Commit 712e53e4 authored by Tao Ma's avatar Tao Ma Committed by Mark Fasheh

ocfs2: Use xs->bucket to set xattr value outside

A long time ago, xs->base is allocated a 4K size and all the contents
in the bucket are copied to the it. Now we use ocfs2_xattr_bucket to
abstract xattr bucket and xs->base is initialized to the start of the
bu_bhs[0]. So xs->base + offset will overflow when the value root is
stored outside the first block.

Then why we can survive the xattr test by now? It is because we always
read the bucket contiguously now and kernel mm allocate continguous
memory for us. We are lucky, but we should fix it. So just get the
right value root as other callers do.
Signed-off-by: default avatarTao Ma <tao.ma@oracle.com>
Acked-by: default avatarJoel Becker <joel.becker@oracle.com>
Signed-off-by: default avatarMark Fasheh <mfasheh@suse.com>
parent 74e77eb3
...@@ -4795,19 +4795,33 @@ static int ocfs2_xattr_bucket_set_value_outside(struct inode *inode, ...@@ -4795,19 +4795,33 @@ static int ocfs2_xattr_bucket_set_value_outside(struct inode *inode,
char *val, char *val,
int value_len) int value_len)
{ {
int offset; int ret, offset, block_off;
struct ocfs2_xattr_value_root *xv; struct ocfs2_xattr_value_root *xv;
struct ocfs2_xattr_entry *xe = xs->here; struct ocfs2_xattr_entry *xe = xs->here;
struct ocfs2_xattr_header *xh = bucket_xh(xs->bucket);
void *base;
BUG_ON(!xs->base || !xe || ocfs2_xattr_is_local(xe)); BUG_ON(!xs->base || !xe || ocfs2_xattr_is_local(xe));
offset = le16_to_cpu(xe->xe_name_offset) + ret = ocfs2_xattr_bucket_get_name_value(inode, xh,
OCFS2_XATTR_SIZE(xe->xe_name_len); xe - xh->xh_entries,
&block_off,
&offset);
if (ret) {
mlog_errno(ret);
goto out;
}
xv = (struct ocfs2_xattr_value_root *)(xs->base + offset); base = bucket_block(xs->bucket, block_off);
xv = (struct ocfs2_xattr_value_root *)(base + offset +
OCFS2_XATTR_SIZE(xe->xe_name_len));
return __ocfs2_xattr_set_value_outside(inode, handle, ret = __ocfs2_xattr_set_value_outside(inode, handle,
xv, val, value_len); xv, val, value_len);
if (ret)
mlog_errno(ret);
out:
return ret;
} }
static int ocfs2_rm_xattr_cluster(struct inode *inode, static int ocfs2_rm_xattr_cluster(struct inode *inode,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment