xfs: make sure the rt allocator doesn't run off the end

[ Upstream commit 2a6ca4baed620303d414934aa1b7b0a8e7bab05f ]

There's an overflow bug in the realtime allocator.  If the rt volume is
large enough to handle a single allocation request that is larger than
the maximum bmap extent length and the rt bitmap ends exactly on a
bitmap block boundary, it's possible that the near allocator will try to
check the freeness of a range that extends past the end of the bitmap.
This fails with a corruption error and shuts down the fs.

Therefore, constrain maxlen so that the range scan cannot run off the
end of the rt bitmap.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
index 0d93d3c..d812f84 100644 (file)
--- a/fs/xfs/xfs_rtalloc.c
+++ b/fs/xfs/xfs_rtalloc.c
@@ -257,6 +257,9 @@ xfs_rtallocate_extent_block(
                end = XFS_BLOCKTOBIT(mp, bbno + 1) - 1;
             i <= end;
             i++) {
+               /* Make sure we don't scan off the end of the rt volume. */
+               maxlen = min(mp->m_sb.sb_rextents, i + maxlen) - i;
+
                /*
                 * See if there's a free extent of maxlen starting at i.
                 * If it's not so then next will contain the first non-free.
@@ -448,6 +451,14 @@ xfs_rtallocate_extent_near(
         */
        if (bno >= mp->m_sb.sb_rextents)
                bno = mp->m_sb.sb_rextents - 1;
+
+       /* Make sure we don't run off the end of the rt volume. */
+       maxlen = min(mp->m_sb.sb_rextents, bno + maxlen) - bno;
+       if (maxlen < minlen) {
+               *rtblock = NULLRTBLOCK;
+               return 0;
+       }
+
        /*
         * Try the exact allocation first.
         */