Merge tag 'xfs-4.13-fixes-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux

Pull xfs fixes from Darrick Wong:

 - fix firstfsb variables that we left uninitialized, which could lead
   to locking problems.

 - check for NULL metadata buffer pointers before using them.

 - don't allow btree cursor manipulation if the btree block is corrupt.
   Better to just shut down.

 - fix infinite loop problems in quotacheck.

 - fix buffer overrun when validating directory blocks.

 - fix deadlock problem in bunmapi.

* tag 'xfs-4.13-fixes-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
  xfs: fix multi-AG deadlock in xfs_bunmapi
  xfs: check that dir block entries don't off the end of the buffer
  xfs: fix quotacheck dquot id overflow infinite loop
  xfs: check _alloc_read_agf buffer pointer before using
  xfs: set firstfsb to NULLFSBLOCK before feeding it to _bmapi_write
  xfs: check _btree_check_block value

6 files changed, 39 insertions, 3 deletions

diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index 0a9880777c9c..c09c16b1ad3b 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -5435,6 +5435,7 @@ __xfs_bunmapi(
         xfs_fsblock_t           sum;
         xfs_filblks_t           len = *rlen;    /* length to unmap in file */
         xfs_fileoff_t           max_len;
+        xfs_agnumber_t          prev_agno = NULLAGNUMBER, agno;
 
         trace_xfs_bunmap(ip, bno, len, flags, _RET_IP_);
 
@@ -5534,6 +5535,17 @@ __xfs_bunmapi(
                  */
                 del = got;
                 wasdel = isnullstartblock(del.br_startblock);
+
+                /*
+                 * Make sure we don't touch multiple AGF headers out of order
+                 * in a single transaction, as that could cause AB-BA deadlocks.
+                 */
+                if (!wasdel) {
+                        agno = XFS_FSB_TO_AGNO(mp, del.br_startblock);
+                        if (prev_agno != NULLAGNUMBER && prev_agno > agno)
+                                break;
+                        prev_agno = agno;
+                }
                 if (got.br_startoff < start) {
                         del.br_startoff = start;
                         del.br_blockcount -= start - got.br_startoff;
@@ -6499,6 +6511,15 @@ xfs_bmap_finish_one(
         xfs_fsblock_t                   firstfsb;
         int                             error = 0;
 
+        /*
+         * firstfsb is tied to the transaction lifetime and is used to
+         * ensure correct AG locking order and schedule work item
+         * continuations.  XFS_BUI_MAX_FAST_EXTENTS (== 1) restricts us
+         * to only making one bmap call per transaction, so it should
+         * be safe to have it as a local variable here.
+         */
+        firstfsb = NULLFSBLOCK;
+
         trace_xfs_bmap_deferred(tp->t_mountp,
                         XFS_FSB_TO_AGNO(tp->t_mountp, startblock), type,
                         XFS_FSB_TO_AGBNO(tp->t_mountp, startblock),
diff --git a/fs/xfs/libxfs/xfs_btree.c b/fs/xfs/libxfs/xfs_btree.c
index 4da85fff69ad..e0bcc4a59efd 100644
--- a/fs/xfs/libxfs/xfs_btree.c
+++ b/fs/xfs/libxfs/xfs_btree.c
@@ -728,7 +728,8 @@ xfs_btree_firstrec(
          * Get the block pointer for this level.
          */
         block = xfs_btree_get_block(cur, level, &bp);
-        xfs_btree_check_block(cur, block, level, bp);
+        if (xfs_btree_check_block(cur, block, level, bp))
+                return 0;
         /*
          * It's empty, there is no such record.
          */
@@ -757,7 +758,8 @@ xfs_btree_lastrec(
          * Get the block pointer for this level.
          */
         block = xfs_btree_get_block(cur, level, &bp);
-        xfs_btree_check_block(cur, block, level, bp);
+        if (xfs_btree_check_block(cur, block, level, bp))
+                return 0;
         /*
          * It's empty, there is no such record.
          */
diff --git a/fs/xfs/libxfs/xfs_dir2_data.c b/fs/xfs/libxfs/xfs_dir2_data.c
index d478065b9544..8727a43115ef 100644
--- a/fs/xfs/libxfs/xfs_dir2_data.c
+++ b/fs/xfs/libxfs/xfs_dir2_data.c
@@ -136,6 +136,8 @@ __xfs_dir3_data_check(
                  */
                 if (be16_to_cpu(dup->freetag) == XFS_DIR2_DATA_FREE_TAG) {
                         XFS_WANT_CORRUPTED_RETURN(mp, lastfree == 0);
+                        XFS_WANT_CORRUPTED_RETURN(mp, endp >=
+                                        p + be16_to_cpu(dup->length));
                         XFS_WANT_CORRUPTED_RETURN(mp,
                                 be16_to_cpu(*xfs_dir2_data_unused_tag_p(dup)) ==
                                                (char *)dup - (char *)hdr);
@@ -164,6 +166,8 @@ __xfs_dir3_data_check(
                 XFS_WANT_CORRUPTED_RETURN(mp, dep->namelen != 0);
                 XFS_WANT_CORRUPTED_RETURN(mp,
                         !xfs_dir_ino_validate(mp, be64_to_cpu(dep->inumber)));
+                XFS_WANT_CORRUPTED_RETURN(mp, endp >=
+                                p + ops->data_entsize(dep->namelen));
                 XFS_WANT_CORRUPTED_RETURN(mp,
                         be16_to_cpu(*ops->data_entry_tag_p(dep)) ==
                                                (char *)dep - (char *)hdr);
diff --git a/fs/xfs/libxfs/xfs_refcount.c b/fs/xfs/libxfs/xfs_refcount.c
index 900ea231f9a3..45b1c3b4e047 100644
--- a/fs/xfs/libxfs/xfs_refcount.c
+++ b/fs/xfs/libxfs/xfs_refcount.c
@@ -1638,6 +1638,10 @@ xfs_refcount_recover_cow_leftovers(
         error = xfs_alloc_read_agf(mp, tp, agno, 0, &agbp);
         if (error)
                 goto out_trans;
+        if (!agbp) {
+                error = -ENOMEM;
+                goto out_trans;
+        }
         cur = xfs_refcountbt_init_cursor(mp, tp, agbp, agno, NULL);
 
         /* Find all the leftover CoW staging extents. */
diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c
index 6ce948c436d5..15751dc2a27d 100644
--- a/fs/xfs/xfs_qm.c
+++ b/fs/xfs/xfs_qm.c
@@ -111,6 +111,9 @@ restart:
                         skipped = 0;
                         break;
                 }
+                /* we're done if id overflows back to zero */
+                if (!next_index)
+                        break;
         }
 
         if (skipped) {
diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c
index ab2270a87196..f45fbf0db9bb 100644
--- a/fs/xfs/xfs_reflink.c
+++ b/fs/xfs/xfs_reflink.c
@@ -170,6 +170,8 @@ xfs_reflink_find_shared(
         error = xfs_alloc_read_agf(mp, tp, agno, 0, &agbp);
         if (error)
                 return error;
+        if (!agbp)
+                return -ENOMEM;
 
         cur = xfs_refcountbt_init_cursor(mp, tp, agbp, agno, NULL);
 
@@ -329,7 +331,7 @@ xfs_reflink_convert_cow_extent(
         xfs_filblks_t                   count_fsb,
         struct xfs_defer_ops            *dfops)
 {
-        xfs_fsblock_t                   first_block;
+        xfs_fsblock_t                   first_block = NULLFSBLOCK;
         int                             nimaps = 1;
 
         if (imap->br_state == XFS_EXT_NORM)