Commit d0141191 authored by Jan Kara's avatar Jan Kara Committed by Theodore Ts'o

ext4: fix xattr shifting when expanding inodes

The code in ext4_expand_extra_isize_ea() treated new_extra_isize
argument sometimes as the desired target i_extra_isize and sometimes as
the amount by which we need to grow current i_extra_isize. These happen
to coincide when i_extra_isize is 0 which used to be the common case and
so nobody noticed this until recently when we added i_projid to the
inode and so i_extra_isize now needs to grow from 28 to 32 bytes.

The result of these bugs was that we sometimes unnecessarily decided to
move xattrs out of inode even if there was enough space and we often
ended up corrupting in-inode xattrs because arguments to
ext4_xattr_shift_entries() were just wrong. This could demonstrate
itself as BUG_ON in ext4_xattr_shift_entries() triggering.

Fix the problem by introducing new isize_diff variable and use it where
appropriate.

CC: stable@vger.kernel.org   # 4.4.x
Reported-by: default avatarDave Chinner <david@fromorbit.com>
Signed-off-by: default avatarJan Kara <jack@suse.cz>
Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
parent 829fa70d
...@@ -1353,11 +1353,13 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize, ...@@ -1353,11 +1353,13 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,
size_t min_offs, free; size_t min_offs, free;
int total_ino; int total_ino;
void *base, *start, *end; void *base, *start, *end;
int extra_isize = 0, error = 0, tried_min_extra_isize = 0; int error = 0, tried_min_extra_isize = 0;
int s_min_extra_isize = le16_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_min_extra_isize); int s_min_extra_isize = le16_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_min_extra_isize);
int isize_diff; /* How much do we need to grow i_extra_isize */
down_write(&EXT4_I(inode)->xattr_sem); down_write(&EXT4_I(inode)->xattr_sem);
retry: retry:
isize_diff = new_extra_isize - EXT4_I(inode)->i_extra_isize;
if (EXT4_I(inode)->i_extra_isize >= new_extra_isize) { if (EXT4_I(inode)->i_extra_isize >= new_extra_isize) {
up_write(&EXT4_I(inode)->xattr_sem); up_write(&EXT4_I(inode)->xattr_sem);
return 0; return 0;
...@@ -1382,7 +1384,7 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize, ...@@ -1382,7 +1384,7 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,
goto cleanup; goto cleanup;
free = ext4_xattr_free_space(last, &min_offs, base, &total_ino); free = ext4_xattr_free_space(last, &min_offs, base, &total_ino);
if (free >= new_extra_isize) { if (free >= isize_diff) {
entry = IFIRST(header); entry = IFIRST(header);
ext4_xattr_shift_entries(entry, EXT4_I(inode)->i_extra_isize ext4_xattr_shift_entries(entry, EXT4_I(inode)->i_extra_isize
- new_extra_isize, (void *)raw_inode + - new_extra_isize, (void *)raw_inode +
...@@ -1414,7 +1416,7 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize, ...@@ -1414,7 +1416,7 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,
end = bh->b_data + bh->b_size; end = bh->b_data + bh->b_size;
min_offs = end - base; min_offs = end - base;
free = ext4_xattr_free_space(first, &min_offs, base, NULL); free = ext4_xattr_free_space(first, &min_offs, base, NULL);
if (free < new_extra_isize) { if (free < isize_diff) {
if (!tried_min_extra_isize && s_min_extra_isize) { if (!tried_min_extra_isize && s_min_extra_isize) {
tried_min_extra_isize++; tried_min_extra_isize++;
new_extra_isize = s_min_extra_isize; new_extra_isize = s_min_extra_isize;
...@@ -1428,7 +1430,7 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize, ...@@ -1428,7 +1430,7 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,
free = inode->i_sb->s_blocksize; free = inode->i_sb->s_blocksize;
} }
while (new_extra_isize > 0) { while (isize_diff > 0) {
size_t offs, size, entry_size; size_t offs, size, entry_size;
struct ext4_xattr_entry *small_entry = NULL; struct ext4_xattr_entry *small_entry = NULL;
struct ext4_xattr_info i = { struct ext4_xattr_info i = {
...@@ -1459,7 +1461,7 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize, ...@@ -1459,7 +1461,7 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,
EXT4_XATTR_SIZE(le32_to_cpu(last->e_value_size)) + EXT4_XATTR_SIZE(le32_to_cpu(last->e_value_size)) +
EXT4_XATTR_LEN(last->e_name_len); EXT4_XATTR_LEN(last->e_name_len);
if (total_size <= free && total_size < min_total_size) { if (total_size <= free && total_size < min_total_size) {
if (total_size < new_extra_isize) { if (total_size < isize_diff) {
small_entry = last; small_entry = last;
} else { } else {
entry = last; entry = last;
...@@ -1516,20 +1518,19 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize, ...@@ -1516,20 +1518,19 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,
goto cleanup; goto cleanup;
entry = IFIRST(header); entry = IFIRST(header);
if (entry_size + EXT4_XATTR_SIZE(size) >= new_extra_isize) if (entry_size + EXT4_XATTR_SIZE(size) >= isize_diff)
shift_bytes = new_extra_isize; shift_bytes = isize_diff;
else else
shift_bytes = entry_size + size; shift_bytes = entry_size + size;
/* Adjust the offsets and shift the remaining entries ahead */ /* Adjust the offsets and shift the remaining entries ahead */
ext4_xattr_shift_entries(entry, EXT4_I(inode)->i_extra_isize - ext4_xattr_shift_entries(entry, -shift_bytes,
shift_bytes, (void *)raw_inode + (void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE +
EXT4_GOOD_OLD_INODE_SIZE + extra_isize + shift_bytes, EXT4_I(inode)->i_extra_isize + shift_bytes,
(void *)header, total_ino - entry_size, (void *)header, total_ino - entry_size,
inode->i_sb->s_blocksize); inode->i_sb->s_blocksize);
extra_isize += shift_bytes; isize_diff -= shift_bytes;
new_extra_isize -= shift_bytes; EXT4_I(inode)->i_extra_isize += shift_bytes;
EXT4_I(inode)->i_extra_isize = extra_isize;
i.name = b_entry_name; i.name = b_entry_name;
i.value = buffer; i.value = buffer;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment