166,8 @@ __xfs_dir3_data_check( 
		XFS_WANT_CORRUPTED_RETURN(mp, dep->namelen != 0);

		XFS_WANT_CORRUPTED_RETURN(mp,

			!xfs_dir_ino_validate(mp, be64_to_cpu(dep->inumber)));

		XFS_WANT_CORRUPTED_RETURN(mp, endp >=

				p + ops->data_entsize(dep->namelen));

		XFS_WANT_CORRUPTED_RETURN(mp,

			be16_to_cpu(*ops->data_entry_tag_p(dep)) ==

					       (char *)dep - (char *)hdr);

fs/xfs/libxfs/xfs_refcount.c

+4 −0
Original line number Diff line number Diff line
@@ -1638,6 +1638,10 @@ xfs_refcount_recover_cow_leftovers( 
	error = xfs_alloc_read_agf(mp, tp, agno, 0, &agbp);

	if (error)

		goto out_trans;

	if (!agbp) {

		error = -ENOMEM;

		goto out_trans;

	}

	cur = xfs_refcountbt_init_cursor(mp, tp, agbp, agno, NULL);



	/* Find all the leftover CoW staging extents. */

fs/xfs/xfs_qm.c

+3 −0
Original line number Diff line number Diff line
@@ -111,6 +111,9 @@ xfs_qm_dquot_walk( 
			skipped = 0;

			break;

		}

		/* we're done if id overflows back to zero */

		if (!next_index)

			break;

	}



	if (skipped) {