Re: [PATCH] xfs: fix s_maxbytes computation on 32-bit kernels

["Darrick J. Wong" <darrick.wong@oracle.com>]

On Tue, Dec 24, 2019 at 12:25:00AM -0800, Christoph Hellwig wrote:
> On Sun, Dec 22, 2019 at 08:37:11AM -0800, Darrick J. Wong wrote:
> > From: Darrick J. Wong <darrick.wong@oracle.com>
> > 
> > I observed a hang in generic/308 while running fstests on a i686 kernel.
> > The hang occurred when trying to purge the pagecache on a large sparse
> > file that had a page created past MAX_LFS_FILESIZE, which caused an
> > integer overflow in the pagecache xarray and resulted in an infinite
> > loop.
> > 
> > I then noticed that Linus changed the definition of MAX_LFS_FILESIZE in
> > commit 0cc3b0ec23ce ("Clarify (and fix) MAX_LFS_FILESIZE macros") so
> > that it is now one page short of the maximum page index on 32-bit
> > kernels.  Because the XFS function to compute max offset open-codes the
> > 2005-era MAX_LFS_FILESIZE computation and neither the vfs nor mm perform
> > any sanity checking of s_maxbytes, the code in generic/308 can create a
> > page above the pagecache's limit and kaboom.
> > 
> > So, fix the function to return MAX_LFS_FILESIZE, but check that bmbt
> > record offsets have enough space to handle that many bytes.  I have no
> > answer for why this seems to have been broken for years and nobody
> > noticed.
> > 
> > Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> > ---
> >  fs/xfs/xfs_super.c |   37 ++++++++++++++++---------------------
> >  1 file changed, 16 insertions(+), 21 deletions(-)
> > 
> > diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
> > index d9ae27ddf253..30a17e5ffa67 100644
> > --- a/fs/xfs/xfs_super.c
> > +++ b/fs/xfs/xfs_super.c
> > @@ -193,30 +193,25 @@ xfs_fs_show_options(
> >  	return 0;
> >  }
> >  
> > -static uint64_t
> > +static loff_t
> >  xfs_max_file_offset(
> > -	unsigned int		blockshift)
> > +	struct xfs_mount	*mp)
> >  {
> > -	unsigned int		pagefactor = 1;
> > -	unsigned int		bitshift = BITS_PER_LONG - 1;
> > -
> > -	/* Figure out maximum filesize, on Linux this can depend on
> > -	 * the filesystem blocksize (on 32 bit platforms).
> > -	 * __block_write_begin does this in an [unsigned] long long...
> > -	 *      page->index << (PAGE_SHIFT - bbits)
> > -	 * So, for page sized blocks (4K on 32 bit platforms),
> > -	 * this wraps at around 8Tb (hence MAX_LFS_FILESIZE which is
> > -	 *      (((u64)PAGE_SIZE << (BITS_PER_LONG-1))-1)
> > -	 * but for smaller blocksizes it is less (bbits = log2 bsize).
> > +	/*
> > +	 * XFS block mappings use 54 bits to store the logical block offset.
> > +	 * This should suffice to handle the maximum file size that the VFS
> > +	 * supports (currently 2^63 bytes on 64-bit and ULONG_MAX << PAGE_SHIFT
> > +	 * bytes on 32-bit), but as XFS and VFS have gotten the s_maxbytes
> > +	 * calculation wrong on 32-bit kernels in the past, we'll add a WARN_ON
> > +	 * to check this assertion before returning MAX_LFS_FILESIZE.
> > +	 *
> > +	 * Avoid integer overflow by comparing the maximum bmbt offset to the
> > +	 * maximum pagecache offset in units of fs blocks.
> >  	 */
> > +	WARN_ON(((1ULL << BMBT_STARTOFF_BITLEN) - 1) <
> > +		XFS_B_TO_FSBT(mp, MAX_LFS_FILESIZE));
> >  
> > -#if BITS_PER_LONG == 32
> > -	ASSERT(sizeof(sector_t) == 8);
> > -	pagefactor = PAGE_SIZE;
> > -	bitshift = BITS_PER_LONG;
> > -#endif
> > -
> > -	return (((uint64_t)pagefactor) << bitshift) - 1;
> > +	return MAX_LFS_FILESIZE;
> >  }
> >  
> >  /*
> > @@ -1435,7 +1430,7 @@ xfs_fc_fill_super(
> >  	sb->s_magic = XFS_SUPER_MAGIC;
> >  	sb->s_blocksize = mp->m_sb.sb_blocksize;
> >  	sb->s_blocksize_bits = ffs(sb->s_blocksize) - 1;
> > -	sb->s_maxbytes = xfs_max_file_offset(sb->s_blocksize_bits);
> > +	sb->s_maxbytes = xfs_max_file_offset(mp);
> 
> The code organization is really weird now.  Just assign MAX_LFS_FILESIZE
> to s_maxbytes directly here, and move the WARN_ON right next to it -
> preferably as a WARN_ON_ONCE with an actual error return instead of
> just warning.

Ok.

--D