Merge tag 'xfs-6.11-merge-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux

Pull xfs updates from Chandan Babu:
 "Major changes in this release are limited to enabling FITRIM on
  realtime devices and Byte-based grant head log reservation tracking.

  The remaining changes are limited to fixes and cleanups included in
  this pull request.

  Core:

   - Enable FITRIM on the realtime device

   - Introduce byte-based grant head log reservation tracking instead of
     physical log location tracking.

     This allows grant head to track a full 64 bit bytes space and hence
     overcome the limit of 4GB indexing that has been present until now

  Fixes:

   - xfs_flush_unmap_range() and xfs_prepare_shift() should consider RT
     extents in the flush unmap range

   - Implement bounds check when traversing log operations during log
     replay

   - Prevent out of bounds access when traversing a directory data block

   - Prevent incorrect ENOSPC when concurrently performing file creation
     and file writes

   - Fix rtalloc rotoring when delalloc is in use

  Cleanups:

   - Clean up I/O path inode locking helpers and the page fault handler

   - xfs: hoist inode operations to libxfs in anticipation of the
     metadata inode directory feature, which maintains a directory tree
     of metadata inodes. This will be necessary for further enhancements
     to the realtime feature, subvolume support

   - Clean up some warts in the extent freeing log intent code

   - Clean up the refcount and rmap intent code before adding support
     for realtime devices

   - Provide the correct email address for sysfs ABI documentation"

* tag 'xfs-6.11-merge-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (80 commits)
  xfs: fix rtalloc rotoring when delalloc is in use
  xfs: get rid of xfs_ag_resv_rmapbt_alloc
  xfs: skip flushing log items during push
  xfs: grant heads track byte counts, not LSNs
  xfs: pass the full grant head to accounting functions
  xfs: track log space pinned by the AIL
  xfs: collapse xlog_state_set_callback in caller
  xfs: l_last_sync_lsn is really AIL state
  xfs: ensure log tail is always up to date
  xfs: background AIL push should target physical space
  xfs: AIL doesn't need manual pushing
  xfs: move and rename xfs_trans_committed_bulk
  xfs: fix the contact address for the sysfs ABI documentation
  xfs: Avoid races with cnt_btree lastrec updates
  xfs: move xfs_refcount_update_defer_add to xfs_refcount_item.c
  xfs: simplify usage of the rcur local variable in xfs_refcount_finish_one
  xfs: don't bother calling xfs_refcount_finish_one_cleanup in xfs_refcount_finish_one
  xfs: reuse xfs_refcount_update_cancel_item
  xfs: add a ci_entry helper
  xfs: remove xfs_trans_set_refcount_flags
  ...

1 files changed, 26 insertions, 5 deletions

diff --git a/fs/xfs/libxfs/xfs_dir2_data.c b/fs/xfs/libxfs/xfs_dir2_data.c
index ea0b9628df18..a16b05c43e2e 100644
--- a/fs/xfs/libxfs/xfs_dir2_data.c
+++ b/fs/xfs/libxfs/xfs_dir2_data.c
@@ -178,6 +178,14 @@ __xfs_dir3_data_check(
 	while (offset < end) {
 		struct xfs_dir2_data_unused	*dup = bp->b_addr + offset;
 		struct xfs_dir2_data_entry	*dep = bp->b_addr + offset;
+		unsigned int	reclen;
+
+		/*
+		 * Are the remaining bytes large enough to hold an
+		 * unused entry?
+		 */
+		if (offset > end - xfs_dir2_data_unusedsize(1))
+			return __this_address;
 
 		/*
 		 * If it's unused, look for the space in the bestfree table.
@@ -187,9 +195,13 @@ __xfs_dir3_data_check(
 		if (be16_to_cpu(dup->freetag) == XFS_DIR2_DATA_FREE_TAG) {
 			xfs_failaddr_t	fa;
 
+			reclen = xfs_dir2_data_unusedsize(
+					be16_to_cpu(dup->length));
 			if (lastfree != 0)
 				return __this_address;
-			if (offset + be16_to_cpu(dup->length) > end)
+			if (be16_to_cpu(dup->length) != reclen)
+				return __this_address;
+			if (offset + reclen > end)
 				return __this_address;
 			if (be16_to_cpu(*xfs_dir2_data_unused_tag_p(dup)) !=
 			    offset)
@@ -207,10 +219,18 @@ __xfs_dir3_data_check(
 				    be16_to_cpu(bf[2].length))
 					return __this_address;
 			}
-			offset += be16_to_cpu(dup->length);
+			offset += reclen;
 			lastfree = 1;
 			continue;
 		}
+
+		/*
+		 * This is not an unused entry. Are the remaining bytes
+		 * large enough for a dirent with a single-byte name?
+		 */
+		if (offset > end - xfs_dir2_data_entsize(mp, 1))
+			return __this_address;
+
 		/*
 		 * It's a real entry.  Validate the fields.
 		 * If this is a block directory then make sure it's
@@ -219,9 +239,10 @@ __xfs_dir3_data_check(
 		 */
 		if (dep->namelen == 0)
 			return __this_address;
-		if (!xfs_verify_dir_ino(mp, be64_to_cpu(dep->inumber)))
+		reclen = xfs_dir2_data_entsize(mp, dep->namelen);
+		if (offset + reclen > end)
 			return __this_address;
-		if (offset + xfs_dir2_data_entsize(mp, dep->namelen) > end)
+		if (!xfs_verify_dir_ino(mp, be64_to_cpu(dep->inumber)))
 			return __this_address;
 		if (be16_to_cpu(*xfs_dir2_data_entry_tag_p(mp, dep)) != offset)
 			return __this_address;
@@ -245,7 +266,7 @@ __xfs_dir3_data_check(
 			if (i >= be32_to_cpu(btp->count))
 				return __this_address;
 		}
-		offset += xfs_dir2_data_entsize(mp, dep->namelen);
+		offset += reclen;
 	}
 	/*
 	 * Need to have seen all the entries and all the bestfree slots.