[PATCH 0/2] xfs: random fixes

[PATCH 0/2] xfs: random fixes

[Darrick J. Wong]

Hi all,

Fixes for a couple of minor bugs that I found.

If you're going to start using this mess, you probably ought to just
pull from my git trees, which are linked below.

This is an extraordinary way to destroy everything.  Enjoy!
Comments and questions are, as always, welcome.

--D

kernel git tree:
https://git.kernel.org/cgit/linux/kernel/git/djwong/xfs-linux.git/log/?h=random-fixes

xfsprogs git tree:
https://git.kernel.org/cgit/linux/kernel/git/djwong/xfsprogs-dev.git/log/?h=random-fixes

fstests git tree:
https://git.kernel.org/cgit/linux/kernel/git/djwong/xfstests-dev.git/log/?h=random-fixes

[PATCH 1/2] xfs: fix use-after-free when aborting corrupt attr inactivation

[Darrick J. Wong]

From: Darrick J. Wong <darrick.wong@oracle.com>

Log the corrupt buffer before we release the buffer.

Fixes: a5155b870d687 ("xfs: always log corruption errors")
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
---
 fs/xfs/xfs_attr_inactive.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


diff --git a/fs/xfs/xfs_attr_inactive.c b/fs/xfs/xfs_attr_inactive.c
index bbfa6ba84dcd..fe8f60b59ec4 100644
--- a/fs/xfs/xfs_attr_inactive.c
+++ b/fs/xfs/xfs_attr_inactive.c
@@ -145,8 +145,8 @@ xfs_attr3_node_inactive(
 	 * Since this code is recursive (gasp!) we must protect ourselves.
 	 */
 	if (level > XFS_DA_NODE_MAXDEPTH) {
-		xfs_trans_brelse(*trans, bp);	/* no locks for later trans */
 		xfs_buf_corruption_error(bp);
+		xfs_trans_brelse(*trans, bp);	/* no locks for later trans */
 		return -EFSCORRUPTED;
 	}
 

[PATCH 2/2] xfs: fix xfs_rmap_has_other_keys usage of ECANCELED

[Darrick J. Wong]

From: Darrick J. Wong <darrick.wong@oracle.com>

In e7ee96dfb8c26, we converted all ITER_ABORT users to use ECANCELED
instead, but we forgot to teach xfs_rmap_has_other_keys not to return
that magic value to callers.  Fix it now.

Fixes: e7ee96dfb8c26 ("xfs: remove all *_ITER_ABORT values")
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
---
 fs/xfs/libxfs/xfs_rmap.c |   13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)


diff --git a/fs/xfs/libxfs/xfs_rmap.c b/fs/xfs/libxfs/xfs_rmap.c
index ff9412f113c4..dae1a2bf28eb 100644
--- a/fs/xfs/libxfs/xfs_rmap.c
+++ b/fs/xfs/libxfs/xfs_rmap.c
@@ -2694,7 +2694,6 @@ struct xfs_rmap_key_state {
 	uint64_t			owner;
 	uint64_t			offset;
 	unsigned int			flags;
-	bool				has_rmap;
 };
 
 /* For each rmap given, figure out if it doesn't match the key we want. */
@@ -2709,7 +2708,6 @@ xfs_rmap_has_other_keys_helper(
 	if (rks->owner == rec->rm_owner && rks->offset == rec->rm_offset &&
 	    ((rks->flags & rec->rm_flags) & XFS_RMAP_KEY_FLAGS) == rks->flags)
 		return 0;
-	rks->has_rmap = true;
 	return -ECANCELED;
 }
 
@@ -2731,7 +2729,7 @@ xfs_rmap_has_other_keys(
 	int				error;
 
 	xfs_owner_info_unpack(oinfo, &rks.owner, &rks.offset, &rks.flags);
-	rks.has_rmap = false;
+	*has_rmap = false;
 
 	low.rm_startblock = bno;
 	memset(&high, 0xFF, sizeof(high));
@@ -2739,11 +2737,12 @@ xfs_rmap_has_other_keys(
 
 	error = xfs_rmap_query_range(cur, &low, &high,
 			xfs_rmap_has_other_keys_helper, &rks);
-	if (error < 0)
-		return error;
+	if (error == -ECANCELED) {
+		*has_rmap = true;
+		return 0;
+	}
 
-	*has_rmap = rks.has_rmap;
-	return 0;
+	return error;
 }
 
 const struct xfs_owner_info XFS_RMAP_OINFO_SKIP_UPDATE = {

Re: [PATCH 1/2] xfs: fix use-after-free when aborting corrupt attr inactivation

[Dave Chinner]

On Tue, Mar 10, 2020 at 05:47:04PM -0700, Darrick J. Wong wrote:
> From: Darrick J. Wong <darrick.wong@oracle.com>
> 
> Log the corrupt buffer before we release the buffer.
> 
> Fixes: a5155b870d687 ("xfs: always log corruption errors")
> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> ---
>  fs/xfs/xfs_attr_inactive.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> 
> diff --git a/fs/xfs/xfs_attr_inactive.c b/fs/xfs/xfs_attr_inactive.c
> index bbfa6ba84dcd..fe8f60b59ec4 100644
> --- a/fs/xfs/xfs_attr_inactive.c
> +++ b/fs/xfs/xfs_attr_inactive.c
> @@ -145,8 +145,8 @@ xfs_attr3_node_inactive(
>  	 * Since this code is recursive (gasp!) we must protect ourselves.
>  	 */
>  	if (level > XFS_DA_NODE_MAXDEPTH) {
> -		xfs_trans_brelse(*trans, bp);	/* no locks for later trans */
>  		xfs_buf_corruption_error(bp);
> +		xfs_trans_brelse(*trans, bp);	/* no locks for later trans */

Yup, that needs fixing.

Reviewed-by: Dave Chinner <dchinner@redhat.com>
-- 
Dave Chinner
david@fromorbit.com

Re: [PATCH 2/2] xfs: fix xfs_rmap_has_other_keys usage of ECANCELED

[Dave Chinner]

On Tue, Mar 10, 2020 at 05:47:10PM -0700, Darrick J. Wong wrote:
> From: Darrick J. Wong <darrick.wong@oracle.com>
> 
> In e7ee96dfb8c26, we converted all ITER_ABORT users to use ECANCELED
> instead, but we forgot to teach xfs_rmap_has_other_keys not to return
> that magic value to callers.  Fix it now.
> 
> Fixes: e7ee96dfb8c26 ("xfs: remove all *_ITER_ABORT values")
> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>

/me had to go look at that commit to see what this was fixing.

> ---
>  fs/xfs/libxfs/xfs_rmap.c |   13 ++++++-------
>  1 file changed, 6 insertions(+), 7 deletions(-)
> 
> 
> diff --git a/fs/xfs/libxfs/xfs_rmap.c b/fs/xfs/libxfs/xfs_rmap.c
> index ff9412f113c4..dae1a2bf28eb 100644
> --- a/fs/xfs/libxfs/xfs_rmap.c
> +++ b/fs/xfs/libxfs/xfs_rmap.c
> @@ -2694,7 +2694,6 @@ struct xfs_rmap_key_state {
>  	uint64_t			owner;
>  	uint64_t			offset;
>  	unsigned int			flags;
> -	bool				has_rmap;
>  };
>  
>  /* For each rmap given, figure out if it doesn't match the key we want. */
> @@ -2709,7 +2708,6 @@ xfs_rmap_has_other_keys_helper(
>  	if (rks->owner == rec->rm_owner && rks->offset == rec->rm_offset &&
>  	    ((rks->flags & rec->rm_flags) & XFS_RMAP_KEY_FLAGS) == rks->flags)
>  		return 0;
> -	rks->has_rmap = true;
>  	return -ECANCELED;
>  }
>  
> @@ -2731,7 +2729,7 @@ xfs_rmap_has_other_keys(
>  	int				error;
>  
>  	xfs_owner_info_unpack(oinfo, &rks.owner, &rks.offset, &rks.flags);
> -	rks.has_rmap = false;
> +	*has_rmap = false;
>  
>  	low.rm_startblock = bno;
>  	memset(&high, 0xFF, sizeof(high));
> @@ -2739,11 +2737,12 @@ xfs_rmap_has_other_keys(
>  
>  	error = xfs_rmap_query_range(cur, &low, &high,
>  			xfs_rmap_has_other_keys_helper, &rks);
> -	if (error < 0)
> -		return error;
> +	if (error == -ECANCELED) {
> +		*has_rmap = true;
> +		return 0;
> +	}
>  
> -	*has_rmap = rks.has_rmap;
> -	return 0;
> +	return error;
>  }

Ok, so there's two things here. The first is catching ECANCELED and
returning the correct value(0). The second is we no longer need the
rks.has_rmap member to be passed to the helper, because -ECANCELED
indicates that we found an rmap.

Ok, makes sense.

Reviewed-by: Dave Chinner <dchinner@redhat.com>
-- 
Dave Chinner
david@fromorbit.com

Re: [PATCH 1/2] xfs: fix use-after-free when aborting corrupt attr inactivation

[Christoph Hellwig]

On Tue, Mar 10, 2020 at 05:47:04PM -0700, Darrick J. Wong wrote:
> From: Darrick J. Wong <darrick.wong@oracle.com>
> 
> Log the corrupt buffer before we release the buffer.

Oops,

looks correct:

Reviewed-by: Christoph Hellwig <hch@lst.de>

Re: [PATCH 2/2] xfs: fix xfs_rmap_has_other_keys usage of ECANCELED

[Christoph Hellwig]

On Tue, Mar 10, 2020 at 05:47:10PM -0700, Darrick J. Wong wrote:
> From: Darrick J. Wong <darrick.wong@oracle.com>
> 
> In e7ee96dfb8c26, we converted all ITER_ABORT users to use ECANCELED
> instead, but we forgot to teach xfs_rmap_has_other_keys not to return
> that magic value to callers.  Fix it now.

This doesn't document the remap of the has_rmap flag.  As far as I can
tell that isn't needed now the caller checks for ECANCELED, but it
takes a while to figure that out.  It'll need to be documented properly
in the commit log.

Re: [PATCH 2/2] xfs: fix xfs_rmap_has_other_keys usage of ECANCELED

[Darrick J. Wong]

On Tue, Mar 10, 2020 at 11:40:11PM -0700, Christoph Hellwig wrote:
> On Tue, Mar 10, 2020 at 05:47:10PM -0700, Darrick J. Wong wrote:
> > From: Darrick J. Wong <darrick.wong@oracle.com>
> > 
> > In e7ee96dfb8c26, we converted all ITER_ABORT users to use ECANCELED
> > instead, but we forgot to teach xfs_rmap_has_other_keys not to return
> > that magic value to callers.  Fix it now.
> 
> This doesn't document the remap of the has_rmap flag.  As far as I can
> tell that isn't needed now the caller checks for ECANCELED, but it
> takes a while to figure that out.  It'll need to be documented properly
> in the commit log.

"Fix it now by using ECANCELED both to abort the iteration and to signal
that we found another reverse mapping.  This enables us to drop the
separate boolean flag." ?

--D

Re: [PATCH 2/2] xfs: fix xfs_rmap_has_other_keys usage of ECANCELED

[Christoph Hellwig]

On Wed, Mar 11, 2020 at 08:47:25AM -0700, Darrick J. Wong wrote:
> On Tue, Mar 10, 2020 at 11:40:11PM -0700, Christoph Hellwig wrote:
> > On Tue, Mar 10, 2020 at 05:47:10PM -0700, Darrick J. Wong wrote:
> > > From: Darrick J. Wong <darrick.wong@oracle.com>
> > > 
> > > In e7ee96dfb8c26, we converted all ITER_ABORT users to use ECANCELED
> > > instead, but we forgot to teach xfs_rmap_has_other_keys not to return
> > > that magic value to callers.  Fix it now.
> > 
> > This doesn't document the remap of the has_rmap flag.  As far as I can
> > tell that isn't needed now the caller checks for ECANCELED, but it
> > takes a while to figure that out.  It'll need to be documented properly
> > in the commit log.
> 
> "Fix it now by using ECANCELED both to abort the iteration and to signal
> that we found another reverse mapping.  This enables us to drop the
> separate boolean flag." ?

Sounds good.

Re: [PATCH 2/2] xfs: fix xfs_rmap_has_other_keys usage of ECANCELED

[Darrick J. Wong]

On Wed, Mar 11, 2020 at 08:52:44AM -0700, Christoph Hellwig wrote:
> On Wed, Mar 11, 2020 at 08:47:25AM -0700, Darrick J. Wong wrote:
> > On Tue, Mar 10, 2020 at 11:40:11PM -0700, Christoph Hellwig wrote:
> > > On Tue, Mar 10, 2020 at 05:47:10PM -0700, Darrick J. Wong wrote:
> > > > From: Darrick J. Wong <darrick.wong@oracle.com>
> > > > 
> > > > In e7ee96dfb8c26, we converted all ITER_ABORT users to use ECANCELED
> > > > instead, but we forgot to teach xfs_rmap_has_other_keys not to return
> > > > that magic value to callers.  Fix it now.
> > > 
> > > This doesn't document the remap of the has_rmap flag.  As far as I can
> > > tell that isn't needed now the caller checks for ECANCELED, but it
> > > takes a while to figure that out.  It'll need to be documented properly
> > > in the commit log.
> > 
> > "Fix it now by using ECANCELED both to abort the iteration and to signal
> > that we found another reverse mapping.  This enables us to drop the
> > separate boolean flag." ?
> 
> Sounds good.

Ok, I'll respin this one.

--D

[PATCH v2 2/2] xfs: fix xfs_rmap_has_other_keys usage of ECANCELED

[Darrick J. Wong]

From: Darrick J. Wong <darrick.wong@oracle.com>

In e7ee96dfb8c26, we converted all ITER_ABORT users to use ECANCELED
instead, but we forgot to teach xfs_rmap_has_other_keys not to return
that magic value to callers.  Fix it now by using ECANCELED both to
abort the iteration and to signal that we found another reverse mapping.
This enables us to drop the separate boolean flag.

Fixes: e7ee96dfb8c26 ("xfs: remove all *_ITER_ABORT values")
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
---
v2: fix commit message per hch feedback
---
 fs/xfs/libxfs/xfs_rmap.c |   13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/fs/xfs/libxfs/xfs_rmap.c b/fs/xfs/libxfs/xfs_rmap.c
index ff9412f113c4..dae1a2bf28eb 100644
--- a/fs/xfs/libxfs/xfs_rmap.c
+++ b/fs/xfs/libxfs/xfs_rmap.c
@@ -2694,7 +2694,6 @@ struct xfs_rmap_key_state {
 	uint64_t			owner;
 	uint64_t			offset;
 	unsigned int			flags;
-	bool				has_rmap;
 };
 
 /* For each rmap given, figure out if it doesn't match the key we want. */
@@ -2709,7 +2708,6 @@ xfs_rmap_has_other_keys_helper(
 	if (rks->owner == rec->rm_owner && rks->offset == rec->rm_offset &&
 	    ((rks->flags & rec->rm_flags) & XFS_RMAP_KEY_FLAGS) == rks->flags)
 		return 0;
-	rks->has_rmap = true;
 	return -ECANCELED;
 }
 
@@ -2731,7 +2729,7 @@ xfs_rmap_has_other_keys(
 	int				error;
 
 	xfs_owner_info_unpack(oinfo, &rks.owner, &rks.offset, &rks.flags);
-	rks.has_rmap = false;
+	*has_rmap = false;
 
 	low.rm_startblock = bno;
 	memset(&high, 0xFF, sizeof(high));
@@ -2739,11 +2737,12 @@ xfs_rmap_has_other_keys(
 
 	error = xfs_rmap_query_range(cur, &low, &high,
 			xfs_rmap_has_other_keys_helper, &rks);
-	if (error < 0)
-		return error;
+	if (error == -ECANCELED) {
+		*has_rmap = true;
+		return 0;
+	}
 
-	*has_rmap = rks.has_rmap;
-	return 0;
+	return error;
 }
 
 const struct xfs_owner_info XFS_RMAP_OINFO_SKIP_UPDATE = {

Re: [PATCH v2 2/2] xfs: fix xfs_rmap_has_other_keys usage of ECANCELED

[Christoph Hellwig]

On Wed, Mar 11, 2020 at 09:03:29AM -0700, Darrick J. Wong wrote:
> From: Darrick J. Wong <darrick.wong@oracle.com>
> 
> In e7ee96dfb8c26, we converted all ITER_ABORT users to use ECANCELED
> instead, but we forgot to teach xfs_rmap_has_other_keys not to return
> that magic value to callers.  Fix it now by using ECANCELED both to
> abort the iteration and to signal that we found another reverse mapping.
> This enables us to drop the separate boolean flag.
> 
> Fixes: e7ee96dfb8c26 ("xfs: remove all *_ITER_ABORT values")
> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> Reviewed-by: Dave Chinner <dchinner@redhat.com>

Looks good,

Reviewed-by: Christoph Hellwig <hch@lst.de>