xfs_scrub: actually iterate all the bulkstat records

In scan_ag_bulkstat, we have a for loop that iterates all the
xfs_bulkstat records in breq->bulkstat.  The loop condition test should
test against the array length, not the number of bits set in an
unrelated data structure.  If ocount > xi_alloccount then we miss some
inodes; if ocount < xi_alloccount then we've walked off the end of the
array.

Cc: <linux-xfs@vger.kernel.org> # v5.18.0
Fixes: 245c72a6eeb720 ("xfs_scrub: balance inode chunk scan across CPUs")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>

diff --git a/scrub/inodes.c b/scrub/inodes.c
index 8bdfa0b35d61728a6c420739be8bf90124a29fe2..4d8b137a698004e4238c74341e707f535ce95141 100644 (file)
--- a/scrub/inodes.c
+++ b/scrub/inodes.c
@@ -216,7 +216,7 @@ scan_ag_bulkstat(
        struct xfs_inumbers_req *ireq = ichunk_to_inumbers(ichunk);
        struct xfs_bulkstat_req *breq = ichunk_to_bulkstat(ichunk);
        struct scan_inodes      *si = ichunk->si;
-       struct xfs_bulkstat     *bs;
+       struct xfs_bulkstat     *bs = &breq->bulkstat[0];
        struct xfs_inumbers     *inumbers = &ireq->inumbers[0];
        uint64_t                last_ino = 0;
        int                     i;
@@ -231,8 +231,7 @@ retry:
        bulkstat_for_inumbers(ctx, &dsc_inumbers, inumbers, breq);
 
        /* Iterate all the inodes. */
-       bs = &breq->bulkstat[0];
-       for (i = 0; !si->aborted && i < inumbers->xi_alloccount; i++, bs++) {
+       for (i = 0; !si->aborted && i < breq->hdr.ocount; i++, bs++) {
                uint64_t        scan_ino = bs->bs_ino;
 
                /* ensure forward progress if we retried */