2018-06-06 02:42:14 +00:00
|
|
|
// SPDX-License-Identifier: GPL-2.0+
|
2016-10-03 16:11:19 +00:00
|
|
|
/*
|
|
|
|
|
* Copyright (C) 2016 Oracle. All Rights Reserved.
|
|
|
|
|
* Author: Darrick J. Wong <darrick.wong@oracle.com>
|
|
|
|
|
*/
|
|
|
|
|
#ifndef __XFS_REFCOUNT_H__
|
|
|
|
|
#define __XFS_REFCOUNT_H__
|
|
|
|
|
|
2021-06-02 00:48:24 +00:00
|
|
|
struct xfs_trans;
|
|
|
|
|
struct xfs_mount;
|
|
|
|
|
struct xfs_perag;
|
|
|
|
|
struct xfs_btree_cur;
|
|
|
|
|
struct xfs_bmbt_irec;
|
|
|
|
|
struct xfs_refcount_irec;
|
|
|
|
|
|
2016-10-03 16:11:19 +00:00
|
|
|
extern int xfs_refcount_lookup_le(struct xfs_btree_cur *cur,
|
xfs: track cow/shared record domains explicitly in xfs_refcount_irec
Just prior to committing the reflink code into upstream, the xfs
maintainer at the time requested that I find a way to shard the refcount
records into two domains -- one for records tracking shared extents, and
a second for tracking CoW staging extents. The idea here was to
minimize mount time CoW reclamation by pushing all the CoW records to
the right edge of the keyspace, and it was accomplished by setting the
upper bit in rc_startblock. We don't allow AGs to have more than 2^31
blocks, so the bit was free.
Unfortunately, this was a very late addition to the codebase, so most of
the refcount record processing code still treats rc_startblock as a u32
and pays no attention to whether or not the upper bit (the cow flag) is
set. This is a weakness is theoretically exploitable, since we're not
fully validating the incoming metadata records.
Fuzzing demonstrates practical exploits of this weakness. If the cow
flag of a node block key record is corrupted, a lookup operation can go
to the wrong record block and start returning records from the wrong
cow/shared domain. This causes the math to go all wrong (since cow
domain is still implicit in the upper bit of rc_startblock) and we can
crash the kernel by tricking xfs into jumping into a nonexistent AG and
tripping over xfs_perag_get(mp, <nonexistent AG>) returning NULL.
To fix this, start tracking the domain as an explicit part of struct
xfs_refcount_irec, adjust all refcount functions to check the domain
of a returned record, and alter the function definitions to accept them
where necessary.
Found by fuzzing keys[2].cowflag = add in xfs/464.
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
2022-10-10 16:06:24 +00:00
|
|
|
enum xfs_refc_domain domain, xfs_agblock_t bno, int *stat);
|
2016-10-03 16:11:19 +00:00
|
|
|
extern int xfs_refcount_lookup_ge(struct xfs_btree_cur *cur,
|
xfs: track cow/shared record domains explicitly in xfs_refcount_irec
Just prior to committing the reflink code into upstream, the xfs
maintainer at the time requested that I find a way to shard the refcount
records into two domains -- one for records tracking shared extents, and
a second for tracking CoW staging extents. The idea here was to
minimize mount time CoW reclamation by pushing all the CoW records to
the right edge of the keyspace, and it was accomplished by setting the
upper bit in rc_startblock. We don't allow AGs to have more than 2^31
blocks, so the bit was free.
Unfortunately, this was a very late addition to the codebase, so most of
the refcount record processing code still treats rc_startblock as a u32
and pays no attention to whether or not the upper bit (the cow flag) is
set. This is a weakness is theoretically exploitable, since we're not
fully validating the incoming metadata records.
Fuzzing demonstrates practical exploits of this weakness. If the cow
flag of a node block key record is corrupted, a lookup operation can go
to the wrong record block and start returning records from the wrong
cow/shared domain. This causes the math to go all wrong (since cow
domain is still implicit in the upper bit of rc_startblock) and we can
crash the kernel by tricking xfs into jumping into a nonexistent AG and
tripping over xfs_perag_get(mp, <nonexistent AG>) returning NULL.
To fix this, start tracking the domain as an explicit part of struct
xfs_refcount_irec, adjust all refcount functions to check the domain
of a returned record, and alter the function definitions to accept them
where necessary.
Found by fuzzing keys[2].cowflag = add in xfs/464.
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
2022-10-10 16:06:24 +00:00
|
|
|
enum xfs_refc_domain domain, xfs_agblock_t bno, int *stat);
|
2018-05-09 17:02:03 +00:00
|
|
|
extern int xfs_refcount_lookup_eq(struct xfs_btree_cur *cur,
|
xfs: track cow/shared record domains explicitly in xfs_refcount_irec
Just prior to committing the reflink code into upstream, the xfs
maintainer at the time requested that I find a way to shard the refcount
records into two domains -- one for records tracking shared extents, and
a second for tracking CoW staging extents. The idea here was to
minimize mount time CoW reclamation by pushing all the CoW records to
the right edge of the keyspace, and it was accomplished by setting the
upper bit in rc_startblock. We don't allow AGs to have more than 2^31
blocks, so the bit was free.
Unfortunately, this was a very late addition to the codebase, so most of
the refcount record processing code still treats rc_startblock as a u32
and pays no attention to whether or not the upper bit (the cow flag) is
set. This is a weakness is theoretically exploitable, since we're not
fully validating the incoming metadata records.
Fuzzing demonstrates practical exploits of this weakness. If the cow
flag of a node block key record is corrupted, a lookup operation can go
to the wrong record block and start returning records from the wrong
cow/shared domain. This causes the math to go all wrong (since cow
domain is still implicit in the upper bit of rc_startblock) and we can
crash the kernel by tricking xfs into jumping into a nonexistent AG and
tripping over xfs_perag_get(mp, <nonexistent AG>) returning NULL.
To fix this, start tracking the domain as an explicit part of struct
xfs_refcount_irec, adjust all refcount functions to check the domain
of a returned record, and alter the function definitions to accept them
where necessary.
Found by fuzzing keys[2].cowflag = add in xfs/464.
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
2022-10-10 16:06:24 +00:00
|
|
|
enum xfs_refc_domain domain, xfs_agblock_t bno, int *stat);
|
2016-10-03 16:11:19 +00:00
|
|
|
extern int xfs_refcount_get_rec(struct xfs_btree_cur *cur,
|
|
|
|
|
struct xfs_refcount_irec *irec, int *stat);
|
|
|
|
|
|
xfs: track cow/shared record domains explicitly in xfs_refcount_irec
Just prior to committing the reflink code into upstream, the xfs
maintainer at the time requested that I find a way to shard the refcount
records into two domains -- one for records tracking shared extents, and
a second for tracking CoW staging extents. The idea here was to
minimize mount time CoW reclamation by pushing all the CoW records to
the right edge of the keyspace, and it was accomplished by setting the
upper bit in rc_startblock. We don't allow AGs to have more than 2^31
blocks, so the bit was free.
Unfortunately, this was a very late addition to the codebase, so most of
the refcount record processing code still treats rc_startblock as a u32
and pays no attention to whether or not the upper bit (the cow flag) is
set. This is a weakness is theoretically exploitable, since we're not
fully validating the incoming metadata records.
Fuzzing demonstrates practical exploits of this weakness. If the cow
flag of a node block key record is corrupted, a lookup operation can go
to the wrong record block and start returning records from the wrong
cow/shared domain. This causes the math to go all wrong (since cow
domain is still implicit in the upper bit of rc_startblock) and we can
crash the kernel by tricking xfs into jumping into a nonexistent AG and
tripping over xfs_perag_get(mp, <nonexistent AG>) returning NULL.
To fix this, start tracking the domain as an explicit part of struct
xfs_refcount_irec, adjust all refcount functions to check the domain
of a returned record, and alter the function definitions to accept them
where necessary.
Found by fuzzing keys[2].cowflag = add in xfs/464.
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
2022-10-10 16:06:24 +00:00
|
|
|
static inline uint32_t
|
|
|
|
|
xfs_refcount_encode_startblock(
|
|
|
|
|
xfs_agblock_t startblock,
|
|
|
|
|
enum xfs_refc_domain domain)
|
|
|
|
|
{
|
|
|
|
|
uint32_t start;
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* low level btree operations need to handle the generic btree range
|
|
|
|
|
* query functions (which set rc_domain == -1U), so we check that the
|
|
|
|
|
* domain is /not/ shared.
|
|
|
|
|
*/
|
2022-10-10 18:13:20 +00:00
|
|
|
start = startblock & ~XFS_REFC_COWFLAG;
|
xfs: track cow/shared record domains explicitly in xfs_refcount_irec
Just prior to committing the reflink code into upstream, the xfs
maintainer at the time requested that I find a way to shard the refcount
records into two domains -- one for records tracking shared extents, and
a second for tracking CoW staging extents. The idea here was to
minimize mount time CoW reclamation by pushing all the CoW records to
the right edge of the keyspace, and it was accomplished by setting the
upper bit in rc_startblock. We don't allow AGs to have more than 2^31
blocks, so the bit was free.
Unfortunately, this was a very late addition to the codebase, so most of
the refcount record processing code still treats rc_startblock as a u32
and pays no attention to whether or not the upper bit (the cow flag) is
set. This is a weakness is theoretically exploitable, since we're not
fully validating the incoming metadata records.
Fuzzing demonstrates practical exploits of this weakness. If the cow
flag of a node block key record is corrupted, a lookup operation can go
to the wrong record block and start returning records from the wrong
cow/shared domain. This causes the math to go all wrong (since cow
domain is still implicit in the upper bit of rc_startblock) and we can
crash the kernel by tricking xfs into jumping into a nonexistent AG and
tripping over xfs_perag_get(mp, <nonexistent AG>) returning NULL.
To fix this, start tracking the domain as an explicit part of struct
xfs_refcount_irec, adjust all refcount functions to check the domain
of a returned record, and alter the function definitions to accept them
where necessary.
Found by fuzzing keys[2].cowflag = add in xfs/464.
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
2022-10-10 16:06:24 +00:00
|
|
|
if (domain != XFS_REFC_DOMAIN_SHARED)
|
2022-10-10 18:13:20 +00:00
|
|
|
start |= XFS_REFC_COWFLAG;
|
xfs: track cow/shared record domains explicitly in xfs_refcount_irec
Just prior to committing the reflink code into upstream, the xfs
maintainer at the time requested that I find a way to shard the refcount
records into two domains -- one for records tracking shared extents, and
a second for tracking CoW staging extents. The idea here was to
minimize mount time CoW reclamation by pushing all the CoW records to
the right edge of the keyspace, and it was accomplished by setting the
upper bit in rc_startblock. We don't allow AGs to have more than 2^31
blocks, so the bit was free.
Unfortunately, this was a very late addition to the codebase, so most of
the refcount record processing code still treats rc_startblock as a u32
and pays no attention to whether or not the upper bit (the cow flag) is
set. This is a weakness is theoretically exploitable, since we're not
fully validating the incoming metadata records.
Fuzzing demonstrates practical exploits of this weakness. If the cow
flag of a node block key record is corrupted, a lookup operation can go
to the wrong record block and start returning records from the wrong
cow/shared domain. This causes the math to go all wrong (since cow
domain is still implicit in the upper bit of rc_startblock) and we can
crash the kernel by tricking xfs into jumping into a nonexistent AG and
tripping over xfs_perag_get(mp, <nonexistent AG>) returning NULL.
To fix this, start tracking the domain as an explicit part of struct
xfs_refcount_irec, adjust all refcount functions to check the domain
of a returned record, and alter the function definitions to accept them
where necessary.
Found by fuzzing keys[2].cowflag = add in xfs/464.
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
2022-10-10 16:06:24 +00:00
|
|
|
|
|
|
|
|
return start;
|
|
|
|
|
}
|
|
|
|
|
|
2016-10-03 16:11:21 +00:00
|
|
|
enum xfs_refcount_intent_type {
|
|
|
|
|
XFS_REFCOUNT_INCREASE = 1,
|
|
|
|
|
XFS_REFCOUNT_DECREASE,
|
|
|
|
|
XFS_REFCOUNT_ALLOC_COW,
|
|
|
|
|
XFS_REFCOUNT_FREE_COW,
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
struct xfs_refcount_intent {
|
|
|
|
|
struct list_head ri_list;
|
2023-04-12 01:59:55 +00:00
|
|
|
struct xfs_perag *ri_pag;
|
2016-10-03 16:11:21 +00:00
|
|
|
enum xfs_refcount_intent_type ri_type;
|
|
|
|
|
xfs_extlen_t ri_blockcount;
|
2021-10-12 22:29:33 +00:00
|
|
|
xfs_fsblock_t ri_startblock;
|
2016-10-03 16:11:21 +00:00
|
|
|
};
|
|
|
|
|
|
2022-10-26 21:31:27 +00:00
|
|
|
/* Check that the refcount is appropriate for the record domain. */
|
|
|
|
|
static inline bool
|
|
|
|
|
xfs_refcount_check_domain(
|
|
|
|
|
const struct xfs_refcount_irec *irec)
|
|
|
|
|
{
|
|
|
|
|
if (irec->rc_domain == XFS_REFC_DOMAIN_COW && irec->rc_refcount != 1)
|
|
|
|
|
return false;
|
|
|
|
|
if (irec->rc_domain == XFS_REFC_DOMAIN_SHARED && irec->rc_refcount < 2)
|
|
|
|
|
return false;
|
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
|
2023-04-12 01:59:55 +00:00
|
|
|
void xfs_refcount_update_get_group(struct xfs_mount *mp,
|
|
|
|
|
struct xfs_refcount_intent *ri);
|
|
|
|
|
|
2019-08-27 00:06:04 +00:00
|
|
|
void xfs_refcount_increase_extent(struct xfs_trans *tp,
|
2018-08-01 14:20:34 +00:00
|
|
|
struct xfs_bmbt_irec *irec);
|
2019-08-27 00:06:04 +00:00
|
|
|
void xfs_refcount_decrease_extent(struct xfs_trans *tp,
|
2018-08-01 14:20:34 +00:00
|
|
|
struct xfs_bmbt_irec *irec);
|
2016-10-03 16:11:22 +00:00
|
|
|
|
|
|
|
|
extern void xfs_refcount_finish_one_cleanup(struct xfs_trans *tp,
|
|
|
|
|
struct xfs_btree_cur *rcur, int error);
|
|
|
|
|
extern int xfs_refcount_finish_one(struct xfs_trans *tp,
|
2023-02-01 18:16:04 +00:00
|
|
|
struct xfs_refcount_intent *ri, struct xfs_btree_cur **pcur);
|
2016-10-03 16:11:22 +00:00
|
|
|
|
2016-10-03 16:11:25 +00:00
|
|
|
extern int xfs_refcount_find_shared(struct xfs_btree_cur *cur,
|
|
|
|
|
xfs_agblock_t agbno, xfs_extlen_t aglen, xfs_agblock_t *fbno,
|
|
|
|
|
xfs_extlen_t *flen, bool find_end_of_shared);
|
|
|
|
|
|
2019-08-27 00:06:04 +00:00
|
|
|
void xfs_refcount_alloc_cow_extent(struct xfs_trans *tp, xfs_fsblock_t fsb,
|
|
|
|
|
xfs_extlen_t len);
|
|
|
|
|
void xfs_refcount_free_cow_extent(struct xfs_trans *tp, xfs_fsblock_t fsb,
|
|
|
|
|
xfs_extlen_t len);
|
2016-10-03 16:11:39 +00:00
|
|
|
extern int xfs_refcount_recover_cow_leftovers(struct xfs_mount *mp,
|
2021-06-02 00:48:24 +00:00
|
|
|
struct xfs_perag *pag);
|
2016-10-03 16:11:39 +00:00
|
|
|
|
2017-06-15 04:25:57 +00:00
|
|
|
/*
|
|
|
|
|
* While we're adjusting the refcounts records of an extent, we have
|
|
|
|
|
* to keep an eye on the number of extents we're dirtying -- run too
|
|
|
|
|
* many in a single transaction and we'll exceed the transaction's
|
|
|
|
|
* reservation and crash the fs. Each record adds 12 bytes to the
|
|
|
|
|
* log (plus any key updates) so we'll conservatively assume 32 bytes
|
|
|
|
|
* per record. We must also leave space for btree splits on both ends
|
|
|
|
|
* of the range and space for the CUD and a new CUI.
|
2022-04-26 22:29:54 +00:00
|
|
|
*
|
|
|
|
|
* Each EFI that we attach to the transaction is assumed to consume ~32 bytes.
|
|
|
|
|
* This is a low estimate for an EFI tracking a single extent (16 bytes for the
|
|
|
|
|
* EFI header, 16 for the extent, and 12 for the xlog op header), but the
|
|
|
|
|
* estimate is acceptable if there's more than one extent being freed.
|
|
|
|
|
* In the worst case of freeing every other block during a refcount decrease
|
|
|
|
|
* operation, we amortize the space used for one EFI log item across 16
|
|
|
|
|
* extents.
|
2017-06-15 04:25:57 +00:00
|
|
|
*/
|
|
|
|
|
#define XFS_REFCOUNT_ITEM_OVERHEAD 32
|
|
|
|
|
|
2023-04-12 02:00:10 +00:00
|
|
|
extern int xfs_refcount_has_records(struct xfs_btree_cur *cur,
|
xfs: track cow/shared record domains explicitly in xfs_refcount_irec
Just prior to committing the reflink code into upstream, the xfs
maintainer at the time requested that I find a way to shard the refcount
records into two domains -- one for records tracking shared extents, and
a second for tracking CoW staging extents. The idea here was to
minimize mount time CoW reclamation by pushing all the CoW records to
the right edge of the keyspace, and it was accomplished by setting the
upper bit in rc_startblock. We don't allow AGs to have more than 2^31
blocks, so the bit was free.
Unfortunately, this was a very late addition to the codebase, so most of
the refcount record processing code still treats rc_startblock as a u32
and pays no attention to whether or not the upper bit (the cow flag) is
set. This is a weakness is theoretically exploitable, since we're not
fully validating the incoming metadata records.
Fuzzing demonstrates practical exploits of this weakness. If the cow
flag of a node block key record is corrupted, a lookup operation can go
to the wrong record block and start returning records from the wrong
cow/shared domain. This causes the math to go all wrong (since cow
domain is still implicit in the upper bit of rc_startblock) and we can
crash the kernel by tricking xfs into jumping into a nonexistent AG and
tripping over xfs_perag_get(mp, <nonexistent AG>) returning NULL.
To fix this, start tracking the domain as an explicit part of struct
xfs_refcount_irec, adjust all refcount functions to check the domain
of a returned record, and alter the function definitions to accept them
where necessary.
Found by fuzzing keys[2].cowflag = add in xfs/464.
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
2022-10-10 16:06:24 +00:00
|
|
|
enum xfs_refc_domain domain, xfs_agblock_t bno,
|
2023-04-12 02:00:10 +00:00
|
|
|
xfs_extlen_t len, enum xbtree_recpacking *outcome);
|
2018-05-09 17:02:02 +00:00
|
|
|
union xfs_btree_rec;
|
2021-08-11 00:02:16 +00:00
|
|
|
extern void xfs_refcount_btrec_to_irec(const union xfs_btree_rec *rec,
|
2018-05-09 17:02:02 +00:00
|
|
|
struct xfs_refcount_irec *irec);
|
2023-04-12 02:00:02 +00:00
|
|
|
xfs_failaddr_t xfs_refcount_check_irec(struct xfs_btree_cur *cur,
|
|
|
|
|
const struct xfs_refcount_irec *irec);
|
2018-05-09 17:02:02 +00:00
|
|
|
extern int xfs_refcount_insert(struct xfs_btree_cur *cur,
|
|
|
|
|
struct xfs_refcount_irec *irec, int *stat);
|
2018-01-17 02:52:14 +00:00
|
|
|
|
2021-10-12 21:11:01 +00:00
|
|
|
extern struct kmem_cache *xfs_refcount_intent_cache;
|
|
|
|
|
|
|
|
|
|
int __init xfs_refcount_intent_init_cache(void);
|
|
|
|
|
void xfs_refcount_intent_destroy_cache(void);
|
|
|
|
|
|
2016-10-03 16:11:19 +00:00
|
|
|
#endif /* __XFS_REFCOUNT_H__ */
|