https://github.com/torvalds/linux
Revision ada49d64fb3538144192181db05de17e2ffc3551 authored by Gao Xiang on 14 November 2020, 19:06:01 UTC, committed by Darrick J. Wong on 18 November 2020, 17:23:51 UTC
Currently, commit e9e2eae89ddb dropped a (int) decoration from XFS_LITINO(mp), and since sizeof() expression is also involved, the result of XFS_LITINO(mp) is simply as the size_t type (commonly unsigned long). Considering the expression in xfs_attr_shortform_bytesfit(): offset = (XFS_LITINO(mp) - bytes) >> 3; let "bytes" be (int)340, and "XFS_LITINO(mp)" be (unsigned long)336. on 64-bit platform, the expression is offset = ((unsigned long)336 - (int)340) >> 3 = (int)(0xfffffffffffffffcUL >> 3) = -1 but on 32-bit platform, the expression is offset = ((unsigned long)336 - (int)340) >> 3 = (int)(0xfffffffcUL >> 3) = 0x1fffffff instead. so offset becomes a large positive number on 32-bit platform, and cause xfs_attr_shortform_bytesfit() returns maxforkoff rather than 0. Therefore, one result is "ASSERT(new_size <= XFS_IFORK_SIZE(ip, whichfork));" assertion failure in xfs_idata_realloc(), which was also the root cause of the original bugreport from Dennis, see: https://bugzilla.redhat.com/show_bug.cgi?id=1894177 And it can also be manually triggered with the following commands: $ touch a; $ setfattr -n user.0 -v "`seq 0 80`" a; $ setfattr -n user.1 -v "`seq 0 80`" a on 32-bit platform. Fix the case in xfs_attr_shortform_bytesfit() by bailing out "XFS_LITINO(mp) < bytes" in advance suggested by Eric and a misleading comment together with this bugfix suggested by Darrick. It seems the other users of XFS_LITINO(mp) are not impacted. Fixes: e9e2eae89ddb ("xfs: only check the superblock version for dinode size calculation") Cc: <stable@vger.kernel.org> # 5.7+ Reported-and-tested-by: Dennis Gilmore <dgilmore@redhat.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Gao Xiang <hsiangkao@redhat.com> Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
1 parent 6b48e5b
Tip revision: ada49d64fb3538144192181db05de17e2ffc3551 authored by Gao Xiang on 14 November 2020, 19:06:01 UTC
xfs: fix forkoff miscalculation related to XFS_LITINO(mp)
xfs: fix forkoff miscalculation related to XFS_LITINO(mp)
Tip revision: ada49d6
File | Mode | Size |
---|---|---|
accounting | ||
arch | ||
bootconfig | ||
bpf | ||
build | ||
cgroup | ||
debugging | ||
edid | ||
firewire | ||
firmware | ||
gpio | ||
hv | ||
iio | ||
include | ||
io_uring | ||
kvm | ||
laptop | ||
leds | ||
lib | ||
memory-model | ||
objtool | ||
pci | ||
pcmcia | ||
perf | ||
power | ||
scripts | ||
spi | ||
testing | ||
thermal | ||
time | ||
usb | ||
virtio | ||
vm | ||
wmi | ||
Makefile | -rw-r--r-- | 6.1 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...