From: Andrey Albershteyn <aalbersh@kernel.org>
To: linux-xfs@vger.kernel.org
Cc: cem@kernel.org, cihan.cihan@gmail.com, cmaiolino@redhat.com,
dchinner@redhat.com, dgc@kernel.org, djwong@kernel.org,
floss@jetm.me, hch@lst.de, hemanth.selam@gmail.com,
jiapenglin@tencent.com, johannes.thumshirn@wdc.com,
kees+treewide@kernel.org, norbert@doyensec.com,
syzbot+837bcd54843dd6262f2f@syzkaller.appspotmail.com,
yijiangshan@kylinos.cn, yun.zhou@windriver.com,
zenghongling@kylinos.cn, Javier Tia <javier@peridio.com>
Subject: [PATCH 17/28] xfs: assert the reservation covers each da fork growth
Date: Thu, 29 Oct 2026 13:06:14 +0100 [thread overview]
Message-ID: <20261029120631.803074-18-aalbersh@kernel.org> (raw)
In-Reply-To: <20261029120631.803074-1-aalbersh@kernel.org>
From: Javier Tia <javier@peridio.com>
Source kernel commit: 0fe77e57588b989450d668f7c978bb0264c5c340
xfs_da_grow_inode_int() subtracts the blocks it just allocated from
args->total, the caller's remaining block reservation. The subtraction
is unsigned, so a caller that reaches it with too small a total wraps
the field instead of failing, and every allocation afterwards runs with
a bogus reservation. Assert the remaining reservation still covers the
step, so an under-reserved or uninitialised total trips in debug builds
instead of silently wrapping.
Suggested-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Javier Tia <floss@jetm.me>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
---
libxfs/xfs_da_btree.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libxfs/xfs_da_btree.c b/libxfs/xfs_da_btree.c
index 7938d2324e87..8cbdd6574755 100644
--- a/libxfs/xfs_da_btree.c
+++ b/libxfs/xfs_da_btree.c
@@ -2384,6 +2384,7 @@ xfs_da_grow_inode_int(
}
/* account for newly allocated blocks in reserved blocks total */
+ ASSERT(args->total >= dp->i_nblocks - nblks);
args->total -= dp->i_nblocks - nblks;
out_free_map:
--
2.54.0
next prev parent reply other threads:[~2026-10-29 12:10 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-29 12:05 [PATCH 00/28] xfsprogs: libxfs sync for v7.3 Andrey Albershteyn
2026-10-29 12:05 ` [PATCH 01/28] xfs: add xfs_metadir_create_file helper Andrey Albershteyn
2026-10-29 12:05 ` [PATCH 02/28] xfs: create quota metadir inodes using xfs_metadir_create_file Andrey Albershteyn
2026-10-29 12:06 ` [PATCH 03/28] xfs: create rtgroup " Andrey Albershteyn
2026-10-29 12:06 ` [PATCH 04/28] xfs: mark internal metadir file creation helpers static Andrey Albershteyn
2026-10-29 12:06 ` [PATCH 05/28] xfs: use kmalloc_objs() instead of kmalloc() in xfs_da_grow_inode_int Andrey Albershteyn
2026-10-29 12:06 ` [PATCH 06/28] xfs: remove spurious XBF_DONE clearing on readahead validation failure Andrey Albershteyn
2026-10-29 12:06 ` [PATCH 07/28] xfs: hide b_flags manipulation from code outside of xfs_buf.c Andrey Albershteyn
2026-10-29 12:06 ` [PATCH 08/28] xfs: validate attr entry pointer before field access Andrey Albershteyn
2026-10-29 12:06 ` [PATCH 09/28] xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf Andrey Albershteyn
2026-10-29 12:06 ` [PATCH 10/28] treewide: refresh kmalloc_obj() conversions Andrey Albershteyn
2026-10-29 12:06 ` [PATCH 11/28] xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN Andrey Albershteyn
2026-10-29 12:06 ` [PATCH 12/28] xfs: initialise error in xfs_defer_finish_one() Andrey Albershteyn
2026-10-29 12:06 ` [PATCH 13/28] xfs: give the deferred barrier op type a name Andrey Albershteyn
2026-10-29 12:06 ` [PATCH 14/28] xfs: report the error that made deferred work shut down the fs Andrey Albershteyn
2026-10-29 12:06 ` [PATCH 15/28] xfs: correct the parent pointer space reservation comment Andrey Albershteyn
2026-10-29 12:06 ` [PATCH 16/28] xfs: initialise args->total for parent pointer updates Andrey Albershteyn
2026-10-29 12:06 ` Andrey Albershteyn [this message]
2026-10-29 12:06 ` [PATCH 18/28] xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions Andrey Albershteyn
2026-10-29 12:06 ` [PATCH 19/28] xfs: fix xfs_rtrmapbt_mem_cursor for non-rmap filesystems Andrey Albershteyn
2026-10-29 12:06 ` [PATCH 20/28] xfs: preserve owner on in-memory btree creation Andrey Albershteyn
2026-10-29 12:06 ` [PATCH 21/28] xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails Andrey Albershteyn
2026-10-29 12:06 ` [PATCH 22/28] xfs: fix under-reservation of blocks when repairing sf directories Andrey Albershteyn
2026-10-29 12:06 ` [PATCH 23/28] xfs: remove duplicate INO1_WRITTEN check Andrey Albershteyn
2026-10-29 12:06 ` [PATCH 24/28] xfs: fix typos and repeated words in comments Andrey Albershteyn
2026-10-29 12:06 ` [PATCH 25/28] xfs: don't let hidden_space go negative in xfs_metafile_resv_init Andrey Albershteyn
2026-10-29 12:06 ` [PATCH 26/28] xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots Andrey Albershteyn
2026-10-29 12:06 ` [PATCH 27/28] xfs: stop exchanging reflink flags when exchanging mappings Andrey Albershteyn
2026-10-29 12:06 ` [PATCH 28/28] xfs: fix exchange-range-to-eof file size exchange Andrey Albershteyn
2026-10-29 12:25 ` [PATCH 00/28] xfsprogs: libxfs sync for v7.3 Christoph Hellwig
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261029120631.803074-18-aalbersh@kernel.org \
--to=aalbersh@kernel.org \
--cc=cem@kernel.org \
--cc=cihan.cihan@gmail.com \
--cc=cmaiolino@redhat.com \
--cc=dchinner@redhat.com \
--cc=dgc@kernel.org \
--cc=djwong@kernel.org \
--cc=floss@jetm.me \
--cc=hch@lst.de \
--cc=hemanth.selam@gmail.com \
--cc=javier@peridio.com \
--cc=jiapenglin@tencent.com \
--cc=johannes.thumshirn@wdc.com \
--cc=kees+treewide@kernel.org \
--cc=linux-xfs@vger.kernel.org \
--cc=norbert@doyensec.com \
--cc=syzbot+837bcd54843dd6262f2f@syzkaller.appspotmail.com \
--cc=yijiangshan@kylinos.cn \
--cc=yun.zhou@windriver.com \
--cc=zenghongling@kylinos.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox