xfs_repair: fix left-shift overflows

pmask in struct parent_list is a __uint64_t, but in some places
we populated it with "1LL << shift" where shift could be up
to 63; this really needs to be a 1ULL type for this to be correct.

Also spotted by libubsan...

Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>

diff --git a/repair/incore_ino.c b/repair/incore_ino.c
index 32d767860ad2c2ddb08a582ea8fd1269de81b5f2..1898257cc177bfbd52f18bf640c0509f00f08f75 100644 (file)
--- a/repair/incore_ino.c
+++ b/repair/incore_ino.c
@@ -625,7 +625,7 @@ set_inode_parent(
                else
                        irec->ino_un.plist = ptbl;
 
-               ptbl->pmask = 1LL << offset;
+               ptbl->pmask = 1ULL << offset;
                ptbl->pentries = (xfs_ino_t*)memalign(sizeof(xfs_ino_t),
                                                        sizeof(xfs_ino_t));
                if (!ptbl->pentries)
@@ -638,8 +638,8 @@ set_inode_parent(
                return;
        }
 
-       if (ptbl->pmask & (1LL << offset))  {
-               bitmask = 1LL;
+       if (ptbl->pmask & (1ULL << offset))  {
+               bitmask = 1ULL;
                target = 0;
 
                for (i = 0; i < offset; i++)  {
@@ -655,7 +655,7 @@ set_inode_parent(
                return;
        }
 
-       bitmask = 1LL;
+       bitmask = 1ULL;
        cnt = target = 0;
 
        for (i = 0; i < XFS_INODES_PER_CHUNK; i++)  {
@@ -691,7 +691,7 @@ set_inode_parent(
        ptbl->cnt++;
 #endif
        ptbl->pentries[target] = parent;
-       ptbl->pmask |= (1LL << offset);
+       ptbl->pmask |= (1ULL << offset);
 }
 
 xfs_ino_t
@@ -707,8 +707,8 @@ get_inode_parent(ino_tree_node_t *irec, int offset)
        else
                ptbl = irec->ino_un.plist;
 
-       if (ptbl->pmask & (1LL << offset))  {
-               bitmask = 1LL;
+       if (ptbl->pmask & (1ULL << offset))  {
+               bitmask = 1ULL;
                target = 0;
 
                for (i = 0; i < offset; i++)  {

diff --git a/repair/prefetch.c b/repair/prefetch.c
index 52238ca3314547a6c8ae814a5f16415c7d037547..b11dcb31d3046bef1ea02fb00515ea606999c733 100644 (file)
--- a/repair/prefetch.c
+++ b/repair/prefetch.c
@@ -762,7 +762,7 @@ pf_queuing_worker(
                         * sparse state in cluster sized chunks as cluster size
                         * is the min. granularity of sparse irec regions.
                         */
-                       if ((sparse & ((1 << inodes_per_cluster) - 1)) == 0)
+                       if ((sparse & ((1ULL << inodes_per_cluster) - 1)) == 0)
                                pf_queue_io(args, &map, 1,
                                            (cur_irec->ino_isa_dir != 0) ?
                                             B_DIR_INODE : B_INODE);