linux/fs/xfs
Darrick J. Wong fe2f9135df xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots
LOLLM noticed that the inode btree root formatting methods copy too many
bytes -- there's only one set of keys in node blocks, not two.  This
causes memory corruption of whatever's beyond the buffers.

Cc: stable@vger.kernel.org # v6.14
Fixes: f0415af60f ("xfs: wire up a new metafile type for the realtime refcount")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
2026-09-17 11:27:41 +02:00
..
libxfs xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots 2026-09-17 11:27:41 +02:00
scrub xfs: don't let memory failures leak blocks and kill repairs 2026-09-17 11:27:41 +02:00
Kconfig xfs: XFS_ONLINE_SCRUB_STATS should depend on DEBUG_FS 2025-10-21 09:52:59 +02:00
Makefile xfs: split ioend handling into a separate source file 2026-08-21 09:09:54 +02:00
xfs_acl.c xfs: directly include xfs_platform.h 2026-01-21 12:57:16 +01:00
xfs_acl.h
xfs_aops.c xfs: split ioend handling into a separate source file 2026-08-21 09:09:54 +02:00
xfs_aops.h xfs: split ioend handling into a separate source file 2026-08-21 09:09:54 +02:00
xfs_attr_inactive.c xfs: close crash window in attr dabtree inactivation 2026-03-23 10:47:28 +01:00
xfs_attr_item.c xfs: remove the i_ino field in struct xfs_inode 2026-06-09 09:14:41 +02:00
xfs_attr_item.h xfs: don't use a xfs_log_iovec for attr_item names and values 2025-07-24 17:30:15 +02:00
xfs_attr_list.c xfs: remove the i_ino field in struct xfs_inode 2026-06-09 09:14:41 +02:00
xfs_bio_io.c xfs: directly include xfs_platform.h 2026-01-21 12:57:16 +01:00
xfs_bmap_item.c xfs: fix typos and repeated words in comments 2026-09-15 10:47:28 +02:00
xfs_bmap_item.h xfs: add helpers to compute log item overhead 2025-05-07 14:25:30 -07:00
xfs_bmap_util.c xfs: add support for FALLOC_FL_WRITE_ZEROES 2026-07-22 15:12:10 +02:00
xfs_bmap_util.h xfs: add support for FALLOC_FL_WRITE_ZEROES 2026-07-22 15:12:10 +02:00
xfs_buf_item_recover.c xfs: remove _XBF_LOGRECOVERY 2026-08-10 08:34:43 +02:00
xfs_buf_item.c xfs: remove _XBF_LOGRECOVERY 2026-08-10 08:34:43 +02:00
xfs_buf_item.h xfs: remove several unused and never-implemented declarations 2026-09-07 08:21:54 +02:00
xfs_buf_mem.c xfs: switch (back) to a per-buftarg buffer hash 2026-03-30 16:34:05 +02:00
xfs_buf_mem.h xfs: cleanup mapping tmpfs folios into the buffer cache 2025-03-10 14:29:44 +01:00
xfs_buf.c xfs: mark slab-allocated xfs_buf backing memory as __GFP_RECLAIMABLE 2026-09-07 07:50:35 +02:00
xfs_buf.h xfs: hide b_flags manipulation from code outside of xfs_buf.c 2026-08-10 08:34:43 +02:00
xfs_dahash_test.c xfs: directly include xfs_platform.h 2026-01-21 12:57:16 +01:00
xfs_dahash_test.h
xfs_dir2_readdir.c xfs: remove the i_ino field in struct xfs_inode 2026-06-09 09:14:41 +02:00
xfs_discard.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
xfs_discard.h xfs: ignore discard return value 2025-12-16 08:49:56 +01:00
xfs_dquot_item_recover.c xfs: new patches for Linux 7.3 2026-08-17 16:41:57 -07:00
xfs_dquot_item.c xfs: save ailp before dropping the AIL lock in push callbacks 2026-03-18 09:40:31 +01:00
xfs_dquot_item.h
xfs_dquot.c xfs: call xfs_dquot_set_prealloc_limits if we installed default rtb limits 2026-09-17 11:27:41 +02:00
xfs_dquot.h xfs: remove xfs_qm_dqput and optimize dropping dquot references 2025-11-11 11:45:58 +01:00
xfs_drain.c xfs: directly include xfs_platform.h 2026-01-21 12:57:16 +01:00
xfs_drain.h xfs: allow queued realtime intents to drain before scrubbing 2024-12-23 13:06:06 -08:00
xfs_error.c xfs: remove the i_ino field in struct xfs_inode 2026-06-09 09:14:41 +02:00
xfs_error.h xfs: allow setting errortags at mount time 2026-01-30 10:41:42 +01:00
xfs_exchmaps_item.c xfs: actually recover intended file sizes in xfs_xmi_item_recover_intent 2026-09-07 07:50:35 +02:00
xfs_exchmaps_item.h
xfs_exchrange.c xfs: don't call xfs_exchange_range_finish for a dry run 2026-09-15 10:11:11 +02:00
xfs_exchrange.h
xfs_export.c xfs: new code for Linux 7.2 2026-06-16 11:50:40 +05:30
xfs_export.h
xfs_extent_busy.c xfs: fix the lock annotation in xfs_extent_busy_update_extent 2026-09-07 07:50:34 +02:00
xfs_extent_busy.h xfs: don't allocate the xfs_extent_busy structure for zoned RTGs 2025-07-18 17:42:31 +02:00
xfs_extfree_item.c xfs: fix integer overflow in deferred intent sort comparators 2026-04-07 13:08:27 +02:00
xfs_extfree_item.h xfs: remove the xfs_efd_log_format_t typedef 2025-09-16 12:25:05 +02:00
xfs_file.c xfs: avoid extra cache flushes for multi-device file systems in xfs_fsync 2026-09-10 16:26:37 +02:00
xfs_file.h
xfs_filestream.c xfs: remove the i_ino field in struct xfs_inode 2026-06-09 09:14:41 +02:00
xfs_filestream.h
xfs_fsmap.c xfs: replace ns_capable_noaudit 2026-08-21 09:09:54 +02:00
xfs_fsmap.h
xfs_fsops.c xfs: hide b_flags manipulation from code outside of xfs_buf.c 2026-08-10 08:34:43 +02:00
xfs_fsops.h xfs: support reserved blocks for the rt extent counter 2025-03-03 08:16:43 -07:00
xfs_globals.c xfs: directly include xfs_platform.h 2026-01-21 12:57:16 +01:00
xfs_handle.c xfs: remove the i_ino field in struct xfs_inode 2026-06-09 09:14:41 +02:00
xfs_handle.h
xfs_health.c xfs: don't report half-built inodes to fserror 2026-02-25 13:58:49 +01:00
xfs_healthmon.c xfs: don't merge different file IO error types 2026-09-17 11:27:41 +02:00
xfs_healthmon.h xfs: port healthmon event list to list_head 2026-09-07 07:50:36 +02:00
xfs_hooks.c xfs: directly include xfs_platform.h 2026-01-21 12:57:16 +01:00
xfs_hooks.h
xfs_icache.c xfs: fix blockgc group quota scanning when usrquota isn't enforced 2026-09-17 11:27:41 +02:00
xfs_icache.h
xfs_icreate_item.c xfs: directly include xfs_platform.h 2026-01-21 12:57:16 +01:00
xfs_icreate_item.h
xfs_inode_item_recover.c xfs: remove _XBF_LOGRECOVERY 2026-08-10 08:34:43 +02:00
xfs_inode_item.c xfs: store an agbno in struct xfs_imap 2026-06-09 09:14:42 +02:00
xfs_inode_item.h xfs: rework datasync tracking and execution 2025-09-23 15:12:43 +02:00
xfs_inode.c xfs: fix typos and repeated words in comments 2026-09-15 10:47:28 +02:00
xfs_inode.h xfs: remove several unused and never-implemented declarations 2026-09-07 08:21:54 +02:00
xfs_ioctl.c xfs: replace ns_capable_noaudit 2026-08-21 09:09:54 +02:00
xfs_ioctl.h tree-wide: s/struct fileattr/struct file_kattr/g 2025-07-04 16:14:39 +02:00
xfs_ioctl32.c xfs: directly include xfs_platform.h 2026-01-21 12:57:16 +01:00
xfs_ioctl32.h
xfs_ioend.c xfs: split ioend handling into a separate source file 2026-08-21 09:09:54 +02:00
xfs_ioend.h xfs: split ioend handling into a separate source file 2026-08-21 09:09:54 +02:00
xfs_iomap.c xfs: factor out a xfs_iomap_set_anon_write helper 2026-08-21 09:09:54 +02:00
xfs_iomap.h xfs: set IOMAP_F_INTEGRITY for zoned writes on integrity devices 2026-09-10 16:26:37 +02:00
xfs_iops.c xfs: replace ns_capable_noaudit 2026-08-21 09:09:54 +02:00
xfs_iops.h xfs: refine atomic write size check in xfs_file_write_iter() 2025-05-07 14:25:31 -07:00
xfs_itable.c xfs: store an agbno in struct xfs_imap 2026-06-09 09:14:42 +02:00
xfs_itable.h xfs: remove XFS_IBULK_SAME_AG 2025-08-11 14:03:31 +02:00
xfs_iunlink_item.c xfs: store an agbno in struct xfs_imap 2026-06-09 09:14:42 +02:00
xfs_iunlink_item.h
xfs_iwalk.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
xfs_iwalk.h
xfs_log_cil.c xfs: fix typos and repeated words in comments 2026-09-15 10:47:28 +02:00
xfs_log_priv.h xfs: improve lock annotations in the log code 2026-09-07 07:50:34 +02:00
xfs_log_recover.c xfs: fix cursor and pointer handling when recovering iunlink buckets 2026-09-17 11:27:41 +02:00
xfs_log.c xfs: also flush the RT device cache in xlog_write_iclog 2026-09-10 16:26:37 +02:00
xfs_log.h xfs: remove several unused and never-implemented declarations 2026-09-07 08:21:54 +02:00
xfs_message.c xfs: drop the experimental warning for the zoned allocator 2026-06-09 09:14:41 +02:00
xfs_message.h xfs: drop the experimental warning for the zoned allocator 2026-06-09 09:14:41 +02:00
xfs_mount.c xfs: shut down the filesystem on a failed mount 2026-06-12 09:57:02 +02:00
xfs_mount.h xfs: update BDI {io,ra}_pages values based on the RT device limits 2026-07-22 15:06:24 +02:00
xfs_mru_cache.c xfs: fix the lock annotation in xfs_mru_cache_lookup 2026-09-07 07:50:34 +02:00
xfs_mru_cache.h
xfs_notify_failure.c xfs: Fix typo in comment 2026-05-11 12:58:38 +02:00
xfs_notify_failure.h xfs: react to fsdax failure notifications on the rt device 2024-12-23 13:06:09 -08:00
xfs_platform.h xfs: fix typos and repeated words in comments 2026-09-15 10:47:28 +02:00
xfs_pnfs.c vfs-7.2-rc1.exportfs 2026-06-15 02:38:54 +05:30
xfs_pnfs.h exportfs: split out the ops for layout-based block device access 2026-05-11 11:11:48 +02:00
xfs_pwork.c xfs: directly include xfs_platform.h 2026-01-21 12:57:16 +01:00
xfs_pwork.h
xfs_qm_bhv.c xfs: directly include xfs_platform.h 2026-01-21 12:57:16 +01:00
xfs_qm_syscalls.c xfs: return default quota limits for IDs without a dquot 2026-03-31 12:51:41 +02:00
xfs_qm.c xfs: drop dquot flush lock when we can't find a buffer to flush 2026-09-17 11:27:41 +02:00
xfs_qm.h xfs: make qi_dquots a 64-bit value 2025-11-11 11:45:57 +01:00
xfs_quota.h xfs: prepare to reuse the dquot pointer space in struct xfs_inode 2024-12-23 13:06:03 -08:00
xfs_quotaops.c xfs: remove the i_ino field in struct xfs_inode 2026-06-09 09:14:41 +02:00
xfs_refcount_item.c xfs: use the correct reservations for rtrmap/refcount recovery 2026-09-15 10:11:11 +02:00
xfs_refcount_item.h xfs: add helpers to compute log item overhead 2025-05-07 14:25:30 -07:00
xfs_reflink.c xfs: resample the data fork mapping after cycling ILOCK 2026-07-14 11:00:14 +02:00
xfs_reflink.h xfs: remove unused xfs_reflink_remap_range declaration 2026-09-15 10:20:05 +02:00
xfs_rmap_item.c xfs: use the correct reservations for rtrmap/refcount recovery 2026-09-15 10:11:11 +02:00
xfs_rmap_item.h xfs: add helpers to compute log item overhead 2025-05-07 14:25:30 -07:00
xfs_rtalloc.c xfs: propagate errors from xfs_rtginode_load 2026-07-20 11:17:32 +02:00
xfs_rtalloc.h xfs: make metabtree reservations global 2025-03-03 08:16:43 -07:00
xfs_stats.c xfs: remove metafile inodes from the active inode stat 2026-02-25 13:58:48 +01:00
xfs_stats.h xfs: remove metafile inodes from the active inode stat 2026-02-25 13:58:48 +01:00
xfs_super.c xfs: don't flush and invalidate internal RT device twice in xfs_shutdown_devices 2026-08-21 09:09:54 +02:00
xfs_super.h xfs: react to fsdax failure notifications on the rt device 2024-12-23 13:06:09 -08:00
xfs_symlink.c xfs: remove the i_ino field in struct xfs_inode 2026-06-09 09:14:41 +02:00
xfs_symlink.h
xfs_sysctl.c xfs: directly include xfs_platform.h 2026-01-21 12:57:16 +01:00
xfs_sysctl.h xfs: remove deprecated sysctl knobs 2025-09-05 08:48:23 -07:00
xfs_sysfs.c xfs: tie zoned sysfs lifetime to zone info 2026-07-08 14:54:04 +02:00
xfs_sysfs.h xfs: tie zoned sysfs lifetime to zone info 2026-07-08 14:54:04 +02:00
xfs_trace.c xfs: autonomous self healing of filesystems [v7] 2026-01-28 10:02:20 +01:00
xfs_trace.h xfs: merge healthmon insert/push helpers 2026-09-07 07:50:36 +02:00
xfs_trans_ail.c xfs: add lock annotations to xfs_ail_delete* 2026-09-07 07:50:34 +02:00
xfs_trans_buf.c xfs: split an assert in xfs_trans_log_buf 2026-08-21 09:09:54 +02:00
xfs_trans_dquot.c xfs: remove the i_ino field in struct xfs_inode 2026-06-09 09:14:41 +02:00
xfs_trans_priv.h xfs: remove the leftover xfs_{set,clear}_li_failed infrastructure 2025-04-14 10:24:30 +02:00
xfs_trans.c xfs: restore nofs context unconditionally in xfs_trans_roll 2026-08-10 08:43:56 +02:00
xfs_trans.h xfs: fix incorrect context handling in xfs_trans_roll 2026-01-21 12:59:10 +01:00
xfs_verify_media.c xfs: fix media verification ioctl for internal rt volumes 2026-09-07 07:50:33 +02:00
xfs_verify_media.h xfs: add media verification ioctl 2026-01-20 18:06:52 -08:00
xfs_xattr.c xfs: remove the i_ino field in struct xfs_inode 2026-06-09 09:14:41 +02:00
xfs_xattr.h
xfs_zone_alloc.c xfs: fix typos and repeated words in comments 2026-09-15 10:47:28 +02:00
xfs_zone_alloc.h xfs: factor out a xfs_zone_mark_free helper 2026-06-10 08:25:13 +02:00
xfs_zone_gc.c xfs: fix typos and repeated words in comments 2026-09-15 10:47:28 +02:00
xfs_zone_info.c xfs: untangle the open zones reporting in mountinfo 2026-04-07 13:28:47 +02:00
xfs_zone_priv.h xfs: reduce special casing for the open GC zone 2026-04-07 13:28:47 +02:00
xfs_zone_space_resv.c xfs: prevent race in zoned space reservations 2026-09-07 07:50:33 +02:00