Skip to contentSkip to conversation

fix bad quota inodes in the superblock causing xfs_repair to crash

PATCH In review Barry Naujok 2 participants 2 messages Feb 20, 2007

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 fix bad quota inodes in the superblock causing xfs_repair to crash

Thanks to Eric for generating bad images with fsfuzzer, bad quota inode values in the superblock caused xfs_repair to segfault. The patch checks the validity of the inodes before doing an internal lookup which assumes the numbers are valid before being called.

xfsprogs/repair/phase4.c +13 -5
@@ -1059,8 +1059,12 @@ quotino_check(xfs_mount_t *mp)
 	ino_tree_node_t *irec;
 
 	if (mp->m_sb.sb_uquotino != NULLFSINO && mp->m_sb.sb_uquotino != 0)  {
-		irec = find_inode_rec(XFS_INO_TO_AGNO(mp, mp->m_sb.sb_uquotino),
-			XFS_INO_TO_AGINO(mp, mp->m_sb.sb_uquotino));
+		if (verify_inum(mp, mp->m_sb.sb_uquotino))
+			irec = NULL;
+		else
+			irec = find_inode_rec(
+				XFS_INO_TO_AGNO(mp, mp->m_sb.sb_uquotino),
+				XFS_INO_TO_AGINO(mp, mp->m_sb.sb_uquotino));
 
 		if (irec == NULL || is_inode_free(irec,
 				mp->m_sb.sb_uquotino - irec->ino_startnum))  {
@@ -1071,8 +1075,12 @@ quotino_check(xfs_mount_t *mp)
 	}
 
 	if (mp->m_sb.sb_gquotino != NULLFSINO && mp->m_sb.sb_gquotino != 0)  {
-		irec = find_inode_rec(XFS_INO_TO_AGNO(mp, mp->m_sb.sb_gquotino),
-			XFS_INO_TO_AGINO(mp, mp->m_sb.sb_gquotino));
+		if (verify_inum(mp, mp->m_sb.sb_gquotino))
+			irec = NULL;
+		else
+			irec = find_inode_rec(
+				XFS_INO_TO_AGNO(mp, mp->m_sb.sb_gquotino),
+				XFS_INO_TO_AGINO(mp, mp->m_sb.sb_gquotino));
 
 		if (irec == NULL || is_inode_free(irec,
 				mp->m_sb.sb_gquotino - irec->ino_startnum))  {
@@ -1322,7 +1330,7 @@ phase4(xfs_mount_t *mp)
 		/*
 		 * now reset the bitmap for all ags
 		 */
-		bzero(ba_bmap[i], 
+		bzero(ba_bmap[i],
 		    roundup((mp->m_sb.sb_agblocks+(NBBY/XR_BB)-1)/(NBBY/XR_BB),
 						sizeof(__uint64_t)));
 		for (j = 0; j < ag_hdr_block; j++)
#1 lore raw
Quoted 5 lines · Barry Naujok

Thanks to Eric for generating bad images with fsfuzzer, bad quota inode values in the superblock caused xfs_repair to segfault. The patch checks the validity of the inodes before doing an internal lookup which assumes the numbers are valid before being called.

Looks good to me Barry, thanks! I'll see if I can find more corrupt images for you. ;-)

-Eric