[PATCH v2 0/3] udf: refactor udf_current_aext()/udf_next_aext()/inode_bmap() to handle error

[PATCH v2 0/3] udf: refactor udf_current_aext()/udf_next_aext()/inode_bmap() to handle error

[Zhao Mengmeng]

From: Zhao Mengmeng <zhaomengmeng@kylinos.cn>

syzbot reports a udf slab-out-of-bounds at [1] and I proposed a fix patch,
after talking with Jan, a better way to fix this is to refactor 
udf_current_aext() and udf_next_aext() to differentiate between error and
"hit EOF".
This series refactor udf_current_aext(), udf_next_aext() and inode_bmap(),
they take pointer to etype to store the extent type and just return 0 on 
success, <0 on error. It has passed the syz repro test.

[1]. https://lore.kernel.org/all/0000000000005093590621340ecf@google.com/

changelog:

v2:
----
 - Take advices of Jan to fix the error handling code
 - Check all other places that may involves EOF and error checking
 - Add two macros the simply the error checking of extent

v1:
----
 - https://lore.kernel.org/all/20240918093634.12906-1-zhaomzhao@126.com/

Zhao Mengmeng (3):
  udf: refactor udf_current_aext() to handle error
  udf: refactor udf_next_aext() to handle error
  udf: refactor inode_bmap() to handle error

 fs/udf/balloc.c    |  22 +++++--
 fs/udf/directory.c |  23 +++++--
 fs/udf/inode.c     | 155 +++++++++++++++++++++++++++++----------------
 fs/udf/partition.c |   6 +-
 fs/udf/super.c     |   3 +-
 fs/udf/truncate.c  |  41 ++++++++----
 fs/udf/udfdecl.h   |  18 ++++--
 7 files changed, 180 insertions(+), 88 deletions(-)

-- 
2.43.0

[PATCH v2 1/3] udf: refactor udf_current_aext() to handle error

[Zhao Mengmeng]

From: Zhao Mengmeng <zhaomengmeng@kylinos.cn>

As Jan suggested in links below, refactor udf_current_aext() to
differentiate between error and "hit EOF", it now takes pointer to etype
to store the extent type, return 0 when get etype success; return -ENODATA
when hit EOF; return -EINVAL when i_alloc_type invalid. Add two macroes to
test return value.

Link: https://lore.kernel.org/all/20240912111235.6nr3wuqvktecy3vh@quack3/
Signed-off-by: Zhao Mengmeng <zhaomengmeng@kylinos.cn>
Suggested-by: Jan Kara <jack@suse.cz>
---
 fs/udf/inode.c    | 37 +++++++++++++++++++++++--------------
 fs/udf/truncate.c | 10 ++++++++--
 fs/udf/udfdecl.h  |  8 ++++++--
 3 files changed, 37 insertions(+), 18 deletions(-)

diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index 4726a4d014b6..3be59aa8d4fd 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -1955,6 +1955,7 @@ int udf_setup_indirect_aext(struct inode *inode, udf_pblk_t block,
 	struct extent_position nepos;
 	struct kernel_lb_addr neloc;
 	int ver, adsize;
+	int err = 0;
 
 	if (UDF_I(inode)->i_alloc_type == ICBTAG_FLAG_AD_SHORT)
 		adsize = sizeof(struct short_ad);
@@ -1999,10 +2000,12 @@ int udf_setup_indirect_aext(struct inode *inode, udf_pblk_t block,
 	if (epos->offset + adsize > sb->s_blocksize) {
 		struct kernel_lb_addr cp_loc;
 		uint32_t cp_len;
-		int cp_type;
+		int8_t cp_type;
 
 		epos->offset -= adsize;
-		cp_type = udf_current_aext(inode, epos, &cp_loc, &cp_len, 0);
+		err = udf_current_aext(inode, epos, &cp_loc, &cp_len, &cp_type, 0);
+		if (err < 0)
+			goto err_out;
 		cp_len |= ((uint32_t)cp_type) << 30;
 
 		__udf_add_aext(inode, &nepos, &cp_loc, cp_len, 1);
@@ -2017,6 +2020,9 @@ int udf_setup_indirect_aext(struct inode *inode, udf_pblk_t block,
 	*epos = nepos;
 
 	return 0;
+err_out:
+	brelse(bh);
+	return err;
 }
 
 /*
@@ -2167,9 +2173,12 @@ int8_t udf_next_aext(struct inode *inode, struct extent_position *epos,
 {
 	int8_t etype;
 	unsigned int indirections = 0;
+	int err = 0;
+
+	while ((err = udf_current_aext(inode, epos, eloc, elen, &etype, inc))) {
+		if (err || etype != (EXT_NEXT_EXTENT_ALLOCDESCS >> 30))
+			break;
 
-	while ((etype = udf_current_aext(inode, epos, eloc, elen, inc)) ==
-	       (EXT_NEXT_EXTENT_ALLOCDESCS >> 30)) {
 		udf_pblk_t block;
 
 		if (++indirections > UDF_MAX_INDIR_EXTS) {
@@ -2190,14 +2199,14 @@ int8_t udf_next_aext(struct inode *inode, struct extent_position *epos,
 		}
 	}
 
-	return etype;
+	return !err ? etype : -1;
 }
 
-int8_t udf_current_aext(struct inode *inode, struct extent_position *epos,
-			struct kernel_lb_addr *eloc, uint32_t *elen, int inc)
+int udf_current_aext(struct inode *inode, struct extent_position *epos,
+		     struct kernel_lb_addr *eloc, uint32_t *elen, int8_t *etype,
+		     int inc)
 {
 	int alen;
-	int8_t etype;
 	uint8_t *ptr;
 	struct short_ad *sad;
 	struct long_ad *lad;
@@ -2224,8 +2233,8 @@ int8_t udf_current_aext(struct inode *inode, struct extent_position *epos,
 	case ICBTAG_FLAG_AD_SHORT:
 		sad = udf_get_fileshortad(ptr, alen, &epos->offset, inc);
 		if (!sad)
-			return -1;
-		etype = le32_to_cpu(sad->extLength) >> 30;
+			return -ENODATA;
+		*etype = le32_to_cpu(sad->extLength) >> 30;
 		eloc->logicalBlockNum = le32_to_cpu(sad->extPosition);
 		eloc->partitionReferenceNum =
 				iinfo->i_location.partitionReferenceNum;
@@ -2234,17 +2243,17 @@ int8_t udf_current_aext(struct inode *inode, struct extent_position *epos,
 	case ICBTAG_FLAG_AD_LONG:
 		lad = udf_get_filelongad(ptr, alen, &epos->offset, inc);
 		if (!lad)
-			return -1;
-		etype = le32_to_cpu(lad->extLength) >> 30;
+			return -ENODATA;
+		*etype = le32_to_cpu(lad->extLength) >> 30;
 		*eloc = lelb_to_cpu(lad->extLocation);
 		*elen = le32_to_cpu(lad->extLength) & UDF_EXTENT_LENGTH_MASK;
 		break;
 	default:
 		udf_debug("alloc_type = %u unsupported\n", iinfo->i_alloc_type);
-		return -1;
+		return -EINVAL;
 	}
 
-	return etype;
+	return 0;
 }
 
 static int udf_insert_aext(struct inode *inode, struct extent_position epos,
diff --git a/fs/udf/truncate.c b/fs/udf/truncate.c
index a686c10fd709..16db2613401d 100644
--- a/fs/udf/truncate.c
+++ b/fs/udf/truncate.c
@@ -188,6 +188,7 @@ int udf_truncate_extents(struct inode *inode)
 	loff_t byte_offset;
 	int adsize;
 	struct udf_inode_info *iinfo = UDF_I(inode);
+	int err = 0;
 
 	if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_SHORT)
 		adsize = sizeof(struct short_ad);
@@ -217,8 +218,8 @@ int udf_truncate_extents(struct inode *inode)
 	else
 		lenalloc -= sizeof(struct allocExtDesc);
 
-	while ((etype = udf_current_aext(inode, &epos, &eloc,
-					 &elen, 0)) != -1) {
+	while (!(err = udf_current_aext(inode, &epos, &eloc, &elen, &etype,
+					0))) {
 		if (etype == (EXT_NEXT_EXTENT_ALLOCDESCS >> 30)) {
 			udf_write_aext(inode, &epos, &neloc, nelen, 0);
 			if (indirect_ext_len) {
@@ -253,6 +254,11 @@ int udf_truncate_extents(struct inode *inode)
 		}
 	}
 
+	if (UDF_EXT_ERR(err)) {
+		brelse(epos.bh);
+		return err;
+	}
+
 	if (indirect_ext_len) {
 		BUG_ON(!epos.bh);
 		udf_free_blocks(sb, NULL, &epos.block, 0, indirect_ext_len);
diff --git a/fs/udf/udfdecl.h b/fs/udf/udfdecl.h
index 88692512a466..a902652450dd 100644
--- a/fs/udf/udfdecl.h
+++ b/fs/udf/udfdecl.h
@@ -43,6 +43,9 @@ extern __printf(3, 4) void _udf_warn(struct super_block *sb,
 #define UDF_NAME_LEN		254
 #define UDF_NAME_LEN_CS0	255
 
+#define UDF_EXT_EOF(err)        ((err) == -ENODATA)
+#define UDF_EXT_ERR(err)        (((err) < 0) && (!UDF_EXT_EOF(err)))
+
 static inline size_t udf_file_entry_alloc_offset(struct inode *inode)
 {
 	struct udf_inode_info *iinfo = UDF_I(inode);
@@ -171,8 +174,9 @@ extern void udf_write_aext(struct inode *, struct extent_position *,
 extern int8_t udf_delete_aext(struct inode *, struct extent_position);
 extern int8_t udf_next_aext(struct inode *, struct extent_position *,
 			    struct kernel_lb_addr *, uint32_t *, int);
-extern int8_t udf_current_aext(struct inode *, struct extent_position *,
-			       struct kernel_lb_addr *, uint32_t *, int);
+extern int udf_current_aext(struct inode *inode, struct extent_position *epos,
+			    struct kernel_lb_addr *eloc, uint32_t *elen,
+			    int8_t *etype, int inc);
 extern void udf_update_extra_perms(struct inode *inode, umode_t mode);
 
 /* misc.c */
-- 
2.43.0

Re: [PATCH v2 1/3] udf: refactor udf_current_aext() to handle error

[Jan Kara]

On Thu 26-09-24 20:07:51, Zhao Mengmeng wrote:
> From: Zhao Mengmeng <zhaomengmeng@kylinos.cn>
> 
> As Jan suggested in links below, refactor udf_current_aext() to
> differentiate between error and "hit EOF", it now takes pointer to etype
> to store the extent type, return 0 when get etype success; return -ENODATA
> when hit EOF; return -EINVAL when i_alloc_type invalid. Add two macroes to
> test return value.
> 
> Link: https://lore.kernel.org/all/20240912111235.6nr3wuqvktecy3vh@quack3/
> Signed-off-by: Zhao Mengmeng <zhaomengmeng@kylinos.cn>
> Suggested-by: Jan Kara <jack@suse.cz>
...
> @@ -2167,9 +2173,12 @@ int8_t udf_next_aext(struct inode *inode, struct extent_position *epos,
>  {
>  	int8_t etype;
>  	unsigned int indirections = 0;
> +	int err = 0;
> +
> +	while ((err = udf_current_aext(inode, epos, eloc, elen, &etype, inc))) {
> +		if (err || etype != (EXT_NEXT_EXTENT_ALLOCDESCS >> 30))
> +			break;
>  
> -	while ((etype = udf_current_aext(inode, epos, eloc, elen, inc)) ==
> -	       (EXT_NEXT_EXTENT_ALLOCDESCS >> 30)) {

This looks wrong. If udf_current_aext() succeeds, you'll immediately abort
the loop now. I'd rather code this as:

	while (1) {
		err = udf_current_aext(inode, epos, eloc, elen, &etype, inc);
		if (err || etype != (EXT_NEXT_EXTENT_ALLOCDESCS >> 30))
			break;
		...
	}

> diff --git a/fs/udf/udfdecl.h b/fs/udf/udfdecl.h
> index 88692512a466..a902652450dd 100644
> --- a/fs/udf/udfdecl.h
> +++ b/fs/udf/udfdecl.h
> @@ -43,6 +43,9 @@ extern __printf(3, 4) void _udf_warn(struct super_block *sb,
>  #define UDF_NAME_LEN		254
>  #define UDF_NAME_LEN_CS0	255
>  
> +#define UDF_EXT_EOF(err)        ((err) == -ENODATA)
> +#define UDF_EXT_ERR(err)        (((err) < 0) && (!UDF_EXT_EOF(err)))
> +

So I agree the explicit ENODATA checks are a bit ugly but these macros
aren't really much better. How about the following calling convention:

On error, ret < 0, on EOF ret == 0, on success ret == 1. This is a similar
convention as e.g. for read(2) so it is well understood and easy test for
various combinations.

								Honza
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR

Re: [PATCH v2 1/3] udf: refactor udf_current_aext() to handle error

[Zhao Mengmeng]

On 2024/9/27 19:55, Jan Kara wrote:
> On Thu 26-09-24 20:07:51, Zhao Mengmeng wrote:
>> From: Zhao Mengmeng <zhaomengmeng@kylinos.cn>
>>
>> As Jan suggested in links below, refactor udf_current_aext() to
>> differentiate between error and "hit EOF", it now takes pointer to etype
>> to store the extent type, return 0 when get etype success; return -ENODATA
>> when hit EOF; return -EINVAL when i_alloc_type invalid. Add two macroes to
>> test return value.
>>
>> Link: https://lore.kernel.org/all/20240912111235.6nr3wuqvktecy3vh@quack3/
>> Signed-off-by: Zhao Mengmeng <zhaomengmeng@kylinos.cn>
>> Suggested-by: Jan Kara <jack@suse.cz>
> ...
>> @@ -2167,9 +2173,12 @@ int8_t udf_next_aext(struct inode *inode, struct extent_position *epos,
>>  {
>>  	int8_t etype;
>>  	unsigned int indirections = 0;
>> +	int err = 0;
>> +
>> +	while ((err = udf_current_aext(inode, epos, eloc, elen, &etype, inc))) {
>> +		if (err || etype != (EXT_NEXT_EXTENT_ALLOCDESCS >> 30))
>> +			break;
>>  
>> -	while ((etype = udf_current_aext(inode, epos, eloc, elen, inc)) ==
>> -	       (EXT_NEXT_EXTENT_ALLOCDESCS >> 30)) {
> 
> This looks wrong. If udf_current_aext() succeeds, you'll immediately abort
> the loop now. I'd rather code this as:
> 
> 	while (1) {
> 		err = udf_current_aext(inode, epos, eloc, elen, &etype, inc);
> 		if (err || etype != (EXT_NEXT_EXTENT_ALLOCDESCS >> 30))
> 			break;
> 		...
> 	}

Yes, you are right. I forget the return check, should be:
	while (!(err = udf_current_aext(inode, epos, eloc, elen, &etype, inc))) {
		if (err || etype != (EXT_NEXT_EXTENT_ALLOCDESCS >> 30))
			break;
>> diff --git a/fs/udf/udfdecl.h b/fs/udf/udfdecl.h
>> index 88692512a466..a902652450dd 100644
>> --- a/fs/udf/udfdecl.h
>> +++ b/fs/udf/udfdecl.h
>> @@ -43,6 +43,9 @@ extern __printf(3, 4) void _udf_warn(struct super_block *sb,
>>  #define UDF_NAME_LEN		254
>>  #define UDF_NAME_LEN_CS0	255
>>  
>> +#define UDF_EXT_EOF(err)        ((err) == -ENODATA)
>> +#define UDF_EXT_ERR(err)        (((err) < 0) && (!UDF_EXT_EOF(err)))
>> +
> 
> So I agree the explicit ENODATA checks are a bit ugly but these macros
> aren't really much better. How about the following calling convention:
> 
> On error, ret < 0, on EOF ret == 0, on success ret == 1. This is a similar
> convention as e.g. for read(2) so it is well understood and easy test for
> various combinations.

No problem, I will add some comments on these three functions do it in V3.

[PATCH v2 2/3] udf: refactor udf_next_aext() to handle error

[Zhao Mengmeng]

From: Zhao Mengmeng <zhaomengmeng@kylinos.cn>

Since udf_current_aext() has error handling, udf_next_aext() should have
error handling too. Besides, when too many indirect extents found in one
inode, return -EFSCORRUPTED; when reading block failed, return -EIO.

Signed-off-by: Zhao Mengmeng <zhaomengmeng@kylinos.cn>
Suggested-by: Jan Kara <jack@suse.cz>
---
 fs/udf/balloc.c    | 22 +++++++----
 fs/udf/directory.c | 10 ++++-
 fs/udf/inode.c     | 99 ++++++++++++++++++++++++++++++----------------
 fs/udf/super.c     |  3 +-
 fs/udf/truncate.c  | 23 ++++++++---
 fs/udf/udfdecl.h   |  5 ++-
 6 files changed, 110 insertions(+), 52 deletions(-)

diff --git a/fs/udf/balloc.c b/fs/udf/balloc.c
index d8fc11765d61..99cf8fbc805e 100644
--- a/fs/udf/balloc.c
+++ b/fs/udf/balloc.c
@@ -370,6 +370,7 @@ static void udf_table_free_blocks(struct super_block *sb,
 	struct extent_position oepos, epos;
 	int8_t etype;
 	struct udf_inode_info *iinfo;
+	int err = 0;
 
 	mutex_lock(&sbi->s_alloc_mutex);
 	iinfo = UDF_I(table);
@@ -384,7 +385,7 @@ static void udf_table_free_blocks(struct super_block *sb,
 	epos.bh = oepos.bh = NULL;
 
 	while (count &&
-	       (etype = udf_next_aext(table, &epos, &eloc, &elen, 1)) != -1) {
+	       !(err = udf_next_aext(table, &epos, &eloc, &elen, &etype, 1))) {
 		if (((eloc.logicalBlockNum +
 			(elen >> sb->s_blocksize_bits)) == start)) {
 			if ((0x3FFFFFFF - elen) <
@@ -435,6 +436,9 @@ static void udf_table_free_blocks(struct super_block *sb,
 		}
 	}
 
+	if (UDF_EXT_ERR(err))
+		goto error_return;
+
 	if (count) {
 		/*
 		 * NOTE: we CANNOT use udf_add_aext here, as it can try to
@@ -460,8 +464,6 @@ static void udf_table_free_blocks(struct super_block *sb,
 		else if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_LONG)
 			adsize = sizeof(struct long_ad);
 		else {
-			brelse(oepos.bh);
-			brelse(epos.bh);
 			goto error_return;
 		}
 
@@ -479,10 +481,10 @@ static void udf_table_free_blocks(struct super_block *sb,
 			__udf_add_aext(table, &epos, &eloc, elen, 1);
 	}
 
+error_return:
 	brelse(epos.bh);
 	brelse(oepos.bh);
 
-error_return:
 	mutex_unlock(&sbi->s_alloc_mutex);
 	return;
 }
@@ -498,6 +500,7 @@ static int udf_table_prealloc_blocks(struct super_block *sb,
 	struct extent_position epos;
 	int8_t etype = -1;
 	struct udf_inode_info *iinfo;
+	int err = 0;
 
 	if (first_block >= sbi->s_partmaps[partition].s_partition_len)
 		return 0;
@@ -517,12 +520,15 @@ static int udf_table_prealloc_blocks(struct super_block *sb,
 	eloc.logicalBlockNum = 0xFFFFFFFF;
 
 	while (first_block != eloc.logicalBlockNum &&
-	       (etype = udf_next_aext(table, &epos, &eloc, &elen, 1)) != -1) {
+	       !(err = udf_next_aext(table, &epos, &eloc, &elen, &etype, 1))) {
 		udf_debug("eloc=%u, elen=%u, first_block=%u\n",
 			  eloc.logicalBlockNum, elen, first_block);
 		; /* empty loop body */
 	}
 
+	if (UDF_EXT_ERR(err))
+		goto err_out;
+
 	if (first_block == eloc.logicalBlockNum) {
 		epos.offset -= adsize;
 
@@ -539,6 +545,7 @@ static int udf_table_prealloc_blocks(struct super_block *sb,
 		alloc_count = 0;
 	}
 
+err_out:
 	brelse(epos.bh);
 
 	if (alloc_count)
@@ -560,6 +567,7 @@ static udf_pblk_t udf_table_new_block(struct super_block *sb,
 	struct extent_position epos, goal_epos;
 	int8_t etype;
 	struct udf_inode_info *iinfo = UDF_I(table);
+	int ret = 0;
 
 	*err = -ENOSPC;
 
@@ -584,7 +592,7 @@ static udf_pblk_t udf_table_new_block(struct super_block *sb,
 	epos.bh = goal_epos.bh = NULL;
 
 	while (spread &&
-	       (etype = udf_next_aext(table, &epos, &eloc, &elen, 1)) != -1) {
+	       !(ret = udf_next_aext(table, &epos, &eloc, &elen, &etype, 1))) {
 		if (goal >= eloc.logicalBlockNum) {
 			if (goal < eloc.logicalBlockNum +
 					(elen >> sb->s_blocksize_bits))
@@ -612,7 +620,7 @@ static udf_pblk_t udf_table_new_block(struct super_block *sb,
 
 	brelse(epos.bh);
 
-	if (spread == 0xFFFFFFFF) {
+	if (UDF_EXT_ERR(ret) || spread == 0xFFFFFFFF) {
 		brelse(goal_epos.bh);
 		mutex_unlock(&sbi->s_alloc_mutex);
 		return 0;
diff --git a/fs/udf/directory.c b/fs/udf/directory.c
index 93153665eb37..82922a4ae425 100644
--- a/fs/udf/directory.c
+++ b/fs/udf/directory.c
@@ -166,13 +166,19 @@ static struct buffer_head *udf_fiiter_bread_blk(struct udf_fileident_iter *iter)
  */
 static int udf_fiiter_advance_blk(struct udf_fileident_iter *iter)
 {
+	int8_t etype = -1;
+	int err = 0;
+
 	iter->loffset++;
 	if (iter->loffset < DIV_ROUND_UP(iter->elen, 1<<iter->dir->i_blkbits))
 		return 0;
 
 	iter->loffset = 0;
-	if (udf_next_aext(iter->dir, &iter->epos, &iter->eloc, &iter->elen, 1)
-			!= (EXT_RECORDED_ALLOCATED >> 30)) {
+	err = udf_next_aext(iter->dir, &iter->epos, &iter->eloc, &iter->elen,
+			    &etype, 1);
+	if (UDF_EXT_ERR(err))
+		return err;
+	else if (UDF_EXT_EOF(err) || etype != (EXT_RECORDED_ALLOCATED >> 30)) {
 		if (iter->pos == iter->dir->i_size) {
 			iter->elen = 0;
 			return 0;
diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index 3be59aa8d4fd..6c4f104e2bf7 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -545,6 +545,7 @@ static int udf_do_extend_file(struct inode *inode,
 	} else {
 		struct kernel_lb_addr tmploc;
 		uint32_t tmplen;
+		int8_t tmptype;
 
 		udf_write_aext(inode, last_pos, &last_ext->extLocation,
 				last_ext->extLength, 1);
@@ -554,8 +555,12 @@ static int udf_do_extend_file(struct inode *inode,
 		 * more extents, we may need to enter possible following
 		 * empty indirect extent.
 		 */
-		if (new_block_bytes)
-			udf_next_aext(inode, last_pos, &tmploc, &tmplen, 0);
+		if (new_block_bytes) {
+			err = udf_next_aext(inode, last_pos, &tmploc, &tmplen,
+					    &tmptype, 0);
+			if (UDF_EXT_ERR(err))
+				goto out_err;
+		}
 	}
 	iinfo->i_lenExtents += add;
 
@@ -674,8 +679,10 @@ static int udf_extend_file(struct inode *inode, loff_t newsize)
 		extent.extLength = EXT_NOT_RECORDED_NOT_ALLOCATED;
 	} else {
 		epos.offset -= adsize;
-		etype = udf_next_aext(inode, &epos, &extent.extLocation,
-				      &extent.extLength, 0);
+		err = udf_next_aext(inode, &epos, &extent.extLocation,
+				    &extent.extLength, &etype, 0);
+		if (UDF_EXT_ERR(err))
+			goto out;
 		extent.extLength |= etype << 30;
 	}
 
@@ -712,11 +719,11 @@ static int inode_getblk(struct inode *inode, struct udf_map_rq *map)
 	loff_t lbcount = 0, b_off = 0;
 	udf_pblk_t newblocknum;
 	sector_t offset = 0;
-	int8_t etype;
+	int8_t etype, tmpetype;
 	struct udf_inode_info *iinfo = UDF_I(inode);
 	udf_pblk_t goal = 0, pgoal = iinfo->i_location.logicalBlockNum;
 	int lastblock = 0;
-	bool isBeyondEOF;
+	bool isBeyondEOF = false;
 	int ret = 0;
 
 	prev_epos.offset = udf_file_entry_alloc_offset(inode);
@@ -748,9 +755,12 @@ static int inode_getblk(struct inode *inode, struct udf_map_rq *map)
 		prev_epos.offset = cur_epos.offset;
 		cur_epos.offset = next_epos.offset;
 
-		etype = udf_next_aext(inode, &next_epos, &eloc, &elen, 1);
-		if (etype == -1)
+		ret = udf_next_aext(inode, &next_epos, &eloc, &elen, &etype, 1);
+		if (UDF_EXT_EOF(ret)) {
+			isBeyondEOF = true;
 			break;
+		} else if (ret < 0)
+			goto out_free;
 
 		c = !c;
 
@@ -771,8 +781,12 @@ static int inode_getblk(struct inode *inode, struct udf_map_rq *map)
 	 * Move prev_epos and cur_epos into indirect extent if we are at
 	 * the pointer to it
 	 */
-	udf_next_aext(inode, &prev_epos, &tmpeloc, &tmpelen, 0);
-	udf_next_aext(inode, &cur_epos, &tmpeloc, &tmpelen, 0);
+	ret = udf_next_aext(inode, &prev_epos, &tmpeloc, &tmpelen, &tmpetype, 0);
+	if (UDF_EXT_ERR(ret))
+		goto out_free;
+	ret = udf_next_aext(inode, &cur_epos, &tmpeloc, &tmpelen, &tmpetype, 0);
+	if (UDF_EXT_ERR(ret))
+		goto out_free;
 
 	/* if the extent is allocated and recorded, return the block
 	   if the extent is not a multiple of the blocksize, round up */
@@ -793,10 +807,9 @@ static int inode_getblk(struct inode *inode, struct udf_map_rq *map)
 	}
 
 	/* Are we beyond EOF and preallocated extent? */
-	if (etype == -1) {
+	if (isBeyondEOF) {
 		loff_t hole_len;
 
-		isBeyondEOF = true;
 		if (count) {
 			if (c)
 				laarr[0] = laarr[1];
@@ -832,7 +845,6 @@ static int inode_getblk(struct inode *inode, struct udf_map_rq *map)
 		endnum = c + 1;
 		lastblock = 1;
 	} else {
-		isBeyondEOF = false;
 		endnum = startnum = ((count > 2) ? 2 : count);
 
 		/* if the current extent is in position 0,
@@ -846,15 +858,17 @@ static int inode_getblk(struct inode *inode, struct udf_map_rq *map)
 
 		/* if the current block is located in an extent,
 		   read the next extent */
-		etype = udf_next_aext(inode, &next_epos, &eloc, &elen, 0);
-		if (etype != -1) {
+		ret = udf_next_aext(inode, &next_epos, &eloc, &elen, &etype, 0);
+		if (!ret) {
 			laarr[c + 1].extLength = (etype << 30) | elen;
 			laarr[c + 1].extLocation = eloc;
 			count++;
 			startnum++;
 			endnum++;
-		} else
+		} else if (UDF_EXT_EOF(ret))
 			lastblock = 1;
+		else
+			goto out_free;
 	}
 
 	/* if the current extent is not recorded but allocated, get the
@@ -1172,6 +1186,7 @@ static int udf_update_extents(struct inode *inode, struct kernel_long_ad *laarr,
 	int start = 0, i;
 	struct kernel_lb_addr tmploc;
 	uint32_t tmplen;
+	int8_t tmpetype;
 	int err;
 
 	if (startnum > endnum) {
@@ -1189,14 +1204,19 @@ static int udf_update_extents(struct inode *inode, struct kernel_long_ad *laarr,
 			 */
 			if (err < 0)
 				return err;
-			udf_next_aext(inode, epos, &laarr[i].extLocation,
-				      &laarr[i].extLength, 1);
+			err = udf_next_aext(inode, epos, &laarr[i].extLocation,
+				      &laarr[i].extLength, &tmpetype, 1);
+			if (UDF_EXT_ERR(err))
+				return err;
 			start++;
 		}
 	}
 
 	for (i = start; i < endnum; i++) {
-		udf_next_aext(inode, epos, &tmploc, &tmplen, 0);
+		err = udf_next_aext(inode, epos, &tmploc, &tmplen, &tmpetype, 0);
+		if (UDF_EXT_ERR(err))
+			return err;
+
 		udf_write_aext(inode, epos, &laarr[i].extLocation,
 			       laarr[i].extLength, 1);
 	}
@@ -2168,15 +2188,15 @@ void udf_write_aext(struct inode *inode, struct extent_position *epos,
  */
 #define UDF_MAX_INDIR_EXTS 16
 
-int8_t udf_next_aext(struct inode *inode, struct extent_position *epos,
-		     struct kernel_lb_addr *eloc, uint32_t *elen, int inc)
+int udf_next_aext(struct inode *inode, struct extent_position *epos,
+		  struct kernel_lb_addr *eloc, uint32_t *elen, int8_t *etype,
+		  int inc)
 {
-	int8_t etype;
 	unsigned int indirections = 0;
 	int err = 0;
 
-	while ((err = udf_current_aext(inode, epos, eloc, elen, &etype, inc))) {
-		if (err || etype != (EXT_NEXT_EXTENT_ALLOCDESCS >> 30))
+	while ((err = udf_current_aext(inode, epos, eloc, elen, etype, inc))) {
+		if (err || *etype != (EXT_NEXT_EXTENT_ALLOCDESCS >> 30))
 			break;
 
 		udf_pblk_t block;
@@ -2185,7 +2205,7 @@ int8_t udf_next_aext(struct inode *inode, struct extent_position *epos,
 			udf_err(inode->i_sb,
 				"too many indirect extents in inode %lu\n",
 				inode->i_ino);
-			return -1;
+			return -EFSCORRUPTED;
 		}
 
 		epos->block = *eloc;
@@ -2195,11 +2215,11 @@ int8_t udf_next_aext(struct inode *inode, struct extent_position *epos,
 		epos->bh = sb_bread(inode->i_sb, block);
 		if (!epos->bh) {
 			udf_debug("reading block %u failed!\n", block);
-			return -1;
+			return -EIO;
 		}
 	}
 
-	return !err ? etype : -1;
+	return err;
 }
 
 int udf_current_aext(struct inode *inode, struct extent_position *epos,
@@ -2267,12 +2287,14 @@ static int udf_insert_aext(struct inode *inode, struct extent_position epos,
 	if (epos.bh)
 		get_bh(epos.bh);
 
-	while ((etype = udf_next_aext(inode, &epos, &oeloc, &oelen, 0)) != -1) {
+	while (!(err = udf_next_aext(inode, &epos, &oeloc,
+				     &oelen, &etype, 0))) {
 		udf_write_aext(inode, &epos, &neloc, nelen, 1);
 		neloc = oeloc;
 		nelen = (etype << 30) | oelen;
 	}
-	err = udf_add_aext(inode, &epos, &neloc, nelen, 1);
+	if (UDF_EXT_EOF(err))
+		err = udf_add_aext(inode, &epos, &neloc, nelen, 1);
 	brelse(epos.bh);
 
 	return err;
@@ -2287,6 +2309,7 @@ int8_t udf_delete_aext(struct inode *inode, struct extent_position epos)
 	struct udf_inode_info *iinfo;
 	struct kernel_lb_addr eloc;
 	uint32_t elen;
+	int err = 0;
 
 	if (epos.bh) {
 		get_bh(epos.bh);
@@ -2302,10 +2325,11 @@ int8_t udf_delete_aext(struct inode *inode, struct extent_position epos)
 		adsize = 0;
 
 	oepos = epos;
-	if (udf_next_aext(inode, &epos, &eloc, &elen, 1) == -1)
+	err = udf_next_aext(inode, &epos, &eloc, &elen, &etype, 1);
+	if (UDF_EXT_ERR(err))
 		return -1;
 
-	while ((etype = udf_next_aext(inode, &epos, &eloc, &elen, 1)) != -1) {
+	while (!(err = udf_next_aext(inode, &epos, &eloc, &elen, &etype, 1))) {
 		udf_write_aext(inode, &oepos, &eloc, (etype << 30) | elen, 1);
 		if (oepos.bh != epos.bh) {
 			oepos.block = epos.block;
@@ -2315,6 +2339,11 @@ int8_t udf_delete_aext(struct inode *inode, struct extent_position epos)
 			oepos.offset = epos.offset - adsize;
 		}
 	}
+	if (UDF_EXT_ERR(err)) {
+		brelse(epos.bh);
+		brelse(oepos.bh);
+		return -1;
+	}
 	memset(&eloc, 0x00, sizeof(struct kernel_lb_addr));
 	elen = 0;
 
@@ -2370,6 +2399,7 @@ int8_t inode_bmap(struct inode *inode, sector_t block,
 	loff_t lbcount = 0, bcount = (loff_t) block << blocksize_bits;
 	int8_t etype;
 	struct udf_inode_info *iinfo;
+	int err = 0;
 
 	iinfo = UDF_I(inode);
 	if (!udf_read_extent_cache(inode, bcount, &lbcount, pos)) {
@@ -2379,12 +2409,13 @@ int8_t inode_bmap(struct inode *inode, sector_t block,
 	}
 	*elen = 0;
 	do {
-		etype = udf_next_aext(inode, pos, eloc, elen, 1);
-		if (etype == -1) {
+		err = udf_next_aext(inode, pos, eloc, elen, &etype, 1);
+		if (UDF_EXT_EOF(err)) {
 			*offset = (bcount - lbcount) >> blocksize_bits;
 			iinfo->i_lenExtents = lbcount;
-			return -1;
 		}
+		if (err < 0)
+			return -1;
 		lbcount += *elen;
 	} while (lbcount <= bcount);
 	/* update extent cache */
diff --git a/fs/udf/super.c b/fs/udf/super.c
index 3460ecc826d1..8c34224e1aee 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -2482,13 +2482,14 @@ static unsigned int udf_count_free_table(struct super_block *sb,
 	uint32_t elen;
 	struct kernel_lb_addr eloc;
 	struct extent_position epos;
+	int8_t etype;
 
 	mutex_lock(&UDF_SB(sb)->s_alloc_mutex);
 	epos.block = UDF_I(table)->i_location;
 	epos.offset = sizeof(struct unallocSpaceEntry);
 	epos.bh = NULL;
 
-	while (udf_next_aext(table, &epos, &eloc, &elen, 1) != -1)
+	while (!udf_next_aext(table, &epos, &eloc, &elen, &etype, 1))
 		accum += (elen >> table->i_sb->s_blocksize_bits);
 
 	brelse(epos.bh);
diff --git a/fs/udf/truncate.c b/fs/udf/truncate.c
index 16db2613401d..af06f7101859 100644
--- a/fs/udf/truncate.c
+++ b/fs/udf/truncate.c
@@ -69,6 +69,7 @@ void udf_truncate_tail_extent(struct inode *inode)
 	int8_t etype = -1, netype;
 	int adsize;
 	struct udf_inode_info *iinfo = UDF_I(inode);
+	int err = 0;
 
 	if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB ||
 	    inode->i_size == iinfo->i_lenExtents)
@@ -85,7 +86,7 @@ void udf_truncate_tail_extent(struct inode *inode)
 		BUG();
 
 	/* Find the last extent in the file */
-	while ((netype = udf_next_aext(inode, &epos, &eloc, &elen, 1)) != -1) {
+	while (!(err = udf_next_aext(inode, &epos, &eloc, &elen, &netype, 1))) {
 		etype = netype;
 		lbcount += elen;
 		if (lbcount > inode->i_size) {
@@ -101,7 +102,7 @@ void udf_truncate_tail_extent(struct inode *inode)
 			epos.offset -= adsize;
 			extent_trunc(inode, &epos, &eloc, etype, elen, nelen);
 			epos.offset += adsize;
-			if (udf_next_aext(inode, &epos, &eloc, &elen, 1) != -1)
+			if (!udf_next_aext(inode, &epos, &eloc, &elen, &netype, 1))
 				udf_err(inode->i_sb,
 					"Extent after EOF in inode %u\n",
 					(unsigned)inode->i_ino);
@@ -110,7 +111,8 @@ void udf_truncate_tail_extent(struct inode *inode)
 	}
 	/* This inode entry is in-memory only and thus we don't have to mark
 	 * the inode dirty */
-	iinfo->i_lenExtents = inode->i_size;
+	if (UDF_EXT_EOF(err))
+		iinfo->i_lenExtents = inode->i_size;
 	brelse(epos.bh);
 }
 
@@ -124,6 +126,8 @@ void udf_discard_prealloc(struct inode *inode)
 	int8_t etype = -1;
 	struct udf_inode_info *iinfo = UDF_I(inode);
 	int bsize = i_blocksize(inode);
+	int8_t tmpetype = -1;
+	int err = 0;
 
 	if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB ||
 	    ALIGN(inode->i_size, bsize) == ALIGN(iinfo->i_lenExtents, bsize))
@@ -132,16 +136,22 @@ void udf_discard_prealloc(struct inode *inode)
 	epos.block = iinfo->i_location;
 
 	/* Find the last extent in the file */
-	while (udf_next_aext(inode, &epos, &eloc, &elen, 0) != -1) {
+	while (!(err = udf_next_aext(inode, &epos, &eloc, &elen, &tmpetype,
+				     0))) {
 		brelse(prev_epos.bh);
 		prev_epos = epos;
 		if (prev_epos.bh)
 			get_bh(prev_epos.bh);
 
-		etype = udf_next_aext(inode, &epos, &eloc, &elen, 1);
+		err = udf_next_aext(inode, &epos, &eloc, &elen, &etype, 1);
+		if (err < 0)
+			break;
 		lbcount += elen;
 	}
-	if (etype == (EXT_NOT_RECORDED_ALLOCATED >> 30)) {
+	if (UDF_EXT_ERR(err))
+		goto out;
+
+	if (!err && etype == (EXT_NOT_RECORDED_ALLOCATED >> 30)) {
 		lbcount -= elen;
 		udf_delete_aext(inode, prev_epos);
 		udf_free_blocks(inode->i_sb, inode, &eloc, 0,
@@ -150,6 +160,7 @@ void udf_discard_prealloc(struct inode *inode)
 	/* This inode entry is in-memory only and thus we don't have to mark
 	 * the inode dirty */
 	iinfo->i_lenExtents = lbcount;
+out:
 	brelse(epos.bh);
 	brelse(prev_epos.bh);
 }
diff --git a/fs/udf/udfdecl.h b/fs/udf/udfdecl.h
index a902652450dd..206077da9968 100644
--- a/fs/udf/udfdecl.h
+++ b/fs/udf/udfdecl.h
@@ -172,8 +172,9 @@ extern int udf_add_aext(struct inode *, struct extent_position *,
 extern void udf_write_aext(struct inode *, struct extent_position *,
 			   struct kernel_lb_addr *, uint32_t, int);
 extern int8_t udf_delete_aext(struct inode *, struct extent_position);
-extern int8_t udf_next_aext(struct inode *, struct extent_position *,
-			    struct kernel_lb_addr *, uint32_t *, int);
+extern int udf_next_aext(struct inode *inode, struct extent_position *epos,
+			 struct kernel_lb_addr *eloc, uint32_t *elen,
+			 int8_t *etype, int inc);
 extern int udf_current_aext(struct inode *inode, struct extent_position *epos,
 			    struct kernel_lb_addr *eloc, uint32_t *elen,
 			    int8_t *etype, int inc);
-- 
2.43.0

Re: [PATCH v2 2/3] udf: refactor udf_next_aext() to handle error

[Jan Kara]

On Thu 26-09-24 20:07:52, Zhao Mengmeng wrote:
> From: Zhao Mengmeng <zhaomengmeng@kylinos.cn>
> 
> Since udf_current_aext() has error handling, udf_next_aext() should have
> error handling too. Besides, when too many indirect extents found in one
> inode, return -EFSCORRUPTED; when reading block failed, return -EIO.
> 
> Signed-off-by: Zhao Mengmeng <zhaomengmeng@kylinos.cn>
> Suggested-by: Jan Kara <jack@suse.cz>

This patch looks good to me now.

								Honza

> ---
>  fs/udf/balloc.c    | 22 +++++++----
>  fs/udf/directory.c | 10 ++++-
>  fs/udf/inode.c     | 99 ++++++++++++++++++++++++++++++----------------
>  fs/udf/super.c     |  3 +-
>  fs/udf/truncate.c  | 23 ++++++++---
>  fs/udf/udfdecl.h   |  5 ++-
>  6 files changed, 110 insertions(+), 52 deletions(-)
> 
> diff --git a/fs/udf/balloc.c b/fs/udf/balloc.c
> index d8fc11765d61..99cf8fbc805e 100644
> --- a/fs/udf/balloc.c
> +++ b/fs/udf/balloc.c
> @@ -370,6 +370,7 @@ static void udf_table_free_blocks(struct super_block *sb,
>  	struct extent_position oepos, epos;
>  	int8_t etype;
>  	struct udf_inode_info *iinfo;
> +	int err = 0;
>  
>  	mutex_lock(&sbi->s_alloc_mutex);
>  	iinfo = UDF_I(table);
> @@ -384,7 +385,7 @@ static void udf_table_free_blocks(struct super_block *sb,
>  	epos.bh = oepos.bh = NULL;
>  
>  	while (count &&
> -	       (etype = udf_next_aext(table, &epos, &eloc, &elen, 1)) != -1) {
> +	       !(err = udf_next_aext(table, &epos, &eloc, &elen, &etype, 1))) {
>  		if (((eloc.logicalBlockNum +
>  			(elen >> sb->s_blocksize_bits)) == start)) {
>  			if ((0x3FFFFFFF - elen) <
> @@ -435,6 +436,9 @@ static void udf_table_free_blocks(struct super_block *sb,
>  		}
>  	}
>  
> +	if (UDF_EXT_ERR(err))
> +		goto error_return;
> +
>  	if (count) {
>  		/*
>  		 * NOTE: we CANNOT use udf_add_aext here, as it can try to
> @@ -460,8 +464,6 @@ static void udf_table_free_blocks(struct super_block *sb,
>  		else if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_LONG)
>  			adsize = sizeof(struct long_ad);
>  		else {
> -			brelse(oepos.bh);
> -			brelse(epos.bh);
>  			goto error_return;
>  		}
>  
> @@ -479,10 +481,10 @@ static void udf_table_free_blocks(struct super_block *sb,
>  			__udf_add_aext(table, &epos, &eloc, elen, 1);
>  	}
>  
> +error_return:
>  	brelse(epos.bh);
>  	brelse(oepos.bh);
>  
> -error_return:
>  	mutex_unlock(&sbi->s_alloc_mutex);
>  	return;
>  }
> @@ -498,6 +500,7 @@ static int udf_table_prealloc_blocks(struct super_block *sb,
>  	struct extent_position epos;
>  	int8_t etype = -1;
>  	struct udf_inode_info *iinfo;
> +	int err = 0;
>  
>  	if (first_block >= sbi->s_partmaps[partition].s_partition_len)
>  		return 0;
> @@ -517,12 +520,15 @@ static int udf_table_prealloc_blocks(struct super_block *sb,
>  	eloc.logicalBlockNum = 0xFFFFFFFF;
>  
>  	while (first_block != eloc.logicalBlockNum &&
> -	       (etype = udf_next_aext(table, &epos, &eloc, &elen, 1)) != -1) {
> +	       !(err = udf_next_aext(table, &epos, &eloc, &elen, &etype, 1))) {
>  		udf_debug("eloc=%u, elen=%u, first_block=%u\n",
>  			  eloc.logicalBlockNum, elen, first_block);
>  		; /* empty loop body */
>  	}
>  
> +	if (UDF_EXT_ERR(err))
> +		goto err_out;
> +
>  	if (first_block == eloc.logicalBlockNum) {
>  		epos.offset -= adsize;
>  
> @@ -539,6 +545,7 @@ static int udf_table_prealloc_blocks(struct super_block *sb,
>  		alloc_count = 0;
>  	}
>  
> +err_out:
>  	brelse(epos.bh);
>  
>  	if (alloc_count)
> @@ -560,6 +567,7 @@ static udf_pblk_t udf_table_new_block(struct super_block *sb,
>  	struct extent_position epos, goal_epos;
>  	int8_t etype;
>  	struct udf_inode_info *iinfo = UDF_I(table);
> +	int ret = 0;
>  
>  	*err = -ENOSPC;
>  
> @@ -584,7 +592,7 @@ static udf_pblk_t udf_table_new_block(struct super_block *sb,
>  	epos.bh = goal_epos.bh = NULL;
>  
>  	while (spread &&
> -	       (etype = udf_next_aext(table, &epos, &eloc, &elen, 1)) != -1) {
> +	       !(ret = udf_next_aext(table, &epos, &eloc, &elen, &etype, 1))) {
>  		if (goal >= eloc.logicalBlockNum) {
>  			if (goal < eloc.logicalBlockNum +
>  					(elen >> sb->s_blocksize_bits))
> @@ -612,7 +620,7 @@ static udf_pblk_t udf_table_new_block(struct super_block *sb,
>  
>  	brelse(epos.bh);
>  
> -	if (spread == 0xFFFFFFFF) {
> +	if (UDF_EXT_ERR(ret) || spread == 0xFFFFFFFF) {
>  		brelse(goal_epos.bh);
>  		mutex_unlock(&sbi->s_alloc_mutex);
>  		return 0;
> diff --git a/fs/udf/directory.c b/fs/udf/directory.c
> index 93153665eb37..82922a4ae425 100644
> --- a/fs/udf/directory.c
> +++ b/fs/udf/directory.c
> @@ -166,13 +166,19 @@ static struct buffer_head *udf_fiiter_bread_blk(struct udf_fileident_iter *iter)
>   */
>  static int udf_fiiter_advance_blk(struct udf_fileident_iter *iter)
>  {
> +	int8_t etype = -1;
> +	int err = 0;
> +
>  	iter->loffset++;
>  	if (iter->loffset < DIV_ROUND_UP(iter->elen, 1<<iter->dir->i_blkbits))
>  		return 0;
>  
>  	iter->loffset = 0;
> -	if (udf_next_aext(iter->dir, &iter->epos, &iter->eloc, &iter->elen, 1)
> -			!= (EXT_RECORDED_ALLOCATED >> 30)) {
> +	err = udf_next_aext(iter->dir, &iter->epos, &iter->eloc, &iter->elen,
> +			    &etype, 1);
> +	if (UDF_EXT_ERR(err))
> +		return err;
> +	else if (UDF_EXT_EOF(err) || etype != (EXT_RECORDED_ALLOCATED >> 30)) {
>  		if (iter->pos == iter->dir->i_size) {
>  			iter->elen = 0;
>  			return 0;
> diff --git a/fs/udf/inode.c b/fs/udf/inode.c
> index 3be59aa8d4fd..6c4f104e2bf7 100644
> --- a/fs/udf/inode.c
> +++ b/fs/udf/inode.c
> @@ -545,6 +545,7 @@ static int udf_do_extend_file(struct inode *inode,
>  	} else {
>  		struct kernel_lb_addr tmploc;
>  		uint32_t tmplen;
> +		int8_t tmptype;
>  
>  		udf_write_aext(inode, last_pos, &last_ext->extLocation,
>  				last_ext->extLength, 1);
> @@ -554,8 +555,12 @@ static int udf_do_extend_file(struct inode *inode,
>  		 * more extents, we may need to enter possible following
>  		 * empty indirect extent.
>  		 */
> -		if (new_block_bytes)
> -			udf_next_aext(inode, last_pos, &tmploc, &tmplen, 0);
> +		if (new_block_bytes) {
> +			err = udf_next_aext(inode, last_pos, &tmploc, &tmplen,
> +					    &tmptype, 0);
> +			if (UDF_EXT_ERR(err))
> +				goto out_err;
> +		}
>  	}
>  	iinfo->i_lenExtents += add;
>  
> @@ -674,8 +679,10 @@ static int udf_extend_file(struct inode *inode, loff_t newsize)
>  		extent.extLength = EXT_NOT_RECORDED_NOT_ALLOCATED;
>  	} else {
>  		epos.offset -= adsize;
> -		etype = udf_next_aext(inode, &epos, &extent.extLocation,
> -				      &extent.extLength, 0);
> +		err = udf_next_aext(inode, &epos, &extent.extLocation,
> +				    &extent.extLength, &etype, 0);
> +		if (UDF_EXT_ERR(err))
> +			goto out;
>  		extent.extLength |= etype << 30;
>  	}
>  
> @@ -712,11 +719,11 @@ static int inode_getblk(struct inode *inode, struct udf_map_rq *map)
>  	loff_t lbcount = 0, b_off = 0;
>  	udf_pblk_t newblocknum;
>  	sector_t offset = 0;
> -	int8_t etype;
> +	int8_t etype, tmpetype;
>  	struct udf_inode_info *iinfo = UDF_I(inode);
>  	udf_pblk_t goal = 0, pgoal = iinfo->i_location.logicalBlockNum;
>  	int lastblock = 0;
> -	bool isBeyondEOF;
> +	bool isBeyondEOF = false;
>  	int ret = 0;
>  
>  	prev_epos.offset = udf_file_entry_alloc_offset(inode);
> @@ -748,9 +755,12 @@ static int inode_getblk(struct inode *inode, struct udf_map_rq *map)
>  		prev_epos.offset = cur_epos.offset;
>  		cur_epos.offset = next_epos.offset;
>  
> -		etype = udf_next_aext(inode, &next_epos, &eloc, &elen, 1);
> -		if (etype == -1)
> +		ret = udf_next_aext(inode, &next_epos, &eloc, &elen, &etype, 1);
> +		if (UDF_EXT_EOF(ret)) {
> +			isBeyondEOF = true;
>  			break;
> +		} else if (ret < 0)
> +			goto out_free;
>  
>  		c = !c;
>  
> @@ -771,8 +781,12 @@ static int inode_getblk(struct inode *inode, struct udf_map_rq *map)
>  	 * Move prev_epos and cur_epos into indirect extent if we are at
>  	 * the pointer to it
>  	 */
> -	udf_next_aext(inode, &prev_epos, &tmpeloc, &tmpelen, 0);
> -	udf_next_aext(inode, &cur_epos, &tmpeloc, &tmpelen, 0);
> +	ret = udf_next_aext(inode, &prev_epos, &tmpeloc, &tmpelen, &tmpetype, 0);
> +	if (UDF_EXT_ERR(ret))
> +		goto out_free;
> +	ret = udf_next_aext(inode, &cur_epos, &tmpeloc, &tmpelen, &tmpetype, 0);
> +	if (UDF_EXT_ERR(ret))
> +		goto out_free;
>  
>  	/* if the extent is allocated and recorded, return the block
>  	   if the extent is not a multiple of the blocksize, round up */
> @@ -793,10 +807,9 @@ static int inode_getblk(struct inode *inode, struct udf_map_rq *map)
>  	}
>  
>  	/* Are we beyond EOF and preallocated extent? */
> -	if (etype == -1) {
> +	if (isBeyondEOF) {
>  		loff_t hole_len;
>  
> -		isBeyondEOF = true;
>  		if (count) {
>  			if (c)
>  				laarr[0] = laarr[1];
> @@ -832,7 +845,6 @@ static int inode_getblk(struct inode *inode, struct udf_map_rq *map)
>  		endnum = c + 1;
>  		lastblock = 1;
>  	} else {
> -		isBeyondEOF = false;
>  		endnum = startnum = ((count > 2) ? 2 : count);
>  
>  		/* if the current extent is in position 0,
> @@ -846,15 +858,17 @@ static int inode_getblk(struct inode *inode, struct udf_map_rq *map)
>  
>  		/* if the current block is located in an extent,
>  		   read the next extent */
> -		etype = udf_next_aext(inode, &next_epos, &eloc, &elen, 0);
> -		if (etype != -1) {
> +		ret = udf_next_aext(inode, &next_epos, &eloc, &elen, &etype, 0);
> +		if (!ret) {
>  			laarr[c + 1].extLength = (etype << 30) | elen;
>  			laarr[c + 1].extLocation = eloc;
>  			count++;
>  			startnum++;
>  			endnum++;
> -		} else
> +		} else if (UDF_EXT_EOF(ret))
>  			lastblock = 1;
> +		else
> +			goto out_free;
>  	}
>  
>  	/* if the current extent is not recorded but allocated, get the
> @@ -1172,6 +1186,7 @@ static int udf_update_extents(struct inode *inode, struct kernel_long_ad *laarr,
>  	int start = 0, i;
>  	struct kernel_lb_addr tmploc;
>  	uint32_t tmplen;
> +	int8_t tmpetype;
>  	int err;
>  
>  	if (startnum > endnum) {
> @@ -1189,14 +1204,19 @@ static int udf_update_extents(struct inode *inode, struct kernel_long_ad *laarr,
>  			 */
>  			if (err < 0)
>  				return err;
> -			udf_next_aext(inode, epos, &laarr[i].extLocation,
> -				      &laarr[i].extLength, 1);
> +			err = udf_next_aext(inode, epos, &laarr[i].extLocation,
> +				      &laarr[i].extLength, &tmpetype, 1);
> +			if (UDF_EXT_ERR(err))
> +				return err;
>  			start++;
>  		}
>  	}
>  
>  	for (i = start; i < endnum; i++) {
> -		udf_next_aext(inode, epos, &tmploc, &tmplen, 0);
> +		err = udf_next_aext(inode, epos, &tmploc, &tmplen, &tmpetype, 0);
> +		if (UDF_EXT_ERR(err))
> +			return err;
> +
>  		udf_write_aext(inode, epos, &laarr[i].extLocation,
>  			       laarr[i].extLength, 1);
>  	}
> @@ -2168,15 +2188,15 @@ void udf_write_aext(struct inode *inode, struct extent_position *epos,
>   */
>  #define UDF_MAX_INDIR_EXTS 16
>  
> -int8_t udf_next_aext(struct inode *inode, struct extent_position *epos,
> -		     struct kernel_lb_addr *eloc, uint32_t *elen, int inc)
> +int udf_next_aext(struct inode *inode, struct extent_position *epos,
> +		  struct kernel_lb_addr *eloc, uint32_t *elen, int8_t *etype,
> +		  int inc)
>  {
> -	int8_t etype;
>  	unsigned int indirections = 0;
>  	int err = 0;
>  
> -	while ((err = udf_current_aext(inode, epos, eloc, elen, &etype, inc))) {
> -		if (err || etype != (EXT_NEXT_EXTENT_ALLOCDESCS >> 30))
> +	while ((err = udf_current_aext(inode, epos, eloc, elen, etype, inc))) {
> +		if (err || *etype != (EXT_NEXT_EXTENT_ALLOCDESCS >> 30))
>  			break;
>  
>  		udf_pblk_t block;
> @@ -2185,7 +2205,7 @@ int8_t udf_next_aext(struct inode *inode, struct extent_position *epos,
>  			udf_err(inode->i_sb,
>  				"too many indirect extents in inode %lu\n",
>  				inode->i_ino);
> -			return -1;
> +			return -EFSCORRUPTED;
>  		}
>  
>  		epos->block = *eloc;
> @@ -2195,11 +2215,11 @@ int8_t udf_next_aext(struct inode *inode, struct extent_position *epos,
>  		epos->bh = sb_bread(inode->i_sb, block);
>  		if (!epos->bh) {
>  			udf_debug("reading block %u failed!\n", block);
> -			return -1;
> +			return -EIO;
>  		}
>  	}
>  
> -	return !err ? etype : -1;
> +	return err;
>  }
>  
>  int udf_current_aext(struct inode *inode, struct extent_position *epos,
> @@ -2267,12 +2287,14 @@ static int udf_insert_aext(struct inode *inode, struct extent_position epos,
>  	if (epos.bh)
>  		get_bh(epos.bh);
>  
> -	while ((etype = udf_next_aext(inode, &epos, &oeloc, &oelen, 0)) != -1) {
> +	while (!(err = udf_next_aext(inode, &epos, &oeloc,
> +				     &oelen, &etype, 0))) {
>  		udf_write_aext(inode, &epos, &neloc, nelen, 1);
>  		neloc = oeloc;
>  		nelen = (etype << 30) | oelen;
>  	}
> -	err = udf_add_aext(inode, &epos, &neloc, nelen, 1);
> +	if (UDF_EXT_EOF(err))
> +		err = udf_add_aext(inode, &epos, &neloc, nelen, 1);
>  	brelse(epos.bh);
>  
>  	return err;
> @@ -2287,6 +2309,7 @@ int8_t udf_delete_aext(struct inode *inode, struct extent_position epos)
>  	struct udf_inode_info *iinfo;
>  	struct kernel_lb_addr eloc;
>  	uint32_t elen;
> +	int err = 0;
>  
>  	if (epos.bh) {
>  		get_bh(epos.bh);
> @@ -2302,10 +2325,11 @@ int8_t udf_delete_aext(struct inode *inode, struct extent_position epos)
>  		adsize = 0;
>  
>  	oepos = epos;
> -	if (udf_next_aext(inode, &epos, &eloc, &elen, 1) == -1)
> +	err = udf_next_aext(inode, &epos, &eloc, &elen, &etype, 1);
> +	if (UDF_EXT_ERR(err))
>  		return -1;
>  
> -	while ((etype = udf_next_aext(inode, &epos, &eloc, &elen, 1)) != -1) {
> +	while (!(err = udf_next_aext(inode, &epos, &eloc, &elen, &etype, 1))) {
>  		udf_write_aext(inode, &oepos, &eloc, (etype << 30) | elen, 1);
>  		if (oepos.bh != epos.bh) {
>  			oepos.block = epos.block;
> @@ -2315,6 +2339,11 @@ int8_t udf_delete_aext(struct inode *inode, struct extent_position epos)
>  			oepos.offset = epos.offset - adsize;
>  		}
>  	}
> +	if (UDF_EXT_ERR(err)) {
> +		brelse(epos.bh);
> +		brelse(oepos.bh);
> +		return -1;
> +	}
>  	memset(&eloc, 0x00, sizeof(struct kernel_lb_addr));
>  	elen = 0;
>  
> @@ -2370,6 +2399,7 @@ int8_t inode_bmap(struct inode *inode, sector_t block,
>  	loff_t lbcount = 0, bcount = (loff_t) block << blocksize_bits;
>  	int8_t etype;
>  	struct udf_inode_info *iinfo;
> +	int err = 0;
>  
>  	iinfo = UDF_I(inode);
>  	if (!udf_read_extent_cache(inode, bcount, &lbcount, pos)) {
> @@ -2379,12 +2409,13 @@ int8_t inode_bmap(struct inode *inode, sector_t block,
>  	}
>  	*elen = 0;
>  	do {
> -		etype = udf_next_aext(inode, pos, eloc, elen, 1);
> -		if (etype == -1) {
> +		err = udf_next_aext(inode, pos, eloc, elen, &etype, 1);
> +		if (UDF_EXT_EOF(err)) {
>  			*offset = (bcount - lbcount) >> blocksize_bits;
>  			iinfo->i_lenExtents = lbcount;
> -			return -1;
>  		}
> +		if (err < 0)
> +			return -1;
>  		lbcount += *elen;
>  	} while (lbcount <= bcount);
>  	/* update extent cache */
> diff --git a/fs/udf/super.c b/fs/udf/super.c
> index 3460ecc826d1..8c34224e1aee 100644
> --- a/fs/udf/super.c
> +++ b/fs/udf/super.c
> @@ -2482,13 +2482,14 @@ static unsigned int udf_count_free_table(struct super_block *sb,
>  	uint32_t elen;
>  	struct kernel_lb_addr eloc;
>  	struct extent_position epos;
> +	int8_t etype;
>  
>  	mutex_lock(&UDF_SB(sb)->s_alloc_mutex);
>  	epos.block = UDF_I(table)->i_location;
>  	epos.offset = sizeof(struct unallocSpaceEntry);
>  	epos.bh = NULL;
>  
> -	while (udf_next_aext(table, &epos, &eloc, &elen, 1) != -1)
> +	while (!udf_next_aext(table, &epos, &eloc, &elen, &etype, 1))
>  		accum += (elen >> table->i_sb->s_blocksize_bits);
>  
>  	brelse(epos.bh);
> diff --git a/fs/udf/truncate.c b/fs/udf/truncate.c
> index 16db2613401d..af06f7101859 100644
> --- a/fs/udf/truncate.c
> +++ b/fs/udf/truncate.c
> @@ -69,6 +69,7 @@ void udf_truncate_tail_extent(struct inode *inode)
>  	int8_t etype = -1, netype;
>  	int adsize;
>  	struct udf_inode_info *iinfo = UDF_I(inode);
> +	int err = 0;
>  
>  	if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB ||
>  	    inode->i_size == iinfo->i_lenExtents)
> @@ -85,7 +86,7 @@ void udf_truncate_tail_extent(struct inode *inode)
>  		BUG();
>  
>  	/* Find the last extent in the file */
> -	while ((netype = udf_next_aext(inode, &epos, &eloc, &elen, 1)) != -1) {
> +	while (!(err = udf_next_aext(inode, &epos, &eloc, &elen, &netype, 1))) {
>  		etype = netype;
>  		lbcount += elen;
>  		if (lbcount > inode->i_size) {
> @@ -101,7 +102,7 @@ void udf_truncate_tail_extent(struct inode *inode)
>  			epos.offset -= adsize;
>  			extent_trunc(inode, &epos, &eloc, etype, elen, nelen);
>  			epos.offset += adsize;
> -			if (udf_next_aext(inode, &epos, &eloc, &elen, 1) != -1)
> +			if (!udf_next_aext(inode, &epos, &eloc, &elen, &netype, 1))
>  				udf_err(inode->i_sb,
>  					"Extent after EOF in inode %u\n",
>  					(unsigned)inode->i_ino);
> @@ -110,7 +111,8 @@ void udf_truncate_tail_extent(struct inode *inode)
>  	}
>  	/* This inode entry is in-memory only and thus we don't have to mark
>  	 * the inode dirty */
> -	iinfo->i_lenExtents = inode->i_size;
> +	if (UDF_EXT_EOF(err))
> +		iinfo->i_lenExtents = inode->i_size;
>  	brelse(epos.bh);
>  }
>  
> @@ -124,6 +126,8 @@ void udf_discard_prealloc(struct inode *inode)
>  	int8_t etype = -1;
>  	struct udf_inode_info *iinfo = UDF_I(inode);
>  	int bsize = i_blocksize(inode);
> +	int8_t tmpetype = -1;
> +	int err = 0;
>  
>  	if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB ||
>  	    ALIGN(inode->i_size, bsize) == ALIGN(iinfo->i_lenExtents, bsize))
> @@ -132,16 +136,22 @@ void udf_discard_prealloc(struct inode *inode)
>  	epos.block = iinfo->i_location;
>  
>  	/* Find the last extent in the file */
> -	while (udf_next_aext(inode, &epos, &eloc, &elen, 0) != -1) {
> +	while (!(err = udf_next_aext(inode, &epos, &eloc, &elen, &tmpetype,
> +				     0))) {
>  		brelse(prev_epos.bh);
>  		prev_epos = epos;
>  		if (prev_epos.bh)
>  			get_bh(prev_epos.bh);
>  
> -		etype = udf_next_aext(inode, &epos, &eloc, &elen, 1);
> +		err = udf_next_aext(inode, &epos, &eloc, &elen, &etype, 1);
> +		if (err < 0)
> +			break;
>  		lbcount += elen;
>  	}
> -	if (etype == (EXT_NOT_RECORDED_ALLOCATED >> 30)) {
> +	if (UDF_EXT_ERR(err))
> +		goto out;
> +
> +	if (!err && etype == (EXT_NOT_RECORDED_ALLOCATED >> 30)) {
>  		lbcount -= elen;
>  		udf_delete_aext(inode, prev_epos);
>  		udf_free_blocks(inode->i_sb, inode, &eloc, 0,
> @@ -150,6 +160,7 @@ void udf_discard_prealloc(struct inode *inode)
>  	/* This inode entry is in-memory only and thus we don't have to mark
>  	 * the inode dirty */
>  	iinfo->i_lenExtents = lbcount;
> +out:
>  	brelse(epos.bh);
>  	brelse(prev_epos.bh);
>  }
> diff --git a/fs/udf/udfdecl.h b/fs/udf/udfdecl.h
> index a902652450dd..206077da9968 100644
> --- a/fs/udf/udfdecl.h
> +++ b/fs/udf/udfdecl.h
> @@ -172,8 +172,9 @@ extern int udf_add_aext(struct inode *, struct extent_position *,
>  extern void udf_write_aext(struct inode *, struct extent_position *,
>  			   struct kernel_lb_addr *, uint32_t, int);
>  extern int8_t udf_delete_aext(struct inode *, struct extent_position);
> -extern int8_t udf_next_aext(struct inode *, struct extent_position *,
> -			    struct kernel_lb_addr *, uint32_t *, int);
> +extern int udf_next_aext(struct inode *inode, struct extent_position *epos,
> +			 struct kernel_lb_addr *eloc, uint32_t *elen,
> +			 int8_t *etype, int inc);
>  extern int udf_current_aext(struct inode *inode, struct extent_position *epos,
>  			    struct kernel_lb_addr *eloc, uint32_t *elen,
>  			    int8_t *etype, int inc);
> -- 
> 2.43.0
> 
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR

[PATCH v2 3/3] udf: refactor inode_bmap() to handle error

[Zhao Mengmeng]

From: Zhao Mengmeng <zhaomengmeng@kylinos.cn>

Refactor inode_bmap() to handle error since udf_next_aext() can return
error now. On situations like ftruncate, udf_extend_file() can now
detect errors and bail out early without resorting to checking for
particular offsets and assuming internal behavior of these functions.

Reported-by: syzbot+7a4842f0b1801230a989@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7a4842f0b1801230a989
Tested-by: syzbot+7a4842f0b1801230a989@syzkaller.appspotmail.com
Signed-off-by: Zhao Mengmeng <zhaomengmeng@kylinos.cn>
Suggested-by: Jan Kara <jack@suse.cz>
---
 fs/udf/directory.c | 13 ++++++++-----
 fs/udf/inode.c     | 29 ++++++++++++++++++-----------
 fs/udf/partition.c |  6 ++++--
 fs/udf/truncate.c  |  8 +++++---
 fs/udf/udfdecl.h   |  5 +++--
 5 files changed, 38 insertions(+), 23 deletions(-)

diff --git a/fs/udf/directory.c b/fs/udf/directory.c
index 82922a4ae425..4b8bb77eaffa 100644
--- a/fs/udf/directory.c
+++ b/fs/udf/directory.c
@@ -246,6 +246,7 @@ int udf_fiiter_init(struct udf_fileident_iter *iter, struct inode *dir,
 {
 	struct udf_inode_info *iinfo = UDF_I(dir);
 	int err = 0;
+	int8_t etype;
 
 	iter->dir = dir;
 	iter->bh[0] = iter->bh[1] = NULL;
@@ -265,9 +266,9 @@ int udf_fiiter_init(struct udf_fileident_iter *iter, struct inode *dir,
 		goto out;
 	}
 
-	if (inode_bmap(dir, iter->pos >> dir->i_blkbits, &iter->epos,
-		       &iter->eloc, &iter->elen, &iter->loffset) !=
-	    (EXT_RECORDED_ALLOCATED >> 30)) {
+	err = inode_bmap(dir, iter->pos >> dir->i_blkbits, &iter->epos, &iter->eloc,
+		   &iter->elen, &iter->loffset, &etype);
+	if (err || etype != (EXT_RECORDED_ALLOCATED >> 30)) {
 		if (pos == dir->i_size)
 			return 0;
 		udf_err(dir->i_sb,
@@ -463,6 +464,7 @@ int udf_fiiter_append_blk(struct udf_fileident_iter *iter)
 	sector_t block;
 	uint32_t old_elen = iter->elen;
 	int err;
+	int8_t etype;
 
 	if (WARN_ON_ONCE(iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB))
 		return -EINVAL;
@@ -477,8 +479,9 @@ int udf_fiiter_append_blk(struct udf_fileident_iter *iter)
 		udf_fiiter_update_elen(iter, old_elen);
 		return err;
 	}
-	if (inode_bmap(iter->dir, block, &iter->epos, &iter->eloc, &iter->elen,
-		       &iter->loffset) != (EXT_RECORDED_ALLOCATED >> 30)) {
+	err = inode_bmap(iter->dir, block, &iter->epos, &iter->eloc, &iter->elen,
+		   &iter->loffset, &etype);
+	if (err || etype != (EXT_RECORDED_ALLOCATED >> 30)) {
 		udf_err(iter->dir->i_sb,
 			"block %llu not allocated in directory (ino %lu)\n",
 			(unsigned long long)block, iter->dir->i_ino);
diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index 6c4f104e2bf7..be9356f0eecf 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -418,10 +418,11 @@ static int udf_map_block(struct inode *inode, struct udf_map_rq *map)
 		uint32_t elen;
 		sector_t offset;
 		struct extent_position epos = {};
+		int8_t etype;
 
 		down_read(&iinfo->i_data_sem);
-		if (inode_bmap(inode, map->lblk, &epos, &eloc, &elen, &offset)
-				== (EXT_RECORDED_ALLOCATED >> 30)) {
+		err = inode_bmap(inode, map->lblk, &epos, &eloc, &elen, &offset, &etype);
+		if (!err && etype == (EXT_RECORDED_ALLOCATED >> 30)) {
 			map->pblk = udf_get_lb_pblock(inode->i_sb, &eloc,
 							offset);
 			map->oflags |= UDF_BLK_MAPPED;
@@ -664,8 +665,10 @@ static int udf_extend_file(struct inode *inode, loff_t newsize)
 	 */
 	udf_discard_prealloc(inode);
 
-	etype = inode_bmap(inode, first_block, &epos, &eloc, &elen, &offset);
-	within_last_ext = (etype != -1);
+	err = inode_bmap(inode, first_block, &epos, &eloc, &elen, &offset, &etype);
+	if (UDF_EXT_ERR(err))
+		goto out;
+	within_last_ext = (!err);
 	/* We don't expect extents past EOF... */
 	WARN_ON_ONCE(within_last_ext &&
 		     elen > ((loff_t)offset + 1) << inode->i_blkbits);
@@ -2391,13 +2394,17 @@ int8_t udf_delete_aext(struct inode *inode, struct extent_position epos)
 	return (elen >> 30);
 }
 
-int8_t inode_bmap(struct inode *inode, sector_t block,
-		  struct extent_position *pos, struct kernel_lb_addr *eloc,
-		  uint32_t *elen, sector_t *offset)
+/*
+ * return 0 when iudf_next_aext() loop success.
+ * return err < 0 and err != -ENODATA indicates error.
+ * return err == -ENODATA indicates hit EOF.
+ */
+int inode_bmap(struct inode *inode, sector_t block, struct extent_position *pos,
+	       struct kernel_lb_addr *eloc, uint32_t *elen, sector_t *offset,
+	       int8_t *etype)
 {
 	unsigned char blocksize_bits = inode->i_sb->s_blocksize_bits;
 	loff_t lbcount = 0, bcount = (loff_t) block << blocksize_bits;
-	int8_t etype;
 	struct udf_inode_info *iinfo;
 	int err = 0;
 
@@ -2409,18 +2416,18 @@ int8_t inode_bmap(struct inode *inode, sector_t block,
 	}
 	*elen = 0;
 	do {
-		err = udf_next_aext(inode, pos, eloc, elen, &etype, 1);
+		err = udf_next_aext(inode, pos, eloc, elen, etype, 1);
 		if (UDF_EXT_EOF(err)) {
 			*offset = (bcount - lbcount) >> blocksize_bits;
 			iinfo->i_lenExtents = lbcount;
 		}
 		if (err < 0)
-			return -1;
+			return err;
 		lbcount += *elen;
 	} while (lbcount <= bcount);
 	/* update extent cache */
 	udf_update_extent_cache(inode, lbcount - *elen, pos);
 	*offset = (bcount + *elen - lbcount) >> blocksize_bits;
 
-	return etype;
+	return 0;
 }
diff --git a/fs/udf/partition.c b/fs/udf/partition.c
index af877991edc1..c441d4ae1f96 100644
--- a/fs/udf/partition.c
+++ b/fs/udf/partition.c
@@ -282,9 +282,11 @@ static uint32_t udf_try_read_meta(struct inode *inode, uint32_t block,
 	sector_t ext_offset;
 	struct extent_position epos = {};
 	uint32_t phyblock;
+	int8_t etype;
+	int err = 0;
 
-	if (inode_bmap(inode, block, &epos, &eloc, &elen, &ext_offset) !=
-						(EXT_RECORDED_ALLOCATED >> 30))
+	err = inode_bmap(inode, block, &epos, &eloc, &elen, &ext_offset, &etype);
+	if (err || etype != (EXT_RECORDED_ALLOCATED >> 30))
 		phyblock = 0xFFFFFFFF;
 	else {
 		map = &UDF_SB(sb)->s_partmaps[partition];
diff --git a/fs/udf/truncate.c b/fs/udf/truncate.c
index af06f7101859..d13ba9fd1309 100644
--- a/fs/udf/truncate.c
+++ b/fs/udf/truncate.c
@@ -208,10 +208,12 @@ int udf_truncate_extents(struct inode *inode)
 	else
 		BUG();
 
-	etype = inode_bmap(inode, first_block, &epos, &eloc, &elen, &offset);
+	err = inode_bmap(inode, first_block, &epos, &eloc, &elen, &offset, &etype);
 	byte_offset = (offset << sb->s_blocksize_bits) +
-		(inode->i_size & (sb->s_blocksize - 1));
-	if (etype == -1) {
+		      (inode->i_size & (sb->s_blocksize - 1));
+	if (UDF_EXT_ERR(err))
+		return err;
+	if (UDF_EXT_EOF(err)) {
 		/* We should extend the file? */
 		WARN_ON(byte_offset);
 		return 0;
diff --git a/fs/udf/udfdecl.h b/fs/udf/udfdecl.h
index 206077da9968..a156ed95189a 100644
--- a/fs/udf/udfdecl.h
+++ b/fs/udf/udfdecl.h
@@ -160,8 +160,9 @@ extern struct buffer_head *udf_bread(struct inode *inode, udf_pblk_t block,
 extern int udf_setsize(struct inode *, loff_t);
 extern void udf_evict_inode(struct inode *);
 extern int udf_write_inode(struct inode *, struct writeback_control *wbc);
-extern int8_t inode_bmap(struct inode *, sector_t, struct extent_position *,
-			 struct kernel_lb_addr *, uint32_t *, sector_t *);
+extern int inode_bmap(struct inode *inode, sector_t block,
+		      struct extent_position *pos, struct kernel_lb_addr *eloc,
+		      uint32_t *elen, sector_t *offset, int8_t *etype);
 int udf_get_block(struct inode *, sector_t, struct buffer_head *, int);
 extern int udf_setup_indirect_aext(struct inode *inode, udf_pblk_t block,
 				   struct extent_position *epos);
-- 
2.43.0

Re: [PATCH v2 3/3] udf: refactor inode_bmap() to handle error

[Jan Kara]

On Thu 26-09-24 20:07:53, Zhao Mengmeng wrote:
> From: Zhao Mengmeng <zhaomengmeng@kylinos.cn>
> 
> Refactor inode_bmap() to handle error since udf_next_aext() can return
> error now. On situations like ftruncate, udf_extend_file() can now
> detect errors and bail out early without resorting to checking for
> particular offsets and assuming internal behavior of these functions.
> 
> Reported-by: syzbot+7a4842f0b1801230a989@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=7a4842f0b1801230a989
> Tested-by: syzbot+7a4842f0b1801230a989@syzkaller.appspotmail.com
> Signed-off-by: Zhao Mengmeng <zhaomengmeng@kylinos.cn>
> Suggested-by: Jan Kara <jack@suse.cz>

This patch looks good to me now too. Thanks!

								Honza

> ---
>  fs/udf/directory.c | 13 ++++++++-----
>  fs/udf/inode.c     | 29 ++++++++++++++++++-----------
>  fs/udf/partition.c |  6 ++++--
>  fs/udf/truncate.c  |  8 +++++---
>  fs/udf/udfdecl.h   |  5 +++--
>  5 files changed, 38 insertions(+), 23 deletions(-)
> 
> diff --git a/fs/udf/directory.c b/fs/udf/directory.c
> index 82922a4ae425..4b8bb77eaffa 100644
> --- a/fs/udf/directory.c
> +++ b/fs/udf/directory.c
> @@ -246,6 +246,7 @@ int udf_fiiter_init(struct udf_fileident_iter *iter, struct inode *dir,
>  {
>  	struct udf_inode_info *iinfo = UDF_I(dir);
>  	int err = 0;
> +	int8_t etype;
>  
>  	iter->dir = dir;
>  	iter->bh[0] = iter->bh[1] = NULL;
> @@ -265,9 +266,9 @@ int udf_fiiter_init(struct udf_fileident_iter *iter, struct inode *dir,
>  		goto out;
>  	}
>  
> -	if (inode_bmap(dir, iter->pos >> dir->i_blkbits, &iter->epos,
> -		       &iter->eloc, &iter->elen, &iter->loffset) !=
> -	    (EXT_RECORDED_ALLOCATED >> 30)) {
> +	err = inode_bmap(dir, iter->pos >> dir->i_blkbits, &iter->epos, &iter->eloc,
> +		   &iter->elen, &iter->loffset, &etype);
> +	if (err || etype != (EXT_RECORDED_ALLOCATED >> 30)) {
>  		if (pos == dir->i_size)
>  			return 0;
>  		udf_err(dir->i_sb,
> @@ -463,6 +464,7 @@ int udf_fiiter_append_blk(struct udf_fileident_iter *iter)
>  	sector_t block;
>  	uint32_t old_elen = iter->elen;
>  	int err;
> +	int8_t etype;
>  
>  	if (WARN_ON_ONCE(iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB))
>  		return -EINVAL;
> @@ -477,8 +479,9 @@ int udf_fiiter_append_blk(struct udf_fileident_iter *iter)
>  		udf_fiiter_update_elen(iter, old_elen);
>  		return err;
>  	}
> -	if (inode_bmap(iter->dir, block, &iter->epos, &iter->eloc, &iter->elen,
> -		       &iter->loffset) != (EXT_RECORDED_ALLOCATED >> 30)) {
> +	err = inode_bmap(iter->dir, block, &iter->epos, &iter->eloc, &iter->elen,
> +		   &iter->loffset, &etype);
> +	if (err || etype != (EXT_RECORDED_ALLOCATED >> 30)) {
>  		udf_err(iter->dir->i_sb,
>  			"block %llu not allocated in directory (ino %lu)\n",
>  			(unsigned long long)block, iter->dir->i_ino);
> diff --git a/fs/udf/inode.c b/fs/udf/inode.c
> index 6c4f104e2bf7..be9356f0eecf 100644
> --- a/fs/udf/inode.c
> +++ b/fs/udf/inode.c
> @@ -418,10 +418,11 @@ static int udf_map_block(struct inode *inode, struct udf_map_rq *map)
>  		uint32_t elen;
>  		sector_t offset;
>  		struct extent_position epos = {};
> +		int8_t etype;
>  
>  		down_read(&iinfo->i_data_sem);
> -		if (inode_bmap(inode, map->lblk, &epos, &eloc, &elen, &offset)
> -				== (EXT_RECORDED_ALLOCATED >> 30)) {
> +		err = inode_bmap(inode, map->lblk, &epos, &eloc, &elen, &offset, &etype);
> +		if (!err && etype == (EXT_RECORDED_ALLOCATED >> 30)) {
>  			map->pblk = udf_get_lb_pblock(inode->i_sb, &eloc,
>  							offset);
>  			map->oflags |= UDF_BLK_MAPPED;
> @@ -664,8 +665,10 @@ static int udf_extend_file(struct inode *inode, loff_t newsize)
>  	 */
>  	udf_discard_prealloc(inode);
>  
> -	etype = inode_bmap(inode, first_block, &epos, &eloc, &elen, &offset);
> -	within_last_ext = (etype != -1);
> +	err = inode_bmap(inode, first_block, &epos, &eloc, &elen, &offset, &etype);
> +	if (UDF_EXT_ERR(err))
> +		goto out;
> +	within_last_ext = (!err);
>  	/* We don't expect extents past EOF... */
>  	WARN_ON_ONCE(within_last_ext &&
>  		     elen > ((loff_t)offset + 1) << inode->i_blkbits);
> @@ -2391,13 +2394,17 @@ int8_t udf_delete_aext(struct inode *inode, struct extent_position epos)
>  	return (elen >> 30);
>  }
>  
> -int8_t inode_bmap(struct inode *inode, sector_t block,
> -		  struct extent_position *pos, struct kernel_lb_addr *eloc,
> -		  uint32_t *elen, sector_t *offset)
> +/*
> + * return 0 when iudf_next_aext() loop success.
> + * return err < 0 and err != -ENODATA indicates error.
> + * return err == -ENODATA indicates hit EOF.
> + */
> +int inode_bmap(struct inode *inode, sector_t block, struct extent_position *pos,
> +	       struct kernel_lb_addr *eloc, uint32_t *elen, sector_t *offset,
> +	       int8_t *etype)
>  {
>  	unsigned char blocksize_bits = inode->i_sb->s_blocksize_bits;
>  	loff_t lbcount = 0, bcount = (loff_t) block << blocksize_bits;
> -	int8_t etype;
>  	struct udf_inode_info *iinfo;
>  	int err = 0;
>  
> @@ -2409,18 +2416,18 @@ int8_t inode_bmap(struct inode *inode, sector_t block,
>  	}
>  	*elen = 0;
>  	do {
> -		err = udf_next_aext(inode, pos, eloc, elen, &etype, 1);
> +		err = udf_next_aext(inode, pos, eloc, elen, etype, 1);
>  		if (UDF_EXT_EOF(err)) {
>  			*offset = (bcount - lbcount) >> blocksize_bits;
>  			iinfo->i_lenExtents = lbcount;
>  		}
>  		if (err < 0)
> -			return -1;
> +			return err;
>  		lbcount += *elen;
>  	} while (lbcount <= bcount);
>  	/* update extent cache */
>  	udf_update_extent_cache(inode, lbcount - *elen, pos);
>  	*offset = (bcount + *elen - lbcount) >> blocksize_bits;
>  
> -	return etype;
> +	return 0;
>  }
> diff --git a/fs/udf/partition.c b/fs/udf/partition.c
> index af877991edc1..c441d4ae1f96 100644
> --- a/fs/udf/partition.c
> +++ b/fs/udf/partition.c
> @@ -282,9 +282,11 @@ static uint32_t udf_try_read_meta(struct inode *inode, uint32_t block,
>  	sector_t ext_offset;
>  	struct extent_position epos = {};
>  	uint32_t phyblock;
> +	int8_t etype;
> +	int err = 0;
>  
> -	if (inode_bmap(inode, block, &epos, &eloc, &elen, &ext_offset) !=
> -						(EXT_RECORDED_ALLOCATED >> 30))
> +	err = inode_bmap(inode, block, &epos, &eloc, &elen, &ext_offset, &etype);
> +	if (err || etype != (EXT_RECORDED_ALLOCATED >> 30))
>  		phyblock = 0xFFFFFFFF;
>  	else {
>  		map = &UDF_SB(sb)->s_partmaps[partition];
> diff --git a/fs/udf/truncate.c b/fs/udf/truncate.c
> index af06f7101859..d13ba9fd1309 100644
> --- a/fs/udf/truncate.c
> +++ b/fs/udf/truncate.c
> @@ -208,10 +208,12 @@ int udf_truncate_extents(struct inode *inode)
>  	else
>  		BUG();
>  
> -	etype = inode_bmap(inode, first_block, &epos, &eloc, &elen, &offset);
> +	err = inode_bmap(inode, first_block, &epos, &eloc, &elen, &offset, &etype);
>  	byte_offset = (offset << sb->s_blocksize_bits) +
> -		(inode->i_size & (sb->s_blocksize - 1));
> -	if (etype == -1) {
> +		      (inode->i_size & (sb->s_blocksize - 1));
> +	if (UDF_EXT_ERR(err))
> +		return err;
> +	if (UDF_EXT_EOF(err)) {
>  		/* We should extend the file? */
>  		WARN_ON(byte_offset);
>  		return 0;
> diff --git a/fs/udf/udfdecl.h b/fs/udf/udfdecl.h
> index 206077da9968..a156ed95189a 100644
> --- a/fs/udf/udfdecl.h
> +++ b/fs/udf/udfdecl.h
> @@ -160,8 +160,9 @@ extern struct buffer_head *udf_bread(struct inode *inode, udf_pblk_t block,
>  extern int udf_setsize(struct inode *, loff_t);
>  extern void udf_evict_inode(struct inode *);
>  extern int udf_write_inode(struct inode *, struct writeback_control *wbc);
> -extern int8_t inode_bmap(struct inode *, sector_t, struct extent_position *,
> -			 struct kernel_lb_addr *, uint32_t *, sector_t *);
> +extern int inode_bmap(struct inode *inode, sector_t block,
> +		      struct extent_position *pos, struct kernel_lb_addr *eloc,
> +		      uint32_t *elen, sector_t *offset, int8_t *etype);
>  int udf_get_block(struct inode *, sector_t, struct buffer_head *, int);
>  extern int udf_setup_indirect_aext(struct inode *inode, udf_pblk_t block,
>  				   struct extent_position *epos);
> -- 
> 2.43.0
> 
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR