Commit 64cce597 authored by Jiachen Zhang's avatar Jiachen Zhang Committed by openeuler-sync-bot
Browse files

xfs: ensure logflagsp is initialized in xfs_bmap_del_extent_real 

mainline inclusion
from mainline-v6.7-rc4
commit e6af9c98cbf0164a619d95572136bfb54d482dd6
category: bugfix
bugzilla: 188220, https://gitee.com/openeuler/kernel/issues/I76JSK
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e6af9c98cbf0164a619d95572136bfb54d482dd6



--------------------------------

In the case of returning -ENOSPC, ensure logflagsp is initialized by 0.
Otherwise the caller __xfs_bunmapi will set uninitialized illegal
tmp_logflags value into xfs log, which might cause unpredictable error
in the log recovery procedure.

Also, remove the flags variable and set the *logflagsp directly, so that
the code should be more robust in the long run.

Fixes: 1b24b633 ("xfs: move some more code into xfs_bmap_del_extent_real")
Signed-off-by: default avatarJiachen Zhang <zhangjiachen.jaycee@bytedance.com>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Reviewed-by: default avatar"Darrick J. Wong" <djwong@kernel.org>
Signed-off-by: default avatarChandan Babu R <chandanbabu@kernel.org>
Conflicts:
	fs/xfs/libxfs/xfs_bmap.c
[conflicts in xfs_bmap_del_extent_real()]
Signed-off-by: default avatarLong Li <leo.lilong@huawei.com>
(cherry picked from commit 7d542696)
parent 0fee06e0

fs/xfs/libxfs/xfs_bmap.c

+32 −44
Original line number Diff line number Diff line
@@ -4952,7 +4952,6 @@ xfs_bmap_del_extent_real( 
	xfs_fileoff_t		del_endoff;	/* first offset past del */

	int			do_fx;	/* free extent at end of routine */

	int			error;	/* error return value */

	int			flags = 0;/* inode logging flags */

	struct xfs_bmbt_irec	got;	/* current extent entry */

	xfs_fileoff_t		got_endoff;	/* first offset past got */

	int			i;	/* temp state */
@@ -4965,6 +4964,8 @@ xfs_bmap_del_extent_real( 
	int			state = xfs_bmap_fork_to_state(whichfork);

	struct xfs_bmbt_irec	old;



	*logflagsp = 0;



	mp = ip->i_mount;

	XFS_STATS_INC(mp, xs_del_exlist);
@@ -4977,7 +4978,6 @@ xfs_bmap_del_extent_real( 
	ASSERT(got_endoff >= del_endoff);

	ASSERT(!isnullstartblock(got.br_startblock));

	qfield = 0;

	error = 0;



	/*

	 * If it's the case where the directory code is running with no block
@@ -4993,7 +4993,7 @@ xfs_bmap_del_extent_real( 
	    del->br_startoff > got.br_startoff && del_endoff < got_endoff)

		return -ENOSPC;



	flags = XFS_ILOG_CORE;

	*logflagsp = XFS_ILOG_CORE;

	if (whichfork == XFS_DATA_FORK && XFS_IS_REALTIME_INODE(ip)) {

		xfs_filblks_t	len;

		xfs_extlen_t	mod;
@@ -5011,7 +5011,7 @@ xfs_bmap_del_extent_real( 


			error = xfs_rtfree_extent(tp, bno, (xfs_extlen_t)len);

			if (error)

				goto done;

				return error;

		}



		do_fx = 0;
@@ -5027,11 +5027,9 @@ xfs_bmap_del_extent_real( 
	if (cur) {

		error = xfs_bmbt_lookup_eq(cur, &got, &i);

		if (error)

			goto done;

		if (XFS_IS_CORRUPT(mp, i != 1)) {

			error = -EFSCORRUPTED;

			goto done;

		}

			return error;

		if (XFS_IS_CORRUPT(mp, i != 1))

			return -EFSCORRUPTED;

	}



	if (got.br_startoff == del->br_startoff)
@@ -5048,17 +5046,15 @@ xfs_bmap_del_extent_real( 
		xfs_iext_prev(ifp, icur);

		ifp->if_nextents--;



		flags |= XFS_ILOG_CORE;

		*logflagsp |= XFS_ILOG_CORE;

		if (!cur) {

			flags |= xfs_ilog_fext(whichfork);

			*logflagsp |= xfs_ilog_fext(whichfork);

			break;

		}

		if ((error = xfs_btree_delete(cur, &i)))

			goto done;

		if (XFS_IS_CORRUPT(mp, i != 1)) {

			error = -EFSCORRUPTED;

			goto done;

		}

			return error;

		if (XFS_IS_CORRUPT(mp, i != 1))

			return -EFSCORRUPTED;

		break;

	case BMAP_LEFT_FILLING:

		/*
@@ -5069,12 +5065,12 @@ xfs_bmap_del_extent_real( 
		got.br_blockcount -= del->br_blockcount;

		xfs_iext_update_extent(ip, state, icur, &got);

		if (!cur) {

			flags |= xfs_ilog_fext(whichfork);

			*logflagsp |= xfs_ilog_fext(whichfork);

			break;

		}

		error = xfs_bmbt_update(cur, &got);

		if (error)

			goto done;

			return error;

		break;

	case BMAP_RIGHT_FILLING:

		/*
@@ -5083,12 +5079,12 @@ xfs_bmap_del_extent_real( 
		got.br_blockcount -= del->br_blockcount;

		xfs_iext_update_extent(ip, state, icur, &got);

		if (!cur) {

			flags |= xfs_ilog_fext(whichfork);

			*logflagsp |= xfs_ilog_fext(whichfork);

			break;

		}

		error = xfs_bmbt_update(cur, &got);

		if (error)

			goto done;

			return error;

		break;

	case 0:

		/*
@@ -5111,8 +5107,7 @@ xfs_bmap_del_extent_real( 
		if (error) {

			ASSERT(S_ISDIR(VFS_I(ip)->i_mode) &&

				whichfork == XFS_DATA_FORK);

			error = -ENOSPC;

			goto done;

			return -ENOSPC;

		}



		old = got;
@@ -5125,18 +5120,18 @@ xfs_bmap_del_extent_real( 
		new.br_state = got.br_state;

		new.br_startblock = del_endblock;



		flags |= XFS_ILOG_CORE;

		*logflagsp |= XFS_ILOG_CORE;

		if (cur) {

			error = xfs_bmbt_update(cur, &got);

			if (error)

				goto done;

				return error;

			error = xfs_btree_increment(cur, 0, &i);

			if (error)

				goto done;

				return error;

			cur->bc_rec.b = new;

			error = xfs_btree_insert(cur, &i);

			if (error && error != -ENOSPC)

				goto done;

				return error;

			/*

			 * If get no-space back from btree insert, it tried a

			 * split, and we have a zero block reservation.  Fix up
@@ -5149,33 +5144,28 @@ xfs_bmap_del_extent_real( 
				 */

				error = xfs_bmbt_lookup_eq(cur, &got, &i);

				if (error)

					goto done;

				if (XFS_IS_CORRUPT(mp, i != 1)) {

					error = -EFSCORRUPTED;

					goto done;

				}

					return error;

				if (XFS_IS_CORRUPT(mp, i != 1))

					return -EFSCORRUPTED;

				/*

				 * Update the btree record back

				 * to the original value.

				 */

				error = xfs_bmbt_update(cur, &old);

				if (error)

					goto done;

					return error;

				/*

				 * Reset the extent record back

				 * to the original value.

				 */

				xfs_iext_update_extent(ip, state, icur, &old);

				flags = 0;

				error = -ENOSPC;

				goto done;

			}

			if (XFS_IS_CORRUPT(mp, i != 1)) {

				error = -EFSCORRUPTED;

				goto done;

				*logflagsp = 0;

				return -ENOSPC;

			}

			if (XFS_IS_CORRUPT(mp, i != 1))

				return -EFSCORRUPTED;

		} else

			flags |= xfs_ilog_fext(whichfork);

			*logflagsp |= xfs_ilog_fext(whichfork);



		ifp->if_nextents++;

		xfs_iext_next(ifp, icur);
@@ -5199,7 +5189,7 @@ xfs_bmap_del_extent_real( 
					((bflags & XFS_BMAPI_NODISCARD) ||

					del->br_state == XFS_EXT_UNWRITTEN));

			if (error)

				goto done;

				return error;

		}

	}
@@ -5214,9 +5204,7 @@ xfs_bmap_del_extent_real( 
	if (qfield && !(bflags & XFS_BMAPI_REMAP))

		xfs_trans_mod_dquot_byino(tp, ip, qfield, (long)-nblks);



done:

	*logflagsp = flags;

	return error;

	return 0;

}



/*