Skip to content

Commit 6038299

Browse files
author
Darrick J. Wong
committed
xfs: get rid of the xchk_xfile_*_descr calls
The xchk_xfile_*_descr macros call kasprintf, which can fail to allocate memory if the formatted string is larger than 16 bytes (or whatever the nofail guarantees are nowadays). Some of them could easily exceed that, and Jiaming Zhang found a few places where that can happen with syzbot. The descriptions are debugging aids and aren't required to be unique, so let's just pass in static strings and eliminate this path to failure. Note this patch touches a number of commits, most of which were merged between 6.6 and 6.14. Cc: r772577952@gmail.com Cc: <stable@vger.kernel.org> # v6.12 Fixes: ab97f4b ("xfs: repair AGI unlinked inode bucket lists") Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Tested-by: Jiaming Zhang <r772577952@gmail.com>
1 parent eaec8ae commit 6038299

19 files changed

Lines changed: 47 additions & 166 deletions

‎fs/xfs/scrub/agheader_repair.c‎

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1708,7 +1708,6 @@ xrep_agi(
17081708
{
17091709
struct xrep_agi *ragi;
17101710
struct xfs_mount *mp = sc->mp;
1711-
char *descr;
17121711
unsigned int i;
17131712
int error;
17141713

@@ -1742,17 +1741,13 @@ xrep_agi(
17421741
xagino_bitmap_init(&ragi->iunlink_bmp);
17431742
sc->buf_cleanup = xrep_agi_buf_cleanup;
17441743

1745-
descr = xchk_xfile_ag_descr(sc, "iunlinked next pointers");
1746-
error = xfarray_create(descr, 0, sizeof(xfs_agino_t),
1747-
&ragi->iunlink_next);
1748-
kfree(descr);
1744+
error = xfarray_create("iunlinked next pointers", 0,
1745+
sizeof(xfs_agino_t), &ragi->iunlink_next);
17491746
if (error)
17501747
return error;
17511748

1752-
descr = xchk_xfile_ag_descr(sc, "iunlinked prev pointers");
1753-
error = xfarray_create(descr, 0, sizeof(xfs_agino_t),
1754-
&ragi->iunlink_prev);
1755-
kfree(descr);
1749+
error = xfarray_create("iunlinked prev pointers", 0,
1750+
sizeof(xfs_agino_t), &ragi->iunlink_prev);
17561751
if (error)
17571752
return error;
17581753

‎fs/xfs/scrub/alloc_repair.c‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -850,7 +850,6 @@ xrep_allocbt(
850850
struct xrep_abt *ra;
851851
struct xfs_mount *mp = sc->mp;
852852
unsigned int busy_gen;
853-
char *descr;
854853
int error;
855854

856855
/* We require the rmapbt to rebuild anything. */
@@ -876,11 +875,9 @@ xrep_allocbt(
876875
}
877876

878877
/* Set up enough storage to handle maximally fragmented free space. */
879-
descr = xchk_xfile_ag_descr(sc, "free space records");
880-
error = xfarray_create(descr, mp->m_sb.sb_agblocks / 2,
878+
error = xfarray_create("free space records", mp->m_sb.sb_agblocks / 2,
881879
sizeof(struct xfs_alloc_rec_incore),
882880
&ra->free_records);
883-
kfree(descr);
884881
if (error)
885882
goto out_ra;
886883

‎fs/xfs/scrub/attr_repair.c‎

Lines changed: 5 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1529,7 +1529,6 @@ xrep_xattr_setup_scan(
15291529
struct xrep_xattr **rxp)
15301530
{
15311531
struct xrep_xattr *rx;
1532-
char *descr;
15331532
int max_len;
15341533
int error;
15351534

@@ -1555,35 +1554,26 @@ xrep_xattr_setup_scan(
15551554
goto out_rx;
15561555

15571556
/* Set up some staging for salvaged attribute keys and values */
1558-
descr = xchk_xfile_ino_descr(sc, "xattr keys");
1559-
error = xfarray_create(descr, 0, sizeof(struct xrep_xattr_key),
1557+
error = xfarray_create("xattr keys", 0, sizeof(struct xrep_xattr_key),
15601558
&rx->xattr_records);
1561-
kfree(descr);
15621559
if (error)
15631560
goto out_rx;
15641561

1565-
descr = xchk_xfile_ino_descr(sc, "xattr names");
1566-
error = xfblob_create(descr, &rx->xattr_blobs);
1567-
kfree(descr);
1562+
error = xfblob_create("xattr names", &rx->xattr_blobs);
15681563
if (error)
15691564
goto out_keys;
15701565

15711566
if (xfs_has_parent(sc->mp)) {
15721567
ASSERT(sc->flags & XCHK_FSGATES_DIRENTS);
15731568

1574-
descr = xchk_xfile_ino_descr(sc,
1575-
"xattr retained parent pointer entries");
1576-
error = xfarray_create(descr, 0,
1569+
error = xfarray_create("xattr parent pointer entries", 0,
15771570
sizeof(struct xrep_xattr_pptr),
15781571
&rx->pptr_recs);
1579-
kfree(descr);
15801572
if (error)
15811573
goto out_values;
15821574

1583-
descr = xchk_xfile_ino_descr(sc,
1584-
"xattr retained parent pointer names");
1585-
error = xfblob_create(descr, &rx->pptr_names);
1586-
kfree(descr);
1575+
error = xfblob_create("xattr parent pointer names",
1576+
&rx->pptr_names);
15871577
if (error)
15881578
goto out_pprecs;
15891579

‎fs/xfs/scrub/bmap_repair.c‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -923,7 +923,6 @@ xrep_bmap(
923923
bool allow_unwritten)
924924
{
925925
struct xrep_bmap *rb;
926-
char *descr;
927926
xfs_extnum_t max_bmbt_recs;
928927
bool large_extcount;
929928
int error = 0;
@@ -945,11 +944,8 @@ xrep_bmap(
945944
/* Set up enough storage to handle the max records for this fork. */
946945
large_extcount = xfs_has_large_extent_counts(sc->mp);
947946
max_bmbt_recs = xfs_iext_max_nextents(large_extcount, whichfork);
948-
descr = xchk_xfile_ino_descr(sc, "%s fork mapping records",
949-
whichfork == XFS_DATA_FORK ? "data" : "attr");
950-
error = xfarray_create(descr, max_bmbt_recs,
947+
error = xfarray_create("fork mapping records", max_bmbt_recs,
951948
sizeof(struct xfs_bmbt_rec), &rb->bmap_records);
952-
kfree(descr);
953949
if (error)
954950
goto out_rb;
955951

‎fs/xfs/scrub/common.h‎

Lines changed: 0 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -246,31 +246,6 @@ static inline bool xchk_could_repair(const struct xfs_scrub *sc)
246246

247247
int xchk_metadata_inode_forks(struct xfs_scrub *sc);
248248

249-
/*
250-
* Helper macros to allocate and format xfile description strings.
251-
* Callers must kfree the pointer returned.
252-
*/
253-
#define xchk_xfile_descr(sc, fmt, ...) \
254-
kasprintf(XCHK_GFP_FLAGS, "XFS (%s): " fmt, \
255-
(sc)->mp->m_super->s_id, ##__VA_ARGS__)
256-
#define xchk_xfile_ag_descr(sc, fmt, ...) \
257-
kasprintf(XCHK_GFP_FLAGS, "XFS (%s): AG 0x%x " fmt, \
258-
(sc)->mp->m_super->s_id, \
259-
(sc)->sa.pag ? \
260-
pag_agno((sc)->sa.pag) : (sc)->sm->sm_agno, \
261-
##__VA_ARGS__)
262-
#define xchk_xfile_ino_descr(sc, fmt, ...) \
263-
kasprintf(XCHK_GFP_FLAGS, "XFS (%s): inode 0x%llx " fmt, \
264-
(sc)->mp->m_super->s_id, \
265-
(sc)->ip ? (sc)->ip->i_ino : (sc)->sm->sm_ino, \
266-
##__VA_ARGS__)
267-
#define xchk_xfile_rtgroup_descr(sc, fmt, ...) \
268-
kasprintf(XCHK_GFP_FLAGS, "XFS (%s): rtgroup 0x%x " fmt, \
269-
(sc)->mp->m_super->s_id, \
270-
(sc)->sa.pag ? \
271-
rtg_rgno((sc)->sr.rtg) : (sc)->sm->sm_agno, \
272-
##__VA_ARGS__)
273-
274249
/*
275250
* Setting up a hook to wait for intents to drain is costly -- we have to take
276251
* the CPU hotplug lock and force an i-cache flush on all CPUs once to set it

‎fs/xfs/scrub/dir.c‎

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1102,22 +1102,17 @@ xchk_directory(
11021102
sd->xname.name = sd->namebuf;
11031103

11041104
if (xfs_has_parent(sc->mp)) {
1105-
char *descr;
1106-
11071105
/*
11081106
* Set up some staging memory for dirents that we can't check
11091107
* due to locking contention.
11101108
*/
1111-
descr = xchk_xfile_ino_descr(sc, "slow directory entries");
1112-
error = xfarray_create(descr, 0, sizeof(struct xchk_dirent),
1113-
&sd->dir_entries);
1114-
kfree(descr);
1109+
error = xfarray_create("slow directory entries", 0,
1110+
sizeof(struct xchk_dirent), &sd->dir_entries);
11151111
if (error)
11161112
goto out_sd;
11171113

1118-
descr = xchk_xfile_ino_descr(sc, "slow directory entry names");
1119-
error = xfblob_create(descr, &sd->dir_names);
1120-
kfree(descr);
1114+
error = xfblob_create("slow directory entry names",
1115+
&sd->dir_names);
11211116
if (error)
11221117
goto out_entries;
11231118
}

‎fs/xfs/scrub/dir_repair.c‎

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1784,20 +1784,15 @@ xrep_dir_setup_scan(
17841784
struct xrep_dir *rd)
17851785
{
17861786
struct xfs_scrub *sc = rd->sc;
1787-
char *descr;
17881787
int error;
17891788

17901789
/* Set up some staging memory for salvaging dirents. */
1791-
descr = xchk_xfile_ino_descr(sc, "directory entries");
1792-
error = xfarray_create(descr, 0, sizeof(struct xrep_dirent),
1793-
&rd->dir_entries);
1794-
kfree(descr);
1790+
error = xfarray_create("directory entries", 0,
1791+
sizeof(struct xrep_dirent), &rd->dir_entries);
17951792
if (error)
17961793
return error;
17971794

1798-
descr = xchk_xfile_ino_descr(sc, "directory entry names");
1799-
error = xfblob_create(descr, &rd->dir_names);
1800-
kfree(descr);
1795+
error = xfblob_create("directory entry names", &rd->dir_names);
18011796
if (error)
18021797
goto out_xfarray;
18031798

‎fs/xfs/scrub/dirtree.c‎

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,6 @@ xchk_setup_dirtree(
9292
struct xfs_scrub *sc)
9393
{
9494
struct xchk_dirtree *dl;
95-
char *descr;
9695
int error;
9796

9897
xchk_fsgates_enable(sc, XCHK_FSGATES_DIRENTS);
@@ -116,16 +115,12 @@ xchk_setup_dirtree(
116115

117116
mutex_init(&dl->lock);
118117

119-
descr = xchk_xfile_ino_descr(sc, "dirtree path steps");
120-
error = xfarray_create(descr, 0, sizeof(struct xchk_dirpath_step),
121-
&dl->path_steps);
122-
kfree(descr);
118+
error = xfarray_create("dirtree path steps", 0,
119+
sizeof(struct xchk_dirpath_step), &dl->path_steps);
123120
if (error)
124121
goto out_dl;
125122

126-
descr = xchk_xfile_ino_descr(sc, "dirtree path names");
127-
error = xfblob_create(descr, &dl->path_names);
128-
kfree(descr);
123+
error = xfblob_create("dirtree path names", &dl->path_names);
129124
if (error)
130125
goto out_steps;
131126

‎fs/xfs/scrub/ialloc_repair.c‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -797,7 +797,6 @@ xrep_iallocbt(
797797
{
798798
struct xrep_ibt *ri;
799799
struct xfs_mount *mp = sc->mp;
800-
char *descr;
801800
xfs_agino_t first_agino, last_agino;
802801
int error = 0;
803802

@@ -816,11 +815,9 @@ xrep_iallocbt(
816815
/* Set up enough storage to handle an AG with nothing but inodes. */
817816
xfs_agino_range(mp, pag_agno(sc->sa.pag), &first_agino, &last_agino);
818817
last_agino /= XFS_INODES_PER_CHUNK;
819-
descr = xchk_xfile_ag_descr(sc, "inode index records");
820-
error = xfarray_create(descr, last_agino,
818+
error = xfarray_create("inode index records", last_agino,
821819
sizeof(struct xfs_inobt_rec_incore),
822820
&ri->inode_records);
823-
kfree(descr);
824821
if (error)
825822
goto out_ri;
826823

‎fs/xfs/scrub/nlinks.c‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -990,7 +990,6 @@ xchk_nlinks_setup_scan(
990990
struct xchk_nlink_ctrs *xnc)
991991
{
992992
struct xfs_mount *mp = sc->mp;
993-
char *descr;
994993
unsigned long long max_inos;
995994
xfs_agnumber_t last_agno = mp->m_sb.sb_agcount - 1;
996995
xfs_agino_t first_agino, last_agino;
@@ -1007,10 +1006,9 @@ xchk_nlinks_setup_scan(
10071006
*/
10081007
xfs_agino_range(mp, last_agno, &first_agino, &last_agino);
10091008
max_inos = XFS_AGINO_TO_INO(mp, last_agno, last_agino) + 1;
1010-
descr = xchk_xfile_descr(sc, "file link counts");
1011-
error = xfarray_create(descr, min(XFS_MAXINUMBER + 1, max_inos),
1009+
error = xfarray_create("file link counts",
1010+
min(XFS_MAXINUMBER + 1, max_inos),
10121011
sizeof(struct xchk_nlink), &xnc->nlinks);
1013-
kfree(descr);
10141012
if (error)
10151013
goto out_teardown;
10161014

0 commit comments

Comments
 (0)