Darrick J. Wong dffa765748 xfs: fix high key handling in the rt allocator's query_range function ... [ Upstream commit d88850bd55 ] Fix some off-by-one errors in xfs_rtalloc_query_range. The highest key in the realtime bitmap is always one less than the number of rt extents, which means that the key clamp at the start of the function is wrong. The 4th argument to xfs_rtfind_forw is the highest rt extent that we want to probe, which means that passing 1 less than the high key is wrong. Finally, drop the rem variable that controls the loop because we can compare the iteration point (rtstart) against the high key directly. The sordid history of this function is that the original commit (fb3c3) incorrectly passed (high_rec->ar_startblock - 1) as the 'limit' parameter to xfs_rtfind_forw. This was wrong because the "high key" is supposed to be the largest key for which the caller wants result rows, not the key for the first row that could possibly be outside the range that the caller wants to see. A subsequent attempt (8ad56) to strengthen the parameter checking added incorrect clamping of the parameters to the number of rt blocks in the system (despite the bitmap functions all taking units of rt extents) to avoid querying ranges past the end of rt bitmap file but failed to fix the incorrect _rtfind_forw parameter. The original _rtfind_forw parameter error then survived the conversion of the startblock and blockcount fields to rt extents (a0e5c), and the most recent off-by-one fix (a3a37) thought it was patching a problem when the end of the rt volume is not in use, but none of these fixes actually solved the original problem that the author was confused about the "limit" argument to xfs_rtfind_forw. Sadly, all four of these patches were written by this author and even his own usage of this function and rt testing were inadequate to get this fixed quickly. Original-problem: fb3c3de2f6 ("xfs: add a couple of queries to iterate free extents in the rtbitmap") Not-fixed-by: 8ad560d256 ("xfs: strengthen rtalloc query range checks") Not-fixed-by: a0e5c435ba ("xfs: fix xfs_rtalloc_rec units") Fixes: a3a374bf18 ("xfs: fix off-by-one error in xfs_rtalloc_query_range") Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Reviewed-by: Chandan Babu R <chandanrlinux@gmail.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2020-10-29 09:55:17 +01:00
..
9p	9p: Fix memory leak in v9fs_mount	2020-08-19 08:15:06 +02:00
adfs	fs/adfs: super: fix use-after-free bug	2019-08-06 19:06:49 +02:00
affs	affs: fix basic permission bits to actually work	2020-09-09 19:04:30 +02:00
afs	afs: Fix NULL deref in afs_dynroot_depopulate()	2020-08-26 10:31:05 +02:00
autofs	autofs: fix a leak in autofs_expire_indirect()	2019-12-13 08:51:01 +01:00
befs
bfs	bfs: add sanity check at bfs_fill_super()	2018-12-01 09:37:27 +01:00
btrfs	btrfs: qgroup: fix data leak caused by race between writeback and truncate	2020-10-01 13:14:49 +02:00
cachefiles	cachefiles: Fix race between read_waiter and read_copier involving op->to_do	2020-06-03 08:19:29 +02:00
ceph	ceph: fix potential race in ceph_check_caps	2020-10-01 13:14:47 +02:00
cifs	cifs: Return the error from crypt_message when enc/dec key not found.	2020-10-29 09:54:59 +01:00
coda	coda: add error handling for fget	2019-08-06 19:06:51 +02:00
configfs	configfs: fix config_item refcnt leak in configfs_rmdir()	2020-05-27 17:37:32 +02:00
cramfs	Cramfs: fix abad comparison when wrap-arounds occur	2018-11-13 11:08:55 -08:00
crypto	fscrypt: clean up some BUG_ON()s in block encryption/decryption	2019-07-26 09:14:02 +02:00
debugfs	debugfs: fix use-after-free on symlink traversal	2019-05-08 07:21:48 +02:00
devpts	fs/devpts: always delete dcache dentry-s in dput()	2019-03-23 20:09:59 +01:00
dlm	dlm: Fix kobject memleak	2020-08-19 08:15:02 +02:00
ecryptfs	ecryptfs: replace BUG_ON with error handling code	2020-02-28 16:38:59 +01:00
efivarfs
efs
exofs	exofs_mount(): fix leaks on failure exits	2019-12-05 09:20:32 +01:00
exportfs	exportfs: fix 'passing zero to ERR_PTR()' warning	2020-01-27 14:50:02 +01:00
ext2	ext2: don't update mtime on COW faults	2020-09-09 19:04:28 +02:00
ext4	ext4: mark block bitmap corrupted when found instead of BUGON	2020-10-01 13:14:37 +02:00
f2fs	f2fs: Return EOF on unaligned end of file DIO read	2020-09-23 12:10:59 +02:00
fat	fat: don't allow to mount if the FAT length == 0	2020-06-22 09:05:08 +02:00
freevxfs
fscache	fscache: fix race between enablement and dropping of object	2018-12-17 09:24:40 +01:00
fuse	fuse: don't check refcount after stealing page	2020-10-01 13:14:44 +02:00
gfs2	gfs2: clean up iopen glock mess in gfs2_create_inode	2020-10-01 13:14:28 +02:00
hfs	fs/hfs/extent.c: fix array out of bounds read of array extent	2019-12-01 09:17:10 +01:00
hfsplus	hfsplus: fix crash and filesystem corruption when deleting files	2020-04-17 10:48:52 +02:00
hostfs	vfs: discard ATTR_ATTR_FLAG	2018-08-17 16:20:28 -07:00
hpfs	hpfs: remove unnecessary checks on the value of r when assigning error code	2018-08-25 12:42:33 -07:00
hugetlbfs	hugetlb: use same fault hash key for shared and private mappings	2019-05-22 07:37:40 +02:00
isofs	isofs: reject hardware sector size > 2048 bytes	2018-08-21 11:37:41 +02:00
jbd2	jbd2: abort journal if free a async write error metadata buffer	2020-09-03 11:24:24 +02:00
jffs2	jffs2: fix UAF problem	2020-08-26 10:31:01 +02:00
jfs	jfs: fix bogus variable self-initialization	2020-01-27 14:50:33 +01:00
kernfs	kernfs: fix ino wrap-around detection	2019-12-13 08:52:43 +01:00
lockd	lockd: fix decoding of TEST results	2019-12-13 08:51:59 +01:00
minix	fs/minix: remove expected error message in block_to_path()	2020-08-21 11:05:38 +02:00
nfs	nfs: Fix security label length not being reset	2020-10-07 08:00:07 +02:00
nfs_common
nfsd	nfsd: Don't add locks to closed or closing open stateids	2020-10-01 13:14:38 +02:00
nilfs2	nilfs2: fix null pointer dereference at nilfs_segctor_do_construct()	2020-06-22 09:05:03 +02:00
nls
notify	fanotify: fix ignore mask logic for events on child and on dir	2020-06-30 23:17:00 -04:00
ntfs	ntfs: mft: remove VLA usage	2018-08-17 16:20:27 -07:00
ocfs2	ocfs2: change slot number type s16 to u16	2020-08-21 11:05:33 +02:00
omfs
openpromfs
orangefs	help_next should increase position index	2020-02-24 08:34:53 +01:00
overlayfs	ovl: fix unneeded call to ovl_change_flags()	2020-07-22 09:32:10 +02:00
proc	mm, oom_adj: don't loop through tasks in __set_oom_adj when not necessary	2020-10-29 09:55:15 +01:00
pstore	pstore: Fix linking when crypto API disabled	2020-08-19 08:15:04 +02:00
qnx4
qnx6
quota	quota: clear padding in v2r1_mem2diskdqb()	2020-10-29 09:55:12 +01:00
ramfs
reiserfs	reiserfs: Fix oops during mount	2020-10-17 10:12:58 +02:00
romfs	romfs: fix uninitialized memory leak in romfs_dev_read()	2020-08-26 10:30:59 +02:00
squashfs
sysfs	Driver core patches for 4.19-rc1	2018-08-18 11:44:53 -07:00
sysv	sysv: return 'err' instead of 0 in __sysv_write_inode	2018-12-17 09:24:30 +01:00
tracefs
ubifs	ubifs: Fix out-of-bounds memory access caused by abnormal value of node_len	2020-10-01 13:14:40 +02:00
udf	udf: Fix free space reporting for metadata and virtual partitions	2020-02-24 08:34:45 +01:00
ufs	fs/ufs: avoid potential u32 multiplication overflow	2020-08-21 11:05:38 +02:00
xfs	xfs: fix high key handling in the rt allocator's query_range function	2020-10-29 09:55:17 +01:00
aio.c	aio: fix async fsync creds	2020-06-22 09:05:01 +02:00
anon_inodes.c
attr.c
bad_inode.c
binfmt_aout.c
binfmt_elf_fdpic.c
binfmt_elf.c	fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()	2020-06-03 08:19:41 +02:00
binfmt_em86.c
binfmt_flat.c	fs/binfmt_flat.c: make load_flat_shared_library() work	2019-07-03 13:14:44 +02:00
binfmt_misc.c
binfmt_script.c	exec: load_script: Do not exec truncated interpreter path	2019-11-06 13:05:37 +01:00
block_dev.c	bdev: Reduce time holding bd_mutex in sync in blkdev_close()	2020-10-01 13:14:42 +02:00
buffer.c	fs: prevent BUG_ON in submit_bh_wbc()	2020-09-03 11:24:24 +02:00
char_dev.c	chardev: Avoid potential use-after-free in 'chrdev_open()'	2020-01-14 20:06:57 +01:00
compat_binfmt_elf.c
compat_ioctl.c	fix compat handling of FICLONERANGE, FIDEDUPERANGE and FS_IOC_FIEMAP	2020-01-09 10:19:07 +01:00
compat.c
coredump.c	coredump: fix crash when umh is disabled	2020-05-14 07:57:21 +02:00
d_path.c
dax.c	dax: pass NOWAIT flag to iomap_apply	2020-03-05 16:42:12 +01:00
dcache.c	fix dget_parent() fastpath race	2020-10-01 13:14:27 +02:00
dcookies.c
direct-io.c	direct-io: allow direct writes to empty inodes	2019-03-05 17:58:50 +01:00
drop_caches.c	fs: avoid softlockups in s_inodes iterators	2020-01-12 12:17:20 +01:00
eventfd.c	eventfd: track eventfd_signal() recursion depth	2020-02-11 04:34:08 -08:00
eventpoll.c	ep_create_wakeup_source(): dentry name can change under you...	2020-10-07 08:00:09 +02:00
exec.c	exec: Move would_dump into flush_old_exec	2020-05-20 08:18:50 +02:00
fcntl.c	signal: Don't send signals to tasks that don't exist	2018-08-15 23:03:20 -05:00
fhandle.c
file_table.c	overlayfs update for 4.19	2018-08-21 18:19:09 -07:00
file.c	fix multiplication overflow in copy_fdtable()	2020-05-27 17:37:29 +02:00
filesystems.c	fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once()	2020-04-17 10:48:51 +02:00
fs_pin.c
fs_struct.c
fs-writeback.c	writeback: Fix sync livelock due to b_dirty_time processing	2020-09-03 11:24:28 +02:00
inode.c	futex: Fix inode life-time issue	2020-03-25 08:06:14 +01:00
internal.h	acct_on(): don't mess with freeze protection	2019-05-31 06:46:05 -07:00
ioctl.c	vfs: fix FIGETBSZ ioctl on an overlayfs file	2018-11-21 09:19:14 +01:00
iomap.c	iomap: partially revert 4721a60109 (simulated directio short read on EFAULT)	2019-12-13 08:52:56 +01:00
Kconfig
Kconfig.binfmt
libfs.c	libfs: fix infoleak in simple_attr_read()	2020-04-02 15:28:21 +02:00
locks.c	locks: print unsigned ino in /proc/locks	2020-01-09 10:19:00 +01:00
Makefile
mbcache.c
mount.h
mpage.c	mpage: mpage_readpages() should submit IO as read-ahead	2018-08-17 16:20:29 -07:00
namei.c	namei: only return -ECHILD from follow_dotdot_rcu()	2020-03-05 16:42:20 +01:00
namespace.c	fs/namespace.c: fix mountpoint reference counter race	2020-04-29 16:31:26 +02:00
no-block.c
nsfs.c	dcache: sort the freeing-without-RCU-delay mess for good.	2019-05-25 18:23:26 +02:00
open.c	cifs_atomic_open(): fix double-put on late allocation failure	2020-03-18 07:14:21 +01:00
pipe.c	fs: prevent page refcount overflow in pipe_buf_get	2019-05-04 09:20:11 +02:00
pnode.c	propagate_one(): mnt_set_mountpoint() needs mount_lock	2020-05-02 17:26:01 +02:00
pnode.h
posix_acl.c
proc_namespace.c
read_write.c	vfs: avoid problematic remapping requests into partial EOF block	2019-12-01 09:17:04 +01:00
readdir.c	filldir[64]: remove WARN_ON_ONCE() for bad directory entries	2020-01-04 19:13:26 +01:00
select.c
seq_file.c	seq_file: fix problem when seeking mid-record	2019-08-25 10:47:43 +02:00
signalfd.c	fs/signalfd.c: fix inconsistent return codes for signalfd4	2020-08-26 10:31:02 +02:00
splice.c	splice: only read in as much information as there is pipe buffer space	2019-12-17 20:35:43 +01:00
stack.c
stat.c
statfs.c	vfs: Fix EOVERFLOW testing in put_compat_statfs64	2019-10-11 18:21:39 +02:00
super.c	Merge branch 'ida-4.19' of git://git.infradead.org/users/willy/linux-dax	2018-08-26 11:48:42 -07:00
sync.c
timerfd.c	Merge branch 'work.aio' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-08-13 20:56:23 -07:00
userfaultfd.c	userfaultfd: require CAP_SYS_PTRACE for UFFD_FEATURE_EVENT_FORK	2020-01-04 19:13:18 +01:00
utimes.c
xattr.c	xattr: break delegations in {set,remove}xattr	2020-08-11 15:32:34 +02:00