• Gao Xiang's avatar
    xfs: fix forkoff miscalculation related to XFS_LITINO(mp) · ada49d64
    Gao Xiang authored
    Currently, commit e9e2eae8 dropped a (int) decoration from
    XFS_LITINO(mp), and since sizeof() expression is also involved,
    the result of XFS_LITINO(mp) is simply as the size_t type
    (commonly unsigned long).
    
    Considering the expression in xfs_attr_shortform_bytesfit():
      offset = (XFS_LITINO(mp) - bytes) >> 3;
    let "bytes" be (int)340, and
        "XFS_LITINO(mp)" be (unsigned long)336.
    
    on 64-bit platform, the expression is
      offset = ((unsigned long)336 - (int)340) >> 3 =
               (int)(0xfffffffffffffffcUL >> 3) = -1
    
    but on 32-bit platform, the expression is
      offset = ((unsigned long)336 - (int)340) >> 3 =
               (int)(0xfffffffcUL >> 3) = 0x1fffffff
    instead.
    
    so offset becomes a large positive number on 32-bit platform, and
    cause xfs_attr_shortform_bytesfit() returns maxforkoff rather than 0.
    
    Therefore, one result is
      "ASSERT(new_size <= XFS_IFORK_SIZE(ip, whichfork));"
    
    assertion failure in xfs_idata_realloc(), which was also the root
    cause of the original bugreport from Dennis, see:
       https://bugzilla.redhat.com/show_bug.cgi?id=1894177
    
    And it can also be manually triggered with the following commands:
      $ touch a;
      $ setfattr -n user.0 -v "`seq 0 80`" a;
      $ setfattr -n user.1 -v "`seq 0 80`" a
    
    on 32-bit platform.
    
    Fix the case in xfs_attr_shortform_bytesfit() by bailing out
    "XFS_LITINO(mp) < bytes" in advance suggested by Eric and a misleading
    comment together with this bugfix suggested by Darrick. It seems the
    other users of XFS_LITINO(mp) are not impacted.
    
    Fixes: e9e2eae8 ("xfs: only check the superblock version for dinode size calculation")
    Cc: <stable@vger.kernel.org> # 5.7+
    Reported-and-tested-by: default avatarDennis Gilmore <dgilmore@redhat.com>
    Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
    Signed-off-by: default avatarGao Xiang <hsiangkao@redhat.com>
    Reviewed-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
    Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
    ada49d64
xfs_attr_leaf.c 83.3 KB