]> git.ipfire.org Git - thirdparty/xfsprogs-dev.git/commit
xfs_repair: fix segfault from uninitialized tp in mv_orphanage
authorEric Sandeen <sandeen@redhat.com>
Thu, 22 Sep 2016 23:16:47 +0000 (09:16 +1000)
committerDave Chinner <david@fromorbit.com>
Thu, 22 Sep 2016 23:16:47 +0000 (09:16 +1000)
commite5c4ab5e1ff0145e1a071ce76b12c57c723c63e6
treed762577e178ce0eb1b9cc1672b5f5e5cb8fe428b
parent4d457e2472108185d767299e35efbaca07e9fcb0
xfs_repair: fix segfault from uninitialized tp in mv_orphanage

After 9074815 xfs: better xfs_trans_alloc interface, mv_orphanage
was passing an uninitialized *tp into libxfs_dir_lookup, because
the trans_alloc() call which was present prior to the call got
removed in that commit.

This ultimately led to testing an uninit tp var:

Conditional jump or move depends on uninitialised value(s)
   at 0x434D01: libxfs_trans_read_buf_map (trans.c:554)
   by 0x45152E: libxfs_da_read_buf (xfs_da_btree.c:2610)
   by 0x456ACB: xfs_dir3_block_read (xfs_dir2_block.c:136)
   by 0x4570A8: xfs_dir2_block_lookup_int (xfs_dir2_block.c:675)
   by 0x457DB7: xfs_dir2_block_lookup (xfs_dir2_block.c:623)
   by 0x455F54: libxfs_dir_lookup (xfs_dir2.c:399)
   by 0x421C46: mv_orphanage (phase6.c:1095)
   by 0x4222C2: check_for_orphaned_inodes (phase6.c:3108)
   by 0x423ABD: phase6 (phase6.c:3287)
   by 0x42E4B2: main (xfs_repair.c:933)

and ended with a segfault as we tried to use that tp when
searching for the buffer in xfs_trans_buf_item_match():

        list_for_each_entry(lidp, &tp->t_items, lid_trans) {

I think simply passing in NULL for this tp is sufficient to fix
this; we'll just go read the buffer from disk in
libxfs_trans_read_buf_map rather than trying to find it in an
existing transaction.

Reported-by: Consigliere <admin@russenmafia.at>
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
repair/phase6.c