diff options
| author | Dave Chinner <dchinner@redhat.com> | 2013-08-26 14:13:30 +1000 |
|---|---|---|
| committer | Ben Myers <bpm@sgi.com> | 2013-08-30 09:48:59 -0500 |
| commit | 37804376121de1a25fb582bdd8970f139c4d9685 (patch) | |
| tree | d475f98cdb8fc0548a7e14f8eb480a58c855a1b3 | |
| parent | 0f0d334595105d982ea22ae1d5947723e462344f (diff) | |
| download | linux-37804376121de1a25fb582bdd8970f139c4d9685.tar.bz2 | |
XFS: Assertion failed: first <= last && last < BBTOB(bp->b_length), file: fs/xfs/xfs_trans_buf.c, line: 568
The calculation doesn't take into account the size of the dir v3
header, so overestimates the hash entries in a node. This causes
directory buffer overruns when splitting and merging nodes.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Tested-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Mark Tinguely <tinguely@sgi.com>
Signed-off-by: Ben Myers <bpm@sgi.com>
| -rw-r--r-- | fs/xfs/xfs_da_btree.h | 11 | ||||
| -rw-r--r-- | fs/xfs/xfs_dir2.c | 16 |
2 files changed, 19 insertions, 8 deletions
diff --git a/fs/xfs/xfs_da_btree.h b/fs/xfs/xfs_da_btree.h index 8cdc77b2e58d..b1f267995dea 100644 --- a/fs/xfs/xfs_da_btree.h +++ b/fs/xfs/xfs_da_btree.h @@ -133,12 +133,19 @@ extern void xfs_da3_node_hdr_to_disk(struct xfs_da_intnode *to, struct xfs_da3_icnode_hdr *from); static inline int -xfs_da3_node_hdr_size(struct xfs_da_intnode *dap) +__xfs_da3_node_hdr_size(bool v3) { - if (dap->hdr.info.magic == cpu_to_be16(XFS_DA3_NODE_MAGIC)) + if (v3) return sizeof(struct xfs_da3_node_hdr); return sizeof(struct xfs_da_node_hdr); } +static inline int +xfs_da3_node_hdr_size(struct xfs_da_intnode *dap) +{ + bool v3 = dap->hdr.info.magic == cpu_to_be16(XFS_DA3_NODE_MAGIC); + + return __xfs_da3_node_hdr_size(v3); +} static inline struct xfs_da_node_entry * xfs_da3_node_tree_p(struct xfs_da_intnode *dap) diff --git a/fs/xfs/xfs_dir2.c b/fs/xfs/xfs_dir2.c index d3ff96c321f9..edf203ab50af 100644 --- a/fs/xfs/xfs_dir2.c +++ b/fs/xfs/xfs_dir2.c @@ -90,6 +90,9 @@ void xfs_dir_mount( xfs_mount_t *mp) { + int nodehdr_size; + + ASSERT(xfs_sb_version_hasdirv2(&mp->m_sb)); ASSERT((1 << (mp->m_sb.sb_blocklog + mp->m_sb.sb_dirblklog)) <= XFS_MAX_BLOCKSIZE); @@ -98,12 +101,13 @@ xfs_dir_mount( mp->m_dirdatablk = xfs_dir2_db_to_da(mp, XFS_DIR2_DATA_FIRSTDB(mp)); mp->m_dirleafblk = xfs_dir2_db_to_da(mp, XFS_DIR2_LEAF_FIRSTDB(mp)); mp->m_dirfreeblk = xfs_dir2_db_to_da(mp, XFS_DIR2_FREE_FIRSTDB(mp)); - mp->m_attr_node_ents = - (mp->m_sb.sb_blocksize - (uint)sizeof(xfs_da_node_hdr_t)) / - (uint)sizeof(xfs_da_node_entry_t); - mp->m_dir_node_ents = - (mp->m_dirblksize - (uint)sizeof(xfs_da_node_hdr_t)) / - (uint)sizeof(xfs_da_node_entry_t); + + nodehdr_size = __xfs_da3_node_hdr_size(xfs_sb_version_hascrc(&mp->m_sb)); + mp->m_attr_node_ents = (mp->m_sb.sb_blocksize - nodehdr_size) / + (uint)sizeof(xfs_da_node_entry_t); + mp->m_dir_node_ents = (mp->m_dirblksize - nodehdr_size) / + (uint)sizeof(xfs_da_node_entry_t); + mp->m_dir_magicpct = (mp->m_dirblksize * 37) / 100; if (xfs_sb_version_hasasciici(&mp->m_sb)) mp->m_dirnameops = &xfs_ascii_ci_nameops; |