diff mbox series

[2/3] xfs: make sure the rt allocator doesn't run off the end

Message ID 159950167474.582172.16930353017934744381.stgit@magnolia (mailing list archive)
State Accepted
Headers show
Series xfs: fix a few realtime bugs | expand

Commit Message

Darrick J. Wong Sept. 7, 2020, 6:01 p.m. UTC 
From: Darrick J. Wong <darrick.wong@oracle.com>

There's an overflow bug in the realtime allocator.  If the rt volume is
large enough to handle a single allocation request that is larger than
the maximum bmap extent length and the rt bitmap ends exactly on a
bitmap block boundary, it's possible that the near allocator will try to
check the freeness of a range that extends past the end of the bitmap.
This fails with a corruption error and shuts down the fs.

Therefore, constrain maxlen so that the range scan cannot run off the
end of the rt bitmap.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
---
 fs/xfs/xfs_rtalloc.c |   11 +++++++++++
 1 file changed, 11 insertions(+)

Comments

Christoph Hellwig Sept. 8, 2020, 2:58 p.m. UTC | #1 
On Mon, Sep 07, 2020 at 11:01:14AM -0700, Darrick J. Wong wrote:
> From: Darrick J. Wong <darrick.wong@oracle.com>
> 
> There's an overflow bug in the realtime allocator.  If the rt volume is
> large enough to handle a single allocation request that is larger than
> the maximum bmap extent length and the rt bitmap ends exactly on a
> bitmap block boundary, it's possible that the near allocator will try to
> check the freeness of a range that extends past the end of the bitmap.
> This fails with a corruption error and shuts down the fs.
> 
> Therefore, constrain maxlen so that the range scan cannot run off the
> end of the rt bitmap.

Looks good,

Reviewed-by: Christoph Hellwig <hch@lst.de>
diff mbox series

Patch

diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
index 6209e7b6b895..86994d7f7cba 100644
--- a/fs/xfs/xfs_rtalloc.c
+++ b/fs/xfs/xfs_rtalloc.c
@@ -247,6 +247,9 @@  xfs_rtallocate_extent_block(
 		end = XFS_BLOCKTOBIT(mp, bbno + 1) - 1;
 	     i <= end;
 	     i++) {
+		/* Make sure we don't scan off the end of the rt volume. */
+		maxlen = min(mp->m_sb.sb_rextents, i + maxlen) - i;
+
 		/*
 		 * See if there's a free extent of maxlen starting at i.
 		 * If it's not so then next will contain the first non-free.
@@ -442,6 +445,14 @@  xfs_rtallocate_extent_near(
 	 */
 	if (bno >= mp->m_sb.sb_rextents)
 		bno = mp->m_sb.sb_rextents - 1;
+
+	/* Make sure we don't run off the end of the rt volume. */
+	maxlen = min(mp->m_sb.sb_rextents, bno + maxlen) - bno;
+	if (maxlen < minlen) {
+		*rtblock = NULLRTBLOCK;
+		return 0;
+	}
+
 	/*
 	 * Try the exact allocation first.
 	 */