From nobody Sun Feb 8 14:35:29 2026 Received: from szxga05-in.huawei.com (szxga05-in.huawei.com [45.249.212.191]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AFFF15B683; Thu, 14 Mar 2024 14:07:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.191 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710425268; cv=none; b=V6nwte8vtkS5xzOlrl7TtJs7Wm/xB8vQHcxi/Z7dfD7l7h6Tmpqqaw5gi6JEwTeejL4NHoHw4d5NAW+OWz/oTUQKmaZXXhxPk86aDlEssocvROAzv6GFxNsUpUmR+xVIXLI6J1GMSMx65TKjbCNae+SM1jrnlzXCEk6OPl6wcQE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710425268; c=relaxed/simple; bh=8AM8pym/lLuefOMlDqaQegYdsko79Al05Npk0vTE81Q=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=qQxDW9fEpdyWDV+zkfH6Az3SQUDvUuepLUfIfqQwTBHjNSh/xxUIw7Kz/YS6tKpjwUq0ghLJA4ZVFxKGwbbzePQIAxkILzU/7zUMNVM4zwhtI0xTFxr+5MKvVzJKNwPbNewp7knMsxo6eLBZGmOJ4As2tidQvVETmgsmY70ajT0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; arc=none smtp.client-ip=45.249.212.191 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Received: from mail.maildlp.com (unknown [172.19.163.17]) by szxga05-in.huawei.com (SkyGuard) with ESMTP id 4TwTjC0W8Nz1FM9Z; Thu, 14 Mar 2024 22:07:27 +0800 (CST) Received: from dggpeml500021.china.huawei.com (unknown [7.185.36.21]) by mail.maildlp.com (Postfix) with ESMTPS id 0329B1A0172; Thu, 14 Mar 2024 22:07:44 +0800 (CST) Received: from huawei.com (10.175.127.227) by dggpeml500021.china.huawei.com (7.185.36.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2507.35; Thu, 14 Mar 2024 22:07:43 +0800 From: Baokun Li To: CC: , , , , , , , , , Subject: [PATCH v3 1/9] ext4: avoid overflow when setting values via sysfs Date: Thu, 14 Mar 2024 22:08:58 +0800 Message-ID: <20240314140906.3064072-2-libaokun1@huawei.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20240314140906.3064072-1-libaokun1@huawei.com> References: <20240314140906.3064072-1-libaokun1@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To dggpeml500021.china.huawei.com (7.185.36.21) Content-Type: text/plain; charset="utf-8" When setting values of type unsigned int through sysfs, we use kstrtoul() to parse it and then truncate part of it as the final set value, when the set value is greater than UINT_MAX, the set value will not match what we see because of the truncation. As follows: $ echo 4294967296 > /sys/fs/ext4/sda/mb_max_linear_groups $ cat /sys/fs/ext4/sda/mb_max_linear_groups 0 So we use kstrtouint() to parse the attr_pointer_ui type to avoid the inconsistency described above. In addition, a judgment is added to avoid setting s_resv_clusters less than 0. Signed-off-by: Baokun Li Reviewed-by: Jan Kara --- fs/ext4/sysfs.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/fs/ext4/sysfs.c b/fs/ext4/sysfs.c index 6d332dff79dd..ca820620b974 100644 --- a/fs/ext4/sysfs.c +++ b/fs/ext4/sysfs.c @@ -104,7 +104,7 @@ static ssize_t reserved_clusters_store(struct ext4_sb_i= nfo *sbi, int ret; =20 ret =3D kstrtoull(skip_spaces(buf), 0, &val); - if (ret || val >=3D clusters) + if (ret || val >=3D clusters || (s64)val < 0) return -EINVAL; =20 atomic64_set(&sbi->s_resv_clusters, val); @@ -451,7 +451,8 @@ static ssize_t ext4_attr_store(struct kobject *kobj, s_kobj); struct ext4_attr *a =3D container_of(attr, struct ext4_attr, attr); void *ptr =3D calc_ptr(a, sbi); - unsigned long t; + unsigned int t; + unsigned long lt; int ret; =20 switch (a->attr_id) { @@ -460,7 +461,7 @@ static ssize_t ext4_attr_store(struct kobject *kobj, case attr_pointer_ui: if (!ptr) return 0; - ret =3D kstrtoul(skip_spaces(buf), 0, &t); + ret =3D kstrtouint(skip_spaces(buf), 0, &t); if (ret) return ret; if (a->attr_ptr =3D=3D ptr_ext4_super_block_offset) @@ -471,10 +472,10 @@ static ssize_t ext4_attr_store(struct kobject *kobj, case attr_pointer_ul: if (!ptr) return 0; - ret =3D kstrtoul(skip_spaces(buf), 0, &t); + ret =3D kstrtoul(skip_spaces(buf), 0, <); if (ret) return ret; - *((unsigned long *) ptr) =3D t; + *((unsigned long *) ptr) =3D lt; return len; case attr_inode_readahead: return inode_readahead_blks_store(sbi, buf, len); --=20 2.31.1 From nobody Sun Feb 8 14:35:29 2026 Received: from szxga05-in.huawei.com (szxga05-in.huawei.com [45.249.212.191]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B00325D8F8; Thu, 14 Mar 2024 14:07:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.191 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710425269; cv=none; b=O6ByUMl94fg7lzc9Sx4I5CxK9cUhkNz8v+QsCDOo7IJnBMw+dRTlRjzGPrTVwjYS+/2PxlfA5QdYXp2e/TPg6jg3uuD3QY0rvndpEtwYSecaTeFG6uVoPbug8NA6nvZzSzxPfsx9vc2VZeGwtXsCZhX4HjTtSPigQt+fzXj1f7w= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710425269; c=relaxed/simple; bh=OZpA7WL4wKhc3TzlPCYeSrdk8I55QEYuvT1JrMm4KGA=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=ie5Z2QvAd6Rj8ZBkIjLXvPO0X/tHwZ433erMW80pLtdfwZxTjp0F+kXZzNEujMvpxT72IaXMOx1afW7lFrdXQWmYBNbzDdmbWN9qeDQYWz05vtIpsnfhpIEzrgmLF4c9RvYgc6xzIYVkgbAqw3+oebOt/LmiOoILNNGtsJDIDd8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; arc=none smtp.client-ip=45.249.212.191 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Received: from mail.maildlp.com (unknown [172.19.163.17]) by szxga05-in.huawei.com (SkyGuard) with ESMTP id 4TwTfh31tDz1h25w; Thu, 14 Mar 2024 22:05:16 +0800 (CST) Received: from dggpeml500021.china.huawei.com (unknown [7.185.36.21]) by mail.maildlp.com (Postfix) with ESMTPS id 7FC3C1A0172; Thu, 14 Mar 2024 22:07:44 +0800 (CST) Received: from huawei.com (10.175.127.227) by dggpeml500021.china.huawei.com (7.185.36.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2507.35; Thu, 14 Mar 2024 22:07:43 +0800 From: Baokun Li To: CC: , , , , , , , , , Subject: [PATCH v3 2/9] ext4: refactor out ext4_generic_attr_store() Date: Thu, 14 Mar 2024 22:08:59 +0800 Message-ID: <20240314140906.3064072-3-libaokun1@huawei.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20240314140906.3064072-1-libaokun1@huawei.com> References: <20240314140906.3064072-1-libaokun1@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To dggpeml500021.china.huawei.com (7.185.36.21) Content-Type: text/plain; charset="utf-8" Refactor out the function ext4_generic_attr_store() to handle the setting of values of various common types, with no functional changes. Signed-off-by: Baokun Li Reviewed-by: Jan Kara --- fs/ext4/sysfs.c | 40 +++++++++++++++++++++++++--------------- 1 file changed, 25 insertions(+), 15 deletions(-) diff --git a/fs/ext4/sysfs.c b/fs/ext4/sysfs.c index ca820620b974..2b1c529b7fdf 100644 --- a/fs/ext4/sysfs.c +++ b/fs/ext4/sysfs.c @@ -443,24 +443,20 @@ static ssize_t ext4_attr_show(struct kobject *kobj, return 0; } =20 -static ssize_t ext4_attr_store(struct kobject *kobj, - struct attribute *attr, - const char *buf, size_t len) +static ssize_t ext4_generic_attr_store(struct ext4_attr *a, + struct ext4_sb_info *sbi, + const char *buf, size_t len) { - struct ext4_sb_info *sbi =3D container_of(kobj, struct ext4_sb_info, - s_kobj); - struct ext4_attr *a =3D container_of(attr, struct ext4_attr, attr); - void *ptr =3D calc_ptr(a, sbi); + int ret; unsigned int t; unsigned long lt; - int ret; + void *ptr =3D calc_ptr(a, sbi); + + if (!ptr) + return 0; =20 switch (a->attr_id) { - case attr_reserved_clusters: - return reserved_clusters_store(sbi, buf, len); case attr_pointer_ui: - if (!ptr) - return 0; ret =3D kstrtouint(skip_spaces(buf), 0, &t); if (ret) return ret; @@ -470,19 +466,33 @@ static ssize_t ext4_attr_store(struct kobject *kobj, *((unsigned int *) ptr) =3D t; return len; case attr_pointer_ul: - if (!ptr) - return 0; ret =3D kstrtoul(skip_spaces(buf), 0, <); if (ret) return ret; *((unsigned long *) ptr) =3D lt; return len; + } + return 0; +} + +static ssize_t ext4_attr_store(struct kobject *kobj, + struct attribute *attr, + const char *buf, size_t len) +{ + struct ext4_sb_info *sbi =3D container_of(kobj, struct ext4_sb_info, + s_kobj); + struct ext4_attr *a =3D container_of(attr, struct ext4_attr, attr); + + switch (a->attr_id) { + case attr_reserved_clusters: + return reserved_clusters_store(sbi, buf, len); case attr_inode_readahead: return inode_readahead_blks_store(sbi, buf, len); case attr_trigger_test_error: return trigger_test_error(sbi, buf, len); + default: + return ext4_generic_attr_store(a, sbi, buf, len); } - return 0; } =20 static void ext4_sb_release(struct kobject *kobj) --=20 2.31.1 From nobody Sun Feb 8 14:35:29 2026 Received: from szxga05-in.huawei.com (szxga05-in.huawei.com [45.249.212.191]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8DD416CDD7; Thu, 14 Mar 2024 14:07:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.191 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710425269; cv=none; b=M7TXCoQdS9gNlbCcv7od0eA05MDhxI4/3zxAPZ8F6bXaUH1inyvv1RjeSt7HJHteV6JP1vtLlq6i05cNydeM3Uw+bmvEs0YuUPHX2TnMV2A+ssQAJvRDwkckrplHEia84/gnWD7mvmyuQa085A80ezcz0jpMQaHoOyJoR2s8P4k= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710425269; c=relaxed/simple; bh=GQePeHmLBXBOXIAO3Kr28EekfNyWO9K0IjzdXcsDa/c=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=fPVtE4k57PqD0XHpARuxpQxfTrN7/VQAJlt2ACvdmR4zG+zaL3k1xchP+7ISbzbIoLMOn+cgmV589k2ZTCwFYoFY/87hWaRRaJNNCvi5jYl0fhbBzD7k696X3vkREUUlatM0dsgVnk3fyh4YCcyTXs0Meltj4CZ7/JIYSDUz7gM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; arc=none smtp.client-ip=45.249.212.191 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Received: from mail.maildlp.com (unknown [172.19.88.214]) by szxga05-in.huawei.com (SkyGuard) with ESMTP id 4TwTjD0xR5z1FMW2; Thu, 14 Mar 2024 22:07:28 +0800 (CST) Received: from dggpeml500021.china.huawei.com (unknown [7.185.36.21]) by mail.maildlp.com (Postfix) with ESMTPS id 11D1E1A016F; Thu, 14 Mar 2024 22:07:45 +0800 (CST) Received: from huawei.com (10.175.127.227) by dggpeml500021.china.huawei.com (7.185.36.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2507.35; Thu, 14 Mar 2024 22:07:44 +0800 From: Baokun Li To: CC: , , , , , , , , , Subject: [PATCH v3 3/9] ext4: refactor out ext4_generic_attr_show() Date: Thu, 14 Mar 2024 22:09:00 +0800 Message-ID: <20240314140906.3064072-4-libaokun1@huawei.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20240314140906.3064072-1-libaokun1@huawei.com> References: <20240314140906.3064072-1-libaokun1@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To dggpeml500021.china.huawei.com (7.185.36.21) Content-Type: text/plain; charset="utf-8" Refactor out the function ext4_generic_attr_show() to handle the reading of values of various common types, with no functional changes. Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara --- fs/ext4/sysfs.c | 74 +++++++++++++++++++++---------------------------- 1 file changed, 32 insertions(+), 42 deletions(-) diff --git a/fs/ext4/sysfs.c b/fs/ext4/sysfs.c index 2b1c529b7fdf..7f455b5f22c0 100644 --- a/fs/ext4/sysfs.c +++ b/fs/ext4/sysfs.c @@ -366,13 +366,42 @@ static ssize_t __print_tstamp(char *buf, __le32 lo, _= _u8 hi) #define print_tstamp(buf, es, tstamp) \ __print_tstamp(buf, (es)->tstamp, (es)->tstamp ## _hi) =20 +static ssize_t ext4_generic_attr_show(struct ext4_attr *a, + struct ext4_sb_info *sbi, char *buf) +{ + void *ptr =3D calc_ptr(a, sbi); + + if (!ptr) + return 0; + + switch (a->attr_id) { + case attr_inode_readahead: + case attr_pointer_ui: + if (a->attr_ptr =3D=3D ptr_ext4_super_block_offset) + return sysfs_emit(buf, "%u\n", le32_to_cpup(ptr)); + return sysfs_emit(buf, "%u\n", *((unsigned int *) ptr)); + case attr_pointer_ul: + return sysfs_emit(buf, "%lu\n", *((unsigned long *) ptr)); + case attr_pointer_u8: + return sysfs_emit(buf, "%u\n", *((unsigned char *) ptr)); + case attr_pointer_u64: + if (a->attr_ptr =3D=3D ptr_ext4_super_block_offset) + return sysfs_emit(buf, "%llu\n", le64_to_cpup(ptr)); + return sysfs_emit(buf, "%llu\n", *((unsigned long long *) ptr)); + case attr_pointer_string: + return sysfs_emit(buf, "%.*s\n", a->attr_size, (char *) ptr); + case attr_pointer_atomic: + return sysfs_emit(buf, "%d\n", atomic_read((atomic_t *) ptr)); + } + return 0; +} + static ssize_t ext4_attr_show(struct kobject *kobj, struct attribute *attr, char *buf) { struct ext4_sb_info *sbi =3D container_of(kobj, struct ext4_sb_info, s_kobj); struct ext4_attr *a =3D container_of(attr, struct ext4_attr, attr); - void *ptr =3D calc_ptr(a, sbi); =20 switch (a->attr_id) { case attr_delayed_allocation_blocks: @@ -391,45 +420,6 @@ static ssize_t ext4_attr_show(struct kobject *kobj, return sysfs_emit(buf, "%llu\n", (unsigned long long) percpu_counter_sum(&sbi->s_sra_exceeded_retry_limit)); - case attr_inode_readahead: - case attr_pointer_ui: - if (!ptr) - return 0; - if (a->attr_ptr =3D=3D ptr_ext4_super_block_offset) - return sysfs_emit(buf, "%u\n", - le32_to_cpup(ptr)); - else - return sysfs_emit(buf, "%u\n", - *((unsigned int *) ptr)); - case attr_pointer_ul: - if (!ptr) - return 0; - return sysfs_emit(buf, "%lu\n", - *((unsigned long *) ptr)); - case attr_pointer_u8: - if (!ptr) - return 0; - return sysfs_emit(buf, "%u\n", - *((unsigned char *) ptr)); - case attr_pointer_u64: - if (!ptr) - return 0; - if (a->attr_ptr =3D=3D ptr_ext4_super_block_offset) - return sysfs_emit(buf, "%llu\n", - le64_to_cpup(ptr)); - else - return sysfs_emit(buf, "%llu\n", - *((unsigned long long *) ptr)); - case attr_pointer_string: - if (!ptr) - return 0; - return sysfs_emit(buf, "%.*s\n", a->attr_size, - (char *) ptr); - case attr_pointer_atomic: - if (!ptr) - return 0; - return sysfs_emit(buf, "%d\n", - atomic_read((atomic_t *) ptr)); case attr_feature: return sysfs_emit(buf, "supported\n"); case attr_first_error_time: @@ -438,9 +428,9 @@ static ssize_t ext4_attr_show(struct kobject *kobj, return print_tstamp(buf, sbi->s_es, s_last_error_time); case attr_journal_task: return journal_task_show(sbi, buf); + default: + return ext4_generic_attr_show(a, sbi, buf); } - - return 0; } =20 static ssize_t ext4_generic_attr_store(struct ext4_attr *a, --=20 2.31.1 From nobody Sun Feb 8 14:35:29 2026 Received: from szxga07-in.huawei.com (szxga07-in.huawei.com [45.249.212.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 65D0A6FE02; Thu, 14 Mar 2024 14:07:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.35 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710425276; cv=none; b=J9Vz/7pGS/tFrbXBTzqiGoS2uxKivsYsGSf5hg0fW5YWYAOd6jFEtqEYudn0jpbkfExgZ940yp3SjxOQqud8U8C/9QEGzyx9ohi5kP0h1acPFHNb7z/Jt4LCEEocC3S8hpl0BhtKSVgnVZkRJgMA0sg9SCQQMgbhY5+zlONMgbU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710425276; c=relaxed/simple; bh=O0O3LXs8h1g6myDGlC1LeMEFa1dp5L9hgjVJBW1rijk=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=aZQLFhkKr8hn0S7VqrdhtzKcCl3TybivkI1VDznoBp54+x1u+w44O5hCEN6Jd/9vy8DlHqQawdkRwim59XEQwp60UXjNvOQyRM99Ek2ISl6r11TMZCPQEWvdTnxrD8AsSJ67sGb9AuDy/CRQfs17UzGzKGINNvrSrLIXMpBpyok= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; arc=none smtp.client-ip=45.249.212.35 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Received: from mail.maildlp.com (unknown [172.19.163.44]) by szxga07-in.huawei.com (SkyGuard) with ESMTP id 4TwTfj0Kgbz1QBL3; Thu, 14 Mar 2024 22:05:17 +0800 (CST) Received: from dggpeml500021.china.huawei.com (unknown [7.185.36.21]) by mail.maildlp.com (Postfix) with ESMTPS id A2C1F14011F; Thu, 14 Mar 2024 22:07:45 +0800 (CST) Received: from huawei.com (10.175.127.227) by dggpeml500021.china.huawei.com (7.185.36.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2507.35; Thu, 14 Mar 2024 22:07:45 +0800 From: Baokun Li To: CC: , , , , , , , , , , Subject: [PATCH v3 4/9] ext4: fix slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists() Date: Thu, 14 Mar 2024 22:09:01 +0800 Message-ID: <20240314140906.3064072-5-libaokun1@huawei.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20240314140906.3064072-1-libaokun1@huawei.com> References: <20240314140906.3064072-1-libaokun1@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To dggpeml500021.china.huawei.com (7.185.36.21) Content-Type: text/plain; charset="utf-8" We can trigger a slab-out-of-bounds with the following commands: mkfs.ext4 -F /dev/$disk 10G mount /dev/$disk /tmp/test echo 2147483647 > /sys/fs/ext4/$disk/mb_group_prealloc echo test > /tmp/test/file && sync =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BUG: KASAN: slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists+0x= 8a/0x200 [ext4] Read of size 8 at addr ffff888121b9d0f0 by task kworker/u2:0/11 CPU: 0 PID: 11 Comm: kworker/u2:0 Tainted: GL 6.7.0-next-20240118 #521 Call Trace: dump_stack_lvl+0x2c/0x50 kasan_report+0xb6/0xf0 ext4_mb_find_good_group_avg_frag_lists+0x8a/0x200 [ext4] ext4_mb_regular_allocator+0x19e9/0x2370 [ext4] ext4_mb_new_blocks+0x88a/0x1370 [ext4] ext4_ext_map_blocks+0x14f7/0x2390 [ext4] ext4_map_blocks+0x569/0xea0 [ext4] ext4_do_writepages+0x10f6/0x1bc0 [ext4] [...] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D The flow of issue triggering is as follows: // Set s_mb_group_prealloc to 2147483647 via sysfs ext4_mb_new_blocks ext4_mb_normalize_request ext4_mb_normalize_group_request ac->ac_g_ex.fe_len =3D EXT4_SB(sb)->s_mb_group_prealloc ext4_mb_regular_allocator ext4_mb_choose_next_group ext4_mb_choose_next_group_best_avail mb_avg_fragment_size_order order =3D fls(len) - 2 =3D 29 ext4_mb_find_good_group_avg_frag_lists frag_list =3D &sbi->s_mb_avg_fragment_size[order] if (list_empty(frag_list)) // Trigger SOOB! At 4k block size, the length of the s_mb_avg_fragment_size list is 14, but an oversized s_mb_group_prealloc is set, causing slab-out-of-bounds to be triggered by an attempt to access an element at index 29. Add a new attr_id attr_clusters_in_group with values in the range [0, sbi->s_clusters_per_group] and declare mb_group_prealloc as that type to fix the issue. In addition avoid returning an order from mb_avg_fragment_size_order() greater than MB_NUM_ORDERS(sb) and reduce some useless loops. Fixes: 7e170922f06b ("ext4: Add allocation criteria 1.5 (CR1_5)") CC: stable@vger.kernel.org Signed-off-by: Baokun Li Reviewed-by: Jan Kara Reviewed-by: Ojaswin Mujoo --- fs/ext4/mballoc.c | 4 ++++ fs/ext4/sysfs.c | 13 ++++++++++++- 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index 12b3f196010b..48afe5aa228c 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -831,6 +831,8 @@ static int mb_avg_fragment_size_order(struct super_bloc= k *sb, ext4_grpblk_t len) return 0; if (order =3D=3D MB_NUM_ORDERS(sb)) order--; + if (WARN_ON_ONCE(order > MB_NUM_ORDERS(sb))) + order =3D MB_NUM_ORDERS(sb) - 1; return order; } =20 @@ -1008,6 +1010,8 @@ static void ext4_mb_choose_next_group_best_avail(stru= ct ext4_allocation_context * goal length. */ order =3D fls(ac->ac_g_ex.fe_len) - 1; + if (WARN_ON_ONCE(order > MB_NUM_ORDERS(ac->ac_sb) - 1)) + order =3D MB_NUM_ORDERS(ac->ac_sb) - 1; min_order =3D order - sbi->s_mb_best_avail_max_trim_order; if (min_order < 0) min_order =3D 0; diff --git a/fs/ext4/sysfs.c b/fs/ext4/sysfs.c index 7f455b5f22c0..ddd71673176c 100644 --- a/fs/ext4/sysfs.c +++ b/fs/ext4/sysfs.c @@ -29,6 +29,7 @@ typedef enum { attr_trigger_test_error, attr_first_error_time, attr_last_error_time, + attr_clusters_in_group, attr_feature, attr_pointer_ui, attr_pointer_ul, @@ -207,13 +208,14 @@ EXT4_ATTR_FUNC(sra_exceeded_retry_limit, 0444); =20 EXT4_ATTR_OFFSET(inode_readahead_blks, 0644, inode_readahead, ext4_sb_info, s_inode_readahead_blks); +EXT4_ATTR_OFFSET(mb_group_prealloc, 0644, clusters_in_group, + ext4_sb_info, s_mb_group_prealloc); EXT4_RW_ATTR_SBI_UI(inode_goal, s_inode_goal); EXT4_RW_ATTR_SBI_UI(mb_stats, s_mb_stats); EXT4_RW_ATTR_SBI_UI(mb_max_to_scan, s_mb_max_to_scan); EXT4_RW_ATTR_SBI_UI(mb_min_to_scan, s_mb_min_to_scan); EXT4_RW_ATTR_SBI_UI(mb_order2_req, s_mb_order2_reqs); EXT4_RW_ATTR_SBI_UI(mb_stream_req, s_mb_stream_request); -EXT4_RW_ATTR_SBI_UI(mb_group_prealloc, s_mb_group_prealloc); EXT4_RW_ATTR_SBI_UI(mb_max_linear_groups, s_mb_max_linear_groups); EXT4_RW_ATTR_SBI_UI(extent_max_zeroout_kb, s_extent_max_zeroout_kb); EXT4_ATTR(trigger_fs_error, 0200, trigger_test_error); @@ -376,6 +378,7 @@ static ssize_t ext4_generic_attr_show(struct ext4_attr = *a, =20 switch (a->attr_id) { case attr_inode_readahead: + case attr_clusters_in_group: case attr_pointer_ui: if (a->attr_ptr =3D=3D ptr_ext4_super_block_offset) return sysfs_emit(buf, "%u\n", le32_to_cpup(ptr)); @@ -455,6 +458,14 @@ static ssize_t ext4_generic_attr_store(struct ext4_att= r *a, else *((unsigned int *) ptr) =3D t; return len; + case attr_clusters_in_group: + ret =3D kstrtouint(skip_spaces(buf), 0, &t); + if (ret) + return ret; + if (t > sbi->s_clusters_per_group) + return -EINVAL; + *((unsigned int *) ptr) =3D t; + return len; case attr_pointer_ul: ret =3D kstrtoul(skip_spaces(buf), 0, <); if (ret) --=20 2.31.1 From nobody Sun Feb 8 14:35:29 2026 Received: from szxga04-in.huawei.com (szxga04-in.huawei.com [45.249.212.190]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D46706EB75; Thu, 14 Mar 2024 14:07:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.190 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710425277; cv=none; b=XD5Pv5bewgMOQmei+xG8eTRVDv0huxxEF/bKCnid2dM22Ua2nG8airftmpjO6ll+jX7skzZrrRCcBBpLCg1dGjRgZzZKRuPfHNHkdTF/7xl1xj4h+vZIUzoWRK5m+nB8SP5TGvE5PPX3ZeLLlinHE+n2ND28Fqnzd589msuuj3Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710425277; c=relaxed/simple; bh=PG8dxu2wmb6J4SvE44TEF7QKq15BiMIinNoTBc5u7gI=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=ZQnj+WfRjSO7NEqKDsroxZZ8+d3cfEjRxzKixEyPjV+dOMriQcMZ7eRPTScrCQevGro3qW15y4FBtz0TPleWOQmJGLHGT5dWlI6B1AvpGXBm9+2Z3mK6lJCrWx15AW4CPjKC2PskOpXQsEefO8EE3PFJIWslbRzPhoxcwv9G9ZQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; arc=none smtp.client-ip=45.249.212.190 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Received: from mail.maildlp.com (unknown [172.19.163.17]) by szxga04-in.huawei.com (SkyGuard) with ESMTP id 4TwTfj6Qh9z2BgHs; Thu, 14 Mar 2024 22:05:17 +0800 (CST) Received: from dggpeml500021.china.huawei.com (unknown [7.185.36.21]) by mail.maildlp.com (Postfix) with ESMTPS id 305F71A0172; Thu, 14 Mar 2024 22:07:46 +0800 (CST) Received: from huawei.com (10.175.127.227) by dggpeml500021.china.huawei.com (7.185.36.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2507.35; Thu, 14 Mar 2024 22:07:45 +0800 From: Baokun Li To: CC: , , , , , , , , , Subject: [PATCH v3 5/9] ext4: add new attr pointer attr_mb_order Date: Thu, 14 Mar 2024 22:09:02 +0800 Message-ID: <20240314140906.3064072-6-libaokun1@huawei.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20240314140906.3064072-1-libaokun1@huawei.com> References: <20240314140906.3064072-1-libaokun1@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To dggpeml500021.china.huawei.com (7.185.36.21) Content-Type: text/plain; charset="utf-8" The s_mb_best_avail_max_trim_order is of type unsigned int, and has a range of values well beyond the normal use of the mb_order. Although the mballoc code is careful enough that large numbers don't matter there, but this can mislead the sysadmin into thinking that it's normal to set such values. Hence add a new attr_id attr_mb_order with values in the range [0, 64] to avoid storing garbage values and make us more resilient to surprises in the future. Suggested-by: Jan Kara Signed-off-by: Baokun Li Reviewed-by: Jan Kara --- fs/ext4/sysfs.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/fs/ext4/sysfs.c b/fs/ext4/sysfs.c index ddd71673176c..8e0473169458 100644 --- a/fs/ext4/sysfs.c +++ b/fs/ext4/sysfs.c @@ -30,6 +30,7 @@ typedef enum { attr_first_error_time, attr_last_error_time, attr_clusters_in_group, + attr_mb_order, attr_feature, attr_pointer_ui, attr_pointer_ul, @@ -210,6 +211,8 @@ EXT4_ATTR_OFFSET(inode_readahead_blks, 0644, inode_read= ahead, ext4_sb_info, s_inode_readahead_blks); EXT4_ATTR_OFFSET(mb_group_prealloc, 0644, clusters_in_group, ext4_sb_info, s_mb_group_prealloc); +EXT4_ATTR_OFFSET(mb_best_avail_max_trim_order, 0644, mb_order, + ext4_sb_info, s_mb_best_avail_max_trim_order); EXT4_RW_ATTR_SBI_UI(inode_goal, s_inode_goal); EXT4_RW_ATTR_SBI_UI(mb_stats, s_mb_stats); EXT4_RW_ATTR_SBI_UI(mb_max_to_scan, s_mb_max_to_scan); @@ -225,7 +228,6 @@ EXT4_RW_ATTR_SBI_UI(warning_ratelimit_interval_ms, s_wa= rning_ratelimit_state.int EXT4_RW_ATTR_SBI_UI(warning_ratelimit_burst, s_warning_ratelimit_state.bur= st); EXT4_RW_ATTR_SBI_UI(msg_ratelimit_interval_ms, s_msg_ratelimit_state.inter= val); EXT4_RW_ATTR_SBI_UI(msg_ratelimit_burst, s_msg_ratelimit_state.burst); -EXT4_RW_ATTR_SBI_UI(mb_best_avail_max_trim_order, s_mb_best_avail_max_trim= _order); #ifdef CONFIG_EXT4_DEBUG EXT4_RW_ATTR_SBI_UL(simulate_fail, s_simulate_fail); #endif @@ -379,6 +381,7 @@ static ssize_t ext4_generic_attr_show(struct ext4_attr = *a, switch (a->attr_id) { case attr_inode_readahead: case attr_clusters_in_group: + case attr_mb_order: case attr_pointer_ui: if (a->attr_ptr =3D=3D ptr_ext4_super_block_offset) return sysfs_emit(buf, "%u\n", le32_to_cpup(ptr)); @@ -458,6 +461,14 @@ static ssize_t ext4_generic_attr_store(struct ext4_att= r *a, else *((unsigned int *) ptr) =3D t; return len; + case attr_mb_order: + ret =3D kstrtouint(skip_spaces(buf), 0, &t); + if (ret) + return ret; + if (t > 64) + return -EINVAL; + *((unsigned int *) ptr) =3D t; + return len; case attr_clusters_in_group: ret =3D kstrtouint(skip_spaces(buf), 0, &t); if (ret) --=20 2.31.1 From nobody Sun Feb 8 14:35:29 2026 Received: from szxga05-in.huawei.com (szxga05-in.huawei.com [45.249.212.191]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 07F9D6FE0F; Thu, 14 Mar 2024 14:07:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.191 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710425271; cv=none; b=u33P0MSqL57Exd+24gbn600n+OgqTYn8mKVOwRJibJAoiDCSG4tpky+gcxdIK9Ood+PDvkHHSIBL52N0VVW+4RMCOYlNxA+e4lw8Co+ecir62Ceiqf+Vy8iIr19Dkc8vzizgU/ywkbgil8ZHWCcEls+HimGiWO7C1hEUJjjMRHA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710425271; c=relaxed/simple; bh=vETwVB3GhASM8vuvsTXrKuIYeexJx5Wkt0p0/Qi0PHg=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=YEEMFlzgU79qhcqv0jJEuXqCdkqxHJ91JjDjIhQ8kf84KtO5rdV1RDUv5PFQs3UQVSIbnqZvZQPUxb/jTkXE1Bw3tgrEg4F2Tf2vP/40FBgBVenTqGSQHLWEXG7DjE+hLZz9uTIg7uVette+YsrVXXRyRe8QE0QyEarrK5qd7/U= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; arc=none smtp.client-ip=45.249.212.191 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Received: from mail.maildlp.com (unknown [172.19.163.44]) by szxga05-in.huawei.com (SkyGuard) with ESMTP id 4TwTjF5tVsz1FMWK; Thu, 14 Mar 2024 22:07:29 +0800 (CST) Received: from dggpeml500021.china.huawei.com (unknown [7.185.36.21]) by mail.maildlp.com (Postfix) with ESMTPS id BAF6C14011F; Thu, 14 Mar 2024 22:07:46 +0800 (CST) Received: from huawei.com (10.175.127.227) by dggpeml500021.china.huawei.com (7.185.36.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2507.35; Thu, 14 Mar 2024 22:07:46 +0800 From: Baokun Li To: CC: , , , , , , , , , Subject: [PATCH v3 6/9] ext4: add positive int attr pointer to avoid sysfs variables overflow Date: Thu, 14 Mar 2024 22:09:03 +0800 Message-ID: <20240314140906.3064072-7-libaokun1@huawei.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20240314140906.3064072-1-libaokun1@huawei.com> References: <20240314140906.3064072-1-libaokun1@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To dggpeml500021.china.huawei.com (7.185.36.21) Content-Type: text/plain; charset="utf-8" The following variables controlled by the sysfs interface are of type int and are normally used in the range [0, INT_MAX], but are declared as attr_pointer_ui, and thus may be set to values that exceed INT_MAX and result in overflows to get negative values. err_ratelimit_burst msg_ratelimit_burst warning_ratelimit_burst err_ratelimit_interval_ms msg_ratelimit_interval_ms warning_ratelimit_interval_ms Therefore, we add attr_pointer_pi (aka positive int attr pointer) with a value range of 0-INT_MAX to avoid overflow. Signed-off-by: Baokun Li Reviewed-by: Jan Kara --- fs/ext4/sysfs.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) diff --git a/fs/ext4/sysfs.c b/fs/ext4/sysfs.c index 8e0473169458..ddb54608ca2e 100644 --- a/fs/ext4/sysfs.c +++ b/fs/ext4/sysfs.c @@ -32,6 +32,7 @@ typedef enum { attr_clusters_in_group, attr_mb_order, attr_feature, + attr_pointer_pi, attr_pointer_ui, attr_pointer_ul, attr_pointer_u64, @@ -180,6 +181,9 @@ static struct ext4_attr ext4_attr_##_name =3D { \ #define EXT4_RO_ATTR_ES_STRING(_name,_elname,_size) \ EXT4_ATTR_STRING(_name, 0444, _size, ext4_super_block, _elname) =20 +#define EXT4_RW_ATTR_SBI_PI(_name,_elname) \ + EXT4_ATTR_OFFSET(_name, 0644, pointer_pi, ext4_sb_info, _elname) + #define EXT4_RW_ATTR_SBI_UI(_name,_elname) \ EXT4_ATTR_OFFSET(_name, 0644, pointer_ui, ext4_sb_info, _elname) =20 @@ -222,12 +226,12 @@ EXT4_RW_ATTR_SBI_UI(mb_stream_req, s_mb_stream_reques= t); EXT4_RW_ATTR_SBI_UI(mb_max_linear_groups, s_mb_max_linear_groups); EXT4_RW_ATTR_SBI_UI(extent_max_zeroout_kb, s_extent_max_zeroout_kb); EXT4_ATTR(trigger_fs_error, 0200, trigger_test_error); -EXT4_RW_ATTR_SBI_UI(err_ratelimit_interval_ms, s_err_ratelimit_state.inter= val); -EXT4_RW_ATTR_SBI_UI(err_ratelimit_burst, s_err_ratelimit_state.burst); -EXT4_RW_ATTR_SBI_UI(warning_ratelimit_interval_ms, s_warning_ratelimit_sta= te.interval); -EXT4_RW_ATTR_SBI_UI(warning_ratelimit_burst, s_warning_ratelimit_state.bur= st); -EXT4_RW_ATTR_SBI_UI(msg_ratelimit_interval_ms, s_msg_ratelimit_state.inter= val); -EXT4_RW_ATTR_SBI_UI(msg_ratelimit_burst, s_msg_ratelimit_state.burst); +EXT4_RW_ATTR_SBI_PI(err_ratelimit_interval_ms, s_err_ratelimit_state.inter= val); +EXT4_RW_ATTR_SBI_PI(err_ratelimit_burst, s_err_ratelimit_state.burst); +EXT4_RW_ATTR_SBI_PI(warning_ratelimit_interval_ms, s_warning_ratelimit_sta= te.interval); +EXT4_RW_ATTR_SBI_PI(warning_ratelimit_burst, s_warning_ratelimit_state.bur= st); +EXT4_RW_ATTR_SBI_PI(msg_ratelimit_interval_ms, s_msg_ratelimit_state.inter= val); +EXT4_RW_ATTR_SBI_PI(msg_ratelimit_burst, s_msg_ratelimit_state.burst); #ifdef CONFIG_EXT4_DEBUG EXT4_RW_ATTR_SBI_UL(simulate_fail, s_simulate_fail); #endif @@ -382,6 +386,7 @@ static ssize_t ext4_generic_attr_show(struct ext4_attr = *a, case attr_inode_readahead: case attr_clusters_in_group: case attr_mb_order: + case attr_pointer_pi: case attr_pointer_ui: if (a->attr_ptr =3D=3D ptr_ext4_super_block_offset) return sysfs_emit(buf, "%u\n", le32_to_cpup(ptr)); @@ -452,6 +457,14 @@ static ssize_t ext4_generic_attr_store(struct ext4_att= r *a, return 0; =20 switch (a->attr_id) { + case attr_pointer_pi: + ret =3D kstrtouint(skip_spaces(buf), 0, &t); + if (ret) + return ret; + if ((int)t < 0) + return -EINVAL; + *((unsigned int *) ptr) =3D t; + return len; case attr_pointer_ui: ret =3D kstrtouint(skip_spaces(buf), 0, &t); if (ret) --=20 2.31.1 From nobody Sun Feb 8 14:35:29 2026 Received: from szxga07-in.huawei.com (szxga07-in.huawei.com [45.249.212.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 009166FBB8; Thu, 14 Mar 2024 14:07:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.35 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710425276; cv=none; b=U+HWEr4YhF4FDRP6QJHjGansOKUg+FY2wKEKnYRBrdfAAG/tc55Fa8KCFKNdRAaMviaDrGVuhZXsG1huh2Wudyc0Zyr+/3JsBEKgHRq7Z2ZPY9iBNwLxRZ4lp47QiwU3IsN5PoKRi2EwaWFcgBT2tybTqrDCzzJ8Hcamr5pcUqQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710425276; c=relaxed/simple; bh=Z1PfTQCHqpaHAw0hjUIVt4fpmIlFDfWjpJ3N+/nqPNo=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=RbUInEbsi4kLesiBbWW9djbP8yAX4HKUUD3AwDZ/mtEwBYxWSuCUi1ZOuaF3ZYbkK8Lr6i13nq8n4ZJk88gXU72sDFrp/Yxkv/MZpjQZrzR+/gREzwBxABNq1y/7aIEh5SPtVY2E0stSNeJ/8/+TpVVuvz9W6qk4GP+wa4fyg7g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; arc=none smtp.client-ip=45.249.212.35 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Received: from mail.maildlp.com (unknown [172.19.88.234]) by szxga07-in.huawei.com (SkyGuard) with ESMTP id 4TwTfk52fLz1QBPq; Thu, 14 Mar 2024 22:05:18 +0800 (CST) Received: from dggpeml500021.china.huawei.com (unknown [7.185.36.21]) by mail.maildlp.com (Postfix) with ESMTPS id 5130C1400DB; Thu, 14 Mar 2024 22:07:47 +0800 (CST) Received: from huawei.com (10.175.127.227) by dggpeml500021.china.huawei.com (7.185.36.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2507.35; Thu, 14 Mar 2024 22:07:46 +0800 From: Baokun Li To: CC: , , , , , , , , , , Subject: [PATCH v3 7/9] ext4: set type of ac_groups_linear_remaining to __u32 to avoid overflow Date: Thu, 14 Mar 2024 22:09:04 +0800 Message-ID: <20240314140906.3064072-8-libaokun1@huawei.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20240314140906.3064072-1-libaokun1@huawei.com> References: <20240314140906.3064072-1-libaokun1@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To dggpeml500021.china.huawei.com (7.185.36.21) Content-Type: text/plain; charset="utf-8" Now ac_groups_linear_remaining is of type __u16 and s_mb_max_linear_groups is of type unsigned int, so an overflow occurs when setting a value above 65535 through the mb_max_linear_groups sysfs interface. Therefore, the type of ac_groups_linear_remaining is set to __u32 to avoid overflow. Fixes: 196e402adf2e ("ext4: improve cr 0 / cr 1 group scanning") CC: stable@kernel.org Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara --- fs/ext4/mballoc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/ext4/mballoc.h b/fs/ext4/mballoc.h index 56938532b4ce..7bfc5fb5a128 100644 --- a/fs/ext4/mballoc.h +++ b/fs/ext4/mballoc.h @@ -193,8 +193,8 @@ struct ext4_allocation_context { ext4_grpblk_t ac_orig_goal_len; =20 __u32 ac_flags; /* allocation hints */ + __u32 ac_groups_linear_remaining; __u16 ac_groups_scanned; - __u16 ac_groups_linear_remaining; __u16 ac_found; __u16 ac_cX_found[EXT4_MB_NUM_CRS]; __u16 ac_tail; --=20 2.31.1 From nobody Sun Feb 8 14:35:29 2026 Received: from szxga03-in.huawei.com (szxga03-in.huawei.com [45.249.212.189]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 054226FE03; Thu, 14 Mar 2024 14:07:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.189 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710425279; cv=none; b=SFsGN1NnTnUf+KMwtIMVPYdPkqK9RG44/2Vxo0UdlJfEhHfNQEdOZQP8xs/2ciK122DlGWYIIAYU/367CY7KhCyOd4tys7q4zs7iX/swXECU/eL53AHB4Dh/S2wbThlFJ8gp9ZmpYoR4nVCYUZq+/BZzriG5hOaMU6O5dL6SoM0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710425279; c=relaxed/simple; bh=HUFyIyn2aR8nI6S7apzAbeRc6aQE+WXtA2u1lyTifaI=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=Mk8inwzKbc4GY6U8YaI9yf6c+HgkHrFeMxKLNPr0kmi8Cr893a01hwBwjQwLVWU+vLed+uQB7981HkYjmtVxkutKiCl1lR87pyyJEdXB85ySQG4bMnaTuw3B25/cB7apuLSAaGQcNEc+np3rUv2sH4j/EH+tshTQpq0chLyqlVw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; arc=none smtp.client-ip=45.249.212.189 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Received: from mail.maildlp.com (unknown [172.19.88.194]) by szxga03-in.huawei.com (SkyGuard) with ESMTP id 4TwTgX6hNnzNm2C; Thu, 14 Mar 2024 22:06:00 +0800 (CST) Received: from dggpeml500021.china.huawei.com (unknown [7.185.36.21]) by mail.maildlp.com (Postfix) with ESMTPS id DE9C614011B; Thu, 14 Mar 2024 22:07:47 +0800 (CST) Received: from huawei.com (10.175.127.227) by dggpeml500021.china.huawei.com (7.185.36.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2507.35; Thu, 14 Mar 2024 22:07:47 +0800 From: Baokun Li To: CC: , , , , , , , , , Subject: [PATCH v3 8/9] ext4: set the type of max_zeroout to unsigned int to avoid overflow Date: Thu, 14 Mar 2024 22:09:05 +0800 Message-ID: <20240314140906.3064072-9-libaokun1@huawei.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20240314140906.3064072-1-libaokun1@huawei.com> References: <20240314140906.3064072-1-libaokun1@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To dggpeml500021.china.huawei.com (7.185.36.21) Content-Type: text/plain; charset="utf-8" The max_zeroout is of type int and the s_extent_max_zeroout_kb is of type uint, and the s_extent_max_zeroout_kb can be freely modified via the sysfs interface. When the block size is 1024, max_zeroout may overflow, so declare it as unsigned int to avoid overflow. Signed-off-by: Baokun Li Reviewed-by: Jan Kara --- fs/ext4/extents.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index e57054bdc5fd..e067f2dd0335 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -3402,9 +3402,10 @@ static int ext4_ext_convert_to_initialized(handle_t = *handle, struct ext4_extent *ex, *abut_ex; ext4_lblk_t ee_block, eof_block; unsigned int ee_len, depth, map_len =3D map->m_len; - int allocated =3D 0, max_zeroout =3D 0; int err =3D 0; int split_flag =3D EXT4_EXT_DATA_VALID2; + int allocated =3D 0; + unsigned int max_zeroout =3D 0; =20 ext_debug(inode, "logical block %llu, max_blocks %u\n", (unsigned long long)map->m_lblk, map_len); --=20 2.31.1 From nobody Sun Feb 8 14:35:29 2026 Received: from szxga04-in.huawei.com (szxga04-in.huawei.com [45.249.212.190]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6B59971B43; Thu, 14 Mar 2024 14:07:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.190 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710425279; cv=none; b=fws0i2xgLc8UDQ7c7PIZaF7eMVWksJH2qbqI6hseTBOgYO68ss6fU4vFsH3ePLyvJ5myFqIbHj8q5SW9KR8ZQP6saq4c3ov7aw5MuftOWQCsFzDJV3w/sCShAq7MgUT6oacW00lGRuyDdQA06tZ4ItooCwTpnIROMN6mpjh6E6s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710425279; c=relaxed/simple; bh=P7knyHnbZndkT96HWjKBGpGhwkiQR62ld119bnhrD7E=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=nQ7jUGWUPmDuED21i4Ztomv3k+ssI2CXWW88JJbotEh9+6lLD17ZBvXxKTls2mp+4Lf0f+RiSc7PShfuzkUieME3v7RrEixSk2a6C9rFIWqV+8E6Jx+ucBSmtTGAo5xfvuJnb6nRZYs80xvqagRY4e2Vww3F5UxZXx7AqXeZWZI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; arc=none smtp.client-ip=45.249.212.190 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Received: from mail.maildlp.com (unknown [172.19.88.214]) by szxga04-in.huawei.com (SkyGuard) with ESMTP id 4TwTgY6b3Lz1xr7B; Thu, 14 Mar 2024 22:06:01 +0800 (CST) Received: from dggpeml500021.china.huawei.com (unknown [7.185.36.21]) by mail.maildlp.com (Postfix) with ESMTPS id 7195C1A016C; Thu, 14 Mar 2024 22:07:48 +0800 (CST) Received: from huawei.com (10.175.127.227) by dggpeml500021.china.huawei.com (7.185.36.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2507.35; Thu, 14 Mar 2024 22:07:47 +0800 From: Baokun Li To: CC: , , , , , , , , , Subject: [PATCH v3 9/9] ext4: clean up s_mb_rb_lock to fix build warnings with C=1 Date: Thu, 14 Mar 2024 22:09:06 +0800 Message-ID: <20240314140906.3064072-10-libaokun1@huawei.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20240314140906.3064072-1-libaokun1@huawei.com> References: <20240314140906.3064072-1-libaokun1@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To dggpeml500021.china.huawei.com (7.185.36.21) Content-Type: text/plain; charset="utf-8" Running sparse (make C=3D1) on mballoc.c we get the following warning: fs/ext4/mballoc.c:3194:13: warning: context imbalance in 'ext4_mb_seq_structs_summary_start' - wrong count at exit This is because __acquires(&EXT4_SB(sb)->s_mb_rb_lock) was called in ext4_mb_seq_structs_summary_start(), but s_mb_rb_lock was removed in commit 83e80a6e3543 ("ext4: use buckets for cr 1 block scan instead of rbtree"), so remove the __acquires to silence the warning. Signed-off-by: Baokun Li Reviewed-by: Jan Kara --- fs/ext4/mballoc.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index 48afe5aa228c..b3d616f055b0 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -3190,7 +3190,6 @@ int ext4_seq_mb_stats_show(struct seq_file *seq, void= *offset) } =20 static void *ext4_mb_seq_structs_summary_start(struct seq_file *seq, loff_= t *pos) -__acquires(&EXT4_SB(sb)->s_mb_rb_lock) { struct super_block *sb =3D pde_data(file_inode(seq->file)); unsigned long position; --=20 2.31.1