iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/fs
History
Filipe Manana 51a60253a5 Btrfs: send, fix incorrect ref access when using extrefs 
When running send, if an inode only has extended reference items
associated to it and no regular references, send.c:get_first_ref()
was incorrectly assuming the reference it found was of type
BTRFS_INODE_REF_KEY due to use of the wrong key variable.
This caused weird behaviour when using the found item has a regular
reference, such as weird path string, and occasionally (when lucky)
a crash:

[  190.600652] general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC
[  190.600994] Modules linked in: btrfs xor raid6_pq binfmt_misc nfsd auth_rpcgss oid_registry nfs_acl nfs lockd fscache sunrpc psmouse serio_raw evbug pcspkr i2c_piix4 e1000 floppy
[  190.602565] CPU: 2 PID: 14520 Comm: btrfs Not tainted 3.13.0-fdm-btrfs-next-26+ #1
[  190.602728] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[  190.602868] task: ffff8800d447c920 ti: ffff8801fa79e000 task.ti: ffff8801fa79e000
[  190.603030] RIP: 0010:[<ffffffff813266b4>]  [<ffffffff813266b4>] memcpy+0x54/0x110
[  190.603262] RSP: 0018:ffff8801fa79f880  EFLAGS: 00010202
[  190.603395] RAX: ffff8800d4326e3f RBX: 000000000000036a RCX: ffff880000000000
[  190.603553] RDX: 000000000000032a RSI: ffe708844042936a RDI: ffff8800d43271a9
[  190.603710] RBP: ffff8801fa79f8c8 R08: 00000000003a4ef0 R09: 0000000000000000
[  190.603867] R10: 793a4ef09f000000 R11: 9f0000000053726f R12: ffff8800d43271a9
[  190.604020] R13: 0000160000000000 R14: ffff8802110134f0 R15: 000000000000036a
[  190.604020] FS:  00007fb423d09b80(0000) GS:ffff880216200000(0000) knlGS:0000000000000000
[  190.604020] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[  190.604020] CR2: 00007fb4229d4b78 CR3: 00000001f5d76000 CR4: 00000000000006e0
[  190.604020] Stack:
[  190.604020]  ffffffffa01f4d49 ffff8801fa79f8f0 00000000000009f9 ffff8801fa79f8c8
[  190.604020]  00000000000009f9 ffff880211013260 000000000000f971 ffff88021147dba8
[  190.604020]  00000000000009f9 ffff8801fa79f918 ffffffffa02367f5 ffff8801fa79f928
[  190.604020] Call Trace:
[  190.604020]  [<ffffffffa01f4d49>] ? read_extent_buffer+0xb9/0x120 [btrfs]
[  190.604020]  [<ffffffffa02367f5>] fs_path_add_from_extent_buffer+0x45/0x60 [btrfs]
[  190.604020]  [<ffffffffa0238806>] get_first_ref+0x1f6/0x210 [btrfs]
[  190.604020]  [<ffffffffa0238994>] __get_cur_name_and_parent+0x174/0x3a0 [btrfs]
[  190.604020]  [<ffffffff8118df3d>] ? kmem_cache_alloc_trace+0x11d/0x1e0
[  190.604020]  [<ffffffffa0236674>] ? fs_path_alloc+0x24/0x60 [btrfs]
[  190.604020]  [<ffffffffa0238c91>] get_cur_path+0xd1/0x240 [btrfs]
(...)

Steps to reproduce (either crash or some weirdness like an odd path string):

    mkfs.btrfs -f -O extref /dev/sdd
    mount /dev/sdd /mnt

    mkdir /mnt/testdir
    touch /mnt/testdir/foobar

    for i in `seq 1 2550`; do
        ln /mnt/testdir/foobar /mnt/testdir/foobar_link_`printf "%04d" $i`
    done

    ln /mnt/testdir/foobar /mnt/testdir/final_foobar_name

    rm -f /mnt/testdir/foobar
    for i in `seq 1 2550`; do
        rm -f /mnt/testdir/foobar_link_`printf "%04d" $i`
    done

    btrfs subvolume snapshot -r /mnt /mnt/mysnap
    btrfs send /mnt/mysnap -f /tmp/mysnap.send

Signed-off-by: Filipe David Borba Manana <fdmanana@gmail.com>
Signed-off-by: Chris Mason <clm@fb.com>
Reviewed-by: Liu Bo <bo.li.liu@oracle.com>
2014-05-20 10:18:26 -07:00
..
9p
consolidate simple ->d_delete() instances
2013-11-15 22:04:17 -05:00
adfs
adfs: delayed freeing of sbi
2013-10-24 23:43:27 -04:00
affs
remove obsolete references to powertweak
2013-11-27 20:34:32 -08:00
afs
Merge branch 'fscache' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs into linux-next
2013-10-28 19:36:46 -04:00
autofs4
autofs4: make freeing sbi rcu-delayed
2013-10-24 23:43:27 -04:00
befs
befs: split symlink iops in two - for short and long symlinks resp.
2013-10-24 23:34:50 -04:00
bfs
truncate: drop 'oldsize' truncate_pagecache() parameter
2013-09-12 15:38:02 -07:00
btrfs
Btrfs: send, fix incorrect ref access when using extrefs
2014-05-20 10:18:26 -07:00
cachefiles
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2013-11-13 15:34:18 +09:00
ceph
ceph: Avoid data inconsistency due to d-cache aliasing in readpage()
2013-12-13 09:11:38 -08:00
cifs
cifs: set FILE_CREATED
2013-12-27 15:14:45 -06:00
coda
coda_revalidate_inode(): switch to passing inode...
2013-11-09 00:16:21 -05:00
configfs
configfs: fix race between dentry put and lookup
2013-11-21 16:42:27 -08:00
cramfs
cramfs: mark as obsolete
2013-11-13 12:09:12 +09:00
debugfs
debugfs: use list_next_entry() in debugfs_remove_recursive()
2013-11-13 12:09:24 +09:00
devpts
devpts: plug the memory leak in kill_sb
2013-11-13 12:09:36 +09:00
dlm
genetlink: only pass array to genl_register_family_with_ops()
2013-11-19 16:39:05 -05:00
ecryptfs
Quiet static checkers by removing unneeded conditionals
2013-11-22 10:58:14 -08:00
efivarfs
consolidate simple ->d_delete() instances
2013-11-15 22:04:17 -05:00
efs
efs: iget_locked() doesn't return an ERR_PTR()
2013-08-24 12:10:22 -04:00
exofs
truncate: drop 'oldsize' truncate_pagecache() parameter
2013-09-12 15:38:02 -07:00
exportfs
exportfs: fix quadratic behavior in filehandle lookup
2013-11-09 00:16:38 -05:00
ext2
ext2: Fix oops in ext2_get_block() called from ext2_quota_write()
2013-12-04 12:26:51 +01:00
ext3
Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
2013-11-13 15:25:47 +09:00
ext4
ext4: fix bigalloc regression
2014-01-06 14:00:23 -05:00
f2fs
f2fs: issue more large discard command
2013-11-11 09:36:32 +09:00
fat
fat: rcu-delay unloading nls and freeing sbi
2013-10-24 23:43:28 -04:00
freevxfs
[readdir] convert freevxfs
2013-06-29 12:56:53 +04:00
fscache
Merge branch 'for-3.13/core' of git://git.kernel.dk/linux-block
2013-11-14 12:08:14 +09:00
fuse
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2013-11-13 15:34:18 +09:00
gfs2
GFS2: Fix unsafe dereference in dump_holder()
2014-01-02 12:18:04 +00:00
hfs
fs/hfs/btree.h: remove duplicate defines
2013-11-13 12:09:32 +09:00
hfsplus
block: submit_bio_wait() conversions
2013-11-24 16:33:41 -07:00
hostfs
consolidate simple ->d_delete() instances
2013-11-15 22:04:17 -05:00
hpfs
locks: break delegations on any attribute modification
2013-11-09 00:16:44 -05:00
hppfs
clean up scary strncpy(dst, src, strlen(src)) uses
2013-07-03 16:07:41 -07:00
hugetlbfs
cope with potentially long ->d_dname() output for shmem/hugetlb
2013-08-24 12:10:17 -04:00
isofs
isofs: don't pass dentry to isofs_hash{i,}_common()
2013-10-24 23:34:59 -04:00
jbd
jbd: Revert "jbd: remove dependency on __GFP_NOFAIL"
2013-10-31 20:37:15 +01:00
jbd2
jbd2: rename obsoleted msg JBD->JBD2
2013-12-08 21:14:59 -05:00
jffs2
jffs2: do not support the MLC nand
2013-10-27 16:27:07 -07:00
jfs
Just a patch to fix an oops in an error path.
2013-10-22 09:01:11 +01:00
lockd
LOCKD: Don't call utsname()->nodename from nlmclnt_setlockargs
2013-08-05 15:03:46 -04:00
logfs
block: submit_bio_wait() conversions
2013-11-24 16:33:41 -07:00
minix
fs/minix: Drop dependency on H8300
2013-09-16 18:20:25 -07:00
ncpfs
ncpfs: rcu-delay unload_nls() and freeing ncp_server
2013-10-24 23:43:28 -04:00
nfs
NFS client bugfixes
2013-12-05 13:05:48 -08:00
nfs_common
…
nfsd
nfsd: when reusing an existing repcache entry, unhash it first
2013-12-10 20:34:44 -05:00
nilfs2
nilfs2: fix segctor bug that causes file system corruption
2014-01-15 14:19:42 +07:00
nls
…
notify
fsnotify: update comments concerning locking scheme
2013-07-09 10:33:20 -07:00
ntfs
iget/iget5: don't bother with ->i_lock until we find a match
2013-11-09 00:16:31 -05:00
ocfs2
tree-wide: use reinit_completion instead of INIT_COMPLETION
2013-11-15 09:32:21 +09:00
omfs
truncate: drop 'oldsize' truncate_pagecache() parameter
2013-09-12 15:38:02 -07:00
openpromfs
[readdir] convert openpromfs
2013-06-29 12:56:32 +04:00
proc
procfs: also fix proc_reg_get_unmapped_area() for !MMU case
2013-12-12 18:19:26 -08:00
pstore
pstore: Don't allow high traffic options on fragile devices
2013-12-20 13:12:01 -08:00
qnx4
qnx4: i_sb is never NULL
2013-11-09 00:16:32 -05:00
qnx6
[readdir] convert qnx6
2013-06-29 12:56:39 +04:00
quota
genetlink: make multicast groups const, prevent abuse
2013-11-19 16:39:06 -05:00
ramfs
initmpfs: move rootfs code from fs/ramfs/ to init/
2013-09-11 15:59:37 -07:00
reiserfs
reiserfs: fix race with flush_used_journal_lists and flush_journal_list
2013-09-24 11:24:21 +02:00
romfs
[readdir] convert romfs
2013-06-29 12:56:29 +04:00
squashfs
Squashfs: fix failure to unlock pages on decompress error
2013-11-24 01:02:50 +00:00
sysfs
sysfs: give different locking key to regular and bin files
2013-12-07 21:22:00 -08:00
sysv
sysv: Add forgotten superblock lock init for v7 fs
2013-09-29 22:02:02 -04:00
ubifs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2013-11-13 15:34:18 +09:00
udf
udf: fix for pathetic mount times in case of invalid file system
2013-10-18 22:39:07 +02:00
ufs
truncate: drop 'oldsize' truncate_pagecache() parameter
2013-09-12 15:38:02 -07:00
xfs
xfs: Calling destroy_work_on_stack() to pair with INIT_WORK_ONSTACK()
2014-01-10 12:39:38 -06:00
aio.c
Merge git://git.kvack.org/~bcrl/aio-next
2013-12-22 11:03:49 -08:00
anon_inodes.c
... and kill anon_inode_getfile_private()
2013-11-09 00:16:28 -05:00
attr.c
locks: break delegations on any attribute modification
2013-11-09 00:16:44 -05:00
bad_inode.c
[readdir] ->readdir() is gone
2013-06-29 12:57:04 +04:00
binfmt_aout.c
dump_skip(): dump_seek() replacement taking coredump_params
2013-11-09 00:16:26 -05:00
binfmt_elf_fdpic.c
elf{,_fdpic} coredump: get rid of pointless if (siginfo->si_signo)
2013-11-09 00:16:30 -05:00
binfmt_elf.c
elf{,_fdpic} coredump: get rid of pointless if (siginfo->si_signo)
2013-11-09 00:16:30 -05:00
binfmt_em86.c
file->f_op is never NULL...
2013-10-24 23:34:54 -04:00
binfmt_flat.c
…
binfmt_misc.c
…
binfmt_script.c
…
binfmt_som.c
…
bio-integrity.c
Merge branch 'for-3.12/core' of git://git.kernel.dk/linux-block
2013-09-22 15:00:11 -07:00
bio.c
bio: fix argument of __bio_add_page() for max_sectors > 0xffff
2013-11-18 12:31:27 -07:00
block_dev.c
a trivial writeback fix
2013-09-13 23:06:40 -04:00
buffer.c
fs: buffer: move allocation failure loop into the allocator
2013-10-16 21:35:53 -07:00
char_dev.c
Merge branch 'for-3.13/core' of git://git.kernel.dk/linux-block
2013-11-14 12:08:14 +09:00
compat_binfmt_elf.c
…
compat_ioctl.c
file->f_op is never NULL...
2013-10-24 23:34:54 -04:00
compat.c
[readdir] constify ->actor
2013-06-29 12:57:05 +04:00
coredump.c
dump_emit(): use __kernel_write(), not vfs_write()
2013-11-15 22:04:09 -05:00
coredump.h
…
dcache.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2014-01-17 17:29:36 -08:00
dcookies.c
…
direct-io.c
direct-io: Use return from cmpxchg to decide of assignment happened
2013-09-09 10:47:42 -07:00
drop_caches.c
shrinker: add node awareness
2013-09-10 18:56:31 -04:00
eventfd.c
…
eventpoll.c
epoll: do not take the nested ep->mtx on EPOLL_CTL_DEL
2014-01-02 14:40:30 -08:00
exec.c
Merge git://git.infradead.org/users/eparis/audit
2013-11-21 19:18:14 -08:00
fcntl.c
file->f_op is never NULL...
2013-10-24 23:34:54 -04:00
fhandle.c
…
file_table.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2013-11-13 15:34:18 +09:00
file.c
…
filesystems.c
…
fs_struct.c
seqcount: Add lockdep functionality to seqcount/seqlock structures
2013-11-06 12:40:26 +01:00
fs-writeback.c
writeback: Fix data corruption on NFS
2013-12-14 04:21:26 +08:00
generic_acl.c
…
inode.c
locks: break delegations on any attribute modification
2013-11-09 00:16:44 -05:00
internal.h
get rid of s_files and files_lock
2013-11-09 00:16:20 -05:00
ioctl.c
file->f_op is never NULL...
2013-10-24 23:34:54 -04:00
ioprio.c
…
Kconfig
…
Kconfig.binfmt
…
libfs.c
consolidate simple ->d_delete() instances
2013-11-15 22:04:17 -05:00
locks.c
locks: missing unlock on error in generic_add_lease()
2013-11-13 07:30:53 -05:00
Makefile
…
mbcache.c
fs: convert fs shrinkers to new scan/count API
2013-09-10 18:56:31 -04:00
mount.h
RCU'd vfsmounts
2013-11-09 00:16:19 -05:00
mpage.c
…
namei.c
dcache: allow word-at-a-time name hashing with big-endian CPUs
2013-12-12 10:39:01 -08:00
namespace.c
vfs: Fix a regression in mounting proc
2013-11-26 20:54:52 -08:00
no-block.c
…
open.c
locks: break delegations on any attribute modification
2013-11-09 00:16:44 -05:00
pipe.c
vfs: fix subtle use-after-free of pipe_inode_info
2013-12-02 09:44:51 -08:00
pnode.c
split __lookup_mnt() in two functions
2013-10-24 23:35:00 -04:00
pnode.h
vfs: Don't copy mount bind mounts of /proc/<pid>/ns/mnt between namespaces
2013-08-26 18:42:15 -07:00
posix_acl.c
…
proc_namespace.c
don't bother with vfsmount_lock in mounts_poll()
2013-10-24 23:34:59 -04:00
read_write.c
file->f_op is never NULL...
2013-10-24 23:34:54 -04:00
readdir.c
file->f_op is never NULL...
2013-10-24 23:34:54 -04:00
select.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2013-11-13 15:34:18 +09:00
seq_file.c
seq_file: always clear m->count when we free m->buf
2013-11-18 19:07:53 -08:00
signalfd.c
…
splice.c
file->f_op is never NULL...
2013-10-24 23:34:54 -04:00
stack.c
…
stat.c
vfs: split out vfs_getattr_nosec
2013-11-09 00:16:31 -05:00
statfs.c
vfs: allow O_PATH file descriptors for fstatfs()
2013-10-12 13:12:31 -07:00
super.c
get rid of s_files and files_lock
2013-11-09 00:16:20 -05:00
sync.c
Merge branch 'akpm' (patches from Andrew Morton)
2013-11-13 15:45:43 +09:00
timerfd.c
…
utimes.c
locks: break delegations on any attribute modification
2013-11-09 00:16:44 -05:00
xattr_acl.c
…
xattr.c
…