Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs

* 'for-linus' of git://oss.sgi.com/xfs/xfs: xfs: fix force shutdown handling in xfs_end_io xfs: constify xfs_item_ops xfs: Fix possible memory corruption in xfs_readlink

Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs
* 'for-linus' of git://oss.sgi.com/xfs/xfs: xfs: fix force shutdown handling in xfs_end_io xfs: constify xfs_item_ops xfs: Fix possible memory corruption in xfs_readlink
Linus Torvalds
2 parents 5e442a493f 810627d9a6
Showing 9 changed files Side-by-side Diff
fs/xfs/xfs_aops.c
fs/xfs/xfs_buf_item.c
fs/xfs/xfs_dquot_item.c
fs/xfs/xfs_extfree_item.c
fs/xfs/xfs_inode_item.c
fs/xfs/xfs_log.c
fs/xfs/xfs_log.h
fs/xfs/xfs_trans.h
fs/xfs/xfs_vnodeops.c
@@ -189,7 +189,7 @@
 	int		error = 0;
  
 	if (XFS_FORCED_SHUTDOWN(ip->i_mount)) {
-		error = -EIO;
+		ioend->io_error = -EIO;
 		goto done;
 	}
 	if (ioend->io_error)
@@ -656,7 +656,7 @@
 /*
  * This is the ops vector shared by all buf log items.
  */
-static struct xfs_item_ops xfs_buf_item_ops = {
+static const struct xfs_item_ops xfs_buf_item_ops = {
 	.iop_size	= xfs_buf_item_size,
 	.iop_format	= xfs_buf_item_format,
 	.iop_pin	= xfs_buf_item_pin,
@@ -295,7 +295,7 @@
 /*
  * This is the ops vector for dquots
  */
-static struct xfs_item_ops xfs_dquot_item_ops = {
+static const struct xfs_item_ops xfs_dquot_item_ops = {
 	.iop_size	= xfs_qm_dquot_logitem_size,
 	.iop_format	= xfs_qm_dquot_logitem_format,
 	.iop_pin	= xfs_qm_dquot_logitem_pin,
@@ -483,7 +483,7 @@
 {
 }
  
-static struct xfs_item_ops xfs_qm_qoffend_logitem_ops = {
+static const struct xfs_item_ops xfs_qm_qoffend_logitem_ops = {
 	.iop_size	= xfs_qm_qoff_logitem_size,
 	.iop_format	= xfs_qm_qoff_logitem_format,
 	.iop_pin	= xfs_qm_qoff_logitem_pin,
@@ -498,7 +498,7 @@
 /*
  * This is the ops vector shared by all quotaoff-start log items.
  */
-static struct xfs_item_ops xfs_qm_qoff_logitem_ops = {
+static const struct xfs_item_ops xfs_qm_qoff_logitem_ops = {
 	.iop_size	= xfs_qm_qoff_logitem_size,
 	.iop_format	= xfs_qm_qoff_logitem_format,
 	.iop_pin	= xfs_qm_qoff_logitem_pin,
@@ -217,7 +217,7 @@
 /*
  * This is the ops vector shared by all efi log items.
  */
-static struct xfs_item_ops xfs_efi_item_ops = {
+static const struct xfs_item_ops xfs_efi_item_ops = {
 	.iop_size	= xfs_efi_item_size,
 	.iop_format	= xfs_efi_item_format,
 	.iop_pin	= xfs_efi_item_pin,
@@ -477,7 +477,7 @@
 /*
  * This is the ops vector shared by all efd log items.
  */
-static struct xfs_item_ops xfs_efd_item_ops = {
+static const struct xfs_item_ops xfs_efd_item_ops = {
 	.iop_size	= xfs_efd_item_size,
 	.iop_format	= xfs_efd_item_format,
 	.iop_pin	= xfs_efd_item_pin,
@@ -795,7 +795,7 @@
 /*
  * This is the ops vector shared by all buf log items.
  */
-static struct xfs_item_ops xfs_inode_item_ops = {
+static const struct xfs_item_ops xfs_inode_item_ops = {
 	.iop_size	= xfs_inode_item_size,
 	.iop_format	= xfs_inode_item_format,
 	.iop_pin	= xfs_inode_item_pin,
@@ -626,7 +626,7 @@
 	struct xfs_mount	*mp,
 	struct xfs_log_item	*item,
 	int			type,
-	struct xfs_item_ops	*ops)
+	const struct xfs_item_ops *ops)
 {
 	item->li_mountp = mp;
 	item->li_ailp = mp->m_ail;
@@ -137,7 +137,7 @@
 void	xfs_log_item_init(struct xfs_mount	*mp,
 			struct xfs_log_item	*item,
 			int			type,
-			struct xfs_item_ops	*ops);
+			const struct xfs_item_ops *ops);
  
 xfs_lsn_t xfs_log_done(struct xfs_mount *mp,
 		       struct xlog_ticket *ticket,
@@ -326,7 +326,7 @@
 						 struct xfs_log_item *);
 							/* buffer item iodone */
 							/* callback func */
-	struct xfs_item_ops		*li_ops;	/* function list */
+	const struct xfs_item_ops	*li_ops;	/* function list */
  
 	/* delayed logging */
 	struct list_head		li_cil;		/* CIL pointers */
@@ -341,7 +341,7 @@
 	{ XFS_LI_IN_AIL,	"IN_AIL" }, \
 	{ XFS_LI_ABORTED,	"ABORTED" }
  
-typedef struct xfs_item_ops {
+struct xfs_item_ops {
 	uint (*iop_size)(xfs_log_item_t *);
 	void (*iop_format)(xfs_log_item_t *, struct xfs_log_iovec *);
 	void (*iop_pin)(xfs_log_item_t *);
@@ -352,7 +352,7 @@
 	void (*iop_push)(xfs_log_item_t *);
 	bool (*iop_pushbuf)(xfs_log_item_t *);
 	void (*iop_committing)(xfs_log_item_t *, xfs_lsn_t);
-} xfs_item_ops_t;
+};
  
 #define IOP_SIZE(ip)		(*(ip)->li_ops->iop_size)(ip)
 #define IOP_FORMAT(ip,vp)	(*(ip)->li_ops->iop_format)(ip, vp)
@@ -112,7 +112,7 @@
 	char		*link)
 {
 	xfs_mount_t	*mp = ip->i_mount;
-	int		pathlen;
+	xfs_fsize_t	pathlen;
 	int		error = 0;
  
 	trace_xfs_readlink(ip);
  
@@ -122,12 +122,18 @@
  
 	xfs_ilock(ip, XFS_ILOCK_SHARED);
  
-	ASSERT(S_ISLNK(ip->i_d.di_mode));
-	ASSERT(ip->i_d.di_size <= MAXPATHLEN);
-
 	pathlen = ip->i_d.di_size;
 	if (!pathlen)
 		goto out;
+
+	if (pathlen < 0 || pathlen > MAXPATHLEN) {
+		xfs_alert(mp, "%s: inode (%llu) bad symlink length (%lld)",
+			 __func__, (unsigned long long) ip->i_ino,
+			 (long long) pathlen);
+		ASSERT(0);
+		return XFS_ERROR(EFSCORRUPTED);
+	}
+
  
 	if (ip->i_df.if_flags & XFS_IFINLINE) {
 		memcpy(link, ip->i_df.if_u1.if_data, pathlen);
...	...	@@ -189,7 +189,7 @@
189	189	int error = 0;
190	190
191	191	if (XFS_FORCED_SHUTDOWN(ip->i_mount)) {
192		- error = -EIO;
	192	+ ioend->io_error = -EIO;
193	193	goto done;
194	194	}
195	195	if (ioend->io_error)
...	...	@@ -656,7 +656,7 @@
656	656	/*
657	657	* This is the ops vector shared by all buf log items.
658	658	*/
659		-static struct xfs_item_ops xfs_buf_item_ops = {
	659	+static const struct xfs_item_ops xfs_buf_item_ops = {
660	660	.iop_size = xfs_buf_item_size,
661	661	.iop_format = xfs_buf_item_format,
662	662	.iop_pin = xfs_buf_item_pin,
...	...	@@ -295,7 +295,7 @@
295	295	/*
296	296	* This is the ops vector for dquots
297	297	*/
298		-static struct xfs_item_ops xfs_dquot_item_ops = {
	298	+static const struct xfs_item_ops xfs_dquot_item_ops = {
299	299	.iop_size = xfs_qm_dquot_logitem_size,
300	300	.iop_format = xfs_qm_dquot_logitem_format,
301	301	.iop_pin = xfs_qm_dquot_logitem_pin,
...	...	@@ -483,7 +483,7 @@
483	483	{
484	484	}
485	485
486		-static struct xfs_item_ops xfs_qm_qoffend_logitem_ops = {
	486	+static const struct xfs_item_ops xfs_qm_qoffend_logitem_ops = {
487	487	.iop_size = xfs_qm_qoff_logitem_size,
488	488	.iop_format = xfs_qm_qoff_logitem_format,
489	489	.iop_pin = xfs_qm_qoff_logitem_pin,
...	...	@@ -498,7 +498,7 @@
498	498	/*
499	499	* This is the ops vector shared by all quotaoff-start log items.
500	500	*/
501		-static struct xfs_item_ops xfs_qm_qoff_logitem_ops = {
	501	+static const struct xfs_item_ops xfs_qm_qoff_logitem_ops = {
502	502	.iop_size = xfs_qm_qoff_logitem_size,
503	503	.iop_format = xfs_qm_qoff_logitem_format,
504	504	.iop_pin = xfs_qm_qoff_logitem_pin,
...	...	@@ -217,7 +217,7 @@
217	217	/*
218	218	* This is the ops vector shared by all efi log items.
219	219	*/
220		-static struct xfs_item_ops xfs_efi_item_ops = {
	220	+static const struct xfs_item_ops xfs_efi_item_ops = {
221	221	.iop_size = xfs_efi_item_size,
222	222	.iop_format = xfs_efi_item_format,
223	223	.iop_pin = xfs_efi_item_pin,
...	...	@@ -477,7 +477,7 @@
477	477	/*
478	478	* This is the ops vector shared by all efd log items.
479	479	*/
480		-static struct xfs_item_ops xfs_efd_item_ops = {
	480	+static const struct xfs_item_ops xfs_efd_item_ops = {
481	481	.iop_size = xfs_efd_item_size,
482	482	.iop_format = xfs_efd_item_format,
483	483	.iop_pin = xfs_efd_item_pin,
...	...	@@ -795,7 +795,7 @@
795	795	/*
796	796	* This is the ops vector shared by all buf log items.
797	797	*/
798		-static struct xfs_item_ops xfs_inode_item_ops = {
	798	+static const struct xfs_item_ops xfs_inode_item_ops = {
799	799	.iop_size = xfs_inode_item_size,
800	800	.iop_format = xfs_inode_item_format,
801	801	.iop_pin = xfs_inode_item_pin,
...	...	@@ -626,7 +626,7 @@
626	626	struct xfs_mount *mp,
627	627	struct xfs_log_item *item,
628	628	int type,
629		- struct xfs_item_ops *ops)
	629	+ const struct xfs_item_ops *ops)
630	630	{
631	631	item->li_mountp = mp;
632	632	item->li_ailp = mp->m_ail;
...	...	@@ -137,7 +137,7 @@
137	137	void xfs_log_item_init(struct xfs_mount *mp,
138	138	struct xfs_log_item *item,
139	139	int type,
140		- struct xfs_item_ops *ops);
	140	+ const struct xfs_item_ops *ops);
141	141
142	142	xfs_lsn_t xfs_log_done(struct xfs_mount *mp,
143	143	struct xlog_ticket *ticket,
...	...	@@ -326,7 +326,7 @@
326	326	struct xfs_log_item *);
327	327	/* buffer item iodone */
328	328	/* callback func */
329		- struct xfs_item_ops li_ops; / function list */
	329	+ const struct xfs_item_ops li_ops; / function list */
330	330
331	331	/* delayed logging */
332	332	struct list_head li_cil; /* CIL pointers */
...	...	@@ -341,7 +341,7 @@
341	341	{ XFS_LI_IN_AIL, "IN_AIL" }, \
342	342	{ XFS_LI_ABORTED, "ABORTED" }
343	343
344		-typedef struct xfs_item_ops {
	344	+struct xfs_item_ops {
345	345	uint (iop_size)(xfs_log_item_t );
346	346	void (iop_format)(xfs_log_item_t , struct xfs_log_iovec *);
347	347	void (iop_pin)(xfs_log_item_t );
...	...	@@ -352,7 +352,7 @@
352	352	void (iop_push)(xfs_log_item_t );
353	353	bool (iop_pushbuf)(xfs_log_item_t );
354	354	void (iop_committing)(xfs_log_item_t , xfs_lsn_t);
355		-} xfs_item_ops_t;
	355	+};
356	356
357	357	#define IOP_SIZE(ip) (*(ip)->li_ops->iop_size)(ip)
358	358	#define IOP_FORMAT(ip,vp) (*(ip)->li_ops->iop_format)(ip, vp)
...	...	@@ -112,7 +112,7 @@
112	112	char *link)
113	113	{
114	114	xfs_mount_t *mp = ip->i_mount;
115		- int pathlen;
	115	+ xfs_fsize_t pathlen;
116	116	int error = 0;
117	117
118	118	trace_xfs_readlink(ip);
119	119
...	...	@@ -122,12 +122,18 @@
122	122
123	123	xfs_ilock(ip, XFS_ILOCK_SHARED);
124	124
125		- ASSERT(S_ISLNK(ip->i_d.di_mode));
126		- ASSERT(ip->i_d.di_size <= MAXPATHLEN);
127		-
128	125	pathlen = ip->i_d.di_size;
129	126	if (!pathlen)
130	127	goto out;
	128	+
	129	+ if (pathlen < 0 \|\| pathlen > MAXPATHLEN) {
	130	+ xfs_alert(mp, "%s: inode (%llu) bad symlink length (%lld)",
	131	+ __func__, (unsigned long long) ip->i_ino,
	132	+ (long long) pathlen);
	133	+ ASSERT(0);
	134	+ return XFS_ERROR(EFSCORRUPTED);
	135	+ }
	136	+
131	137
132	138	if (ip->i_df.if_flags & XFS_IFINLINE) {
133	139	memcpy(link, ip->i_df.if_u1.if_data, pathlen);