Commit dc8fbb03 authored Jun 01, 2018 by Bob Peterson

GFS2: gfs2_free_extlen can return an extent that is too long



Function gfs2_free_extlen calculates the length of an extent of
free blocks that may be reserved. The end pointer was calculated as
end = start + bh->b_size but b_size is incorrect because the
bitmap usually stops prior to the end of the buffer data on
the last bitmap.

What this means is that when you do a write, you can reserve a
chunk of blocks that runs off the end of the last bitmap. For
example, I've got a file system where there is only one bitmap
for each rgrp, so ri_length==1. I saw cases in which iozone
tried to do a big write, grabbed a large block reservation,
chose rgrp 5464152, which has ri_data0 5464153 and ri_data 8188.
So 5464153 + 8188 = 5472341 which is the end of the rgrp.

When it grabbed a reservation it got back: 5470936, length 7229.
But 5470936 + 7229 = 5478165. So the reservation starts inside
the rgrp but runs 5824 blocks past the end of the bitmap.

This patch fixes the calculation so it won't exceed the last
bitmap. It also adds a BUG_ON to guard against overflows in the
future.

Signed-off-by: Bob Peterson <rpeterso@redhat.com>

parent 7b5747f4

fs/gfs2/incore.h

+1 −0

Original line number	Diff line number	Diff line
		@@ -116,6 +116,7 @@ static inline struct gfs2_bitmap rbm_bi(const struct gfs2_rbm rbm)

		static inline u64 gfs2_rbm_to_block(const struct gfs2_rbm *rbm)
		{
		BUG_ON(rbm->offset >= rbm->rgd->rd_data);
		return rbm->rgd->rd_data0 + (rbm_bi(rbm)->bi_start * GFS2_NBBY) +
		rbm->offset;
		}

fs/gfs2/rgrp.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -372,8 +372,8 @@ static u32 gfs2_free_extlen(const struct gfs2_rbm *rrbm, u32 len)
		start = bi->bi_bh->b_data;
		if (bi->bi_clone)
		start = bi->bi_clone;
		end = start + bi->bi_bh->b_size;
		start += bi->bi_offset;
		end = start + bi->bi_len;
		BUG_ON(rbm.offset & 3);
		start += (rbm.offset / GFS2_NBBY);
		bytes = min_t(u32, len / GFS2_NBBY, (end - start));

Admin message