* [PATCH] xfs: fix s_maxbytes computation on 32-bit kernels
@ 2019-12-22 16:37 Darrick J. Wong
2019-12-24 8:25 ` Christoph Hellwig
0 siblings, 1 reply; 3+ messages in thread
From: Darrick J. Wong @ 2019-12-22 16:37 UTC (permalink / raw)
To: xfs
From: Darrick J. Wong <darrick.wong@oracle.com>
I observed a hang in generic/308 while running fstests on a i686 kernel.
The hang occurred when trying to purge the pagecache on a large sparse
file that had a page created past MAX_LFS_FILESIZE, which caused an
integer overflow in the pagecache xarray and resulted in an infinite
loop.
I then noticed that Linus changed the definition of MAX_LFS_FILESIZE in
commit 0cc3b0ec23ce ("Clarify (and fix) MAX_LFS_FILESIZE macros") so
that it is now one page short of the maximum page index on 32-bit
kernels. Because the XFS function to compute max offset open-codes the
2005-era MAX_LFS_FILESIZE computation and neither the vfs nor mm perform
any sanity checking of s_maxbytes, the code in generic/308 can create a
page above the pagecache's limit and kaboom.
So, fix the function to return MAX_LFS_FILESIZE, but check that bmbt
record offsets have enough space to handle that many bytes. I have no
answer for why this seems to have been broken for years and nobody
noticed.
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
---
fs/xfs/xfs_super.c | 37 ++++++++++++++++---------------------
1 file changed, 16 insertions(+), 21 deletions(-)
diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index d9ae27ddf253..30a17e5ffa67 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -193,30 +193,25 @@ xfs_fs_show_options(
return 0;
}
-static uint64_t
+static loff_t
xfs_max_file_offset(
- unsigned int blockshift)
+ struct xfs_mount *mp)
{
- unsigned int pagefactor = 1;
- unsigned int bitshift = BITS_PER_LONG - 1;
-
- /* Figure out maximum filesize, on Linux this can depend on
- * the filesystem blocksize (on 32 bit platforms).
- * __block_write_begin does this in an [unsigned] long long...
- * page->index << (PAGE_SHIFT - bbits)
- * So, for page sized blocks (4K on 32 bit platforms),
- * this wraps at around 8Tb (hence MAX_LFS_FILESIZE which is
- * (((u64)PAGE_SIZE << (BITS_PER_LONG-1))-1)
- * but for smaller blocksizes it is less (bbits = log2 bsize).
+ /*
+ * XFS block mappings use 54 bits to store the logical block offset.
+ * This should suffice to handle the maximum file size that the VFS
+ * supports (currently 2^63 bytes on 64-bit and ULONG_MAX << PAGE_SHIFT
+ * bytes on 32-bit), but as XFS and VFS have gotten the s_maxbytes
+ * calculation wrong on 32-bit kernels in the past, we'll add a WARN_ON
+ * to check this assertion before returning MAX_LFS_FILESIZE.
+ *
+ * Avoid integer overflow by comparing the maximum bmbt offset to the
+ * maximum pagecache offset in units of fs blocks.
*/
+ WARN_ON(((1ULL << BMBT_STARTOFF_BITLEN) - 1) <
+ XFS_B_TO_FSBT(mp, MAX_LFS_FILESIZE));
-#if BITS_PER_LONG == 32
- ASSERT(sizeof(sector_t) == 8);
- pagefactor = PAGE_SIZE;
- bitshift = BITS_PER_LONG;
-#endif
-
- return (((uint64_t)pagefactor) << bitshift) - 1;
+ return MAX_LFS_FILESIZE;
}
/*
@@ -1435,7 +1430,7 @@ xfs_fc_fill_super(
sb->s_magic = XFS_SUPER_MAGIC;
sb->s_blocksize = mp->m_sb.sb_blocksize;
sb->s_blocksize_bits = ffs(sb->s_blocksize) - 1;
- sb->s_maxbytes = xfs_max_file_offset(sb->s_blocksize_bits);
+ sb->s_maxbytes = xfs_max_file_offset(mp);
sb->s_max_links = XFS_MAXLINK;
sb->s_time_gran = 1;
sb->s_time_min = S32_MIN;
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] xfs: fix s_maxbytes computation on 32-bit kernels
2019-12-22 16:37 [PATCH] xfs: fix s_maxbytes computation on 32-bit kernels Darrick J. Wong
@ 2019-12-24 8:25 ` Christoph Hellwig
2019-12-24 16:37 ` Darrick J. Wong
0 siblings, 1 reply; 3+ messages in thread
From: Christoph Hellwig @ 2019-12-24 8:25 UTC (permalink / raw)
To: Darrick J. Wong; +Cc: xfs
On Sun, Dec 22, 2019 at 08:37:11AM -0800, Darrick J. Wong wrote:
> From: Darrick J. Wong <darrick.wong@oracle.com>
>
> I observed a hang in generic/308 while running fstests on a i686 kernel.
> The hang occurred when trying to purge the pagecache on a large sparse
> file that had a page created past MAX_LFS_FILESIZE, which caused an
> integer overflow in the pagecache xarray and resulted in an infinite
> loop.
>
> I then noticed that Linus changed the definition of MAX_LFS_FILESIZE in
> commit 0cc3b0ec23ce ("Clarify (and fix) MAX_LFS_FILESIZE macros") so
> that it is now one page short of the maximum page index on 32-bit
> kernels. Because the XFS function to compute max offset open-codes the
> 2005-era MAX_LFS_FILESIZE computation and neither the vfs nor mm perform
> any sanity checking of s_maxbytes, the code in generic/308 can create a
> page above the pagecache's limit and kaboom.
>
> So, fix the function to return MAX_LFS_FILESIZE, but check that bmbt
> record offsets have enough space to handle that many bytes. I have no
> answer for why this seems to have been broken for years and nobody
> noticed.
>
> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> ---
> fs/xfs/xfs_super.c | 37 ++++++++++++++++---------------------
> 1 file changed, 16 insertions(+), 21 deletions(-)
>
> diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
> index d9ae27ddf253..30a17e5ffa67 100644
> --- a/fs/xfs/xfs_super.c
> +++ b/fs/xfs/xfs_super.c
> @@ -193,30 +193,25 @@ xfs_fs_show_options(
> return 0;
> }
>
> -static uint64_t
> +static loff_t
> xfs_max_file_offset(
> - unsigned int blockshift)
> + struct xfs_mount *mp)
> {
> - unsigned int pagefactor = 1;
> - unsigned int bitshift = BITS_PER_LONG - 1;
> -
> - /* Figure out maximum filesize, on Linux this can depend on
> - * the filesystem blocksize (on 32 bit platforms).
> - * __block_write_begin does this in an [unsigned] long long...
> - * page->index << (PAGE_SHIFT - bbits)
> - * So, for page sized blocks (4K on 32 bit platforms),
> - * this wraps at around 8Tb (hence MAX_LFS_FILESIZE which is
> - * (((u64)PAGE_SIZE << (BITS_PER_LONG-1))-1)
> - * but for smaller blocksizes it is less (bbits = log2 bsize).
> + /*
> + * XFS block mappings use 54 bits to store the logical block offset.
> + * This should suffice to handle the maximum file size that the VFS
> + * supports (currently 2^63 bytes on 64-bit and ULONG_MAX << PAGE_SHIFT
> + * bytes on 32-bit), but as XFS and VFS have gotten the s_maxbytes
> + * calculation wrong on 32-bit kernels in the past, we'll add a WARN_ON
> + * to check this assertion before returning MAX_LFS_FILESIZE.
> + *
> + * Avoid integer overflow by comparing the maximum bmbt offset to the
> + * maximum pagecache offset in units of fs blocks.
> */
> + WARN_ON(((1ULL << BMBT_STARTOFF_BITLEN) - 1) <
> + XFS_B_TO_FSBT(mp, MAX_LFS_FILESIZE));
>
> -#if BITS_PER_LONG == 32
> - ASSERT(sizeof(sector_t) == 8);
> - pagefactor = PAGE_SIZE;
> - bitshift = BITS_PER_LONG;
> -#endif
> -
> - return (((uint64_t)pagefactor) << bitshift) - 1;
> + return MAX_LFS_FILESIZE;
> }
>
> /*
> @@ -1435,7 +1430,7 @@ xfs_fc_fill_super(
> sb->s_magic = XFS_SUPER_MAGIC;
> sb->s_blocksize = mp->m_sb.sb_blocksize;
> sb->s_blocksize_bits = ffs(sb->s_blocksize) - 1;
> - sb->s_maxbytes = xfs_max_file_offset(sb->s_blocksize_bits);
> + sb->s_maxbytes = xfs_max_file_offset(mp);
The code organization is really weird now. Just assign MAX_LFS_FILESIZE
to s_maxbytes directly here, and move the WARN_ON right next to it -
preferably as a WARN_ON_ONCE with an actual error return instead of
just warning.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] xfs: fix s_maxbytes computation on 32-bit kernels
2019-12-24 8:25 ` Christoph Hellwig
@ 2019-12-24 16:37 ` Darrick J. Wong
0 siblings, 0 replies; 3+ messages in thread
From: Darrick J. Wong @ 2019-12-24 16:37 UTC (permalink / raw)
To: Christoph Hellwig; +Cc: xfs
On Tue, Dec 24, 2019 at 12:25:00AM -0800, Christoph Hellwig wrote:
> On Sun, Dec 22, 2019 at 08:37:11AM -0800, Darrick J. Wong wrote:
> > From: Darrick J. Wong <darrick.wong@oracle.com>
> >
> > I observed a hang in generic/308 while running fstests on a i686 kernel.
> > The hang occurred when trying to purge the pagecache on a large sparse
> > file that had a page created past MAX_LFS_FILESIZE, which caused an
> > integer overflow in the pagecache xarray and resulted in an infinite
> > loop.
> >
> > I then noticed that Linus changed the definition of MAX_LFS_FILESIZE in
> > commit 0cc3b0ec23ce ("Clarify (and fix) MAX_LFS_FILESIZE macros") so
> > that it is now one page short of the maximum page index on 32-bit
> > kernels. Because the XFS function to compute max offset open-codes the
> > 2005-era MAX_LFS_FILESIZE computation and neither the vfs nor mm perform
> > any sanity checking of s_maxbytes, the code in generic/308 can create a
> > page above the pagecache's limit and kaboom.
> >
> > So, fix the function to return MAX_LFS_FILESIZE, but check that bmbt
> > record offsets have enough space to handle that many bytes. I have no
> > answer for why this seems to have been broken for years and nobody
> > noticed.
> >
> > Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> > ---
> > fs/xfs/xfs_super.c | 37 ++++++++++++++++---------------------
> > 1 file changed, 16 insertions(+), 21 deletions(-)
> >
> > diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
> > index d9ae27ddf253..30a17e5ffa67 100644
> > --- a/fs/xfs/xfs_super.c
> > +++ b/fs/xfs/xfs_super.c
> > @@ -193,30 +193,25 @@ xfs_fs_show_options(
> > return 0;
> > }
> >
> > -static uint64_t
> > +static loff_t
> > xfs_max_file_offset(
> > - unsigned int blockshift)
> > + struct xfs_mount *mp)
> > {
> > - unsigned int pagefactor = 1;
> > - unsigned int bitshift = BITS_PER_LONG - 1;
> > -
> > - /* Figure out maximum filesize, on Linux this can depend on
> > - * the filesystem blocksize (on 32 bit platforms).
> > - * __block_write_begin does this in an [unsigned] long long...
> > - * page->index << (PAGE_SHIFT - bbits)
> > - * So, for page sized blocks (4K on 32 bit platforms),
> > - * this wraps at around 8Tb (hence MAX_LFS_FILESIZE which is
> > - * (((u64)PAGE_SIZE << (BITS_PER_LONG-1))-1)
> > - * but for smaller blocksizes it is less (bbits = log2 bsize).
> > + /*
> > + * XFS block mappings use 54 bits to store the logical block offset.
> > + * This should suffice to handle the maximum file size that the VFS
> > + * supports (currently 2^63 bytes on 64-bit and ULONG_MAX << PAGE_SHIFT
> > + * bytes on 32-bit), but as XFS and VFS have gotten the s_maxbytes
> > + * calculation wrong on 32-bit kernels in the past, we'll add a WARN_ON
> > + * to check this assertion before returning MAX_LFS_FILESIZE.
> > + *
> > + * Avoid integer overflow by comparing the maximum bmbt offset to the
> > + * maximum pagecache offset in units of fs blocks.
> > */
> > + WARN_ON(((1ULL << BMBT_STARTOFF_BITLEN) - 1) <
> > + XFS_B_TO_FSBT(mp, MAX_LFS_FILESIZE));
> >
> > -#if BITS_PER_LONG == 32
> > - ASSERT(sizeof(sector_t) == 8);
> > - pagefactor = PAGE_SIZE;
> > - bitshift = BITS_PER_LONG;
> > -#endif
> > -
> > - return (((uint64_t)pagefactor) << bitshift) - 1;
> > + return MAX_LFS_FILESIZE;
> > }
> >
> > /*
> > @@ -1435,7 +1430,7 @@ xfs_fc_fill_super(
> > sb->s_magic = XFS_SUPER_MAGIC;
> > sb->s_blocksize = mp->m_sb.sb_blocksize;
> > sb->s_blocksize_bits = ffs(sb->s_blocksize) - 1;
> > - sb->s_maxbytes = xfs_max_file_offset(sb->s_blocksize_bits);
> > + sb->s_maxbytes = xfs_max_file_offset(mp);
>
> The code organization is really weird now. Just assign MAX_LFS_FILESIZE
> to s_maxbytes directly here, and move the WARN_ON right next to it -
> preferably as a WARN_ON_ONCE with an actual error return instead of
> just warning.
Ok.
--D
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-12-24 16:37 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-12-22 16:37 [PATCH] xfs: fix s_maxbytes computation on 32-bit kernels Darrick J. Wong
2019-12-24 8:25 ` Christoph Hellwig
2019-12-24 16:37 ` Darrick J. Wong
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.