ext4: limit the number of blocks in one ADD_RANGE TLV
authorHou Tao <houtao1@huawei.com>
Fri, 20 Aug 2021 04:45:05 +0000 (12:45 +0800)
committerSalvatore Bonaccorso <carnil@debian.org>
Sun, 3 Oct 2021 20:14:52 +0000 (21:14 +0100)
commitef4bf53356eb7525d1fcd754a3295feedc823d7d
tree729c0831fdfac7a21231665f7cc2c4560e4632d3
parent96695082f7a3665cb5456ad1c6cde88f0991240e
ext4: limit the number of blocks in one ADD_RANGE TLV

Origin: https://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git/commit/?h=dev&id=a2c2f0826e2b75560b31daf1cd9a755ab93cf4c6
Bug-Debian: https://bugs.debian.org/995425

Now EXT4_FC_TAG_ADD_RANGE uses ext4_extent to track the
newly-added blocks, but the limit on the max value of
ee_len field is ignored, and it can lead to BUG_ON as
shown below when running command "fallocate -l 128M file"
on a fast_commit-enabled fs:

  kernel BUG at fs/ext4/ext4_extents.h:199!
  invalid opcode: 0000 [#1] SMP PTI
  CPU: 3 PID: 624 Comm: fallocate Not tainted 5.14.0-rc6+ #1
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
  RIP: 0010:ext4_fc_write_inode_data+0x1f3/0x200
  Call Trace:
   ? ext4_fc_write_inode+0xf2/0x150
   ext4_fc_commit+0x93b/0xa00
   ? ext4_fallocate+0x1ad/0x10d0
   ext4_sync_file+0x157/0x340
   ? ext4_sync_file+0x157/0x340
   vfs_fsync_range+0x49/0x80
   do_fsync+0x3d/0x70
   __x64_sys_fsync+0x14/0x20
   do_syscall_64+0x3b/0xc0
   entry_SYSCALL_64_after_hwframe+0x44/0xae

Simply fixing it by limiting the number of blocks
in one EXT4_FC_TAG_ADD_RANGE TLV.

Fixes: aa75f4d3daae ("ext4: main fast-commit commit path")
Cc: stable@kernel.org
Signed-off-by: Hou Tao <houtao1@huawei.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Link: https://lore.kernel.org/r/20210820044505.474318-1-houtao1@huawei.com
Gbp-Pq: Topic bugfix/all
Gbp-Pq: Name ext4-limit-the-number-of-blocks-in-one-ADD_RANGE-TLV.patch
fs/ext4/fast_commit.c