Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c40ce3c9 authored by Akira Fujita's avatar Akira Fujita Committed by Theodore Ts'o
Browse files

ext4: Fix different block exchange issue in EXT4_IOC_MOVE_EXT 



If logical block offset of original file which is passed to
EXT4_IOC_MOVE_EXT is different from donor file's,
a calculation error occurs in ext4_calc_swap_extents(),
therefore wrong block is exchanged between original file and donor file.
As a result, we hit ext4_error() in check_block_validity().
To detect the logical offset difference in EXT4_IOC_MOVE_EXT,
add checks to mext_calc_swap_extents() and handle it as error,
since data exchange must be done between the same blocks in EXT4_IOC_MOVE_EXT.

Reported-by: default avatarPeng Tao <bergwolf@gmail.com>
Signed-off-by: default avatarAkira Fujita <a-fujita@rs.jp.nec.com>
Signed-off-by: default avatar"Theodore Ts'o" <tytso@mit.edu>
parent 347fa6f1

fs/ext4/move_extent.c

+37 −9
Original line number Diff line number Diff line
@@ -597,8 +597,10 @@ mext_leaf_block(handle_t *handle, struct inode *orig_inode, 
 * @orig_off:		block offset of original inode

 * @donor_off:		block offset of donor inode

 * @max_count:		the maximun length of extents

 *

 * Return 0 on success, or a negative error value on failure.

 */

static void

static int

mext_calc_swap_extents(struct ext4_extent *tmp_dext,

			      struct ext4_extent *tmp_oext,

			      ext4_lblk_t orig_off, ext4_lblk_t donor_off,
@@ -607,6 +609,19 @@ mext_calc_swap_extents(struct ext4_extent *tmp_dext, 
	ext4_lblk_t diff, orig_diff;

	struct ext4_extent dext_old, oext_old;



	BUG_ON(orig_off != donor_off);



	/* original and donor extents have to cover the same block offset */

	if (orig_off < le32_to_cpu(tmp_oext->ee_block) ||

	    le32_to_cpu(tmp_oext->ee_block) +

			ext4_ext_get_actual_len(tmp_oext) - 1 < orig_off)

		return -ENODATA;



	if (orig_off < le32_to_cpu(tmp_dext->ee_block) ||

	    le32_to_cpu(tmp_dext->ee_block) +

			ext4_ext_get_actual_len(tmp_dext) - 1 < orig_off)

		return -ENODATA;



	dext_old = *tmp_dext;

	oext_old = *tmp_oext;
@@ -634,6 +649,8 @@ mext_calc_swap_extents(struct ext4_extent *tmp_dext, 


	copy_extent_status(&oext_old, tmp_dext);

	copy_extent_status(&dext_old, tmp_oext);



	return 0;

}



/**
@@ -690,8 +707,10 @@ mext_replace_branches(handle_t *handle, struct inode *orig_inode, 
	dext = donor_path[depth].p_ext;

	tmp_dext = *dext;



	mext_calc_swap_extents(&tmp_dext, &tmp_oext, orig_off,

	err = mext_calc_swap_extents(&tmp_dext, &tmp_oext, orig_off,

				      donor_off, count);

	if (err)

		goto out;



	/* Loop for the donor extents */

	while (1) {
@@ -760,9 +779,10 @@ mext_replace_branches(handle_t *handle, struct inode *orig_inode, 
		}

		tmp_dext = *dext;



		mext_calc_swap_extents(&tmp_dext, &tmp_oext, orig_off,

					      donor_off,

					      count - replaced_count);

		err = mext_calc_swap_extents(&tmp_dext, &tmp_oext, orig_off,

					   donor_off, count - replaced_count);

		if (err)

			goto out;

	}



out:
@@ -1243,11 +1263,15 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, 
	ext_cur = holecheck_path[depth].p_ext;



	/*

	 * Get proper extent whose ee_block is beyond block_start

	 * if block_start was within the hole.

	 * Get proper starting location of block replacement if block_start was

	 * within the hole.

	 */

	if (le32_to_cpu(ext_cur->ee_block) +

		ext4_ext_get_actual_len(ext_cur) - 1 < block_start) {

		/*

		 * The hole exists between extents or the tail of

		 * original file.

		 */

		last_extent = mext_next_extent(orig_inode,

					holecheck_path, &ext_cur);

		if (last_extent < 0) {
@@ -1260,7 +1284,11 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, 
			ret1 = last_extent;

			goto out;

		}

	}

		seq_start = le32_to_cpu(ext_cur->ee_block);

	} else if (le32_to_cpu(ext_cur->ee_block) > block_start)

		/* The hole exists at the beginning of original file. */

		seq_start = le32_to_cpu(ext_cur->ee_block);

	else

		seq_start = block_start;



	/* No blocks within the specified range. */