From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:58482 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751054AbdBBKSm (ORCPT ); Thu, 2 Feb 2017 05:18:42 -0500 Subject: Patch "xfs: don't wrap ID in xfs_dq_get_next_id" has been added to the 4.9-stable tree To: hch@lst.de, darrick.wong@oracle.com, gregkh@linuxfoundation.org, sandeen@redhat.com Cc: , From: Date: Thu, 02 Feb 2017 11:18:03 +0100 In-Reply-To: <1486022171-8076-13-git-send-email-hch@lst.de> Message-ID: <148603068320992@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled xfs: don't wrap ID in xfs_dq_get_next_id to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: xfs-don-t-wrap-id-in-xfs_dq_get_next_id.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From hch@lst.de Thu Feb 2 11:15:05 2017 From: Christoph Hellwig Date: Thu, 2 Feb 2017 08:56:04 +0100 Subject: xfs: don't wrap ID in xfs_dq_get_next_id To: stable@vger.kernel.org Cc: linux-xfs@vger.kernel.org, Eric Sandeen , "Darrick J. Wong" Message-ID: <1486022171-8076-13-git-send-email-hch@lst.de> From: Eric Sandeen commit 657bdfb7f5e68ca5e2ed009ab473c429b0d6af85 upstream. The GETNEXTQOTA ioctl takes whatever ID is sent in, and looks for the next active quota for an user equal or higher to that ID. But if we are at the maximum ID and then ask for the "next" one, we may wrap back to zero. In this case, userspace may loop forever, because it will start querying again at zero. We'll fix this in userspace as well, but for the kernel, return -ENOENT if we ask for the next quota ID past UINT_MAX so the caller knows to stop. Signed-off-by: Eric Sandeen Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Signed-off-by: Greg Kroah-Hartman --- fs/xfs/xfs_dquot.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/fs/xfs/xfs_dquot.c +++ b/fs/xfs/xfs_dquot.c @@ -710,6 +710,10 @@ xfs_dq_get_next_id( /* Simple advance */ next_id = *id + 1; + /* If we'd wrap past the max ID, stop */ + if (next_id < *id) + return -ENOENT; + /* If new ID is within the current chunk, advancing it sufficed */ if (next_id % mp->m_quotainfo->qi_dqperchunk) { *id = next_id; Patches currently in stable-queue which might be from hch@lst.de are queue-4.9/xfs-don-t-rely-on-total-in-xfs_alloc_space_available.patch queue-4.9/xfs-replace-xfs_mode_to_ftype-table-with-switch-statement.patch queue-4.9/xfs-fix-bogus-minleft-manipulations.patch queue-4.9/xfs-fix-cow-writeback-race.patch queue-4.9/xfs-sanity-check-inode-mode-when-creating-new-dentry.patch queue-4.9/xfs-extsize-hints-are-not-unlikely-in-xfs_bmap_btalloc.patch queue-4.9/xfs-bump-up-reserved-blocks-in-xfs_alloc_set_aside.patch queue-4.9/xfs-add-missing-include-dependencies-to-xfs_dir2.h.patch queue-4.9/xfs-fix-bmv_count-confusion-w-shared-extents.patch queue-4.9/xfs-adjust-allocation-length-in-xfs_alloc_space_available.patch queue-4.9/xfs-verify-dirblocklog-correctly.patch queue-4.9/xfs-fix-xfs_mode_to_ftype-prototype.patch queue-4.9/xfs-clear-_xbf_pages-from-buffers-when-readahead-page.patch queue-4.9/xfs-remove-racy-hasattr-check-from-attr-ops.patch queue-4.9/xfs-make-the-assert-condition-likely.patch queue-4.9/xfs-sanity-check-directory-inode-di_size.patch queue-4.9/xfs-don-t-print-warnings-when-xfs_log_force-fails.patch queue-4.9/xfs-don-t-wrap-id-in-xfs_dq_get_next_id.patch queue-4.9/xfs-sanity-check-inode-di_mode.patch