btrfs: make sure we stay inside the bvec during __btrfs_lookup_bio_sums

masoncl · masoncl · commit 389f239c5342 · 2016-03-21T07:25:44.000-07:00
Commit c40a3d3 (Btrfs: Compute and look up csums based on sectorsized blocks) changes around how we walk the bios while looking up crcs. There's an inner loop that is jumping to the next bvec based on sectors and before it derefs the next bvec, it needs to make sure we're still in the bio. In this case, the outer loop would have decided to stop moving forward too, and the bvec deref is never actually used for anything. But CONFIG_DEBUG_PAGEALLOC catches it because we're outside our bio. Signed-off-by: Chris Mason <clm@fb.com> Reviewed-by: David Sterba <dsterba@suse.com>
diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c
@@ -292,12 +292,22 @@ static int __btrfs_lookup_bio_sums(struct btrfs_root *root,
 			page_bytes_left -= root->sectorsize;
 			if (!page_bytes_left) {
 				bio_index++;
+				/*
+				 * make sure we're still inside the
+				 * bio before we update page_bytes_left
+				 */
+				if (bio_index >= bio->bi_vcnt) {
+					WARN_ON_ONCE(count);
+					goto done;
+				}
 				bvec++;
 				page_bytes_left = bvec->bv_len;
 			}
 
 		}
 	}
+
+done:
 	btrfs_free_path(path);
 	return 0;
 }

Original file line number	Diff line number	Diff line change
`@@ -292,12 +292,22 @@ static int __btrfs_lookup_bio_sums(struct btrfs_root *root,`
`292`	`292`	`page_bytes_left -= root->sectorsize;`
`293`	`293`	`if (!page_bytes_left) {`
`294`	`294`	`bio_index++;`
	`295`	`+ /*`
	`296`	`+ * make sure we're still inside the`
	`297`	`+ * bio before we update page_bytes_left`
	`298`	`+ */`
	`299`	`+ if (bio_index >= bio->bi_vcnt) {`
	`300`	`+ WARN_ON_ONCE(count);`
	`301`	`+ goto done;`
	`302`	`+ }`
`295`	`303`	`bvec++;`
`296`	`304`	`page_bytes_left = bvec->bv_len;`
`297`	`305`	`}`
`298`	`306`
`299`	`307`	`}`
`300`	`308`	`}`
	`309`	`+`
	`310`	`+done:`
`301`	`311`	`btrfs_free_path(path);`
`302`	`312`	`return 0;`
`303`	`313`	`}`