https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=206328
has a nice analysis of what can go wrong when we try to read blocks which
are at extremely high offsets, when our sector_t is 64 bits but our pgoff_t
is only 32. The cases in question that I've seen are the result of filesystem
corruption.
In short, __getblk_slow() loops until it gets a buffer head.
for (;;) {
struct buffer_head * bh;
bh = __find_get_block(bdev, block, size);
if (bh)
return bh;
if (!grow_buffers(bdev, block, size))
free_more_memory();
}
When it fails it calls grow_buffers() to create buffers for the block in
question. But, nothing stops us from going in there with a huge
block offset, and then:
static int
grow_buffers(struct block_device *bdev, sector_t block, int size)
{
struct page *page;
pgoff_t index; /* 32 bits on 32-bit machines */
int sizebits;
sizebits = -1;
do {
sizebits++;
} while ((size << sizebits) < PAGE_SIZE);
index = block >> sizebits;
block = index << sizebits;
...
has some nasty wrapping, and winds up mapping the wrong block. Then we try
again. Lather, rinse, repeat.
It seems that making sure that our block is not past what we can address is
worth doing, something like the patch that follows.
This also addresses the problem mentioned at:
http://kernelfun.blogspot.com/2006/11/mokb-05-11-2006-linux-26x-iso9660.html
notes/questions:
technically it should probably be ((pgoff_t)1 << (sizeof(pgoff_t)*8)) - 1)
instead of ULONG_MAX? Maybe that'd be a handy macro... MAX_PAGE_INDEX?
Also I think using ffs(size) here is ok, can we ever have block sizes
which are not powers of two?
Signed-off-by: Eric Sandeen <[email protected]>
Index: linux-2.6.18/fs/buffer.c
===================================================================
--- linux-2.6.18.orig/fs/buffer.c
+++ linux-2.6.18/fs/buffer.c
@@ -1202,6 +1202,14 @@ __getblk_slow(struct block_device *bdev,
return NULL;
}
+ /* Don't try to get a block that we can't reach in the page cache... */
+ if (unlikely(block >> (PAGE_SHIFT - ffs(size)) > ULONG_MAX)) {
+ printk(KERN_ERR "getblk(): block %llu beyond pagecache limit\n",
+ (unsigned long long)block);
+ dump_stack();
+ return NULL;
+ }
+
for (;;) {
struct buffer_head * bh;
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
