lkml.org 
[lkml]   [2020]   [Oct]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 370/408] xfs: make sure the rt allocator doesnt run off the end
    Date
    From: Darrick J. Wong <darrick.wong@oracle.com>

    [ Upstream commit 2a6ca4baed620303d414934aa1b7b0a8e7bab05f ]

    There's an overflow bug in the realtime allocator. If the rt volume is
    large enough to handle a single allocation request that is larger than
    the maximum bmap extent length and the rt bitmap ends exactly on a
    bitmap block boundary, it's possible that the near allocator will try to
    check the freeness of a range that extends past the end of the bitmap.
    This fails with a corruption error and shuts down the fs.

    Therefore, constrain maxlen so that the range scan cannot run off the
    end of the rt bitmap.

    Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
    Reviewed-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/xfs/xfs_rtalloc.c | 11 +++++++++++
    1 file changed, 11 insertions(+)

    diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
    index 4a48a8c75b4f7..b583669370825 100644
    --- a/fs/xfs/xfs_rtalloc.c
    +++ b/fs/xfs/xfs_rtalloc.c
    @@ -247,6 +247,9 @@ xfs_rtallocate_extent_block(
    end = XFS_BLOCKTOBIT(mp, bbno + 1) - 1;
    i <= end;
    i++) {
    + /* Make sure we don't scan off the end of the rt volume. */
    + maxlen = min(mp->m_sb.sb_rextents, i + maxlen) - i;
    +
    /*
    * See if there's a free extent of maxlen starting at i.
    * If it's not so then next will contain the first non-free.
    @@ -442,6 +445,14 @@ xfs_rtallocate_extent_near(
    */
    if (bno >= mp->m_sb.sb_rextents)
    bno = mp->m_sb.sb_rextents - 1;
    +
    + /* Make sure we don't run off the end of the rt volume. */
    + maxlen = min(mp->m_sb.sb_rextents, bno + maxlen) - bno;
    + if (maxlen < minlen) {
    + *rtblock = NULLRTBLOCK;
    + return 0;
    + }
    +
    /*
    * Try the exact allocation first.
    */
    --
    2.25.1


    \
     
     \ /
      Last update: 2020-10-27 15:58    [W:4.657 / U:0.660 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site