Skip to content

Commit

Permalink
Merge tag 'xfs-4.14-fixes-5' of git://git.kernel.org/pub/scm/fs/xfs/x…
Browse files Browse the repository at this point in the history
…fs-linux

Pull xfs fixes from Darrick Wong:

 - Fix a stale kernel memory exposure when logging inodes.

 - Fix some build problems with CONFIG_XFS_RT=n

 - Don't change inode mode if the acl write fails, leaving the file
   totally inaccessible.

 - Fix a dangling pointer problem when removing an attr fork under
   memory pressure.

 - Don't crash while trying to invalidate a null buffer associated with
   a corrupt metadata pointer.

* tag 'xfs-4.14-fixes-5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
  xfs: handle error if xfs_btree_get_bufs fails
  xfs: reinit btree pointer on attr tree inactivation walk
  xfs: Fix bool initialization/comparison
  xfs: don't change inode mode if ACL update fails
  xfs: move more RT specific code under CONFIG_XFS_RT
  xfs: Don't log uninitialised fields in inode structures
  • Loading branch information
torvalds committed Oct 12, 2017
2 parents 2aab9c3 + 93e8bef commit 8ff0b97
Show file tree
Hide file tree
Showing 14 changed files with 111 additions and 72 deletions.
8 changes: 8 additions & 0 deletions fs/xfs/libxfs/xfs_alloc.c
Original file line number Diff line number Diff line change
Expand Up @@ -1584,6 +1584,10 @@ xfs_alloc_ag_vextent_small(

bp = xfs_btree_get_bufs(args->mp, args->tp,
args->agno, fbno, 0);
if (!bp) {
error = -EFSCORRUPTED;
goto error0;
}
xfs_trans_binval(args->tp, bp);
}
args->len = 1;
Expand Down Expand Up @@ -2141,6 +2145,10 @@ xfs_alloc_fix_freelist(
if (error)
goto out_agbp_relse;
bp = xfs_btree_get_bufs(mp, tp, args->agno, bno, 0);
if (!bp) {
error = -EFSCORRUPTED;
goto out_agbp_relse;
}
xfs_trans_binval(tp, bp);
}

Expand Down
4 changes: 2 additions & 2 deletions fs/xfs/libxfs/xfs_bmap.c
Original file line number Diff line number Diff line change
Expand Up @@ -1477,14 +1477,14 @@ xfs_bmap_isaeof(
int is_empty;
int error;

bma->aeof = 0;
bma->aeof = false;
error = xfs_bmap_last_extent(NULL, bma->ip, whichfork, &rec,
&is_empty);
if (error)
return error;

if (is_empty) {
bma->aeof = 1;
bma->aeof = true;
return 0;
}

Expand Down
4 changes: 2 additions & 2 deletions fs/xfs/libxfs/xfs_ialloc.c
Original file line number Diff line number Diff line change
Expand Up @@ -1962,7 +1962,7 @@ xfs_difree_inobt(
if (!(mp->m_flags & XFS_MOUNT_IKEEP) &&
rec.ir_free == XFS_INOBT_ALL_FREE &&
mp->m_sb.sb_inopblock <= XFS_INODES_PER_CHUNK) {
xic->deleted = 1;
xic->deleted = true;
xic->first_ino = XFS_AGINO_TO_INO(mp, agno, rec.ir_startino);
xic->alloc = xfs_inobt_irec_to_allocmask(&rec);

Expand All @@ -1989,7 +1989,7 @@ xfs_difree_inobt(

xfs_difree_inode_chunk(mp, agno, &rec, dfops);
} else {
xic->deleted = 0;
xic->deleted = false;

error = xfs_inobt_update(cur, &rec);
if (error) {
Expand Down
27 changes: 8 additions & 19 deletions fs/xfs/libxfs/xfs_log_format.h
Original file line number Diff line number Diff line change
Expand Up @@ -270,6 +270,7 @@ typedef struct xfs_inode_log_format {
uint32_t ilf_fields; /* flags for fields logged */
uint16_t ilf_asize; /* size of attr d/ext/root */
uint16_t ilf_dsize; /* size of data/ext/root */
uint32_t ilf_pad; /* pad for 64 bit boundary */
uint64_t ilf_ino; /* inode number */
union {
uint32_t ilfu_rdev; /* rdev value for dev inode*/
Expand All @@ -280,29 +281,17 @@ typedef struct xfs_inode_log_format {
int32_t ilf_boffset; /* off of inode in buffer */
} xfs_inode_log_format_t;

typedef struct xfs_inode_log_format_32 {
uint16_t ilf_type; /* inode log item type */
uint16_t ilf_size; /* size of this item */
uint32_t ilf_fields; /* flags for fields logged */
uint16_t ilf_asize; /* size of attr d/ext/root */
uint16_t ilf_dsize; /* size of data/ext/root */
uint64_t ilf_ino; /* inode number */
union {
uint32_t ilfu_rdev; /* rdev value for dev inode*/
uuid_t ilfu_uuid; /* mount point value */
} ilf_u;
int64_t ilf_blkno; /* blkno of inode buffer */
int32_t ilf_len; /* len of inode buffer */
int32_t ilf_boffset; /* off of inode in buffer */
} __attribute__((packed)) xfs_inode_log_format_32_t;

typedef struct xfs_inode_log_format_64 {
/*
* Old 32 bit systems will log in this format without the 64 bit
* alignment padding. Recovery will detect this and convert it to the
* correct format.
*/
struct xfs_inode_log_format_32 {
uint16_t ilf_type; /* inode log item type */
uint16_t ilf_size; /* size of this item */
uint32_t ilf_fields; /* flags for fields logged */
uint16_t ilf_asize; /* size of attr d/ext/root */
uint16_t ilf_dsize; /* size of data/ext/root */
uint32_t ilf_pad; /* pad for 64 bit boundary */
uint64_t ilf_ino; /* inode number */
union {
uint32_t ilfu_rdev; /* rdev value for dev inode*/
Expand All @@ -311,7 +300,7 @@ typedef struct xfs_inode_log_format_64 {
int64_t ilf_blkno; /* blkno of inode buffer */
int32_t ilf_len; /* len of inode buffer */
int32_t ilf_boffset; /* off of inode in buffer */
} xfs_inode_log_format_64_t;
} __attribute__((packed));


/*
Expand Down
22 changes: 16 additions & 6 deletions fs/xfs/xfs_acl.c
Original file line number Diff line number Diff line change
Expand Up @@ -247,6 +247,8 @@ xfs_set_mode(struct inode *inode, umode_t mode)
int
xfs_set_acl(struct inode *inode, struct posix_acl *acl, int type)
{
umode_t mode;
bool set_mode = false;
int error = 0;

if (!acl)
Expand All @@ -257,16 +259,24 @@ xfs_set_acl(struct inode *inode, struct posix_acl *acl, int type)
return error;

if (type == ACL_TYPE_ACCESS) {
umode_t mode;

error = posix_acl_update_mode(inode, &mode, &acl);
if (error)
return error;
error = xfs_set_mode(inode, mode);
if (error)
return error;
set_mode = true;
}

set_acl:
return __xfs_set_acl(inode, acl, type);
error = __xfs_set_acl(inode, acl, type);
if (error)
return error;

/*
* We set the mode after successfully updating the ACL xattr because the
* xattr update can fail at ENOSPC and we don't want to change the mode
* if the ACL update hasn't been applied.
*/
if (set_mode)
error = xfs_set_mode(inode, mode);

return error;
}
2 changes: 2 additions & 0 deletions fs/xfs/xfs_attr_inactive.c
Original file line number Diff line number Diff line change
Expand Up @@ -302,6 +302,8 @@ xfs_attr3_node_inactive(
&bp, XFS_ATTR_FORK);
if (error)
return error;
node = bp->b_addr;
btree = dp->d_ops->node_tree_p(node);
child_fsb = be32_to_cpu(btree[i + 1].before);
xfs_trans_brelse(*trans, bp);
}
Expand Down
2 changes: 2 additions & 0 deletions fs/xfs/xfs_bmap_util.c
Original file line number Diff line number Diff line change
Expand Up @@ -84,6 +84,7 @@ xfs_zero_extent(
GFP_NOFS, 0);
}

#ifdef CONFIG_XFS_RT
int
xfs_bmap_rtalloc(
struct xfs_bmalloca *ap) /* bmap alloc argument struct */
Expand Down Expand Up @@ -190,6 +191,7 @@ xfs_bmap_rtalloc(
}
return 0;
}
#endif /* CONFIG_XFS_RT */

/*
* Check if the endoff is outside the last extent. If so the caller will grow
Expand Down
13 changes: 13 additions & 0 deletions fs/xfs/xfs_bmap_util.h
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,20 @@ struct xfs_mount;
struct xfs_trans;
struct xfs_bmalloca;

#ifdef CONFIG_XFS_RT
int xfs_bmap_rtalloc(struct xfs_bmalloca *ap);
#else /* !CONFIG_XFS_RT */
/*
* Attempts to allocate RT extents when RT is disable indicates corruption and
* should trigger a shutdown.
*/
static inline int
xfs_bmap_rtalloc(struct xfs_bmalloca *ap)
{
return -EFSCORRUPTED;
}
#endif /* CONFIG_XFS_RT */

int xfs_bmap_eof(struct xfs_inode *ip, xfs_fileoff_t endoff,
int whichfork, int *eof);
int xfs_bmap_punch_delalloc_range(struct xfs_inode *ip,
Expand Down
4 changes: 2 additions & 2 deletions fs/xfs/xfs_file.c
Original file line number Diff line number Diff line change
Expand Up @@ -764,7 +764,7 @@ xfs_file_fallocate(
enum xfs_prealloc_flags flags = 0;
uint iolock = XFS_IOLOCK_EXCL;
loff_t new_size = 0;
bool do_file_insert = 0;
bool do_file_insert = false;

if (!S_ISREG(inode->i_mode))
return -EINVAL;
Expand Down Expand Up @@ -825,7 +825,7 @@ xfs_file_fallocate(
error = -EINVAL;
goto out_unlock;
}
do_file_insert = 1;
do_file_insert = true;
} else {
flags |= XFS_PREALLOC_SET;

Expand Down
12 changes: 12 additions & 0 deletions fs/xfs/xfs_fsmap.c
Original file line number Diff line number Diff line change
Expand Up @@ -521,6 +521,7 @@ __xfs_getfsmap_rtdev(
return query_fn(tp, info);
}

#ifdef CONFIG_XFS_RT
/* Actually query the realtime bitmap. */
STATIC int
xfs_getfsmap_rtdev_rtbitmap_query(
Expand Down Expand Up @@ -561,6 +562,7 @@ xfs_getfsmap_rtdev_rtbitmap(
return __xfs_getfsmap_rtdev(tp, keys, xfs_getfsmap_rtdev_rtbitmap_query,
info);
}
#endif /* CONFIG_XFS_RT */

/* Execute a getfsmap query against the regular data device. */
STATIC int
Expand Down Expand Up @@ -795,7 +797,15 @@ xfs_getfsmap_check_keys(
return false;
}

/*
* There are only two devices if we didn't configure RT devices at build time.
*/
#ifdef CONFIG_XFS_RT
#define XFS_GETFSMAP_DEVS 3
#else
#define XFS_GETFSMAP_DEVS 2
#endif /* CONFIG_XFS_RT */

/*
* Get filesystem's extents as described in head, and format for
* output. Calls formatter to fill the user's buffer until all
Expand Down Expand Up @@ -853,10 +863,12 @@ xfs_getfsmap(
handlers[1].dev = new_encode_dev(mp->m_logdev_targp->bt_dev);
handlers[1].fn = xfs_getfsmap_logdev;
}
#ifdef CONFIG_XFS_RT
if (mp->m_rtdev_targp) {
handlers[2].dev = new_encode_dev(mp->m_rtdev_targp->bt_dev);
handlers[2].fn = xfs_getfsmap_rtdev_rtbitmap;
}
#endif /* CONFIG_XFS_RT */

xfs_sort(handlers, XFS_GETFSMAP_DEVS, sizeof(struct xfs_getfsmap_dev),
xfs_getfsmap_dev_compare);
Expand Down
79 changes: 41 additions & 38 deletions fs/xfs/xfs_inode_item.c
Original file line number Diff line number Diff line change
Expand Up @@ -364,6 +364,9 @@ xfs_inode_to_log_dinode(
to->di_dmstate = from->di_dmstate;
to->di_flags = from->di_flags;

/* log a dummy value to ensure log structure is fully initialised */
to->di_next_unlinked = NULLAGINO;

if (from->di_version == 3) {
to->di_changecount = inode->i_version;
to->di_crtime.t_sec = from->di_crtime.t_sec;
Expand Down Expand Up @@ -404,6 +407,11 @@ xfs_inode_item_format_core(
* the second with the on-disk inode structure, and a possible third and/or
* fourth with the inode data/extents/b-tree root and inode attributes
* data/extents/b-tree root.
*
* Note: Always use the 64 bit inode log format structure so we don't
* leave an uninitialised hole in the format item on 64 bit systems. Log
* recovery on 32 bit systems handles this just fine, so there's no reason
* for not using an initialising the properly padded structure all the time.
*/
STATIC void
xfs_inode_item_format(
Expand All @@ -412,8 +420,8 @@ xfs_inode_item_format(
{
struct xfs_inode_log_item *iip = INODE_ITEM(lip);
struct xfs_inode *ip = iip->ili_inode;
struct xfs_inode_log_format *ilf;
struct xfs_log_iovec *vecp = NULL;
struct xfs_inode_log_format *ilf;

ASSERT(ip->i_d.di_version > 1);

Expand All @@ -425,7 +433,17 @@ xfs_inode_item_format(
ilf->ilf_boffset = ip->i_imap.im_boffset;
ilf->ilf_fields = XFS_ILOG_CORE;
ilf->ilf_size = 2; /* format + core */
xlog_finish_iovec(lv, vecp, sizeof(struct xfs_inode_log_format));

/*
* make sure we don't leak uninitialised data into the log in the case
* when we don't log every field in the inode.
*/
ilf->ilf_dsize = 0;
ilf->ilf_asize = 0;
ilf->ilf_pad = 0;
uuid_copy(&ilf->ilf_u.ilfu_uuid, &uuid_null);

xlog_finish_iovec(lv, vecp, sizeof(*ilf));

xfs_inode_item_format_core(ip, lv, &vecp);
xfs_inode_item_format_data_fork(iip, ilf, lv, &vecp);
Expand Down Expand Up @@ -855,44 +873,29 @@ xfs_istale_done(
}

/*
* convert an xfs_inode_log_format struct from either 32 or 64 bit versions
* (which can have different field alignments) to the native version
* convert an xfs_inode_log_format struct from the old 32 bit version
* (which can have different field alignments) to the native 64 bit version
*/
int
xfs_inode_item_format_convert(
xfs_log_iovec_t *buf,
xfs_inode_log_format_t *in_f)
struct xfs_log_iovec *buf,
struct xfs_inode_log_format *in_f)
{
if (buf->i_len == sizeof(xfs_inode_log_format_32_t)) {
xfs_inode_log_format_32_t *in_f32 = buf->i_addr;

in_f->ilf_type = in_f32->ilf_type;
in_f->ilf_size = in_f32->ilf_size;
in_f->ilf_fields = in_f32->ilf_fields;
in_f->ilf_asize = in_f32->ilf_asize;
in_f->ilf_dsize = in_f32->ilf_dsize;
in_f->ilf_ino = in_f32->ilf_ino;
/* copy biggest field of ilf_u */
uuid_copy(&in_f->ilf_u.ilfu_uuid, &in_f32->ilf_u.ilfu_uuid);
in_f->ilf_blkno = in_f32->ilf_blkno;
in_f->ilf_len = in_f32->ilf_len;
in_f->ilf_boffset = in_f32->ilf_boffset;
return 0;
} else if (buf->i_len == sizeof(xfs_inode_log_format_64_t)){
xfs_inode_log_format_64_t *in_f64 = buf->i_addr;

in_f->ilf_type = in_f64->ilf_type;
in_f->ilf_size = in_f64->ilf_size;
in_f->ilf_fields = in_f64->ilf_fields;
in_f->ilf_asize = in_f64->ilf_asize;
in_f->ilf_dsize = in_f64->ilf_dsize;
in_f->ilf_ino = in_f64->ilf_ino;
/* copy biggest field of ilf_u */
uuid_copy(&in_f->ilf_u.ilfu_uuid, &in_f64->ilf_u.ilfu_uuid);
in_f->ilf_blkno = in_f64->ilf_blkno;
in_f->ilf_len = in_f64->ilf_len;
in_f->ilf_boffset = in_f64->ilf_boffset;
return 0;
}
return -EFSCORRUPTED;
struct xfs_inode_log_format_32 *in_f32 = buf->i_addr;

if (buf->i_len != sizeof(*in_f32))
return -EFSCORRUPTED;

in_f->ilf_type = in_f32->ilf_type;
in_f->ilf_size = in_f32->ilf_size;
in_f->ilf_fields = in_f32->ilf_fields;
in_f->ilf_asize = in_f32->ilf_asize;
in_f->ilf_dsize = in_f32->ilf_dsize;
in_f->ilf_ino = in_f32->ilf_ino;
/* copy biggest field of ilf_u */
uuid_copy(&in_f->ilf_u.ilfu_uuid, &in_f32->ilf_u.ilfu_uuid);
in_f->ilf_blkno = in_f32->ilf_blkno;
in_f->ilf_len = in_f32->ilf_len;
in_f->ilf_boffset = in_f32->ilf_boffset;
return 0;
}
2 changes: 1 addition & 1 deletion fs/xfs/xfs_log.c
Original file line number Diff line number Diff line change
Expand Up @@ -2515,7 +2515,7 @@ xlog_write(
if (lv)
vecp = lv->lv_iovecp;
}
if (record_cnt == 0 && ordered == false) {
if (record_cnt == 0 && !ordered) {
if (!lv)
return 0;
break;
Expand Down
2 changes: 1 addition & 1 deletion fs/xfs/xfs_mount.c
Original file line number Diff line number Diff line change
Expand Up @@ -704,7 +704,7 @@ xfs_mountfs(
xfs_set_maxicount(mp);

/* enable fail_at_unmount as default */
mp->m_fail_unmount = 1;
mp->m_fail_unmount = true;

error = xfs_sysfs_init(&mp->m_kobj, &xfs_mp_ktype, NULL, mp->m_fsname);
if (error)
Expand Down
Loading

0 comments on commit 8ff0b97

Please sign in to comment.