David Sterba cc2b702c52 btrfs: use correct types for page indices in btrfs_page_exists_in_range ... Variables start_idx and end_idx are supposed to hold a page index derived from the file offsets. The int type is not the right one though, offsets larger than 1 << 44 will get silently trimmed off the high bits. (1 << 44 is 16TiB) What can go wrong, if start is below the boundary and end gets trimmed: - if there's a page after start, we'll find it (radix_tree_gang_lookup_slot) - the final check "if (page->index <= end_idx)" will unexpectedly fail The function will return false, ie. "there's no page in the range", although there is at least one. btrfs_page_exists_in_range is used to prevent races in: * in hole punching, where we make sure there are not pages in the truncated range, otherwise we'll wait for them to finish and redo truncation, but we're going to replace the pages with holes anyway so the only problem is the intermediate state * lock_extent_direct: we want to make sure there are no pages before we lock and start DIO, to prevent stale data reads For practical occurence of the bug, there are several constaints. The file must be quite large, the affected range must cross the 16TiB boundary and the internal state of the file pages and pending operations must match. Also, we must not have started any ordered data in the range, otherwise we don't even reach the buggy function check. DIO locking tries hard in several places to avoid deadlocks with buffered IO and avoids waiting for ranges. The worst consequence seems to be stale data read. CC: Liu Bo <bo.li.liu@oracle.com> CC: stable@vger.kernel.org # 3.16+ Fixes: fc4adbff82 ("btrfs: Drop EXTENT_UPTODATE check in hole punching and direct locking") Reviewed-by: Liu Bo <bo.li.liu@oracle.com> Signed-off-by: David Sterba <dsterba@suse.com>		2017-06-01 16:56:17 +02:00
..
tests	btrfs: remove unused qgroup members from btrfs_trans_handle	2017-04-18 14:07:25 +02:00
acl.c	posix_acl: Clear SGID bit when setting file permissions	2016-09-22 10:55:32 +02:00
async-thread.c	btrfs: fix crash when tracepoint arguments are freed by wq callbacks	2017-01-09 11:24:50 +01:00
async-thread.h	btrfs: limit async_work allocation and worker func duration	2016-12-13 11:01:30 -08:00
backref.c	btrfs: replace hardcoded value with SEQ_LAST macro	2017-04-18 14:07:25 +02:00
backref.h	btrfs: cleanup, remove inode_item_info helper	2015-01-14 19:23:47 +01:00
btrfs_inode.h	Btrfs: fix reported number of inode blocks	2017-04-26 16:27:26 +01:00
check-integrity.c	btrfs: take an fs_info directly when the root is not used otherwise	2016-12-06 16:06:59 +01:00
check-integrity.h	btrfs: take an fs_info directly when the root is not used otherwise	2016-12-06 16:06:59 +01:00
compression.c	btrfs: convert compressed_bio.pending_bios from atomic_t to refcount_t	2017-04-18 14:07:24 +02:00
compression.h	btrfs: derive maximum output size in the compression implementation	2017-02-28 14:26:36 +01:00
ctree.c	btrfs: sink GFP flags parameter to tree_mod_log_insert_root	2017-04-18 14:07:26 +02:00
ctree.h	btrfs: scrub: Introduce full stripe lock for RAID56	2017-04-18 14:07:27 +02:00
dedupe.h	btrfs: expand cow_file_range() to support in-band dedup and subpage-blocksize	2016-07-26 13:52:25 +02:00
delayed-inode.c	btrfs: convert btrfs_delayed_item.refs from atomic_t to refcount_t	2017-04-18 14:07:23 +02:00
delayed-inode.h	btrfs: convert btrfs_delayed_item.refs from atomic_t to refcount_t	2017-04-18 14:07:23 +02:00
delayed-ref.c	btrfs: convert btrfs_delayed_ref_node.refs from atomic_t to refcount_t	2017-04-18 14:07:23 +02:00
delayed-ref.h	btrfs: convert btrfs_delayed_ref_node.refs from atomic_t to refcount_t	2017-04-18 14:07:23 +02:00
dev-replace.c	Btrfs: switch to div64_u64 if with a u64 divisor	2017-04-18 14:07:26 +02:00
dev-replace.h	btrfs: constify device path passed to relevant helpers	2017-02-28 14:26:07 +01:00
dir-item.c	btrfs: do proper error handling in btrfs_insert_xattr_item	2017-02-28 14:27:11 +01:00
disk-io.c	btrfs: Make flush bios explicitely sync	2017-05-16 15:42:01 +02:00
disk-io.h	btrfs: convert btrfs_root.refs from atomic_t to refcount_t	2017-04-18 14:07:23 +02:00
export.c	btrfs: Make btrfs_ino take a struct btrfs_inode	2017-02-14 15:50:51 +01:00
export.h
extent_io.c	btrfs: fix incorrect error return ret being passed to mapping_set_error	2017-05-16 15:42:10 +02:00
extent_io.h	Merge branch 'for-chris-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/fdmanana/linux into for-linus-4.12	2017-04-27 14:13:09 -07:00
extent_map.c	btrfs: convert extent_map.refs from atomic_t to refcount_t	2017-04-18 14:07:23 +02:00
extent_map.h	btrfs: convert extent_map.refs from atomic_t to refcount_t	2017-04-18 14:07:23 +02:00
extent-tree.c	btrfs: scrub: Introduce full stripe lock for RAID56	2017-04-18 14:07:27 +02:00
file-item.c	Merge branch 'for-chris-4.11-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux into for-linus-4.11	2017-02-28 14:35:09 -08:00
file.c	Merge branch 'for-chris-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/fdmanana/linux into for-linus-4.12	2017-04-27 14:13:09 -07:00
free-space-cache.c	btrfs: use clear_page where appropriate	2017-04-18 14:07:26 +02:00
free-space-cache.h	btrfs: free-space-cache, clean up unnecessary root arguments	2017-02-17 12:03:56 +01:00
free-space-tree.c	btrfs: remove unused parameter from clean_tree_block	2017-02-17 12:03:51 +01:00
free-space-tree.h	Btrfs: implement the free space B-tree	2015-12-17 12:16:47 -08:00
hash.c	btrfs: advertise which crc32c implementation is being used at module load	2016-06-06 14:08:28 +02:00
hash.h	btrfs: advertise which crc32c implementation is being used at module load	2016-06-06 14:08:28 +02:00
inode-item.c	btrfs: take an fs_info directly when the root is not used otherwise	2016-12-06 16:06:59 +01:00
inode-map.c	btrfs: all btrfs_delalloc_release_metadata take btrfs_inode	2017-02-28 11:30:07 +01:00
inode-map.h	Btrfs: Initialize btrfs_root->highest_objectid when loading tree root and subvolume roots	2016-01-15 19:25:02 +01:00
inode.c	btrfs: use correct types for page indices in btrfs_page_exists_in_range	2017-06-01 16:56:17 +02:00
ioctl.c	btrfs: track exclusive filesystem operation in flags	2017-04-18 14:07:25 +02:00
Kconfig	rcu: Make SRCU optional by using CONFIG_SRCU	2015-01-06 11:04:29 -08:00
locking.c	btrfs: cleanup, remove stray return statements	2016-01-07 14:30:52 +01:00
locking.h	btrfs: fix lockups from btrfs_clear_path_blocking	2014-11-19 10:34:35 -08:00
lzo.c	btrfs: derive maximum output size in the compression implementation	2017-02-28 14:26:36 +01:00
Makefile	Btrfs: add free space tree sanity tests	2015-12-17 12:16:47 -08:00
math.h	btrfs: cleanup 64bit/32bit divs, compile time constants	2015-03-03 17:23:57 +01:00
ordered-data.c	btrfs: convert btrfs_ordered_extent.refs from atomic_t to refcount_t	2017-04-18 14:07:23 +02:00
ordered-data.h	btrfs: convert btrfs_ordered_extent.refs from atomic_t to refcount_t	2017-04-18 14:07:23 +02:00
orphan.c	btrfs: kill the key type accessor helpers	2014-09-17 13:37:12 -07:00
print-tree.c	btrfs: take an fs_info directly when the root is not used otherwise	2016-12-06 16:06:59 +01:00
print-tree.h	btrfs: take an fs_info directly when the root is not used otherwise	2016-12-06 16:06:59 +01:00
props.c	btrfs: Make btrfs_ino take a struct btrfs_inode	2017-02-14 15:50:51 +01:00
props.h
qgroup.c	btrfs: qgroup: Re-arrange tracepoint timing to co-operate with reserved space tracepoint	2017-04-18 14:07:26 +02:00
qgroup.h	btrfs: qgroup: Re-arrange tracepoint timing to co-operate with reserved space tracepoint	2017-04-18 14:07:26 +02:00
raid56.c	btrfs: Wait for in-flight bios before freeing target device for raid56	2017-04-18 14:07:26 +02:00
raid56.h	btrfs: take an fs_info directly when the root is not used otherwise	2016-12-06 16:06:59 +01:00
rcu-string.h
reada.c	btrfs: remove local blocksize variable in reada_find_extent	2017-04-18 14:07:25 +02:00
relocation.c	btrfs: Make btrfs_orphan_add take btrfs_inode	2017-02-28 11:30:10 +01:00
root-tree.c	btrfs: Use ktime_get_real_ts for root ctime	2017-04-18 14:07:27 +02:00
scrub.c	btrfs: scrub: Fix RAID56 recovery race condition	2017-04-18 14:07:27 +02:00
send.c	Btrfs: send, fix file hole not being preserved due to inline extent	2017-04-26 16:27:25 +01:00
send.h	Btrfs: use linux/sizes.h to represent constants	2016-01-07 14:38:02 +01:00
struct-funcs.c	btrfs: fix string and comment grammatical issues and typos	2016-05-25 22:35:14 +02:00
super.c	btrfs: No need to check !(flags & MS_RDONLY) twice	2017-04-18 14:07:25 +02:00
sysfs.c	btrfs: convert printk(KERN_* to use pr_* calls	2016-09-26 18:08:44 +02:00
sysfs.h	btrfs: sysfs: introduce helper for syncing bits with sysfs files	2016-01-21 18:50:40 +01:00
transaction.c	btrfs: qgroup: Fix qgroup corruption caused by inode_cache mount option	2017-04-18 14:07:26 +02:00
transaction.h	btrfs: remove unused qgroup members from btrfs_trans_handle	2017-04-18 14:07:25 +02:00
tree-defrag.c	Btrfs: fix locking bugs when defragging leaves	2015-12-18 02:51:32 +00:00
tree-log.c	btrfs: convert extent_map.refs from atomic_t to refcount_t	2017-04-18 14:07:23 +02:00
tree-log.h	btrfs: Make btrfs_del_inode_ref take btrfs_inode	2017-02-14 15:50:54 +01:00
ulist.c	btrfs: ulist: rename ulist_fini to ulist_release	2017-02-17 12:03:50 +01:00
ulist.h	btrfs: ulist: rename ulist_fini to ulist_release	2017-02-17 12:03:50 +01:00
uuid-tree.c	btrfs: return the actual error value from from btrfs_uuid_tree_iterate	2016-12-19 18:08:15 +01:00
volumes.c	btrfs: fix the gfp_mask for the reada_zones radix tree	2017-05-04 16:56:11 -07:00
volumes.h	btrfs: delete unused member nobarriers	2017-04-18 16:12:07 +02:00
xattr.c	btrfs: fix over-80 lines introduced by previous cleanups	2017-02-14 15:50:57 +01:00
xattr.h	btrfs: Switch to generic xattr handlers	2016-05-17 19:17:09 -04:00
zlib.c	btrfs: derive maximum output size in the compression implementation	2017-02-28 14:26:36 +01:00