TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

xfs: fix a sloppy memory handling bug in xfs_iroot_realloc

Browse Source 
commit de55149b66 upstream.

While refactoring code, I noticed that when xfs_iroot_realloc tries to
shrink a bmbt root block, it allocates a smaller new block and then
copies "records" and pointers to the new block.  However, bmbt root
blocks cannot ever be leaves, which means that it's not technically
correct to copy records.  We /should/ be copying keys.

Note that this has never resulted in actual memory corruption because
sizeof(bmbt_rec) == (sizeof(bmbt_key) + sizeof(bmbt_ptr)).  However,
this will no longer be true when we start adding realtime rmap stuff,
so fix this now.

Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Catherine Hoang <catherine.hoang@oracle.com>
Acked-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Darrick J. Wong
2025-02-05 13:40:04 -08:00
committed by Greg Kroah-Hartman
parent 629e6a35dd
commit a6790b50bf
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fs/xfs/libxfs/xfs_inode_fork.c
+5 -5
View File
@@ -449,15 +449,15 @@ xfs_iroot_realloc(
}
/*
* Only copy the records and pointers if there are any.
* Only copy the keys and pointers if there are any.
*/
if (new_max > 0) {
/*
* First copy the records.
* First copy the keys.
*/
op = (char *)XFS_BMBT_REC_ADDR(mp, ifp->if_broot, 1);
np = (char *)XFS_BMBT_REC_ADDR(mp, new_broot, 1);
memcpy(np, op, new_max * (uint)sizeof(xfs_bmbt_rec_t));
op = (char *)XFS_BMBT_KEY_ADDR(mp, ifp->if_broot, 1);
np = (char *)XFS_BMBT_KEY_ADDR(mp, new_broot, 1);
memcpy(np, op, new_max * (uint)sizeof(xfs_bmbt_key_t));
/*
* Then copy the pointers.