Re: kernel oops: trying to mount a corrupted xfs partition (2.6.16-rc3)

[Nathan Scott <nathans@sgi.com>]

On Mon, Feb 20, 2006 at 02:09:16AM -0500, Sonny Rao wrote:
> On Sun, Feb 19, 2006 at 04:52:09PM -0500, Dave Jones wrote:
> <snip> 
> > Just for kicks, I just hacked this up..
> > 
> > #!/bin/bash
> > wget http://www.digitaldwarf.be/products/mangle.c
> > gcc mangle.c -o mangle
> > 
> > dd if=/dev/zero of=data.img count=70000
> > 
> > while [ 1 ];
> > do
> >         mkfs.xfs -f data.img >/dev/null
> > 		./mangle data.img $RANDOM
> >         sudo mount -t xfs data.img mntpt -o loop
> >         sudo ls -R mntpt
> >         sudo umount mntpt
> > done
> ...
> > 
> > xfs wins the award for 'noisiest fs in the face of corruption' :-)
> > After a few dozen backtraces from xfs_corruption_error,
> > this fell out...
> > 
> > divide error: 0000 [1] SMP
> <snip trace>
>  
> > (The kernel is based on 2.6.16rc4)
> 
> I see a similar breakage (divide error) on x86 using 2.6.15

>From a quick look at the image you sent me Sonny, I guess this is
the same problem Dave was seeing too -- a divide by zero when we're
working out some of the per-mount constants during mount(2).  There
is probably one or two other superblock fields that could use more
verification, but this will do for now.

cheers.

-- 
Nathan


Index: xfs-linux/xfs_mount.c
===================================================================
--- xfs-linux.orig/xfs_mount.c
+++ xfs-linux/xfs_mount.c
@@ -268,9 +268,12 @@ xfs_mount_validate_sb(
 	    sbp->sb_blocklog > XFS_MAX_BLOCKSIZE_LOG			||
 	    sbp->sb_inodesize < XFS_DINODE_MIN_SIZE			||
 	    sbp->sb_inodesize > XFS_DINODE_MAX_SIZE			||
+	    sbp->sb_inodelog < XFS_DINODE_MIN_LOG			||
+	    sbp->sb_inodelog > XFS_DINODE_MAX_LOG			||
+	    (sbp->sb_blocklog - sbp->sb_inodelog != sbp->sb_inopblog)	||
 	    (sbp->sb_rextsize * sbp->sb_blocksize > XFS_MAX_RTEXTSIZE)	||
 	    (sbp->sb_rextsize * sbp->sb_blocksize < XFS_MIN_RTEXTSIZE)	||
-	    sbp->sb_imax_pct > 100)) {
+	    (sbp->sb_imax_pct > 100 || sbp->sb_imax_pct < 1))) {
 		cmn_err(CE_WARN, "XFS: SB sanity check 1 failed");
 		XFS_CORRUPTION_ERROR("xfs_mount_validate_sb(3)",
 				     XFS_ERRLEVEL_LOW, mp, sbp);