]>
Commit | Line | Data |
---|---|---|
2cb7cef9 BS |
1 | From: David Chinner <david@fromorbit.com> |
2 | Subject: [XFS] XFS: Check for valid transaction headers in recovery | |
3 | References: bnc#450658 | |
4 | Patch-mainline: ? | |
5 | ||
6 | When we are about to add a new item to a transaction in recovery, we need | |
7 | to check that it is valid first. Currently we just assert that header | |
8 | magic number matches, but in production systems that is not present and we | |
9 | add a corrupted transaction to the list to be processed. This results in a | |
10 | kernel oops later when processing the corrupted transaction. | |
11 | ||
12 | Instead, if we detect a corrupted transaction, abort recovery and leave | |
13 | the user to clean up the mess that has occurred. | |
14 | ||
15 | SGI-PV: 988145 | |
16 | ||
17 | SGI-Modid: xfs-linux-melb:xfs-kern:32356a | |
18 | ||
19 | Signed-off-by: David Chinner <david@fromorbit.com> | |
20 | Signed-off-by: Tim Shimmin <tes@sgi.com> | |
21 | Signed-off-by: Eric Sandeen <sandeen@sandeen.net> | |
22 | Signed-off-by: Lachlan McIlroy <lachlan@sgi.com> | |
23 | Acked-by: Jan Kara <jack@suse.cz> | |
24 | ||
25 | Index: linux-2.6.27.5-2/fs/xfs/xfs_log_recover.c | |
26 | =================================================================== | |
27 | --- linux-2.6.27.5-2.orig/fs/xfs/xfs_log_recover.c 2008-12-03 11:58:01.136714829 +1100 | |
28 | +++ linux-2.6.27.5-2/fs/xfs/xfs_log_recover.c 2008-12-03 11:59:11.531741273 +1100 | |
29 | @@ -1419,7 +1419,13 @@ xlog_recover_add_to_trans( | |
30 | return 0; | |
31 | item = trans->r_itemq; | |
32 | if (item == NULL) { | |
33 | - ASSERT(*(uint *)dp == XFS_TRANS_HEADER_MAGIC); | |
34 | + /* we need to catch log corruptions here */ | |
35 | + if (*(uint *)dp != XFS_TRANS_HEADER_MAGIC) { | |
36 | + xlog_warn("XFS: xlog_recover_add_to_trans: " | |
37 | + "bad header magic number"); | |
38 | + ASSERT(0); | |
39 | + return XFS_ERROR(EIO); | |
40 | + } | |
41 | if (len == sizeof(xfs_trans_header_t)) | |
42 | xlog_recover_add_item(&trans->r_itemq); | |
43 | memcpy(&trans->r_theader, dp, len); /* d, s, l */ |