Darrick J. Wong bd721ec7de xfs: don't set bt_nr_sectors to a negative number ...

xfs_daddr_t is a signed type, which means that xfs_buf_map_verify is
using a signed comparison.  This causes problems if bt_nr_sectors is
never overridden (e.g. in the case of an xfbtree for rmap btree repairs)
because even daddr 0 can't pass the verifier test in that case.

Define an explicit max constant and set the initial bt_nr_sectors to a
positive value.

Found by xfs/422.

Cc: stable@vger.kernel.org # v6.18-rc1
Fixes: 42852fe57c ("xfs: track the number of blocks in each buftarg")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>

2025-10-22 10:04:39 +02:00

..

9p

Merge tag '9p-for-6.18-rc1' of https://github.com/martinetd/linux

2025-10-09 11:56:59 -07:00

adfs

Merge tag 'vfs-6.17-rc1.mmap_prepare' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-07-28 13:43:25 -07:00

affs

Merge tag 'vfs-6.17-rc1.mmap_prepare' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-07-28 13:43:25 -07:00

afs

Merge tag 'pull-qstr' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2025-10-03 11:14:02 -07:00

autofs

new helper: set_default_d_op()

2025-06-10 22:21:16 -04:00

befs

…

bfs

Merge tag 'vfs-6.17-rc1.mmap_prepare' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-07-28 13:43:25 -07:00

btrfs

Merge tag 'for-6.18-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux

2025-10-16 10:22:38 -07:00

cachefiles

VFS: unify old_mnt_idmap and new_mnt_idmap in renamedata

2025-09-23 12:37:35 +02:00

ceph

Merge tag 'ceph-for-6.18-rc1' of https://github.com/ceph/ceph-client

2025-10-10 11:30:19 -07:00

coda

Merge tag 'vfs-6.17-rc1.mmap_prepare' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-07-28 13:43:25 -07:00

configfs

Merge tag 'pull-f_path' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2025-10-03 16:32:36 -07:00

cramfs

Merge tag 'mm-nonmm-stable-2025-10-02-15-29' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2025-10-02 18:44:54 -07:00

crypto

Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux

2025-09-29 15:33:50 -07:00

debugfs

Merge tag 'vfs-6.18-rc1.async' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-09-29 11:55:15 -07:00

devpts

devpts, sunrpc, hostfs: don't bother with ->d_op

2025-06-11 13:40:04 -04:00

dlm

Merge tag 'dlm-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm

2025-09-29 15:24:58 -07:00

ecryptfs

Merge tag 'pull-mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2025-10-03 10:19:44 -07:00

efivarfs

Merge tag 'vfs-6.18-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-09-29 09:03:07 -07:00

efs

…

erofs

erofs: drop redundant sanity check for ztailpacking inline

2025-09-25 11:26:39 +08:00

exfat

exfat: fix out-of-bounds in exfat_nls_to_ucs2()

2025-10-15 17:53:20 +09:00

exportfs

exportfs: use lookup_one_unlocked()

2025-06-11 13:44:15 +02:00

ext2

Merge tag 'fs_for_v6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs

2025-07-28 16:16:09 -07:00

ext4

Merge tag 'ext4_for_linus-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4

2025-10-15 07:51:57 -07:00

f2fs

f2fs: fix wrong block mapping for multi-devices

2025-10-13 23:55:44 +00:00

fat

vfat: remove unused variable

2025-09-13 17:32:47 -07:00

freevxfs

…

fuse

Revert "fs: make vfs_fileattr_[get|set] return -EOPNOTSUPP"

2025-10-10 13:44:03 +02:00

gfs2

Merge tag 'pull-finish_no_open' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2025-10-03 10:59:31 -07:00

hfs

hfs/hfsplus: rework debug output subsystem

2025-09-24 16:30:34 -07:00

hfsplus

hfs/hfsplus: rework debug output subsystem

2025-09-24 16:30:34 -07:00

hostfs

fs: rename generic_delete_inode() and generic_drop_inode()

2025-09-15 16:09:42 +02:00

hpfs

Merge tag 'for-6.18/hpfs-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm

2025-10-10 14:06:02 -07:00

hugetlbfs

Merge tag 'mm-stable-2025-10-01-19-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2025-10-02 18:18:33 -07:00

iomap

iomap: open code bio_iov_iter_get_bdev_pages

2025-10-07 08:05:44 -06:00

isofs

Merge tag 'pull-dcache' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2025-07-28 09:17:57 -07:00

jbd2

jbd2: ensure that all ongoing I/O complete before freeing blocks

2025-10-10 13:10:06 -04:00

jffs2

mm: introduce memdesc_flags_t

2025-09-13 16:55:07 -07:00

jfs

Merge tag 'jfs-6.18' of github.com:kleikamp/linux-shaggy

2025-10-03 13:54:23 -07:00

kernfs

Merge tag 'vfs-6.18-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-09-29 09:03:07 -07:00

lockd

SUNRPC: Move the svc_rpcb_cleanup() call sites

2025-09-23 13:28:19 -04:00

minix

minixfs: Verify inode mode when loading from disk

2025-08-19 13:30:46 +02:00

netfs

Merge tag 'vfs-6.18-rc1.workqueue' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-09-29 10:27:17 -07:00

nfs

NFS4: Fix state renewals missing after boot

2025-10-13 14:33:00 -04:00

nfs_common

NFS/localio: nfs_uuid_put() fix the wake up after unlinking the file

2025-08-05 16:45:40 -07:00

nfsd

Merge tag 'nfsd-6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux

2025-10-14 09:28:12 -07:00

nilfs2

Merge branch 'mm-hotfixes-stable' into mm-stable in order to pick up

2025-09-21 14:19:36 -07:00

nls

…

notify

Merge tag 'fsnotify_for_v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs

2025-10-03 13:23:10 -07:00

ntfs3

ntfs3: stop using write_cache_pages

2025-09-13 16:55:13 -07:00

ocfs2

Merge tag 'mm-nonmm-stable-2025-10-02-15-29' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2025-10-02 18:44:54 -07:00

omfs

Merge tag 'vfs-6.17-rc1.mmap_prepare' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-07-28 13:43:25 -07:00

openpromfs

…

orangefs

Merge tag 'for-linus-6.18-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux

2025-10-03 13:59:56 -07:00

overlayfs

ovl: remove redundant IOCB_DIO_CALLER_COMP clearing

2025-10-10 14:02:47 +02:00

proc

Merge tag 'mm-nonmm-stable-2025-10-02-15-29' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2025-10-02 18:44:54 -07:00

pstore

Merge tag 'pstore-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

2025-09-29 18:08:34 -07:00

qnx4

…

qnx6

…

quota

fs: replace use of system_unbound_wq with system_dfl_wq

2025-09-19 16:15:07 +02:00

ramfs

fs: rename generic_delete_inode() and generic_drop_inode()

2025-09-15 16:09:42 +02:00

resctrl

fs/resctrl: Fix counter auto-assignment on mkdir with mbm_event enabled

2025-09-17 11:31:12 +02:00

romfs

fs: replace mmap hook with .mmap_prepare for simple mappings

2025-06-19 13:56:59 +02:00

smb

Merge tag '6.18-rc1-smb-client-fixes' of git://git.samba.org/sfrench/cifs-2.6

2025-10-18 07:11:32 -10:00

squashfs

Merge tag 'mm-nonmm-stable-2025-10-02-15-29' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2025-10-02 18:44:54 -07:00

sysfs

sysfs: remove bin_attribute::read_new/write_new()

2025-08-19 13:12:12 +02:00

tests

…

tracefs

Merge tag 'pull-rpc_pipefs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2025-07-28 09:56:09 -07:00

ubifs

Merge tag 'mm-stable-2025-10-01-19-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2025-10-02 18:18:33 -07:00

udf

fs: udf: fix OOB read in lengthAllocDescs handling

2025-09-22 15:33:56 +02:00

ufs

Merge tag 'vfs-6.17-rc1.mmap_prepare' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-07-28 13:43:25 -07:00

unicode

…

vboxsf

simplify vboxsf_dir_atomic_open()

2025-09-16 23:59:38 -04:00

verity

Merge tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux

2025-09-29 15:55:20 -07:00

xfs

xfs: don't set bt_nr_sectors to a negative number

2025-10-22 10:04:39 +02:00

zonefs

zonefs: correct some spelling mistakes

2025-08-12 11:59:27 +09:00

aio.c

Merge tag 'mm-stable-2025-10-01-19-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2025-10-02 18:18:33 -07:00

anon_inodes.c

module: Rename EXPORT_SYMBOL_GPL_FOR_MODULES to EXPORT_SYMBOL_FOR_MODULES

2025-08-11 16:16:36 +02:00

attr.c

vfs: add ATTR_CTIME_SET flag

2025-09-21 19:24:50 -04:00

backing-file.c

Merge tag 'vfs-6.17-rc1.mmap_prepare' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-07-28 13:43:25 -07:00

bad_inode.c

…

binfmt_elf_fdpic.c

Merge tag 'execve-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

2025-07-28 17:11:40 -07:00

binfmt_elf.c

binfmt_elf: preserve original ELF e_flags for core dumps

2025-09-03 20:49:32 -07:00

binfmt_flat.c

…

binfmt_misc.c

binfmt_misc: switch to locked_recursive_removal()

2025-07-02 22:36:51 -04:00

binfmt_script.c

…

bpf_fs_kfuncs.c

bpf...d_path(): constify path argument

2025-09-15 21:17:08 -04:00

buffer.c

fs/buffer: fix use-after-free when call bh_read() helper

2025-08-19 13:51:28 +02:00

char_dev.c

…

compat_binfmt_elf.c

…

coredump.c

coredump: fix core_pattern input validation

2025-10-07 13:12:46 +02:00

d_path.c

fold fs_struct->{lock,seq} into a seqlock

2025-07-08 10:25:19 +02:00

dax.c

dax: skip read lock assertion for read-only filesystems

2025-10-07 12:48:33 +02:00

dcache.c

vfs: Don't leak disconnected dentries on umount

2025-10-07 13:09:08 +02:00

direct-io.c

Merge tag 'mm-stable-2025-07-30-15-25' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2025-07-31 14:57:54 -07:00

drop_caches.c

…

eventfd.c

…

eventpoll.c

eventpoll: Replace rwlock with spinlock

2025-09-05 15:51:24 +02:00

exec.c

coredump: fix core_pattern input validation

2025-10-07 13:12:46 +02:00

fcntl.c

fcntl: trim arguments

2025-09-26 10:21:23 +02:00

fhandle.c

Merge tag 'namespace-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-09-29 11:20:29 -07:00

file_attr.c

fs: return EOPNOTSUPP from file_setattr/file_getattr syscalls

2025-10-10 13:46:00 +02:00

file_table.c

fs: update comment in init_file()

2025-10-07 12:48:33 +02:00

file.c

fs: always return zero on success from replace_fd()

2025-08-11 14:52:25 +02:00

filesystems.c

fs/filesystems: Fix potential unsigned integer underflow in fs_name()

2025-04-14 13:05:59 +02:00

fs_context.c

change the calling conventions for vfs_parse_fs_string()

2025-09-04 15:20:51 -04:00

fs_parser.c

fs/fs_parse: Remove unused and problematic validate_constant_table()

2025-04-21 10:27:59 +02:00

fs_pin.c

…

fs_struct.c

fold fs_struct->{lock,seq} into a seqlock

2025-07-08 10:25:19 +02:00

fs_types.c

…

fs-writeback.c

Merge tag 'vfs-6.18-rc1.writeback' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-09-29 11:34:40 -07:00

fsopen.c

fscontext: do not consume log entries when returning -EMSGSIZE

2025-08-11 14:52:41 +02:00

init.c

VFS: rename kern_path_locked() and related functions.

2025-09-23 12:37:36 +02:00

inode.c

Merge tag 'vfs-6.18-rc1.inode' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-09-29 09:42:30 -07:00

internal.h

Merge tag 'pull-f_path' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2025-10-03 16:32:36 -07:00

ioctl.c

fs: remove vfs_ioctl export

2025-09-01 13:08:01 +02:00

Kconfig

Merge tag 'mm-stable-2025-10-01-19-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2025-10-02 18:18:33 -07:00

Kconfig.binfmt

binfmt_elf: preserve original ELF e_flags for core dumps

2025-09-03 20:49:32 -07:00

kernel_read_file.c

…

libfs.c

Merge tag 'vfs-6.17-rc1.pidfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-07-28 14:10:15 -07:00

locks.c

locks: Remove the last reference to EXPORT_OP_ASYNC_LOCK.

2025-08-11 14:52:24 +02:00

Makefile

Remove bcachefs core code

2025-09-29 13:43:52 -07:00

mbcache.c

…

mnt_idmapping.c

…

mount.h

Merge tag 'pull-mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2025-10-03 10:19:44 -07:00

mpage.c

mpage: convert do_mpage_readpage() to return void type

2025-09-21 14:22:16 -07:00

namei.c

Merge tag 'pull-f_path' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2025-10-03 16:32:36 -07:00

namespace.c

Merge tag 'pull-fs_context' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2025-10-03 10:51:44 -07:00

nsfs.c

nsfs: handle inode number mismatches gracefully in file handles

2025-10-07 12:48:33 +02:00

open.c

Merge tag 'pull-f_path' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2025-10-03 16:32:36 -07:00

pidfs.c

Merge tag 'pull-f_path' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2025-10-03 16:32:36 -07:00

pipe.c

Add RWF_NOSIGNAL flag for pwritev2

2025-08-29 15:08:07 +02:00

pnode.c

umount_tree(): take all victims out of propagation graph at once

2025-09-15 21:26:44 -04:00

pnode.h

umount_tree(): take all victims out of propagation graph at once

2025-09-15 21:26:44 -04:00

posix_acl.c

…

proc_namespace.c

->mnt_devname is never NULL

2025-05-23 14:20:44 +02:00

read_write.c

copy_file_range: limit size if in compat mode

2025-08-15 16:11:47 +02:00

readdir.c

readdir: supply dir_context.count as readdir buffer size hint

2025-05-29 12:31:23 +02:00

remap_range.c

…

select.c

fs: annotate suspected data race between poll_schedule_timeout() and pollwake()

2025-06-23 12:36:51 +02:00

seq_file.c

…

signalfd.c

…

splice.c

netfs: Fix unbuffered write error handling

2025-08-15 15:56:49 +02:00

stack.c

docs/vfs: update references to i_mutex to i_rwsem

2025-06-23 12:17:33 +02:00

stat.c

constify path argument of vfs_statx_path()

2025-09-15 21:17:07 -04:00

statfs.c

…

super.c

Merge tag 'pull-mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2025-10-03 10:19:44 -07:00

sync.c

…

sysctls.c

…

timerfd.c

…

userfaultfd.c

mm/mremap: use an explicit uffd failure path for mremap

2025-07-24 19:12:29 -07:00

utimes.c

…

xattr.c

Merge tag 'vfs-6.17-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-07-28 11:22:56 -07:00