Merge tag 'xfs-4.11-merge-7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux

Pull xfs updates from Darrick Wong:
 "Here are the XFS changes for 4.11. We aren't introducing any major
  features in this release cycle except for this being the first merge
  window I've managed on my own. :)

  Changes since last update:

   - Various cleanups

   - Livelock fixes for eofblocks scanning

   - Improved input verification for on-disk metadata

   - Fix races in the copy on write remap mechanism

   - Fix buffer io error timeout controls

   - Streamlining of directio copy on write

   - Asynchronous discard support

   - Fix asserts when splitting delalloc reservations

   - Don't bloat bmbt when right shifting extents

   - Inode alignment fixes for 32k block sizes"

* tag 'xfs-4.11-merge-7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (39 commits)
  xfs: remove XFS_ALLOCTYPE_ANY_AG and XFS_ALLOCTYPE_START_AG
  xfs: simplify xfs_rtallocate_extent
  xfs: tune down agno asserts in the bmap code
  xfs: Use xfs_icluster_size_fsb() to calculate inode chunk alignment
  xfs: don't reserve blocks for right shift transactions
  xfs: fix len comparison in xfs_extent_busy_trim
  xfs: fix uninitialized variable in _reflink_convert_cow
  xfs: split indlen reservations fairly when under reserved
  xfs: handle indlen shortage on delalloc extent merge
  xfs: resurrect debug mode drop buffered writes mechanism
  xfs: clear delalloc and cache on buffered write failure
  xfs: don't block the log commit handler for discards
  xfs: improve busy extent sorting
  xfs: improve handling of busy extents in the low-level allocator
  xfs: don't fail xfs_extent_busy allocation
  xfs: correct null checks and error processing in xfs_initialize_perag
  xfs: update ctime and mtime on clone destinatation inodes
  xfs: allocate direct I/O COW blocks in iomap_begin
  xfs: go straight to real allocations for direct I/O COW writes
  xfs: return the converted extent in __xfs_reflink_convert_cow
  ...

1 files changed, 49 insertions, 2 deletions

diff --git a/fs/xfs/libxfs/xfs_dir2_node.c b/fs/xfs/libxfs/xfs_dir2_node.c
index 75a557432d0f..bbd1238852b3 100644
--- a/fs/xfs/libxfs/xfs_dir2_node.c
+++ b/fs/xfs/libxfs/xfs_dir2_node.c
@@ -155,6 +155,42 @@ const struct xfs_buf_ops xfs_dir3_free_buf_ops = {
         .verify_write = xfs_dir3_free_write_verify,
 };
 
+/* Everything ok in the free block header? */
+static bool
+xfs_dir3_free_header_check(
+        struct xfs_inode        *dp,
+        xfs_dablk_t             fbno,
+        struct xfs_buf          *bp)
+{
+        struct xfs_mount        *mp = dp->i_mount;
+        unsigned int            firstdb;
+        int                     maxbests;
+
+        maxbests = dp->d_ops->free_max_bests(mp->m_dir_geo);
+        firstdb = (xfs_dir2_da_to_db(mp->m_dir_geo, fbno) -
+                   xfs_dir2_byte_to_db(mp->m_dir_geo, XFS_DIR2_FREE_OFFSET)) *
+                        maxbests;
+        if (xfs_sb_version_hascrc(&mp->m_sb)) {
+                struct xfs_dir3_free_hdr *hdr3 = bp->b_addr;
+
+                if (be32_to_cpu(hdr3->firstdb) != firstdb)
+                        return false;
+                if (be32_to_cpu(hdr3->nvalid) > maxbests)
+                        return false;
+                if (be32_to_cpu(hdr3->nvalid) < be32_to_cpu(hdr3->nused))
+                        return false;
+        } else {
+                struct xfs_dir2_free_hdr *hdr = bp->b_addr;
+
+                if (be32_to_cpu(hdr->firstdb) != firstdb)
+                        return false;
+                if (be32_to_cpu(hdr->nvalid) > maxbests)
+                        return false;
+                if (be32_to_cpu(hdr->nvalid) < be32_to_cpu(hdr->nused))
+                        return false;
+        }
+        return true;
+}
 
 static int
 __xfs_dir3_free_read(
@@ -168,11 +204,22 @@ __xfs_dir3_free_read(
 
         err = xfs_da_read_buf(tp, dp, fbno, mappedbno, bpp,
                                 XFS_DATA_FORK, &xfs_dir3_free_buf_ops);
+        if (err || !*bpp)
+                return err;
+
+        /* Check things that we can't do in the verifier. */
+        if (!xfs_dir3_free_header_check(dp, fbno, *bpp)) {
+                xfs_buf_ioerror(*bpp, -EFSCORRUPTED);
+                xfs_verifier_error(*bpp);
+                xfs_trans_brelse(tp, *bpp);
+                return -EFSCORRUPTED;
+        }
 
         /* try read returns without an error or *bpp if it lands in a hole */
-        if (!err && tp && *bpp)
+        if (tp)
                 xfs_trans_buf_set_type(tp, *bpp, XFS_BLFT_DIR_FREE_BUF);
-        return err;
+
+        return 0;
 }
 
 int