Patch "xfs: reinit btree pointer on attr tree inactivation walk" has been added to the 4.13-stable tree

This is a note to let you know that I've just added the patch titled

xfs: reinit btree pointer on attr tree inactivation walk

to the 4.13-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
xfs-reinit-btree-pointer-on-attr-tree-inactivation-walk.patch
and it can be found in the queue-4.13 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Brian Foster <[email protected]>
Date: Mon, 9 Oct 2017 11:38:56 -0700
Subject: xfs: reinit btree pointer on attr tree inactivation walk

From: Brian Foster <[email protected]>

commit f35c5e10c6ed6ba52a8dd8573924a80b6a02f03f upstream.

xfs_attr3_root_inactive() walks the attr fork tree to invalidate the associated blocks. xfs_attr3_node_inactive() recursively descends from internal blocks to leaf blocks, caching block address values along the way to revisit parent blocks, locate the next entry and descend down that branch of the tree.

The code that attempts to reread the parent block is unsafe because it assumes that the local xfs_da_node_entry pointer remains valid after an xfs_trans_brelse() and re-read of the parent buffer. Under heavy memory pressure, it is possible that the buffer has been reclaimed and reallocated by the time the parent block is reread. This means that 'btree' can point to an invalid memory address, lead to a random/garbage value for child_fsb and cause the subsequent read of the attr fork to go off the rails and return a NULL buffer for an attr fork offset that is most likely not allocated.

Note that this problem can be manufactured by setting XFS_ATTR_BTREE_REF to 0 to prevent LRU caching of attr buffers, creating a file with a multi-level attr fork and removing it to trigger inactivation.

To address this problem, reinit the node/btree pointers to the parent buffer after it has been re-read. This ensures btree points to a valid record and allows the walk to proceed.

---
 fs/xfs/xfs_attr_inactive.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -302,6 +302,8 @@ xfs_attr3_node_inactive(
 						 &bp, XFS_ATTR_FORK);
 			if (error)
 				return error;
+			node = bp->b_addr;
+			btree = dp->d_ops->node_tree_p(node);
 			child_fsb = be32_to_cpu(btree[i + 1].before);
 			xfs_trans_brelse(*trans, bp);
 		}

Patches currently in stable-queue which might be from [email protected] are

queue-4.13/xfs-move-two-more-rt-specific-functions-into-config_xfs_rt.patch queue-4.13/xfs-reinit-btree-pointer-on-attr-tree-inactivation-walk.patch queue-4.13/xfs-move-more-rt-specific-code-under-config_xfs_rt.patch queue-4.13/xfs-don-t-change-inode-mode-if-acl-update-fails.patch queue-4.13/xfs-update-i_size-after-unwritten-conversion-in-dio-completion.patch queue-4.13/xfs-trim-writepage-mapping-to-within-eof.patch queue-4.13/xfs-perag-initialization-should-only-touch-m_ag_max_usable-for-ag-0.patch queue-4.13/xfs-always-swap-the-cow-forks-when-swapping-extents.patch queue-4.13/xfs-don-t-log-uninitialised-fields-in-inode-structures.patch