Re: [Bug 11175] New: ext3 BUG in add_dirent_to_buf+0x6c/0x269

[Theodore Tso <tytso@MIT.EDU>]

Hmm... disassembling the code, it's pretty clear the problem is here
in do_split(), around line 1208:

	map = (struct dx_map_entry *) (data2 + blocksize);
	count = dx_make_map ((struct ext3_dir_entry_2 *) data1,
			     blocksize, hinfo, map);
	map -= count;
	dx_sort_map (map, count);
	/* Split the existing block in the middle, size-wise */
	size = 0;
	move = 0;
	for (i = count-1; i >= 0; i--) {
		/* is more than half of this entry in 2nd half of the block? */
		if (size + map[i].size/2 > blocksize/2)  <====
			break;
		size += map[i].size;
		move++;
	}

I suspect dx_make_map returned 0, and since i and count are an
unsigned int, things started to go downhill after i was assigned the
value of ((unsigned) -1).

How could this happen?  The only way thing I can think of is a
directory block with a large number of deleted directory entries that
were not coalesced for some reason.  That shouldn't happen normally,
but that's the only explanation I can think of why we might be trying
to split an directory block where dx_make_map() is returning 0.

Asheesh, are you willing to recompile a kernel with some debugging
code inserted?

						- Ted