Commit e1d33a5c authored by Linus Torvalds's avatar Linus Torvalds

Merge tag 'for-linus-v3.6-rc4' of git://oss.sgi.com/xfs/xfs

Pull xfs bugfixes from Ben Myers:
 - fix uninitialised variable in xfs_rtbuf_get()
 - unlock the AGI buffer when looping in xfs_dialloc
 - check for possible overflow in xfs_ioc_trim

* tag 'for-linus-v3.6-rc4' of git://oss.sgi.com/xfs/xfs:
  xfs: check for possible overflow in xfs_ioc_trim
  xfs: unlock the AGI buffer when looping in xfs_dialloc
  xfs: fix uninitialised variable in xfs_rtbuf_get()
parents 2432cbe4 a672e1be
...@@ -179,12 +179,14 @@ xfs_ioc_trim( ...@@ -179,12 +179,14 @@ xfs_ioc_trim(
* used by the fstrim application. In the end it really doesn't * used by the fstrim application. In the end it really doesn't
* matter as trimming blocks is an advisory interface. * matter as trimming blocks is an advisory interface.
*/ */
if (range.start >= XFS_FSB_TO_B(mp, mp->m_sb.sb_dblocks) ||
range.minlen > XFS_FSB_TO_B(mp, XFS_ALLOC_AG_MAX_USABLE(mp)))
return -XFS_ERROR(EINVAL);
start = BTOBB(range.start); start = BTOBB(range.start);
end = start + BTOBBT(range.len) - 1; end = start + BTOBBT(range.len) - 1;
minlen = BTOBB(max_t(u64, granularity, range.minlen)); minlen = BTOBB(max_t(u64, granularity, range.minlen));
if (XFS_BB_TO_FSB(mp, start) >= mp->m_sb.sb_dblocks)
return -XFS_ERROR(EINVAL);
if (end > XFS_FSB_TO_BB(mp, mp->m_sb.sb_dblocks) - 1) if (end > XFS_FSB_TO_BB(mp, mp->m_sb.sb_dblocks) - 1)
end = XFS_FSB_TO_BB(mp, mp->m_sb.sb_dblocks)- 1; end = XFS_FSB_TO_BB(mp, mp->m_sb.sb_dblocks)- 1;
......
...@@ -962,23 +962,22 @@ xfs_dialloc( ...@@ -962,23 +962,22 @@ xfs_dialloc(
if (!pag->pagi_freecount && !okalloc) if (!pag->pagi_freecount && !okalloc)
goto nextag; goto nextag;
/*
* Then read in the AGI buffer and recheck with the AGI buffer
* lock held.
*/
error = xfs_ialloc_read_agi(mp, tp, agno, &agbp); error = xfs_ialloc_read_agi(mp, tp, agno, &agbp);
if (error) if (error)
goto out_error; goto out_error;
/*
* Once the AGI has been read in we have to recheck
* pagi_freecount with the AGI buffer lock held.
*/
if (pag->pagi_freecount) { if (pag->pagi_freecount) {
xfs_perag_put(pag); xfs_perag_put(pag);
goto out_alloc; goto out_alloc;
} }
if (!okalloc) { if (!okalloc)
xfs_trans_brelse(tp, agbp); goto nextag_relse_buffer;
goto nextag;
}
error = xfs_ialloc_ag_alloc(tp, agbp, &ialloced); error = xfs_ialloc_ag_alloc(tp, agbp, &ialloced);
if (error) { if (error) {
...@@ -1007,6 +1006,8 @@ xfs_dialloc( ...@@ -1007,6 +1006,8 @@ xfs_dialloc(
return 0; return 0;
} }
nextag_relse_buffer:
xfs_trans_brelse(tp, agbp);
nextag: nextag:
xfs_perag_put(pag); xfs_perag_put(pag);
if (++agno == mp->m_sb.sb_agcount) if (++agno == mp->m_sb.sb_agcount)
......
...@@ -857,7 +857,7 @@ xfs_rtbuf_get( ...@@ -857,7 +857,7 @@ xfs_rtbuf_get(
xfs_buf_t *bp; /* block buffer, result */ xfs_buf_t *bp; /* block buffer, result */
xfs_inode_t *ip; /* bitmap or summary inode */ xfs_inode_t *ip; /* bitmap or summary inode */
xfs_bmbt_irec_t map; xfs_bmbt_irec_t map;
int nmap; int nmap = 1;
int error; /* error value */ int error; /* error value */
ip = issum ? mp->m_rsumip : mp->m_rbmip; ip = issum ? mp->m_rsumip : mp->m_rbmip;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment