lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge tag 'xfs-for-linus-v3.13-rc4' of git://oss.sgi.com/xfs/xfs

Browse Source 
Pull xfs bugfixes from Ben Myers:

 - fix for buffer overrun in agfl with growfs on v4 superblock

 - return EINVAL if requested discard length is less than a block

 - fix possible memory corruption in xfs_attrlist_by_handle()

* tag 'xfs-for-linus-v3.13-rc4' of git://oss.sgi.com/xfs/xfs:
  xfs: growfs overruns AGFL buffer on V4 filesystems
  xfs: don't perform discard if the given range length is less than block size
  xfs: underflow bug in xfs_attrlist_by_handle()
This commit is contained in:
Linus Torvalds
2013-12-12 10:14:13 -08:00
parent 5cdec2d833 f94c44573e
commit 48a2f0b272
4 changed files with 12 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
fs/xfs/xfs_discard.c
View File

@@ -157,7 +157,7 @@ xfs_ioc_trim(
struct xfs_mount *mp, struct xfs_mount *mp,
struct fstrim_range __user *urange) struct fstrim_range __user *urange)
{ {
struct request_queue *q = mp->m_ddev_targp->bt_bdev->bd_disk->queue; struct request_queue *q = bdev_get_queue(mp->m_ddev_targp->bt_bdev);
unsigned int granularity = q->limits.discard_granularity; unsigned int granularity = q->limits.discard_granularity;
struct fstrim_range range; struct fstrim_range range;
xfs_daddr_t start, end, minlen; xfs_daddr_t start, end, minlen;
@@ -180,7 +180,8 @@ xfs_ioc_trim(
* matter as trimming blocks is an advisory interface. * matter as trimming blocks is an advisory interface.
*/ */
if (range.start >= XFS_FSB_TO_B(mp, mp->m_sb.sb_dblocks) || if (range.start >= XFS_FSB_TO_B(mp, mp->m_sb.sb_dblocks) ||
range.minlen > XFS_FSB_TO_B(mp, XFS_ALLOC_AG_MAX_USABLE(mp))) range.minlen > XFS_FSB_TO_B(mp, XFS_ALLOC_AG_MAX_USABLE(mp)) ||
range.len < mp->m_sb.sb_blocksize)
return -XFS_ERROR(EINVAL); return -XFS_ERROR(EINVAL);
start = BTOBB(range.start); start = BTOBB(range.start);

6
fs/xfs/xfs_fsops.c
View File

@@ -220,6 +220,8 @@ xfs_growfs_data_private(
*/ */
nfree = 0; nfree = 0;
for (agno = nagcount - 1; agno >= oagcount; agno--, new -= agsize) { for (agno = nagcount - 1; agno >= oagcount; agno--, new -= agsize) {
__be32 *agfl_bno;
/* /*
* AG freespace header block * AG freespace header block
*/ */
@@ -279,8 +281,10 @@ xfs_growfs_data_private(
agfl->agfl_seqno = cpu_to_be32(agno); agfl->agfl_seqno = cpu_to_be32(agno);
uuid_copy(&agfl->agfl_uuid, &mp->m_sb.sb_uuid); uuid_copy(&agfl->agfl_uuid, &mp->m_sb.sb_uuid);
} }
agfl_bno = XFS_BUF_TO_AGFL_BNO(mp, bp);
for (bucket = 0; bucket < XFS_AGFL_SIZE(mp); bucket++) for (bucket = 0; bucket < XFS_AGFL_SIZE(mp); bucket++)
agfl->agfl_bno[bucket] = cpu_to_be32(NULLAGBLOCK); agfl_bno[bucket] = cpu_to_be32(NULLAGBLOCK);
error = xfs_bwrite(bp); error = xfs_bwrite(bp);
xfs_buf_relse(bp); xfs_buf_relse(bp);

3
fs/xfs/xfs_ioctl.c
View File

@@ -442,7 +442,8 @@ xfs_attrlist_by_handle(
return -XFS_ERROR(EPERM); return -XFS_ERROR(EPERM);
if (copy_from_user(&al_hreq, arg, sizeof(xfs_fsop_attrlist_handlereq_t))) if (copy_from_user(&al_hreq, arg, sizeof(xfs_fsop_attrlist_handlereq_t)))
return -XFS_ERROR(EFAULT); return -XFS_ERROR(EFAULT);
if (al_hreq.buflen > XATTR_LIST_MAX) if (al_hreq.buflen < sizeof(struct attrlist) ||
al_hreq.buflen > XATTR_LIST_MAX)
return -XFS_ERROR(EINVAL); return -XFS_ERROR(EINVAL);
/* /*

3
fs/xfs/xfs_ioctl32.c
View File

@@ -356,7 +356,8 @@ xfs_compat_attrlist_by_handle(
if (copy_from_user(&al_hreq, arg, if (copy_from_user(&al_hreq, arg,
sizeof(compat_xfs_fsop_attrlist_handlereq_t))) sizeof(compat_xfs_fsop_attrlist_handlereq_t)))
return -XFS_ERROR(EFAULT); return -XFS_ERROR(EFAULT);
if (al_hreq.buflen > XATTR_LIST_MAX) if (al_hreq.buflen < sizeof(struct attrlist) ||
al_hreq.buflen > XATTR_LIST_MAX)
return -XFS_ERROR(EINVAL); return -XFS_ERROR(EINVAL);
/* /*