iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/fs/xfs
History
Darrick J. Wong b82a5c42a5 xfs: don't unconditionally null args->pag in xfs_bmap_btalloc_at_eof 
xfs/170 on a filesystem with su=128k,sw=4 produces this splat:

BUG: kernel NULL pointer dereference, address: 0000000000000010
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 0 P4D 0
Oops: 0002 [#1] PREEMPT SMP
CPU: 1 PID: 4022907 Comm: dd Tainted: G        W          6.3.0-xfsx #2 6ebeeffbe9577d32
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20171121_152543-x86-ol7-bu
RIP: 0010:xfs_perag_rele+0x10/0x70 [xfs]
RSP: 0018:ffffc90001e43858 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000100
RDX: ffffffffa054e717 RSI: 0000000000000005 RDI: 0000000000000000
RBP: ffff888194eea000 R08: 0000000000000000 R09: 0000000000000037
R10: ffff888100ac1cb0 R11: 0000000000000018 R12: 0000000000000000
R13: ffffc90001e43a38 R14: ffff888194eea000 R15: ffff888194eea000
FS:  00007f93d1a0e740(0000) GS:ffff88843fc80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000010 CR3: 000000018a34f000 CR4: 00000000003506e0
Call Trace:
 <TASK>
 xfs_bmap_btalloc+0x1a7/0x5d0 [xfs f85291d6841cbb3dc740083f1f331c0327394518]
 xfs_bmapi_allocate+0xee/0x470 [xfs f85291d6841cbb3dc740083f1f331c0327394518]
 xfs_bmapi_write+0x539/0x9e0 [xfs f85291d6841cbb3dc740083f1f331c0327394518]
 xfs_iomap_write_direct+0x1bb/0x2b0 [xfs f85291d6841cbb3dc740083f1f331c0327394518]
 xfs_direct_write_iomap_begin+0x51c/0x710 [xfs f85291d6841cbb3dc740083f1f331c0327394518]
 iomap_iter+0x132/0x2f0
 __iomap_dio_rw+0x2f8/0x840
 iomap_dio_rw+0xe/0x30
 xfs_file_dio_write_aligned+0xad/0x180 [xfs f85291d6841cbb3dc740083f1f331c0327394518]
 xfs_file_write_iter+0xfb/0x190 [xfs f85291d6841cbb3dc740083f1f331c0327394518]
 vfs_write+0x2eb/0x410
 ksys_write+0x65/0xe0
 do_syscall_64+0x2b/0x80

This crash occurs under the "out_low_space" label.  We grabbed a perag
reference, passed it via args->pag into xfs_bmap_btalloc_at_eof, and
afterwards args->pag is NULL.  Fix the second function not to clobber
args->pag if the caller had passed one in.

Fixes: 85843327094f ("xfs: factor xfs_bmap_btalloc()")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
2023-05-02 09:14:27 +10:00
..
libxfs
xfs: don't unconditionally null args->pag in xfs_bmap_btalloc_at_eof
2023-05-02 09:14:27 +10:00
scrub
xfs: fix duplicate includes
2023-04-20 08:18:34 +10:00
Kconfig
xfs: deprecate the ascii-ci feature
2023-04-11 19:05:19 -07:00
kmem.c
mm: introduce memalloc_retry_wait()
2022-01-15 16:30:29 +02:00
kmem.h
xfs: remove kmem_zone typedef
2021-10-22 16:00:31 -07:00
Makefile
xfs: cross-reference rmap records with ag btrees
2023-04-11 19:00:38 -07:00
mrlock.h
…
xfs_acl.c
fs: port acl to mnt_idmap
2023-01-19 09:24:28 +01:00
xfs_acl.h
fs: port ->set_acl() to pass mnt_idmap
2023-01-19 09:24:27 +01:00
xfs_aops.c
xfs: fix off-by-one-block in xfs_discard_folio()
2023-03-05 15:13:23 -08:00
xfs_aops.h
…
xfs_attr_inactive.c
xfs: don't leak memory when attr fork loading fails
2022-07-20 16:40:39 -07:00
xfs_attr_item.c
xfs: dump corrupt recovered log intent items to dmesg consistently
2022-10-31 08:58:20 -07:00
xfs_attr_item.h
xfs: share xattr name and value buffers when logging xattr updates
2022-05-23 08:43:46 +10:00
xfs_attr_list.c
xfs: use XFS_IFORK_Q to determine the presence of an xattr fork
2022-07-09 15:17:21 -07:00
xfs_bio_io.c
fs/xfs: Use the enum req_op and blk_opf_t types
2022-07-14 12:14:33 -06:00
xfs_bmap_item.c
xfs: allow queued AG intents to drain before scrubbing
2023-04-11 18:59:58 -07:00
xfs_bmap_item.h
xfs: rename _zone variables to _cache
2021-10-22 16:04:20 -07:00
xfs_bmap_util.c
xfs: fix BUG_ON in xfs_getbmap()
2023-04-12 15:49:44 +10:00
xfs_bmap_util.h
xfs: xfs_bmap_punch_delalloc_range() should take a byte range
2022-11-29 09:09:17 +11:00
xfs_buf_item_recover.c
xfs: verify buffer contents when we skip log replay
2023-04-12 15:49:23 +10:00
xfs_buf_item.c
xfs: fix super block buf log item UAF during force shutdown
2022-11-30 09:25:46 -08:00
xfs_buf_item.h
xfs: convert buffer log item flags to unsigned.
2022-04-21 10:46:40 +10:00
xfs_buf.c
xfs: invalidate block device page cache during unmount
2022-11-30 08:55:18 -08:00
xfs_buf.h
xfs: xfs_buf cache destroy isn't RCU safe
2022-07-20 16:40:39 -07:00
xfs_dahash_test.c
xfs: test the ascii case-insensitive hash
2023-04-11 19:05:05 -07:00
xfs_dahash_test.h
xfs: test dir/attr hash when loading module
2023-03-19 09:55:49 -07:00
xfs_dir2_readdir.c
xfs: rearrange the logic and remove the broken comment for xfs_dir2_isxx
2022-10-04 16:39:58 +11:00
xfs_discard.c
xfs: convert trim to use for_each_perag_range
2023-02-13 09:14:54 +11:00
xfs_discard.h
…
xfs_dquot_item_recover.c
xfs: replace xfs_sb_version checks with feature flag checks
2021-08-19 10:07:12 -07:00
xfs_dquot_item.c
xfs: remove support for disabling quota accounting on a mounted file system
2021-08-06 11:05:36 -07:00
xfs_dquot_item.h
xfs: remove support for disabling quota accounting on a mounted file system
2021-08-06 11:05:36 -07:00
xfs_dquot.c
xfs: remove WARN when dquot cache insertion fails
2023-04-12 15:48:59 +10:00
xfs_dquot.h
xfs: remove warning counters from struct xfs_dquot_res
2022-05-11 17:12:09 +10:00
xfs_drain.c
xfs: minimize overhead of drain wakeups by using jump labels
2023-04-11 18:59:59 -07:00
xfs_drain.h
xfs: minimize overhead of drain wakeups by using jump labels
2023-04-11 18:59:59 -07:00
xfs_error.c
xfs: make kobj_type structures constant
2023-02-10 08:59:48 -08:00
xfs_error.h
xfs: allow setting full range of panic tags
2023-02-09 18:36:17 -08:00
xfs_export.c
xfs: convert remaining mount flags to state flags
2021-08-19 10:07:13 -07:00
xfs_export.h
…
xfs_extent_busy.c
xfs: fix extent busy updating
2023-01-05 07:34:21 -08:00
xfs_extent_busy.h
xfs: pass perags through to the busy extent code
2021-06-02 10:48:24 +10:00
xfs_extfree_item.c
xfs: allow queued AG intents to drain before scrubbing
2023-04-11 18:59:58 -07:00
xfs_extfree_item.h
xfs: refactor all the EFI/EFD log item sizeof logic
2022-10-31 08:58:20 -07:00
xfs_file.c
- Daniel Verkamp has contributed a memfd series ("mm/memfd: add
2023-02-23 17:09:35 -08:00
xfs_filestream.c
xfs: refactor the filestreams allocator pick functions
2023-02-13 09:14:56 +11:00
xfs_filestream.h
xfs: pass perag to filestreams tracing
2023-02-13 09:14:56 +11:00
xfs_fsmap.c
xfs: fix uninitialized variable access
2023-02-14 17:51:35 -08:00
xfs_fsmap.h
…
xfs_fsops.c
- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe
2022-08-05 16:32:45 -07:00
xfs_fsops.h
…
xfs_globals.c
xfs: allow setting full range of panic tags
2023-02-09 18:36:17 -08:00
xfs_health.c
xfs: replace XFS_FORCED_SHUTDOWN with xfs_is_shutdown
2021-08-19 10:07:13 -07:00
xfs_icache.c
xfs: fix an inode lookup race in xchk_get_inode
2023-04-11 19:00:21 -07:00
xfs_icache.h
xfs: fix an inode lookup race in xchk_get_inode
2023-04-11 19:00:21 -07:00
xfs_icreate_item.c
xfs: fix potential log item leak
2022-05-04 11:45:11 +10:00
xfs_icreate_item.h
xfs: rename _zone variables to _cache
2021-10-22 16:04:20 -07:00
xfs_inode_item_recover.c
xfs: clean up "%Ld/%Lu" which doesn't meet C standard
2022-09-19 06:47:14 +10:00
xfs_inode_item.c
xfs: remove the redundant word in comment
2022-09-19 06:45:14 +10:00
xfs_inode_item.h
xfs: aborting inodes on shutdown may need buffer lock
2022-03-29 18:21:59 -07:00
xfs_inode.c
New code for 6.3-rc1, part 2:
2023-02-28 16:08:30 -08:00
xfs_inode.h
fs: port inode_init_owner() to mnt_idmap
2023-01-19 09:24:28 +01:00
xfs_ioctl32.c
fs: port i_{g,u}id_into_vfs{g,u}id() to mnt_idmap
2023-01-19 09:24:29 +01:00
xfs_ioctl32.h
xfs: remove unused xfs_ioctl32.h declarations
2022-01-18 10:18:36 -08:00
xfs_ioctl.c
fs.idmapped.v6.3
2023-02-20 11:53:11 -08:00
xfs_ioctl.h
fs: port ->fileattr_set() to pass mnt_idmap
2023-01-19 09:24:27 +01:00
xfs_iomap.c
xfs: pass the correct cursor to xfs_iomap_prealloc_size
2023-03-24 08:40:01 -07:00
xfs_iomap.h
xfs: use iomap_valid method to detect stale cached iomaps
2022-11-29 09:09:17 +11:00
xfs_iops.c
fs: port vfs{g,u}id helpers to mnt_idmap
2023-01-19 09:24:30 +01:00
xfs_iops.h
fs: port ->setattr() to pass mnt_idmap
2023-01-19 09:24:02 +01:00
xfs_itable.c
fs: port i_{g,u}id_into_vfs{g,u}id() to mnt_idmap
2023-01-19 09:24:29 +01:00
xfs_itable.h
fs: port i_{g,u}id_into_vfs{g,u}id() to mnt_idmap
2023-01-19 09:24:29 +01:00
xfs_iunlink_item.c
xfs: create traced helper to get extra perag references
2023-04-11 18:59:55 -07:00
xfs_iunlink_item.h
xfs: add in-memory iunlink log item
2022-07-14 11:47:42 +10:00
xfs_iwalk.c
xfs: create traced helper to get extra perag references
2023-04-11 18:59:55 -07:00
xfs_iwalk.h
xfs: Decouple XFS_IBULK flags from XFS_IWALK flags
2022-04-13 07:02:44 +00:00
xfs_linux.h
xfs: allow queued AG intents to drain before scrubbing
2023-04-11 18:59:58 -07:00
xfs_log_cil.c
xfs: xlog_sync() manually adjusts grant head space
2022-07-07 18:56:09 +10:00
xfs_log_priv.h
xfs: xlog_sync() manually adjusts grant head space
2022-07-07 18:56:09 +10:00
xfs_log_recover.c
xfs: avoid a UAF when log intent item recovery fails
2022-10-18 14:39:29 -07:00
xfs_log.c
xfs: wait iclog complete before tearing down AIL
2022-11-30 09:25:46 -08:00
xfs_log.h
xfs: move CIL ordering to the logvec chain
2022-07-07 18:56:08 +10:00
xfs_message.c
Merge branch 'guilt/xfs-unsigned-flags-5.18' into xfs-5.19-for-next
2022-04-21 16:45:03 +10:00
xfs_message.h
xfs: implement per-mount warnings for scrub and shrink usage
2022-05-27 10:31:34 +10:00
xfs_mount.c
xfs: fix sb write verify for lazysbcount
2022-11-16 19:20:20 -08:00
xfs_mount.h
xfs: convert xfs_ialloc_next_ag() to an atomic
2023-02-13 09:14:52 +11:00
xfs_mru_cache.c
xfs: rename _zone variables to _cache
2021-10-22 16:04:20 -07:00
xfs_mru_cache.h
…
xfs_notify_failure.c
xfs: changes for 6.1-rc1
2022-10-10 20:32:10 -07:00
xfs_ondisk.h
xfs: fix memcpy fortify errors in EFI log format copying
2022-10-31 08:58:20 -07:00
xfs_pnfs.c
fs: port ->setattr() to pass mnt_idmap
2023-01-19 09:24:02 +01:00
xfs_pnfs.h
…
xfs_pwork.c
…
xfs_pwork.h
…
xfs_qm_bhv.c
xfs: replace xfs_sb_version checks with feature flag checks
2021-08-19 10:07:12 -07:00
xfs_qm_syscalls.c
xfs: introduce xfs_inodegc_push()
2022-06-23 13:34:38 -07:00
xfs_qm.c
xfs: quotacheck failure can race with background inode inactivation
2023-03-05 15:13:22 -08:00
xfs_qm.h
xfs: remove quota warning limit from struct xfs_quota_limits
2022-05-11 17:12:09 +10:00
xfs_quota.h
xfs: queue inactivation immediately when quota is nearing enforcement
2021-08-09 10:52:18 -07:00
xfs_quotaops.c
xfs: don't set quota warning values
2022-05-11 17:12:09 +10:00
xfs_refcount_item.c
xfs: allow queued AG intents to drain before scrubbing
2023-04-11 18:59:58 -07:00
xfs_refcount_item.h
xfs: rename _zone variables to _cache
2021-10-22 16:04:20 -07:00
xfs_reflink.c
xfs: active perag reference counting
2023-02-13 09:14:42 +11:00
xfs_reflink.h
xfs: pass perag to xfs_alloc_read_agf()
2022-07-07 19:07:40 +10:00
xfs_rmap_item.c
xfs: allow queued AG intents to drain before scrubbing
2023-04-11 18:59:58 -07:00
xfs_rmap_item.h
xfs: rename _zone variables to _cache
2021-10-22 16:04:20 -07:00
xfs_rtalloc.c
xfs: make rtbitmap ILOCKing consistent when scanning the rt bitmap file
2022-11-16 15:25:03 -08:00
xfs_rtalloc.h
xfs: recalculate free rt extents after log recovery
2022-04-12 06:49:42 +10:00
xfs_stats.c
xfs: replace unnecessary seq_printf with seq_puts
2022-09-19 06:48:14 +10:00
xfs_stats.h
…
xfs_super.c
xfs: deprecate the ascii-ci feature
2023-04-11 19:05:19 -07:00
xfs_super.h
xfs: implement ->notify_failure() for XFS
2022-07-17 17:14:30 -07:00
xfs_symlink.c
fs: port fs{g,u}id helpers to mnt_idmap
2023-01-19 09:24:30 +01:00
xfs_symlink.h
fs: port inode_init_owner() to mnt_idmap
2023-01-19 09:24:28 +01:00
xfs_sysctl.c
…
xfs_sysctl.h
xfs: Add larp debug option
2022-05-11 17:01:22 +10:00
xfs_sysfs.c
xfs: make kobj_type structures constant
2023-02-10 08:59:48 -08:00
xfs_sysfs.h
xfs: make kobj_type structures constant
2023-02-10 08:59:48 -08:00
xfs_trace.c
xfs: add debug knob to slow down writeback for fun
2022-11-28 17:24:35 -08:00
xfs_trace.h
xfs: allow queued AG intents to drain before scrubbing
2023-04-11 18:59:58 -07:00
xfs_trans_ail.c
xfs: shut up -Wuninitialized in xfsaild_push
2022-11-30 08:55:18 -08:00
xfs_trans_buf.c
xfs: introduce xfs_buf_daddr()
2021-08-19 10:07:14 -07:00
xfs_trans_dquot.c
xfs: remove quota warning limit from struct xfs_quota_limits
2022-05-11 17:12:09 +10:00
xfs_trans_priv.h
xfs: convert log vector chain to use list heads
2022-07-07 18:55:59 +10:00
xfs_trans.c
xfs: don't assert fail on transaction cancel with deferred ops
2023-02-11 04:12:06 +11:00
xfs_trans.h
xfs: t_firstblock is tracking AGs not blocks
2023-02-11 04:11:06 +11:00
xfs_xattr.c
xfs: revert commit 8954c44ff477
2023-02-10 09:06:06 -08:00
xfs_xattr.h
xfs: move xfs_attr_use_log_assist usage out of libxfs
2022-05-27 10:34:04 +10:00
xfs.h
…