xfs_repair: fix segfault from uninitialized tp in mv_orphanage

After 9074815 xfs: better xfs_trans_alloc interface, mv_orphanage
was passing an uninitialized *tp into libxfs_dir_lookup, because
the trans_alloc() call which was present prior to the call got
removed in that commit.

This ultimately led to testing an uninit tp var:

Conditional jump or move depends on uninitialised value(s)
   at 0x434D01: libxfs_trans_read_buf_map (trans.c:554)
   by 0x45152E: libxfs_da_read_buf (xfs_da_btree.c:2610)
   by 0x456ACB: xfs_dir3_block_read (xfs_dir2_block.c:136)
   by 0x4570A8: xfs_dir2_block_lookup_int (xfs_dir2_block.c:675)
   by 0x457DB7: xfs_dir2_block_lookup (xfs_dir2_block.c:623)
   by 0x455F54: libxfs_dir_lookup (xfs_dir2.c:399)
   by 0x421C46: mv_orphanage (phase6.c:1095)
   by 0x4222C2: check_for_orphaned_inodes (phase6.c:3108)
   by 0x423ABD: phase6 (phase6.c:3287)
   by 0x42E4B2: main (xfs_repair.c:933)

and ended with a segfault as we tried to use that tp when
searching for the buffer in xfs_trans_buf_item_match():

        list_for_each_entry(lidp, &tp->t_items, lid_trans) {

I think simply passing in NULL for this tp is sufficient to fix
this; we'll just go read the buffer from disk in
libxfs_trans_read_buf_map rather than trying to find it in an
existing transaction.

Reported-by: Consigliere <admin@russenmafia.at>
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>

diff --git a/repair/phase6.c b/repair/phase6.c
index 973a5f8a8620949a7bfa0cb40c004e6f987c0540..5507af4ef5239b3770d21913855c049193fd4c3c 100644 (file)
--- a/repair/phase6.c
+++ b/repair/phase6.c
@@ -1092,7 +1092,7 @@ mv_orphanage(
                                        irec->ino_startnum;
                nres = XFS_DIRENTER_SPACE_RES(mp, fnamelen) +
                       XFS_DIRENTER_SPACE_RES(mp, 2);
-               err = -libxfs_dir_lookup(tp, ino_p, &xfs_name_dotdot,
+               err = -libxfs_dir_lookup(NULL, ino_p, &xfs_name_dotdot,
                                        &entry_ino_num, NULL);
                if (err) {
                        ASSERT(err == ENOENT);