From: Dave Chinner <dchinner@xxxxxxxxxx>
[ Upstream commit 038ca189c0d2c1570b4d922f25b524007c85cf94 ]
Discovered when trying to track down a weird recovery corruption
issue that wasn't detected at recovery time.
The specific corruption was a zero extent count field when big
extent counts are in use, and it turns out the dinode verifier
doesn't detect that specific corruption case, either. So fix it too.
Signed-off-by: Dave Chinner <dchinner@xxxxxxxxxx>
Reviewed-by: "Darrick J. Wong" <djwong@xxxxxxxxxx>
Signed-off-by: Chandan Babu R <chandanbabu@xxxxxxxxxx>
Signed-off-by: Leah Rumancik <leah.rumancik@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/xfs/libxfs/xfs_inode_buf.c | 3 +++
fs/xfs/xfs_inode_item_recover.c | 14 +++++++++++++-
2 files changed, 16 insertions(+), 1 deletion(-)
--- a/fs/xfs/libxfs/xfs_inode_buf.c
+++ b/fs/xfs/libxfs/xfs_inode_buf.c
@@ -507,6 +507,9 @@ xfs_dinode_verify(
if (mode && nextents + naextents > nblocks)
return __this_address;
+ if (nextents + naextents == 0 && nblocks != 0)
+ return __this_address;
+
if (S_ISDIR(mode) && nextents > mp->m_dir_geo->max_extents)
return __this_address;
--- a/fs/xfs/xfs_inode_item_recover.c
+++ b/fs/xfs/xfs_inode_item_recover.c
@@ -286,6 +286,7 @@ xlog_recover_inode_commit_pass2(
struct xfs_log_dinode *ldip;
uint isize;
int need_free = 0;
+ xfs_failaddr_t fa;
if (item->ri_buf[0].i_len == sizeof(struct xfs_inode_log_format)) {
in_f = item->ri_buf[0].i_addr;
@@ -530,8 +531,19 @@ out_owner_change:
(dip->di_mode != 0))
error = xfs_recover_inode_owner_change(mp, dip, in_f,
buffer_list);
- /* re-generate the checksum. */
+ /* re-generate the checksum and validate the recovered inode. */
xfs_dinode_calc_crc(log->l_mp, dip);
+ fa = xfs_dinode_verify(log->l_mp, in_f->ilf_ino, dip);
+ if (fa) {
+ XFS_CORRUPTION_ERROR(
+ "Bad dinode after recovery",
+ XFS_ERRLEVEL_LOW, mp, dip, sizeof(*dip));
+ xfs_alert(mp,
+ "Metadata corruption detected at %pS, inode 0x%llx",
+ fa, in_f->ilf_ino);
+ error = -EFSCORRUPTED;
+ goto out_release;
+ }
ASSERT(bp->b_mount == mp);
bp->b_flags |= _XBF_LOGRECOVERY;
Patches currently in stable-queue which might be from leah.rumancik@xxxxxxxxx are
queue-6.1/xfs-allow-read-io-and-ficlone-to-run-concurrently.patch
queue-6.1/xfs-hoist-freeing-of-rt-data-fork-extent-mappings.patch
queue-6.1/xfs-make-sure-maxlen-is-still-congruent-with-prod-when-rounding-down.patch
queue-6.1/xfs-only-remap-the-written-blocks-in-xfs_reflink_end_cow_extent.patch
queue-6.1/xfs-dquot-recovery-does-not-validate-the-recovered-dquot.patch
queue-6.1/xfs-clean-up-dqblk-extraction.patch
queue-6.1/xfs-abort-intent-items-when-recovery-intents-fail.patch
queue-6.1/xfs-up-ic_sema-if-flushing-data-device-fails.patch
queue-6.1/xfs-fix-internal-error-from-agfl-exhaustion.patch
queue-6.1/xfs-factor-out-xfs_defer_pending_abort.patch
queue-6.1/xfs-fix-units-conversion-error-in-xfs_bmap_del_extent_delay.patch
queue-6.1/xfs-bump-max-fsgeom-struct-version.patch
queue-6.1/xfs-handle-nimaps-0-from-xfs_bmapi_write-in-xfs_alloc_file_space.patch
queue-6.1/xfs-rt-stubs-should-return-negative-errnos-when-rt-disabled.patch
queue-6.1/xfs-clean-up-fs_xflag_realtime-handling-in-xfs_ioctl_setattr_xflags.patch
queue-6.1/xfs-respect-the-stable-writes-flag-on-the-rt-device.patch
queue-6.1/xfs-introduce-protection-for-drop-nlink.patch
queue-6.1/xfs-prevent-rt-growfs-when-quota-is-enabled.patch
queue-6.1/xfs-inode-recovery-does-not-validate-the-recovered-inode.patch
