[PATCH 4/4] xfs_repair: fix left-shift overflows

Eric Sandeen
2015-10-09T00:27:25Z

pmask in struct parent_list is a __uint64_t, but in some places
we populated it with "1LL << shift" where shift could be up
to 63; this really needs to be a 1ULL type for this to be correct.

Also spotted by libubsan...

The code in prefetch.c has another issue with large fs blocks
(32 or 64k) because it shifts by up to 128 bits, but that's left
for later...

Signed-off-by: Eric Sandeen <sandeen@redhat.com>
---
repair/incore_ino.c | 14 +++++++-------
repair/prefetch.c | 2 +-
2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/repair/incore_ino.c b/repair/incore_ino.c
index 32d7678..1898257 100644
--- a/repair/incore_ino.c
+++ b/repair/incore_ino.c
@@ -625,7 +625,7 @@ set_inode_parent(
else
irec->ino_un.plist = ptbl;

- ptbl->pmask = 1LL << offset;
+ ptbl->pmask = 1ULL << offset;
ptbl->pentries = (xfs_ino_t*)memalign(sizeof(xfs_ino_t),
sizeof(xfs_ino_t));
if (!ptbl->pentries)
@@ -638,8 +638,8 @@ set_inode_parent(
return;
}

- if (ptbl->pmask & (1LL << offset)) {
- bitmask = 1LL;
+ if (ptbl->pmask & (1ULL << offset)) {
+ bitmask = 1ULL;
target = 0;

for (i = 0; i < offset; i++) {
@@ -655,7 +655,7 @@ set_inode_parent(
return;
}

- bitmask = 1LL;
+ bitmask = 1ULL;
cnt = target = 0;

for (i = 0; i < XFS_INODES_PER_CHUNK; i++) {
@@ -691,7 +691,7 @@ set_inode_parent(
ptbl->cnt++;
#endif
ptbl->pentries[target] = parent;
- ptbl->pmask |= (1LL << offset);
+ ptbl->pmask |= (1ULL << offset);
}

xfs_ino_t
@@ -707,8 +707,8 @@ get_inode_parent(ino_tree_node_t *irec, int offset)
else
ptbl = irec->ino_un.plist;

- if (ptbl->pmask & (1LL << offset)) {
- bitmask = 1LL;
+ if (ptbl->pmask & (1ULL << offset)) {
+ bitmask = 1ULL;
target = 0;

for (i = 0; i < offset; i++) {
diff --git a/repair/prefetch.c b/repair/prefetch.c
index 52238ca..b11dcb3 100644
--- a/repair/prefetch.c
+++ b/repair/prefetch.c
@@ -762,7 +762,7 @@ pf_queuing_worker(
* sparse state in cluster sized chunks as cluster size
* is the min. granularity of sparse irec regions.
*/
- if ((sparse & ((1 << inodes_per_cluster) - 1)) == 0)
+ if ((sparse & ((1ULL << inodes_per_cluster) - 1)) == 0)
pf_queue_io(args, &map, 1,
(cur_irec->ino_isa_dir != 0) ?
B_DIR_INODE : B_INODE);
--
1.7.1