xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair

LOLLM noticed a longstanding bug where xrep_iunlink_walk_ondisk_bucket
tries to walk ragi->sc->sa.agi_bp to rebuild the unlinked inode lists.
Unfortunately, it's possible for agi_bp to be null if the buffer
verifier fails, so we have to use ragi->agi_bp (which skips verifier
checks) instead.

Cc: stable@vger.kernel.org # v6.10
Fixes: ab97f4b1c03075 ("xfs: repair AGI unlinked inode bucket lists")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Assisted-by: LOLLM # finding obvious bugs
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>

diff --git a/fs/xfs/scrub/agheader_repair.c b/fs/xfs/scrub/agheader_repair.c
index 13074d5e319cc0a9eb1615227eed922245d2a53a..39468b8fa9863d0d384d2c8598db5ba73204b437 100644 (file)
--- a/fs/xfs/scrub/agheader_repair.c
+++ b/fs/xfs/scrub/agheader_repair.c
@@ -1082,7 +1082,7 @@ xrep_iunlink_walk_ondisk_bucket(
 {
        struct xagino_bitmap    seen;
        struct xfs_scrub        *sc = ragi->sc;
-       struct xfs_agi          *agi = sc->sa.agi_bp->b_addr;
+       struct xfs_agi          *agi = ragi->agi_bp->b_addr;
        xfs_agino_t             prev_agino = NULLAGINO;
        xfs_agino_t             next_agino;
        int                     error = 0;