xfsprogs: fix inode crash in xfs_repair

Adding the lost+found in phase 6 could allocate an inode from
a new inode chunk. Since this chunk was not around in phase 3
when the inode chunks are verificated and added to the avl tree,
the avl tree look up will return a NULL pointer. This results
in a NULL defererence and segmentation fault.

Add the newly created inode chunk as if found in the chunk
verification phase.

Signed-off-by: Mark Tinguely <tinguely@sgi.com>
Reviewed-by: Rich Johnston <rjohnston@sgi.com>
Signed-off-by: Rich Johnston <rjohnston@sgi.com>

diff --git a/repair/incore_ino.c b/repair/incore_ino.c
index 2a40727b4747fdeb68eb4d616e419574f4f6c694..efffe753852e8b1fb38680e736115194536628ee 100644 (file)
--- a/repair/incore_ino.c
+++ b/repair/incore_ino.c
@@ -700,7 +700,7 @@ get_inode_parent(ino_tree_node_t *irec, int offset)
        return(0LL);
 }
 
-static void
+void
 alloc_ex_data(ino_tree_node_t *irec)
 {
        parent_list_t   *ptbl;

diff --git a/repair/phase6.c b/repair/phase6.c
index f94cdaf005a60db7de13f0d50d4381cb3ce7cb8f..65e6301867cd773a63076cab4adaa877a21b7ce1 100644 (file)
--- a/repair/phase6.c
+++ b/repair/phase6.c
@@ -930,6 +930,22 @@ mk_orphanage(xfs_mount_t *mp)
        irec = find_inode_rec(mp,
                        XFS_INO_TO_AGNO(mp, ino),
                        XFS_INO_TO_AGINO(mp, ino));
+
+       if (irec == NULL) {
+               /*
+                * This inode is allocated from a newly created inode
+                * chunk and therefore did not exist when inode chunks
+                * were processed in phase3. Add this group of inodes to
+                * the entry avl tree as if they were discovered in phase3.
+                */
+               irec = set_inode_free_alloc(mp, XFS_INO_TO_AGNO(mp, ino),
+                                           XFS_INO_TO_AGINO(mp, ino));
+               alloc_ex_data(irec);
+
+               for (i = 0; i < XFS_INODES_PER_CHUNK; i++)
+                       set_inode_free(irec, i);
+       }
+
        ino_offset = get_inode_offset(mp, ino, irec);
 
        /*