iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

xfs: make sure aglen never goes negative in xfs_refcount_adjust_extents

Browse Source 
Prior to calling xfs_refcount_adjust_extents, we trimmed agbno/aglen
such that the end of the range would not be in the middle of a refcount
record.  If this is no longer the case, something is seriously wrong
with the btree.  Bail out with a corruption error.

Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
This commit is contained in:
Darrick J. Wong 2022-10-25 18:18:21 -07:00
parent 950f0d50ee
commit f850995f60
1 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
fs/xfs/libxfs/xfs_refcount.c
View File

@ -986,15 +986,29 @@ xfs_refcount_adjust_extents(
(*agbno) += tmp.rc_blockcount; (*agbno) += tmp.rc_blockcount;
(*aglen) -= tmp.rc_blockcount; (*aglen) -= tmp.rc_blockcount;
/* Stop if there's nothing left to modify */
if (*aglen == 0 || !xfs_refcount_still_have_space(cur))
break;
/* Move the cursor to the start of ext. */
error = xfs_refcount_lookup_ge(cur, *agbno, error = xfs_refcount_lookup_ge(cur, *agbno,
&found_rec); &found_rec);
if (error) if (error)
goto out_error; goto out_error;
} }
/* Stop if there's nothing left to modify */ /*
if (*aglen == 0 || !xfs_refcount_still_have_space(cur)) * A previous step trimmed agbno/aglen such that the end of the
break; * range would not be in the middle of the record. If this is
* no longer the case, something is seriously wrong with the
* btree. Make sure we never feed the synthesized record into
* the processing loop below.
*/
if (XFS_IS_CORRUPT(cur->bc_mp, ext.rc_blockcount == 0) ||
XFS_IS_CORRUPT(cur->bc_mp, ext.rc_blockcount > *aglen)) {
error = -EFSCORRUPTED;
goto out_error;
}
/* /*
* Adjust the reference count and either update the tree * Adjust the reference count and either update the tree