diff options
author | Eric Sandeen <sandeen@sandeen.net> | 2009-09-25 15:42:26 -0400 |
---|---|---|
committer | Alex Elder <aelder@sgi.com> | 2009-10-08 13:02:12 -0400 |
commit | 8e69ce147127a0235e8d1f2b75ea214be78c61b3 (patch) | |
tree | 9de85d2c0e0527e7821f6844b03ef8ca47ed00f8 | |
parent | dce5065a57c158e0ca5db8e63c50118b2ecf4ac5 (diff) |
fix readahead calculations in xfs_dir2_leaf_getdents()
This is for bug #850,
http://oss.sgi.com/bugzilla/show_bug.cgi?id=850
XFS file system segfaults , repeatedly and 100% reproducable in 2.6.30 , 2.6.31
The above only showed up on a CONFIG_XFS_DEBUG=y kernel, because
xfs_bmapi() ASSERTs that it has been asked for at least one map,
and it was getting 0.
The root cause is that our guesstimated "bufsize" from xfs_file_readdir
was fairly small, and the
bufsize -= length;
in the loop was going negative - except bufsize is a size_t, so it
was wrapping to a very large number.
Then when we did
ra_want = howmany(bufsize + mp->m_dirblksize,
mp->m_sb.sb_blocksize) - 1;
with that very large number, the (int) ra_want was coming out
negative, and a subsequent compare:
if (1 + ra_want > map_blocks ...
was coming out -true- (negative int compare w/ uint) and we went
back to xfs_bmapi() for more, even though we did not need more,
and asked for 0 maps, and hit the ASSERT.
We have kind of a type mess here, but just keeping bufsize from
going negative is probably sufficient to avoid the problem.
Signed-off-by: Eric Sandeen <sandeen@sandeen.net>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Alex Elder <aelder@sgi.com>
Signed-off-by: Alex Elder <aelder@sgi.com>
-rw-r--r-- | fs/xfs/xfs_dir2_leaf.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/fs/xfs/xfs_dir2_leaf.c b/fs/xfs/xfs_dir2_leaf.c index fa913e459442..41ad537c49e9 100644 --- a/fs/xfs/xfs_dir2_leaf.c +++ b/fs/xfs/xfs_dir2_leaf.c | |||
@@ -854,6 +854,7 @@ xfs_dir2_leaf_getdents( | |||
854 | */ | 854 | */ |
855 | ra_want = howmany(bufsize + mp->m_dirblksize, | 855 | ra_want = howmany(bufsize + mp->m_dirblksize, |
856 | mp->m_sb.sb_blocksize) - 1; | 856 | mp->m_sb.sb_blocksize) - 1; |
857 | ASSERT(ra_want >= 0); | ||
857 | 858 | ||
858 | /* | 859 | /* |
859 | * If we don't have as many as we want, and we haven't | 860 | * If we don't have as many as we want, and we haven't |
@@ -1088,7 +1089,8 @@ xfs_dir2_leaf_getdents( | |||
1088 | */ | 1089 | */ |
1089 | ptr += length; | 1090 | ptr += length; |
1090 | curoff += length; | 1091 | curoff += length; |
1091 | bufsize -= length; | 1092 | /* bufsize may have just been a guess; don't go negative */ |
1093 | bufsize = bufsize > length ? bufsize - length : 0; | ||
1092 | } | 1094 | } |
1093 | 1095 | ||
1094 | /* | 1096 | /* |