OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

xfs: make sure the rt allocator doesn't run off the end 

[ Upstream commit 2a6ca4baed ]

There's an overflow bug in the realtime allocator.  If the rt volume is
large enough to handle a single allocation request that is larger than
the maximum bmap extent length and the rt bitmap ends exactly on a
bitmap block boundary, it's possible that the near allocator will try to
check the freeness of a range that extends past the end of the bitmap.
This fails with a corruption error and shuts down the fs.

Therefore, constrain maxlen so that the range scan cannot run off the
end of the rt bitmap.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Darrick J. Wong 2020-09-09 14:21:06 -07:00 committed by Greg Kroah-Hartman
parent 09b63105d0
commit df01087859
1 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
fs/xfs/xfs_rtalloc.c
View File

@ -247,6 +247,9 @@ xfs_rtallocate_extent_block(
end = XFS_BLOCKTOBIT(mp, bbno + 1) - 1; end = XFS_BLOCKTOBIT(mp, bbno + 1) - 1;
i <= end; i <= end;
i++) { i++) {
/* Make sure we don't scan off the end of the rt volume. */
maxlen = min(mp->m_sb.sb_rextents, i + maxlen) - i;
/* /*
* See if there's a free extent of maxlen starting at i. * See if there's a free extent of maxlen starting at i.
* If it's not so then next will contain the first non-free. * If it's not so then next will contain the first non-free.
@ -442,6 +445,14 @@ xfs_rtallocate_extent_near(
*/ */
if (bno >= mp->m_sb.sb_rextents) if (bno >= mp->m_sb.sb_rextents)
bno = mp->m_sb.sb_rextents - 1; bno = mp->m_sb.sb_rextents - 1;
/* Make sure we don't run off the end of the rt volume. */
maxlen = min(mp->m_sb.sb_rextents, bno + maxlen) - bno;
if (maxlen < minlen) {
*rtblock = NULLRTBLOCK;
return 0;
}
/* /*
* Try the exact allocation first. * Try the exact allocation first.
*/ */