mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Greg KH <gregkh@suse.de>
To: <linux-kernel@vger.kernel.org>, <stable@vger.kernel.org>
Cc: <torvalds@linux-foundation.org>, <akpm@linux-foundation.org>,
	<alan@lxorguk.ukuu.org.uk>,
	xfs@oss.sgi.com, Christoph Hellwig <hch@lst.de>,
	Ben Myers <bpm@sgi.com>, Dave Chinner <dchinner@redhat.com>
Subject: [71/80] xfs: fix attr2 vs large data fork assert
Date: Wed, 07 Dec 2011 08:07:31 -0800	[thread overview]
Message-ID: <20111207160828.403515055@clark.kroah.org> (raw)
In-Reply-To: <20111207161256.GA7736@kroah.com>

3.0-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Christoph Hellwig <hch@infradead.org>

commit 4c393a6059f8442a70512a48ce4639b882b6f6ad upstream.

With Dmitry fsstress updates I've seen very reproducible crashes in
xfs_attr_shortform_remove because xfs_attr_shortform_bytesfit claims that
the attributes would not fit inline into the inode after removing an
attribute.  It turns out that we were operating on an inode with lots
of delalloc extents, and thus an if_bytes values for the data fork that
is larger than biggest possible on-disk storage for it which utterly
confuses the code near the end of xfs_attr_shortform_bytesfit.

Fix this by always allowing the current attribute fork, like we already
do for the attr1 format, given that delalloc conversion will take care
for moving either the data or attribute area out of line if it doesn't
fit at that point - or making the point moot by merging extents at this
point.

Also document the function better, and clean up some loose bits.

Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Ben Myers <bpm@sgi.com>
Acked-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 fs/xfs/xfs_attr_leaf.c |   64 +++++++++++++++++++++++++++++--------------------
 1 file changed, 39 insertions(+), 25 deletions(-)

--- a/fs/xfs/xfs_attr_leaf.c
+++ b/fs/xfs/xfs_attr_leaf.c
@@ -110,6 +110,7 @@ xfs_attr_namesp_match(int arg_flags, int
 /*
  * Query whether the requested number of additional bytes of extended
  * attribute space will be able to fit inline.
+ *
  * Returns zero if not, else the di_forkoff fork offset to be used in the
  * literal area for attribute data once the new bytes have been added.
  *
@@ -122,7 +123,7 @@ xfs_attr_shortform_bytesfit(xfs_inode_t
 	int offset;
 	int minforkoff;	/* lower limit on valid forkoff locations */
 	int maxforkoff;	/* upper limit on valid forkoff locations */
-	int dsize;	
+	int dsize;
 	xfs_mount_t *mp = dp->i_mount;
 
 	offset = (XFS_LITINO(mp) - bytes) >> 3; /* rounded down */
@@ -136,47 +137,60 @@ xfs_attr_shortform_bytesfit(xfs_inode_t
 		return (offset >= minforkoff) ? minforkoff : 0;
 	}
 
-	if (!(mp->m_flags & XFS_MOUNT_ATTR2)) {
-		if (bytes <= XFS_IFORK_ASIZE(dp))
-			return dp->i_d.di_forkoff;
+	/*
+	 * If the requested numbers of bytes is smaller or equal to the
+	 * current attribute fork size we can always proceed.
+	 *
+	 * Note that if_bytes in the data fork might actually be larger than
+	 * the current data fork size is due to delalloc extents. In that
+	 * case either the extent count will go down when they are converted
+	 * to real extents, or the delalloc conversion will take care of the
+	 * literal area rebalancing.
+	 */
+	if (bytes <= XFS_IFORK_ASIZE(dp))
+		return dp->i_d.di_forkoff;
+
+	/*
+	 * For attr2 we can try to move the forkoff if there is space in the
+	 * literal area, but for the old format we are done if there is no
+	 * space in the fixed attribute fork.
+	 */
+	if (!(mp->m_flags & XFS_MOUNT_ATTR2))
 		return 0;
-	}
 
 	dsize = dp->i_df.if_bytes;
-	
+
 	switch (dp->i_d.di_format) {
 	case XFS_DINODE_FMT_EXTENTS:
-		/* 
+		/*
 		 * If there is no attr fork and the data fork is extents, 
-		 * determine if creating the default attr fork will result 
-		 * in the extents form migrating to btree. If so, the 
-		 * minimum offset only needs to be the space required for 
+		 * determine if creating the default attr fork will result
+		 * in the extents form migrating to btree. If so, the
+		 * minimum offset only needs to be the space required for
 		 * the btree root.
-		 */ 
+		 */
 		if (!dp->i_d.di_forkoff && dp->i_df.if_bytes >
 		    xfs_default_attroffset(dp))
 			dsize = XFS_BMDR_SPACE_CALC(MINDBTPTRS);
 		break;
-		
 	case XFS_DINODE_FMT_BTREE:
 		/*
-		 * If have data btree then keep forkoff if we have one,
-		 * otherwise we are adding a new attr, so then we set 
-		 * minforkoff to where the btree root can finish so we have 
+		 * If we have a data btree then keep forkoff if we have one,
+		 * otherwise we are adding a new attr, so then we set
+		 * minforkoff to where the btree root can finish so we have
 		 * plenty of room for attrs
 		 */
 		if (dp->i_d.di_forkoff) {
-			if (offset < dp->i_d.di_forkoff) 
+			if (offset < dp->i_d.di_forkoff)
 				return 0;
-			else 
-				return dp->i_d.di_forkoff;
-		} else
-			dsize = XFS_BMAP_BROOT_SPACE(dp->i_df.if_broot);
+			return dp->i_d.di_forkoff;
+		}
+		dsize = XFS_BMAP_BROOT_SPACE(dp->i_df.if_broot);
 		break;
 	}
-	
-	/* 
-	 * A data fork btree root must have space for at least 
+
+	/*
+	 * A data fork btree root must have space for at least
 	 * MINDBTPTRS key/ptr pairs if the data fork is small or empty.
 	 */
 	minforkoff = MAX(dsize, XFS_BMDR_SPACE_CALC(MINDBTPTRS));
@@ -186,10 +200,10 @@ xfs_attr_shortform_bytesfit(xfs_inode_t
 	maxforkoff = XFS_LITINO(mp) - XFS_BMDR_SPACE_CALC(MINABTPTRS);
 	maxforkoff = maxforkoff >> 3;	/* rounded down */
 
-	if (offset >= minforkoff && offset < maxforkoff)
-		return offset;
 	if (offset >= maxforkoff)
 		return maxforkoff;
+	if (offset >= minforkoff)
+		return offset;
 	return 0;
 }
 



  parent reply	other threads:[~2011-12-07 16:19 UTC|newest]

Thread overview: 91+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2011-12-07 16:12 [00/80] 3.0.13-stable review Greg KH
2011-12-07 16:06 ` [01/80] eCryptfs: Flush file in vma close Greg KH
2011-12-07 16:06 ` [02/80] i2c-algo-bit: Generate correct i2c address sequence for 10-bit target Greg KH
2011-12-07 16:06 ` [03/80] eCryptfs: Extend array bounds for all filename chars Greg KH
2011-12-07 16:06 ` [04/80] crypto: mv_cesa - fix hashing of chunks > 1920 bytes Greg KH
2011-12-07 16:06 ` [05/80] drm: integer overflow in drm_mode_dirtyfb_ioctl() Greg KH
2011-12-07 16:06 ` [06/80] drm/radeon/kms: fix up gpio i2c mask bits for r4xx for real Greg KH
2011-12-07 16:06 ` [07/80] drm/i915: Ivybridge still has fences! Greg KH
2011-12-07 16:06 ` [08/80] drm/i915: Turn on a required 3D clock gating bit on Sandybridge Greg KH
2011-12-07 16:06 ` [09/80] drm/i915: Turn on another required clock gating bit on gen6 Greg KH
2011-12-07 16:06 ` [10/80] drm/ttm: request zeroed system memory pages for new TT buffer objects Greg KH
2011-12-07 16:06 ` [11/80] drm/i915: fix CB tuning check for ILK+ Greg KH
2011-12-07 16:06 ` [12/80] PCI hotplug: shpchp: dont blindly claim non-AMD 0x7450 device IDs Greg KH
2011-12-07 16:06 ` [13/80] drm/radeon/kms: fix up gpio i2c mask bits for r4xx Greg KH
2011-12-07 16:06 ` [14/80] viafb: correct sync polarity for OLPC DCON Greg KH
2011-12-07 16:06 ` [15/80] ARM: pxa: fix inconsistent CONFIG_USB_PXA27X Greg KH
2011-12-07 16:06 ` [16/80] arm: mx28: fix bit operation in clock setting Greg KH
2011-12-07 16:06 ` [17/80] ARM: OMAP: smartreflex: fix IRQ handling bug Greg KH
2011-12-07 16:06 ` [18/80] ARM: OMAP2: select ARM_AMBA if OMAP3_EMU is defined Greg KH
2011-12-07 16:06 ` [19/80] ARM: 7161/1: errata: no automatic store buffer drain Greg KH
2011-12-07 16:06 ` [20/80] ALSA: lx6464es - fix device communication via command bus Greg KH
2011-12-07 17:47   ` Linus Torvalds
2011-12-07 18:00     ` H. Peter Anvin
2011-12-07 18:09       ` Linus Torvalds
2011-12-09 23:17         ` H. Peter Anvin
2011-12-08  7:55     ` Brian Gerst
2011-12-11 22:10       ` [PATCH] x86: Split off mem*io functions Brian Gerst
2011-12-11 22:15         ` Brian Gerst
2011-12-13  9:23           ` Tim Blechmann
2011-12-13 22:58         ` Linus Torvalds
2011-12-13 23:47           ` H. Peter Anvin
2011-12-07 16:06 ` [21/80] ASoC: fsl_ssi: properly initialize the sysfs attribute object Greg KH
2011-12-07 16:06 ` [22/80] ASoC: wm8753: Skip noop reconfiguration of DAI mode Greg KH
2011-12-07 16:06 ` [23/80] ASoC: Ensure WM8731 register cache is synced when resuming from disabled Greg KH
2011-12-07 16:06 ` [24/80] SUNRPC: Ensure we return EAGAIN in xs_nospace if congestion is cleared Greg KH
2011-12-07 16:06 ` [25/80] genirq: fix regression in irqfixup, irqpoll Greg KH
2011-12-07 16:06 ` [26/80] cgroup_freezer: fix freezing groups with stopped tasks Greg KH
2011-12-07 16:06 ` [27/80] timekeeping: add arch_offset hook to ktime_get functions Greg KH
2011-12-07 16:06 ` [28/80] hrtimer: Fix extra wakeups from __remove_hrtimer() Greg KH
2011-12-07 16:06 ` [29/80] p54spi: Add missing spin_lock_init Greg KH
2011-12-07 16:06 ` [30/80] p54spi: Fix workqueue deadlock Greg KH
2011-12-07 16:06 ` [31/80] rt2x00: Fix efuse EEPROM reading on PPC32 Greg KH
2011-12-07 16:06 ` [32/80] nl80211: fix MAC address validation Greg KH
2011-12-07 16:06 ` [33/80] cfg80211: fix regulatory NULL dereference Greg KH
2011-12-07 16:06 ` [34/80] mac80211: dont stop a single aggregation session twice Greg KH
2011-12-07 16:06 ` [35/80] mac80211: fix race between the AGG SM and the Tx data path Greg KH
2011-12-07 16:06 ` [36/80] hwmon: (coretemp) Fix oops on driver load Greg KH
2011-12-07 16:06 ` [37/80] revert "mfd: Fix twl4030 dependencies for audio codec" Greg KH
2011-12-07 16:06 ` [38/80] SCSI: Silencing killing requests for dead queue Greg KH
2011-12-07 16:06 ` [39/80] hugetlb: release pages in the error path of hugetlb_cow() Greg KH
2011-12-07 16:07 ` [40/80] drm/radeon/kms: add some new pci ids Greg KH
2011-12-07 16:07 ` [41/80] drm/radeon/kms: add some loop timeouts in pageflip code Greg KH
2011-12-07 16:07 ` [42/80] firmware: Sigma: Prevent out of bounds memory access Greg KH
2011-12-07 16:07 ` [43/80] firmware: Sigma: Skip header during CRC generation Greg KH
2011-12-07 16:07 ` [44/80] firmware: Sigma: Fix endianess issues Greg KH
2011-12-07 16:07 ` [45/80] staging: usbip: bugfix for deadlock Greg KH
2011-12-07 16:07 ` [46/80] staging: comedi: fix oops for USB DAQ devices Greg KH
2011-12-07 16:07 ` [47/80] Staging: comedi: fix mmap_count Greg KH
2011-12-07 16:07 ` [48/80] Staging: comedi: fix signal handling in read and write Greg KH
2011-12-07 16:07 ` [49/80] USB: whci-hcd: fix endian conversion in qset_clear() Greg KH
2011-12-07 16:07 ` [50/80] HID: Correct General touch PID Greg KH
2011-12-07 16:07 ` [51/80] usb: ftdi_sio: add PID for Propox ISPcable III Greg KH
2011-12-07 16:07 ` [52/80] usb: option: add Huawei E353 controlling interfaces Greg KH
2011-12-07 16:07 ` [53/80] usb: option: add SIMCom SIM5218 Greg KH
2011-12-07 16:07 ` [54/80] USB: usb-storage: unusual_devs entry for Kingston DT 101 G2 Greg KH
2011-12-07 16:07 ` [55/80] USB: EHCI: fix HUB TT scheduling issue with iso transfer Greg KH
2011-12-07 16:07 ` [56/80] EHCI : Fix a regression in the ISO scheduler Greg KH
2011-12-07 16:07 ` [57/80] xHCI: fix bug in xhci_clear_command_ring() Greg KH
2011-12-07 16:07 ` [58/80] sched, x86: Avoid unnecessary overflow in sched_clock Greg KH
2011-12-07 16:07 ` [59/80] x86/mpparse: Account for bus types other than ISA and PCI Greg KH
2011-12-07 16:07 ` [60/80] x86: Fix "Acer Aspire 1" reboot hang Greg KH
2011-12-07 16:07 ` [61/80] x86/paravirt: PTE updates in k(un)map_atomic need to be synchronous, regardless of lazy_mmu mode Greg KH
2011-12-07 16:07 ` [62/80] perf/x86: Fix PEBS instruction unwind Greg KH
2011-12-07 16:07 ` [63/80] oprofile, x86: Fix crash when unloading module (nmi timer mode) Greg KH
2011-12-07 16:07 ` [64/80] [S390] add missing .set function for NT_S390_LAST_BREAK regset Greg KH
2011-12-07 16:07 ` [65/80] cfg80211: fix race on init and driver registration Greg KH
2011-12-07 16:07 ` [66/80] cfg80211: amend regulatory NULL dereference fix Greg KH
2011-12-07 16:07 ` [67/80] genirq: Fix race condition when stopping the irq thread Greg KH
2011-12-07 16:07 ` [68/80] NFS: Prevent 3.0 from crashing if it receives a partial layout Greg KH
2011-12-07 16:07 ` [69/80] xfs: validate acl count Greg KH
2011-12-07 16:07 ` [70/80] xfs: force buffer writeback before blocking on the ilock in inode reclaim Greg KH
2011-12-07 16:07 ` Greg KH [this message]
2011-12-07 16:07 ` [72/80] trace_events_filter: Use rcu_assign_pointer() when setting ftrace_event_call->filter Greg KH
2011-12-07 16:07 ` [73/80] rtc: Disable the alarm in the hardware Greg KH
2011-12-07 16:07 ` [74/80] tracing: fix event_subsystem ref counting Greg KH
2011-12-07 16:07 ` [75/80] tick-broadcast: Stop active broadcast device when replacing it Greg KH
2011-12-07 16:07 ` [76/80] perf: Fix parsing of __print_flags() in TP_printk() Greg KH
2011-12-07 16:07 ` [77/80] jump_label: jump_label_inc may return before the code is patched Greg KH
2011-12-07 16:07 ` [78/80] oprofile: Fix crash when unloading module (hr timer mode) Greg KH
2011-12-07 16:07 ` [79/80] clocksource: Fix bug with max_deferment margin calculation Greg KH
2011-12-07 16:07 ` [80/80] clockevents: Set noop handler in clockevents_exchange_device() Greg KH

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20111207160828.403515055@clark.kroah.org \
    --to=gregkh@suse.de \
    --cc=akpm@linux-foundation.org \
    --cc=alan@lxorguk.ukuu.org.uk \
    --cc=bpm@sgi.com \
    --cc=dchinner@redhat.com \
    --cc=hch@lst.de \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=torvalds@linux-foundation.org \
    --cc=xfs@oss.sgi.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®