Darrick J. Wong e8db2aafce xfs: fix memory corruption during remote attr value buffer invalidation ... While running generic/103, I observed what looks like memory corruption and (with slub debugging turned on) a slub redzone warning on i386 when inactivating an inode with a 64k remote attr value. On a v5 filesystem, maximally sized remote attr values require one block more than 64k worth of space to hold both the remote attribute value header (64 bytes). On a 4k block filesystem this results in a 68k buffer; on a 64k block filesystem, this would be a 128k buffer. Note that even though we'll never use more than 65,600 bytes of this buffer, XFS_MAX_BLOCKSIZE is 64k. This is a problem because the definition of struct xfs_buf_log_format allows for XFS_MAX_BLOCKSIZE worth of dirty bitmap (64k). On i386 when we invalidate a remote attribute, xfs_trans_binval zeroes all 68k worth of the dirty map, writing right off the end of the log item and corrupting memory. We've gotten away with this on x86_64 for years because the compiler inserts a u32 padding on the end of struct xfs_buf_log_format. Fortunately for us, remote attribute values are written to disk with xfs_bwrite(), which is to say that they are not logged. Fix the problem by removing all places where we could end up creating a buffer log item for a remote attribute value and leave a note explaining why. Next, replace the open-coded buffer invalidation with a call to the helper we created in the previous patch that does better checking for bad metadata before marking the buffer stale. Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Reviewed-by: Christoph Hellwig <hch@lst.de>		2020-01-16 08:07:23 -08:00
..
9p
adfs
affs	affs: fix a memory leak in affs_remount	2019-11-18 14:26:43 +01:00
afs	afs: Show volume name in /proc/net/afs/<cell>/volumes	2019-12-11 17:48:20 +00:00
autofs	Merge branch 'next.autofs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2019-12-05 17:11:48 -08:00
befs
bfs
btrfs	for-5.5-rc2-tag	2019-12-17 13:27:02 -08:00
cachefiles
ceph	ceph: add more debug info when decoding mdsmap	2019-12-09 20:55:10 +01:00
cifs	cifs: Optimize readdir on reparse points	2019-12-23 09:04:44 -06:00
coda
configfs	configfs: calculate the depth of parent item	2019-11-06 18:36:01 +01:00
cramfs	cramfs: fix usage on non-MTD device	2019-11-23 21:44:49 -05:00
crypto	treewide: Use sizeof_field() macro	2019-12-09 10:36:44 -08:00
debugfs	Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2019-12-06 09:06:58 -08:00
devpts
dlm
ecryptfs	compat_ioctl: remove most of fs/compat_ioctl.c	2019-12-01 13:46:15 -08:00
efivarfs
efs
erofs	Changes since last update:	2019-12-11 12:25:32 -08:00
exportfs	race in exportfs_decode_fh()	2019-11-11 09:21:59 -05:00
ext2	\n	2019-11-30 11:16:07 -08:00
ext4	Ext4 bug fixes (including a regression fix) for 5.5	2019-12-22 10:41:48 -08:00
f2fs	compat_ioctl: remove most of fs/compat_ioctl.c	2019-12-01 13:46:15 -08:00
fat	compat_ioctl: move drivers to compat_ptr_ioctl	2019-10-23 17:23:43 +02:00
freevxfs
fscache
fuse	pipe: Fix iteration end check in fuse_dev_splice_write()	2019-12-06 13:57:04 -08:00
gfs2	GFS2 changes for this merge window:	2019-12-05 13:20:11 -08:00
hfs
hfsplus
hostfs
hpfs	fs: compat_ioctl: move FITRIM emulation into file systems	2019-10-23 17:23:46 +02:00
hugetlbfs	hugetlb: remove unused hstate in hugetlb_fault_mutex_hash()	2019-12-01 12:59:08 -08:00
iomap	iomap: stop using ioend after it's been freed in iomap_finish_ioend()	2019-12-05 07:41:16 -08:00
isofs
jbd2	This merge window saw the the following new featuers added to ext4:	2019-11-30 10:53:02 -08:00
jffs2	Revert "jffs2: Fix possible null-pointer dereferences in jffs2_add_frag_to_fragtree()"	2019-11-29 11:29:58 +01:00
jfs
kernfs	Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2019-12-06 09:06:58 -08:00
lockd	NFSv4.1: Don't rebind to the same source port when reconnecting to the server	2019-11-03 21:28:45 -05:00
minix
nfs	NFS4: Trace lock reclaims	2019-11-18 11:04:32 +01:00
nfs_common
nfsd	This is a relatively quiet cycle for nfsd, mainly various bugfixes.	2019-12-07 16:56:00 -08:00
nilfs2	fs: compat_ioctl: move FITRIM emulation into file systems	2019-10-23 17:23:46 +02:00
nls
notify	fs: call fsnotify_sb_delete after evict_inodes	2019-12-18 00:03:01 -05:00
ntfs
ocfs2	Merge branch 'akpm' (patches from Andrew)	2019-12-01 20:36:41 -08:00
omfs
openpromfs
orangefs	orangefs: posix open permission checking...	2019-12-04 08:52:55 -05:00
overlayfs	overlayfs fixes for 5.5-rc2	2019-12-14 11:13:54 -08:00
proc	sched/cputime, proc/stat: Fix incorrect guest nice cpustat value	2019-12-11 07:09:58 +01:00
pstore	pstore: Make pstore_choose_compression() static	2019-10-29 09:43:03 -07:00
qnx4
qnx6
quota	fs: avoid softlockups in s_inodes iterators	2019-12-18 00:03:01 -05:00
ramfs
reiserfs	reiserfs: replace open-coded atomic_dec_and_mutex_lock()	2019-11-05 12:25:22 +01:00
romfs
squashfs
sysfs
sysv
tracefs	tracing: Do not create tracefs files if tracefs lockdown is in effect	2019-10-12 20:49:07 -04:00
ubifs	ubifs: ubifs_tnc_start_commit: Fix OOB in layout_in_gaps	2019-11-17 22:22:54 +01:00
udf
ufs
unicode
verity	treewide: Use sizeof_field() macro	2019-12-09 10:36:44 -08:00
xfs	xfs: fix memory corruption during remote attr value buffer invalidation	2020-01-16 08:07:23 -08:00
aio.c	y2038: syscall implementation cleanups	2019-12-01 14:00:59 -08:00
anon_inodes.c
attr.c
bad_inode.c
binfmt_aout.c
binfmt_elf_fdpic.c	y2038: elfcore: Use __kernel_old_timeval for process times	2019-11-15 14:38:29 +01:00
binfmt_elf.c	fs/binfmt_elf.c: extract elf_read() function	2019-12-04 19:44:13 -08:00
binfmt_em86.c
binfmt_flat.c
binfmt_misc.c
binfmt_script.c
block_dev.c	block: don't send uevent for empty disk when not invalidating	2019-12-02 18:49:30 -07:00
buffer.c	fs/buffer.c: include internal.h for missing declarations	2019-12-01 06:29:17 -08:00
char_dev.c
compat_binfmt_elf.c	y2038: elfcore: Use __kernel_old_timeval for process times	2019-11-15 14:38:29 +01:00
compat_ioctl.c	New code for 5.5:	2019-12-02 14:46:22 -08:00
compat.c
coredump.c
d_path.c
dax.c	New code for 5.5:	2019-11-30 10:44:49 -08:00
dcache.c	Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2019-12-08 11:08:28 -08:00
dcookies.c
direct-io.c	fs/direct-io.c: keep dio_warn_stale_pagecache() when CONFIG_BLOCK=n	2019-12-01 06:29:18 -08:00
drop_caches.c	fs: avoid softlockups in s_inodes iterators	2019-12-18 00:03:01 -05:00
eventfd.c
eventpoll.c	fs/epoll: remove unnecessary wakeups of nested epoll	2019-12-04 19:44:13 -08:00
exec.c	Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2019-12-03 12:20:25 -08:00
fcntl.c	Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2019-12-08 11:08:28 -08:00
fhandle.c
file_table.c
file.c	fs: remove ksys_dup()	2019-12-12 19:00:36 +01:00
filesystems.c
fs_context.c
fs_parser.c
fs_pin.c
fs_struct.c
fs_types.c
fs-writeback.c	cgroup,writeback: don't switch wbs immediately on dead wbs if the memcg is dead	2019-11-08 13:37:24 -07:00
fsopen.c
inode.c	fs: avoid softlockups in s_inodes iterators	2019-12-18 00:03:01 -05:00
internal.h	make __d_alloc() static	2019-10-25 14:08:24 -04:00
io_uring.c	io_uring: pass in 'sqe' to the prep handlers	2019-12-20 10:04:50 -07:00
io-wq.c	io-wq: add cond_resched() to worker thread	2019-12-24 09:14:29 -07:00
io-wq.h	io-wq: re-add io_wq_current_is_worker()	2019-12-17 19:57:20 -07:00
ioctl.c	New code for 5.5:	2019-12-02 14:46:22 -08:00
Kconfig	io-wq: small threadpool implementation for io_uring	2019-10-29 12:43:00 -06:00
Kconfig.binfmt
libfs.c	fs/libfs.c: fix kernel-doc warning	2019-10-14 15:04:01 -07:00
locks.c	locks: print unsigned ino in /proc/locks	2019-12-29 09:00:58 -05:00
Makefile	io-wq: small threadpool implementation for io_uring	2019-10-29 12:43:00 -06:00
mbcache.c
mount.h
mpage.c
namei.c	Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2019-12-06 09:06:58 -08:00
namespace.c	init: use do_mount() instead of ksys_mount()	2019-12-12 14:50:05 +01:00
no-block.c
nsfs.c
open.c	Revert "vfs: properly and reliably lock f_pos in fdget_pos()"	2019-11-26 11:34:06 -08:00
pipe.c	pipe: fix empty pipe check in pipe_write()	2019-12-22 09:47:47 -08:00
pnode.c
pnode.h
posix_acl.c
proc_namespace.c
read_write.c
readdir.c	filldir[64]: remove WARN_ON_ONCE() for bad directory entries	2019-10-18 18:41:16 -04:00
select.c	y2038: syscalls: change remaining timeval to __kernel_old_timeval	2019-11-15 14:38:29 +01:00
seq_file.c
signalfd.c
splice.c	pipe: remove 'waiting_writers' merging logic	2019-12-07 13:21:01 -08:00
stack.c
stat.c
statfs.c
super.c	fs: call fsnotify_sb_delete after evict_inodes	2019-12-18 00:03:01 -05:00
sync.c
timerfd.c	y2038: timerfd: Use timespec64 internally	2019-11-15 14:38:30 +01:00
userfaultfd.c	Merge branch 'akpm' (patches from Andrew)	2019-12-01 20:36:41 -08:00
utimes.c	y2038: syscalls: change remaining timeval to __kernel_old_timeval	2019-11-15 14:38:29 +01:00
xattr.c