diff mbox series

[4/4] xfs_repair: fix stupid argument error in verify_inode_chunk

Message ID 174257453669.474645.15431452443530778898.stgit@frogsfrogsfrogs (mailing list archive)
State New
Headers show
Series [1/4] xfs_repair: don't recreate /quota metadir if there are no quota inodes | expand

Commit Message

Darrick J. Wong March 21, 2025, 4:32 p.m. UTC 
From: Darrick J. Wong <djwong@kernel.org>

An arm64 VM running fstests with 64k fsblock size blew up the test
filesystem when the OOM killer whacked xfs_repair as it was rebuilding a
sample filesystem.  A subsequent attempt by fstests to repair the
filesystem printed stuff like this:

inode rec for ino 39144576 (1/5590144) overlaps existing rec (start 1/5590144)
inode rec for ino 39144640 (1/5590208) overlaps existing rec (start 1/5590208)

followed by a lot of errors such as:

cannot read agbno (1/5590208), disk block 734257664
xfs_repair: error - read only 0 of 65536 bytes

Here we're feeding per-AG inode numbers into a block reading function as
if it were a per-AG block number.  This is wrong by a factor of 128x so
we read past the end of the filesystem.  Worse yet, the buffer cache
fills up memory and thus the second repair process is also OOM killed.
The filesystem is not fixed.

Cc: <linux-xfs@vger.kernel.org> # v3.1.8
Fixes: 0553a94f522c17 ("repair: kill check_inode_block")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
---
 repair/dino_chunks.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Christoph Hellwig March 23, 2025, 6:35 a.m. UTC | #1 
Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>
diff mbox series

Patch

diff --git a/repair/dino_chunks.c b/repair/dino_chunks.c
index 250985ec264ead..932eaf63f4741f 100644
--- a/repair/dino_chunks.c
+++ b/repair/dino_chunks.c
@@ -132,7 +132,7 @@  verify_inode_chunk(xfs_mount_t		*mp,
 	if (igeo->ialloc_blks == 1)  {
 		if (agbno > max_agbno)
 			return 0;
-		if (check_aginode_block(mp, agno, agino) == 0)
+		if (check_aginode_block(mp, agno, agbno) == 0)
 			return 0;
 
 		lock_ag(agno);