提交 2abdb8c8 编写于 作者: L Lachlan McIlroy 提交者: Lachlan McIlroy

[XFS] Prevent xfs_bmap_check_leaf_extents() referencing unmapped memory.

While investigating the extent corruption bug I ran into this bug in debug
only code. xfs_bmap_check_leaf_extents() loops through the leaf blocks of
the extent btree checking that every extent is entirely before the next
extent. It also compares the last extent in the previous block to the
first extent in the current block when the previous block has been
released and potentially unmapped. So take a copy of the last extent
instead of a pointer. Also move the last extent check out of the loop
because we only need to do it once.

SGI-PV: 976035
SGI-Modid: xfs-linux-melb:xfs-kern:30718a
Signed-off-by: NLachlan McIlroy <lachlan@sgi.com>
Signed-off-by: NChristoph Hellwig <hch@infradead.org>
上级 43355099
...@@ -6194,7 +6194,7 @@ xfs_bmap_check_leaf_extents( ...@@ -6194,7 +6194,7 @@ xfs_bmap_check_leaf_extents(
xfs_mount_t *mp; /* file system mount structure */ xfs_mount_t *mp; /* file system mount structure */
__be64 *pp; /* pointer to block address */ __be64 *pp; /* pointer to block address */
xfs_bmbt_rec_t *ep; /* pointer to current extent */ xfs_bmbt_rec_t *ep; /* pointer to current extent */
xfs_bmbt_rec_t *lastp; /* pointer to previous extent */ xfs_bmbt_rec_t last = {0, 0}; /* last extent in prev block */
xfs_bmbt_rec_t *nextp; /* pointer to next extent */ xfs_bmbt_rec_t *nextp; /* pointer to next extent */
int bp_release = 0; int bp_release = 0;
...@@ -6264,7 +6264,6 @@ xfs_bmap_check_leaf_extents( ...@@ -6264,7 +6264,6 @@ xfs_bmap_check_leaf_extents(
/* /*
* Loop over all leaf nodes checking that all extents are in the right order. * Loop over all leaf nodes checking that all extents are in the right order.
*/ */
lastp = NULL;
for (;;) { for (;;) {
xfs_fsblock_t nextbno; xfs_fsblock_t nextbno;
xfs_extnum_t num_recs; xfs_extnum_t num_recs;
...@@ -6285,18 +6284,16 @@ xfs_bmap_check_leaf_extents( ...@@ -6285,18 +6284,16 @@ xfs_bmap_check_leaf_extents(
*/ */
ep = XFS_BTREE_REC_ADDR(xfs_bmbt, block, 1); ep = XFS_BTREE_REC_ADDR(xfs_bmbt, block, 1);
if (i) {
xfs_btree_check_rec(XFS_BTNUM_BMAP, &last, ep);
}
for (j = 1; j < num_recs; j++) { for (j = 1; j < num_recs; j++) {
nextp = XFS_BTREE_REC_ADDR(xfs_bmbt, block, j + 1); nextp = XFS_BTREE_REC_ADDR(xfs_bmbt, block, j + 1);
if (lastp) { xfs_btree_check_rec(XFS_BTNUM_BMAP, ep, nextp);
xfs_btree_check_rec(XFS_BTNUM_BMAP,
(void *)lastp, (void *)ep);
}
xfs_btree_check_rec(XFS_BTNUM_BMAP, (void *)ep,
(void *)(nextp));
lastp = ep;
ep = nextp; ep = nextp;
} }
last = *ep;
i += num_recs; i += num_recs;
if (bp_release) { if (bp_release) {
bp_release = 0; bp_release = 0;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册