From patchwork Fri Nov 3 02:16:18 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gavin Guo X-Patchwork-Id: 833605 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) by ozlabs.org (Postfix) with ESMTP id 3ySlv96Jlmz9sRn; Fri, 3 Nov 2017 13:16:37 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1eARX5-0003CY-1g; Fri, 03 Nov 2017 02:16:31 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtps (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:128) (Exim 4.86_2) (envelope-from ) id 1eARX3-0003Bi-1a for kernel-team@lists.ubuntu.com; Fri, 03 Nov 2017 02:16:29 +0000 Received: from mail-pg0-f70.google.com ([74.125.83.70]) by youngberry.canonical.com with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.76) (envelope-from ) id 1eARX2-0004WA-MZ for kernel-team@lists.ubuntu.com; Fri, 03 Nov 2017 02:16:28 +0000 Received: by mail-pg0-f70.google.com with SMTP id w24so1696803pgm.7 for ; Thu, 02 Nov 2017 19:16:28 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references; bh=Ji2Cz+c9gI9fpy5slLK5NboSfc2wg1/dbNSrufUvudw=; b=n949IdofDac/S52SAGXC267cNlS7BnxQJtWVLvlrHieci2KHz7GmHx4R51yRWeIK/U R697FXFBXzioJDxCqG/4XE27IRHB/KSI02M9KCyvbBIUWaJYJFKI+BfxtPXq6AXH3nwS WFBDb0JC3F6BXiLYTZRhKi/kBI+TBnM+ORQe3KnGcm8/2pg9wbxj1qzEj/E+5jny/Dha TOiPZL/WN7CN955J9eVOCeE85Pzu6o1+dRYAyNfS8ALVwv8K5pxVfAa0zkMQz/u/4mlc u5dLYYGAbrf950XdV2/46fkclkE3X2xMOg7dBqyDsa3pkQfnzlAVt3y41oXPGG6HOM2L XxAw== X-Gm-Message-State: AMCzsaUx7ZHpxOAgar+epHjN/YXTu9Xs8OiL+bsYy0HLDLDOVPOSfGTj Gjgag8GEvHz3WGJIKw38yZehDokoY30Ve45wj6tXpH1NoRrQ4+nd7cZhf4Zt89H4A2GSyHvrkS1 dZ/t9mjuObnlqYP3ii2HseS4e1/5mJ+MkPtc8PIjyGA== X-Received: by 10.99.109.73 with SMTP id i70mr5436205pgc.177.1509675387133; Thu, 02 Nov 2017 19:16:27 -0700 (PDT) X-Google-Smtp-Source: ABhQp+QVHeopVtlEf8i6cSI97bYpidm3y7MmT6Jc5f86fsUT6PyE/ptg83MJAj18oEAqoxmKRV2NNg== X-Received: by 10.99.109.73 with SMTP id i70mr5436193pgc.177.1509675386822; Thu, 02 Nov 2017 19:16:26 -0700 (PDT) Received: from gavin-P70.buildd (114-35-245-81.HINET-IP.hinet.net. [114.35.245.81]) by smtp.gmail.com with ESMTPSA id m9sm7605264pff.26.2017.11.02.19.16.25 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 02 Nov 2017 19:16:25 -0700 (PDT) From: Gavin Guo To: kernel-team@lists.ubuntu.com Subject: [SRU][X/Z/A][PATCH] xfs: reinit btree pointer on attr tree inactivation walk Date: Fri, 3 Nov 2017 10:16:18 +0800 Message-Id: <1509675378-15958-2-git-send-email-gavin.guo@canonical.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1509675378-15958-1-git-send-email-gavin.guo@canonical.com> References: <1509675378-15958-1-git-send-email-gavin.guo@canonical.com> X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Brian Foster BugLink: http://bugs.launchpad.net/bugs/1729256 xfs_attr3_root_inactive() walks the attr fork tree to invalidate the associated blocks. xfs_attr3_node_inactive() recursively descends from internal blocks to leaf blocks, caching block address values along the way to revisit parent blocks, locate the next entry and descend down that branch of the tree. The code that attempts to reread the parent block is unsafe because it assumes that the local xfs_da_node_entry pointer remains valid after an xfs_trans_brelse() and re-read of the parent buffer. Under heavy memory pressure, it is possible that the buffer has been reclaimed and reallocated by the time the parent block is reread. This means that 'btree' can point to an invalid memory address, lead to a random/garbage value for child_fsb and cause the subsequent read of the attr fork to go off the rails and return a NULL buffer for an attr fork offset that is most likely not allocated. Note that this problem can be manufactured by setting XFS_ATTR_BTREE_REF to 0 to prevent LRU caching of attr buffers, creating a file with a multi-level attr fork and removing it to trigger inactivation. To address this problem, reinit the node/btree pointers to the parent buffer after it has been re-read. This ensures btree points to a valid record and allows the walk to proceed. Signed-off-by: Brian Foster Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong (cherry picked from commit f35c5e10c6ed6ba52a8dd8573924a80b6a02f03f) Signed-off-by: Gavin Guo Acked-by: Stefan Bader Acked-by: Kleber Sacilotto de Souza --- fs/xfs/xfs_attr_inactive.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/xfs/xfs_attr_inactive.c b/fs/xfs/xfs_attr_inactive.c index 2bb959ada45b..d8359f41f4a7 100644 --- a/fs/xfs/xfs_attr_inactive.c +++ b/fs/xfs/xfs_attr_inactive.c @@ -302,6 +302,8 @@ xfs_attr3_node_inactive( &bp, XFS_ATTR_FORK); if (error) return error; + node = bp->b_addr; + btree = dp->d_ops->node_tree_p(node); child_fsb = be32_to_cpu(btree[i + 1].before); xfs_trans_brelse(*trans, bp); }