* XFS bug in log recover with quota (bugzilla id 855)
@ 2009-11-16 11:57 Jan Rekorajski
2009-11-16 13:08 ` Christoph Hellwig
2009-11-16 15:55 ` Alex Elder
0 siblings, 2 replies; 4+ messages in thread
From: Jan Rekorajski @ 2009-11-16 11:57 UTC (permalink / raw)
To: Christoph Hellwig; +Cc: xfs
Hi,
I was hit by a bug in linux 2.6.31 when XFS is not able to recover the
log after a crash if fs was mounted with quotas. Gory details in XFS
bugzilla: http://oss.sgi.com/bugzilla/show_bug.cgi?id=855.
It looks like wrong struct is used in buffer length check, and the following
patch should fix the problem.
xfs_dqblk_t has a size of 104+32 bytes, while xfs_disk_dquot_t is 104 bytes
long, and this is exactly what I see in system logs - "XFS: dquot too small
(104) in xlog_recover_do_dquot_trans."
--- linux-2.6.31.5/fs/xfs/xfs_log_recover.c.orig 2009-11-01 23:59:52.194846209 +0100
+++ linux-2.6.31.5/fs/xfs/xfs_log_recover.c 2009-11-16 12:47:11.601490963 +0100
@@ -1980,7 +1980,7 @@
"XFS: NULL dquot in %s.", __func__);
goto next;
}
- if (item->ri_buf[i].i_len < sizeof(xfs_dqblk_t)) {
+ if (item->ri_buf[i].i_len < sizeof(xfs_disk_dquot_t)) {
cmn_err(CE_ALERT,
"XFS: dquot too small (%d) in %s.",
item->ri_buf[i].i_len, __func__);
@@ -2636,7 +2636,7 @@
"XFS: NULL dquot in %s.", __func__);
return XFS_ERROR(EIO);
}
- if (item->ri_buf[1].i_len < sizeof(xfs_dqblk_t)) {
+ if (item->ri_buf[1].i_len < sizeof(xfs_disk_dquot_t)) {
cmn_err(CE_ALERT,
"XFS: dquot too small (%d) in %s.",
item->ri_buf[1].i_len, __func__);
--
Jan Rekorajski | ALL SUSPECTS ARE GUILTY. PERIOD!
baggins<at>mimuw.edu.pl | OTHERWISE THEY WOULDN'T BE SUSPECTS, WOULD THEY?
BOFH, MANIAC | -- TROOPS by Kevin Rubio
_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: XFS bug in log recover with quota (bugzilla id 855)
2009-11-16 11:57 XFS bug in log recover with quota (bugzilla id 855) Jan Rekorajski
@ 2009-11-16 13:08 ` Christoph Hellwig
2009-11-16 14:29 ` Eric Sandeen
2009-11-16 15:55 ` Alex Elder
1 sibling, 1 reply; 4+ messages in thread
From: Christoph Hellwig @ 2009-11-16 13:08 UTC (permalink / raw)
To: Jan Rekorajski; +Cc: Christoph Hellwig, xfs
On Mon, Nov 16, 2009 at 12:57:02PM +0100, Jan Rekorajski wrote:
> Hi,
> I was hit by a bug in linux 2.6.31 when XFS is not able to recover the
> log after a crash if fs was mounted with quotas. Gory details in XFS
> bugzilla: http://oss.sgi.com/bugzilla/show_bug.cgi?id=855.
>
> It looks like wrong struct is used in buffer length check, and the following
> patch should fix the problem.
>
> xfs_dqblk_t has a size of 104+32 bytes, while xfs_disk_dquot_t is 104 bytes
> long, and this is exactly what I see in system logs - "XFS: dquot too small
> (104) in xlog_recover_do_dquot_trans."
Yikes, great brown paperbag bug. Indeed, as per
xfs_qm_dquot_logitem_format() we only log the xfs_disk_dquot_t and not
the full xfs_dqblk_t.
Felix, can you try to get this to Linus before .32 as this is clearly a
regression.
I'll also put the writing of more quota testcases including testing the
log recovery even higher on my todo list.
Reviewed-by: Christoph Hellwig <hch@lst.de>
> --- linux-2.6.31.5/fs/xfs/xfs_log_recover.c.orig 2009-11-01 23:59:52.194846209 +0100
> +++ linux-2.6.31.5/fs/xfs/xfs_log_recover.c 2009-11-16 12:47:11.601490963 +0100
> @@ -1980,7 +1980,7 @@
> "XFS: NULL dquot in %s.", __func__);
> goto next;
> }
> - if (item->ri_buf[i].i_len < sizeof(xfs_dqblk_t)) {
> + if (item->ri_buf[i].i_len < sizeof(xfs_disk_dquot_t)) {
> cmn_err(CE_ALERT,
> "XFS: dquot too small (%d) in %s.",
> item->ri_buf[i].i_len, __func__);
> @@ -2636,7 +2636,7 @@
> "XFS: NULL dquot in %s.", __func__);
> return XFS_ERROR(EIO);
> }
> - if (item->ri_buf[1].i_len < sizeof(xfs_dqblk_t)) {
> + if (item->ri_buf[1].i_len < sizeof(xfs_disk_dquot_t)) {
> cmn_err(CE_ALERT,
> "XFS: dquot too small (%d) in %s.",
> item->ri_buf[1].i_len, __func__);
>
> --
> Jan Rekorajski | ALL SUSPECTS ARE GUILTY. PERIOD!
> baggins<at>mimuw.edu.pl | OTHERWISE THEY WOULDN'T BE SUSPECTS, WOULD THEY?
> BOFH, MANIAC | -- TROOPS by Kevin Rubio
---end quoted text---
_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: XFS bug in log recover with quota (bugzilla id 855)
2009-11-16 13:08 ` Christoph Hellwig
@ 2009-11-16 14:29 ` Eric Sandeen
0 siblings, 0 replies; 4+ messages in thread
From: Eric Sandeen @ 2009-11-16 14:29 UTC (permalink / raw)
To: Christoph Hellwig; +Cc: Alex Elder, Jan Rekorajski, xfs
Christoph Hellwig wrote:
> On Mon, Nov 16, 2009 at 12:57:02PM +0100, Jan Rekorajski wrote:
>> Hi,
>> I was hit by a bug in linux 2.6.31 when XFS is not able to recover the
>> log after a crash if fs was mounted with quotas. Gory details in XFS
>> bugzilla: http://oss.sgi.com/bugzilla/show_bug.cgi?id=855.
>>
>> It looks like wrong struct is used in buffer length check, and the following
>> patch should fix the problem.
>>
>> xfs_dqblk_t has a size of 104+32 bytes, while xfs_disk_dquot_t is 104 bytes
>> long, and this is exactly what I see in system logs - "XFS: dquot too small
>> (104) in xlog_recover_do_dquot_trans."
>
> Yikes, great brown paperbag bug. Indeed, as per
> xfs_qm_dquot_logitem_format() we only log the xfs_disk_dquot_t and not
> the full xfs_dqblk_t.
>
> Felix, can you try to get this to Linus before .32 as this is clearly a
^^^ Alex ;)
-Eric
> regression.
>
> I'll also put the writing of more quota testcases including testing the
> log recovery even higher on my todo list.
>
> Reviewed-by: Christoph Hellwig <hch@lst.de>
_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs
^ permalink raw reply [flat|nested] 4+ messages in thread
* RE: XFS bug in log recover with quota (bugzilla id 855)
2009-11-16 11:57 XFS bug in log recover with quota (bugzilla id 855) Jan Rekorajski
2009-11-16 13:08 ` Christoph Hellwig
@ 2009-11-16 15:55 ` Alex Elder
1 sibling, 0 replies; 4+ messages in thread
From: Alex Elder @ 2009-11-16 15:55 UTC (permalink / raw)
To: Jan Rekorajski, Christoph Hellwig; +Cc: xfs
Jan Rekorajski wrote:
> Hi,
> I was hit by a bug in linux 2.6.31 when XFS is not able to recover the
> log after a crash if fs was mounted with quotas. Gory details in XFS
> bugzilla: http://oss.sgi.com/bugzilla/show_bug.cgi?id=855.
The patch looks good. I'll try to get it to Linus today.
-Alex
> It looks like wrong struct is used in buffer length check, and the following
> patch should fix the problem.
>
> xfs_dqblk_t has a size of 104+32 bytes, while xfs_disk_dquot_t is 104 bytes
> long, and this is exactly what I see in system logs - "XFS: dquot too small
> (104) in xlog_recover_do_dquot_trans."
>
> --- linux-2.6.31.5/fs/xfs/xfs_log_recover.c.orig 2009-11-01 23:59:52.194846209 +0100
> +++ linux-2.6.31.5/fs/xfs/xfs_log_recover.c 2009-11-16 12:47:11.601490963 +0100
> @@ -1980,7 +1980,7 @@
> "XFS: NULL dquot in %s.", __func__);
> goto next;
> }
> - if (item->ri_buf[i].i_len < sizeof(xfs_dqblk_t)) {
> + if (item->ri_buf[i].i_len < sizeof(xfs_disk_dquot_t)) {
> cmn_err(CE_ALERT,
> "XFS: dquot too small (%d) in %s.",
> item->ri_buf[i].i_len, __func__);
> @@ -2636,7 +2636,7 @@
> "XFS: NULL dquot in %s.", __func__);
> return XFS_ERROR(EIO);
> }
> - if (item->ri_buf[1].i_len < sizeof(xfs_dqblk_t)) {
> + if (item->ri_buf[1].i_len < sizeof(xfs_disk_dquot_t)) {
> cmn_err(CE_ALERT,
> "XFS: dquot too small (%d) in %s.",
> item->ri_buf[1].i_len, __func__);
_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2009-11-16 15:54 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-11-16 11:57 XFS bug in log recover with quota (bugzilla id 855) Jan Rekorajski
2009-11-16 13:08 ` Christoph Hellwig
2009-11-16 14:29 ` Eric Sandeen
2009-11-16 15:55 ` Alex Elder
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox