[PATCH] xfs: handle error if xfs_btree_get_bufs fails

* [PATCH] xfs: handle error if xfs_btree_get_bufs fails
@ 2016-12-12 22:00 Eric Sandeen
  2016-12-12 22:14 ` Dave Chinner
  2016-12-12 22:39 ` Eric Sandeen
  0 siblings, 2 replies; 11+ messages in thread
From: Eric Sandeen @ 2016-12-12 22:00 UTC (permalink / raw)
  To: linux-xfs; +Cc: Jason L Tibbitts III

Jason reported that a corrupted filesystem failed to replay
the log with a metadata block out of bounds warning:

XFS (dm-2): _xfs_buf_find: Block out of range: block 0x80270fff8, EOFS 0x9c40000 

_xfs_buf_find() and xfs_btree_get_bufs() return NULL if
that happens, and then when xfs_alloc_fix_freelist() calls
xfs_trans_binval() on that NULL bp, we oops with:

BUG: unable to handle kernel NULL pointer dereference at 00000000000000f8

We don't handle _xfs_buf_find errors very well, every
caller higher up the stack gets to guess at why it failed.
But we should at least handle it somehow.  I chose EIO here
for lack of a better idea.  :)

Reported-by: Jason L Tibbitts III <tibbs@math.uh.edu>
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
---

diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c
index effb64c..d125135 100644
--- a/fs/xfs/libxfs/xfs_alloc.c
+++ b/fs/xfs/libxfs/xfs_alloc.c
@@ -1640,6 +1640,10 @@ STATIC int xfs_alloc_ag_vextent_small(xfs_alloc_arg_t *,
 
 				bp = xfs_btree_get_bufs(args->mp, args->tp,
 					args->agno, fbno, 0);
+				if (!bp) {
+					error = -EIO;
+					goto error0;
+				}
 				xfs_trans_binval(args->tp, bp);
 			}
 			args->len = 1;
@@ -2185,6 +2189,10 @@ STATIC int xfs_alloc_ag_vextent_small(xfs_alloc_arg_t *,
 		if (error)
 			goto out_agbp_relse;
 		bp = xfs_btree_get_bufs(mp, tp, args->agno, bno, 0);
+		if (!bp) {
+			error = -EIO;
+			goto out_agbp_relse;
+		}
 		xfs_trans_binval(tp, bp);
 	}
 


^ permalink raw reply related	[flat|nested] 11+ messages in thread