• Darrick J. Wong's avatar
    xfs: don't unconditionally null args->pag in xfs_bmap_btalloc_at_eof · b82a5c42
    Darrick J. Wong authored
    xfs/170 on a filesystem with su=128k,sw=4 produces this splat:
    
    BUG: kernel NULL pointer dereference, address: 0000000000000010
    #PF: supervisor write access in kernel mode
    #PF: error_code(0x0002) - not-present page
    PGD 0 P4D 0
    Oops: 0002 [#1] PREEMPT SMP
    CPU: 1 PID: 4022907 Comm: dd Tainted: G        W          6.3.0-xfsx #2 6ebeeffbe9577d32
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20171121_152543-x86-ol7-bu
    RIP: 0010:xfs_perag_rele+0x10/0x70 [xfs]
    RSP: 0018:ffffc90001e43858 EFLAGS: 00010217
    RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000100
    RDX: ffffffffa054e717 RSI: 0000000000000005 RDI: 0000000000000000
    RBP: ffff888194eea000 R08: 0000000000000000 R09: 0000000000000037
    R10: ffff888100ac1cb0 R11: 0000000000000018 R12: 0000000000000000
    R13: ffffc90001e43a38 R14: ffff888194eea000 R15: ffff888194eea000
    FS:  00007f93d1a0e740(0000) GS:ffff88843fc80000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000000000000010 CR3: 000000018a34f000 CR4: 00000000003506e0
    Call Trace:
     <TASK>
     xfs_bmap_btalloc+0x1a7/0x5d0 [xfs f85291d6841cbb3dc740083f1f331c0327394518]
     xfs_bmapi_allocate+0xee/0x470 [xfs f85291d6841cbb3dc740083f1f331c0327394518]
     xfs_bmapi_write+0x539/0x9e0 [xfs f85291d6841cbb3dc740083f1f331c0327394518]
     xfs_iomap_write_direct+0x1bb/0x2b0 [xfs f85291d6841cbb3dc740083f1f331c0327394518]
     xfs_direct_write_iomap_begin+0x51c/0x710 [xfs f85291d6841cbb3dc740083f1f331c0327394518]
     iomap_iter+0x132/0x2f0
     __iomap_dio_rw+0x2f8/0x840
     iomap_dio_rw+0xe/0x30
     xfs_file_dio_write_aligned+0xad/0x180 [xfs f85291d6841cbb3dc740083f1f331c0327394518]
     xfs_file_write_iter+0xfb/0x190 [xfs f85291d6841cbb3dc740083f1f331c0327394518]
     vfs_write+0x2eb/0x410
     ksys_write+0x65/0xe0
     do_syscall_64+0x2b/0x80
    
    This crash occurs under the "out_low_space" label.  We grabbed a perag
    reference, passed it via args->pag into xfs_bmap_btalloc_at_eof, and
    afterwards args->pag is NULL.  Fix the second function not to clobber
    args->pag if the caller had passed one in.
    
    Fixes: 85843327 ("xfs: factor xfs_bmap_btalloc()")
    Signed-off-by: default avatarDarrick J. Wong <djwong@kernel.org>
    Reviewed-by: default avatarDave Chinner <dchinner@redhat.com>
    Signed-off-by: default avatarDave Chinner <david@fromorbit.com>
    b82a5c42
xfs_bmap.c 166 KB