Commit 93e8befc authored by Eric Sandeen's avatar Eric Sandeen Committed by Darrick J. Wong

xfs: handle error if xfs_btree_get_bufs fails

Jason reported that a corrupted filesystem failed to replay
the log with a metadata block out of bounds warning:

XFS (dm-2): _xfs_buf_find: Block out of range: block 0x80270fff8, EOFS 0x9c40000

_xfs_buf_find() and xfs_btree_get_bufs() return NULL if
that happens, and then when xfs_alloc_fix_freelist() calls
xfs_trans_binval() on that NULL bp, we oops with:

BUG: unable to handle kernel NULL pointer dereference at 00000000000000f8

We don't handle _xfs_buf_find errors very well, every
caller higher up the stack gets to guess at why it failed.
But we should at least handle it somehow, so return
EFSCORRUPTED here.
Reported-by: default avatarJason L Tibbitts III <tibbs@math.uh.edu>
Signed-off-by: default avatarEric Sandeen <sandeen@redhat.com>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Reviewed-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
parent f35c5e10
...@@ -1584,6 +1584,10 @@ xfs_alloc_ag_vextent_small( ...@@ -1584,6 +1584,10 @@ xfs_alloc_ag_vextent_small(
bp = xfs_btree_get_bufs(args->mp, args->tp, bp = xfs_btree_get_bufs(args->mp, args->tp,
args->agno, fbno, 0); args->agno, fbno, 0);
if (!bp) {
error = -EFSCORRUPTED;
goto error0;
}
xfs_trans_binval(args->tp, bp); xfs_trans_binval(args->tp, bp);
} }
args->len = 1; args->len = 1;
...@@ -2141,6 +2145,10 @@ xfs_alloc_fix_freelist( ...@@ -2141,6 +2145,10 @@ xfs_alloc_fix_freelist(
if (error) if (error)
goto out_agbp_relse; goto out_agbp_relse;
bp = xfs_btree_get_bufs(mp, tp, args->agno, bno, 0); bp = xfs_btree_get_bufs(mp, tp, args->agno, bno, 0);
if (!bp) {
error = -EFSCORRUPTED;
goto out_agbp_relse;
}
xfs_trans_binval(tp, bp); xfs_trans_binval(tp, bp);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment