From: Daejun Park xfs_iomap_write_direct() maps one extent, but it reserves blocks for the whole count it is given, in an unsigned int. A count of about 2^32 blocks or more wraps the reservation. If it wraps to a few blocks, the allocation uses more blocks than the transaction reserved, and xfs_trans_mod_sb() shuts the filesystem down. If it wraps to nearly 2^32 blocks, the allocation fails with -ENOSPC. Direct I/O, DAX and buffered writes with an extent size hint never ask for that much, as xfs_direct_write_iomap_begin() limits them to 1024 pages to keep the count below 32 bits. xfs_fs_map_blocks() has no such limit: it asks for everything from the start of a hole to the end of the range of a pNFS layout, which a client chooses, and an RW LAYOUTGET at offset 0 of an empty file for 16 TiB does it. Fail such a count with -ENOSPC before anything is reserved, also on a filesystem with that much free space, as the transaction cannot take it. A count that fits is reserved in full, as before, so a hole longer than the free space still fails before it is allocated. With pynfs as the client and a 32 GiB XFS, an RW LAYOUTGET at offset 0 of an empty file for 16 TiB shut the filesystem down: "Corruption of in-memory data (0x8) detected at xfs_trans_mod_sb". With this patch it gets NFS4ERR_NOSPC and nothing is allocated, as with 100 GiB, and one for 16 GiB, which fits, is still granted, in three extents. Fixes: 527851124d10 ("xfs: implement pNFS export operations") Cc: stable@vger.kernel.org Signed-off-by: Daejun Park --- fs/xfs/xfs_iomap.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c index 7c6238fed6..1917e49166 100644 --- a/fs/xfs/xfs_iomap.c +++ b/fs/xfs/xfs_iomap.c @@ -287,6 +287,13 @@ xfs_iomap_write_direct( resaligned = xfs_aligned_fsb_count(offset_fsb, count_fsb, xfs_get_extsz_hint(ip)); + /* + * The transaction takes the block reservation as an unsigned int. + * Refuse a count that does not fit rather than reserve too little; + * only a pNFS layout for a huge range asks for that much. + */ + if (resaligned > UINT_MAX - XFS_DIOSTRAT_SPACE_RES(mp, 0)) + return -ENOSPC; if (unlikely(XFS_IS_REALTIME_INODE(ip))) { dblocks = XFS_DIOSTRAT_SPACE_RES(mp, 0); rblocks = resaligned; -- 2.43.0