xfs: don't set bt_nr_sectors to a negative number

xfs_daddr_t is a signed type, which means that xfs_buf_map_verify is
using a signed comparison.  This causes problems if bt_nr_sectors is
never overridden (e.g. in the case of an xfbtree for rmap btree repairs)
because even daddr 0 can't pass the verifier test in that case.

Define an explicit max constant and set the initial bt_nr_sectors to a
positive value.

Found by xfs/422.

Cc: stable@vger.kernel.org # v6.18-rc1
Fixes: 42852fe57c6d2a ("xfs: track the number of blocks in each buftarg")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>

diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index 773d959965dc29420c71147538b82dd6f69eaa83..47edf3041631bb51ff4ef71f904cceb4625ba8de 100644 (file)
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -1751,7 +1751,7 @@ xfs_init_buftarg(
        const char                      *descr)
 {
        /* The maximum size of the buftarg is only known once the sb is read. */
-       btp->bt_nr_sectors = (xfs_daddr_t)-1;
+       btp->bt_nr_sectors = XFS_BUF_DADDR_MAX;
 
        /* Set up device logical sector size mask */
        btp->bt_logical_sectorsize = logical_sectorsize;

diff --git a/fs/xfs/xfs_buf.h b/fs/xfs/xfs_buf.h
index 8fa7bdf59c911015f7879673d1bbe2e21f40fb0d..e25cd2a160f31c9887b4280f617dc5f5fc2391c7 100644 (file)
--- a/fs/xfs/xfs_buf.h
+++ b/fs/xfs/xfs_buf.h
@@ -22,6 +22,7 @@ extern struct kmem_cache *xfs_buf_cache;
  */
 struct xfs_buf;
 
+#define XFS_BUF_DADDR_MAX      ((xfs_daddr_t) S64_MAX)
 #define XFS_BUF_DADDR_NULL     ((xfs_daddr_t) (-1LL))
 
 #define XBF_READ        (1u << 0) /* buffer intended for reading from device */