Skip to contentSkip to conversation

repair: ensure that unused superblock fields are zeroed

PATCH In review Dave Chinner 2 participants 2 messages Mar 11, 2014

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 repair: ensure that unused superblock fields are zeroed

From: Dave Chinner <[email protected]>

When we grab a superblock off disk via get_sb(), we don't know what the in-memory superblock we are filling out contained. We ned to ensure that the entire structure is returned in an initialised state regardless of which fields libxfs_sb_from_disk() populates from disk. In this case, it doesn't populate the sb_crc field, and so uninitialised values can escape through to disk on v4 filesystems because of this. This causes xfs/031 to fail on v4 filesystems.

---
 repair/sb.c | 1 +
 1 file changed, 1 insertion(+)
repair/sb.c +1 -0
index b111aca..d928dc0 100644
@@ -518,6 +518,7 @@ get_sb(xfs_sb_t *sbp, xfs_off_t off, int size, xfs_agnumber_t agno)
 		exit(1);
 	}
 	memset(buf, 0, size);
+	memset(sbp, 0, sizeof(*sbp));
 
 	/* try and read it first */
 
Signature · 6 lines
1.9.0

_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs
Reviewed-by on v1 1/1
#1 lore raw
Quoted 11 lines · Dave Chinner

From: Dave Chinner <[email protected]>

When we grab a superblock off disk via get_sb(), we don't know what the in-memory superblock we are filling out contained. We ned to ensure that the entire structure is returned in an initialised state regardless of which fields libxfs_sb_from_disk() populates from disk. In this case, it doesn't populate the sb_crc field, and so uninitialised values can escape through to disk on v4 filesystems because of this. This causes xfs/031 to fail on v4 filesystems.

Quoted 2 lines

cool, thanks for finding that "overnight." :)

Quoted 10 lines
---
 repair/sb.c | 1 +
 1 file changed, 1 insertion(+)
repair/sb.c +0 -0
index b111aca..d928dc0 100644

repair/sb.c get_sb(xfs_sb_t *sbp, xfs_off_t off, int size, xfs_agnumber_t agno) · line 524

Quoted 7 lines
repair/sb.c +1 -0
@@ -518,6 +518,7 @@ get_sb(xfs_sb_t *sbp, xfs_off_t off, int size, xfs_agnumber_t agno)
 		exit(1);
 	}
 	memset(buf, 0, size);
+	memset(sbp, 0, sizeof(*sbp));
 
 	/* try and read it first */
 

_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs