Patch "xfs: fix rmap key and record comparison functions" has been added to the 5.9-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    xfs: fix rmap key and record comparison functions

to the 5.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     xfs-fix-rmap-key-and-record-comparison-functions.patch
and it can be found in the queue-5.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit aeb90c68563d907fc704d383f0cadeb8a49bd006
Author: Darrick J. Wong <darrick.wong@xxxxxxxxxx>
Date:   Sun Nov 8 16:32:44 2020 -0800

    xfs: fix rmap key and record comparison functions
    
    [ Upstream commit 6ff646b2ceb0eec916101877f38da0b73e3a5b7f ]
    
    Keys for extent interval records in the reverse mapping btree are
    supposed to be computed as follows:
    
    (physical block, owner, fork, is_btree, is_unwritten, offset)
    
    This provides users the ability to look up a reverse mapping from a bmbt
    record -- start with the physical block; then if there are multiple
    records for the same block, move on to the owner; then the inode fork
    type; and so on to the file offset.
    
    However, the key comparison functions incorrectly remove the
    fork/btree/unwritten information that's encoded in the on-disk offset.
    This means that lookup comparisons are only done with:
    
    (physical block, owner, offset)
    
    This means that queries can return incorrect results.  On consistent
    filesystems this hasn't been an issue because blocks are never shared
    between forks or with bmbt blocks; and are never unwritten.  However,
    this bug means that online repair cannot always detect corruption in the
    key information in internal rmapbt nodes.
    
    Found by fuzzing keys[1].attrfork = ones on xfs/371.
    
    Fixes: 4b8ed67794fe ("xfs: add rmap btree operations")
    Signed-off-by: Darrick J. Wong <darrick.wong@xxxxxxxxxx>
    Reviewed-by: Christoph Hellwig <hch@xxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/xfs/libxfs/xfs_rmap_btree.c b/fs/xfs/libxfs/xfs_rmap_btree.c
index beb81c84a9375..577a66381327c 100644
--- a/fs/xfs/libxfs/xfs_rmap_btree.c
+++ b/fs/xfs/libxfs/xfs_rmap_btree.c
@@ -243,8 +243,8 @@ xfs_rmapbt_key_diff(
 	else if (y > x)
 		return -1;
 
-	x = XFS_RMAP_OFF(be64_to_cpu(kp->rm_offset));
-	y = rec->rm_offset;
+	x = be64_to_cpu(kp->rm_offset);
+	y = xfs_rmap_irec_offset_pack(rec);
 	if (x > y)
 		return 1;
 	else if (y > x)
@@ -275,8 +275,8 @@ xfs_rmapbt_diff_two_keys(
 	else if (y > x)
 		return -1;
 
-	x = XFS_RMAP_OFF(be64_to_cpu(kp1->rm_offset));
-	y = XFS_RMAP_OFF(be64_to_cpu(kp2->rm_offset));
+	x = be64_to_cpu(kp1->rm_offset);
+	y = be64_to_cpu(kp2->rm_offset);
 	if (x > y)
 		return 1;
 	else if (y > x)
@@ -390,8 +390,8 @@ xfs_rmapbt_keys_inorder(
 		return 1;
 	else if (a > b)
 		return 0;
-	a = XFS_RMAP_OFF(be64_to_cpu(k1->rmap.rm_offset));
-	b = XFS_RMAP_OFF(be64_to_cpu(k2->rmap.rm_offset));
+	a = be64_to_cpu(k1->rmap.rm_offset);
+	b = be64_to_cpu(k2->rmap.rm_offset);
 	if (a <= b)
 		return 1;
 	return 0;
@@ -420,8 +420,8 @@ xfs_rmapbt_recs_inorder(
 		return 1;
 	else if (a > b)
 		return 0;
-	a = XFS_RMAP_OFF(be64_to_cpu(r1->rmap.rm_offset));
-	b = XFS_RMAP_OFF(be64_to_cpu(r2->rmap.rm_offset));
+	a = be64_to_cpu(r1->rmap.rm_offset);
+	b = be64_to_cpu(r2->rmap.rm_offset);
 	if (a <= b)
 		return 1;
 	return 0;