bin/50108: fsck_ffs fails replaying wapbl journal on filesystem with 4k sectors

[dudinea%gmail.com@localhost]

>Number:         50108
>Category:       bin
>Synopsis:       fsck_ffs fails replaying wapbl journal on filesystem with 4k sectors
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jul 31 21:55:00 +0000 2015
>Originator:     Eugene Doudine
>Release:        NetBSD 7.99.20
>Organization:
>Environment:
NetBSD nbsd1.trekflow.com 7.99.20 NetBSD 7.99.20 (GENERIC) #1: Wed Jul 29 09:54:29 IDT 2015  root%nbsd1.trekflow.com@localhost:/usr/obj/sys/arch/amd64/compile/GENERIC amd64


fsck_ffs ident:
     $NetBSD: crt0.S,v 1.3 2011/07/01 02:59:05 joerg Exp $
     $NetBSD: crt0-common.c,v 1.13 2013/01/31 22:24:25 matt Exp $
     $NetBSD: crti.S,v 1.1 2010/08/07 18:01:35 joerg Exp $
     $NetBSD: crtbegin.S,v 1.2 2010/11/30 18:37:59 joerg Exp $
     $NetBSD: dir.c,v 1.57 2013/06/23 07:28:36 dholland Exp $
     $NetBSD: inode.c,v 1.71 2014/04/05 12:32:27 justin Exp $
     $NetBSD: main.c,v 1.83 2015/06/16 23:58:30 christos Exp $
     $NetBSD: pass1.c,v 1.56 2013/10/19 01:09:58 christos Exp $
     $NetBSD: pass1b.c,v 1.23 2013/01/22 09:39:12 dholland Exp $
     $NetBSD: pass2.c,v 1.50 2013/06/09 17:57:09 dholland Exp $
     $NetBSD: pass3.c,v 1.21 2013/01/22 09:39:12 dholland Exp $
     $NetBSD: pass4.c,v 1.28 2013/06/23 22:03:34 dholland Exp $
     $NetBSD: pass5.c,v 1.54 2013/06/23 22:03:34 dholland Exp $
     $NetBSD: fsutil.c,v 1.26 2015/06/21 04:01:40 dholland Exp $
     $NetBSD: setup.c,v 1.100 2013/06/23 07:28:36 dholland Exp $
     $NetBSD: utilities.c,v 1.64 2013/10/19 01:09:58 christos Exp $
     $NetBSD: ffs_bswap.c,v 1.39 2015/05/20 18:21:17 riastradh Exp $
     $NetBSD: ffs_subr.c,v 1.48 2013/10/20 00:29:10 htodd Exp $
     $NetBSD: ffs_tables.c,v 1.9 2005/12/11 12:25:25 christos Exp $
     $NetBSD: ffs_appleufs.c,v 1.15 2015/02/15 11:04:43 maxv Exp $
     $NetBSD: partutil.c,v 1.15 2015/06/03 17:53:23 martin Exp $
     $NetBSD: quota2_subr.c,v 1.5 2012/02/05 14:19:04 dholland Exp $
     $NetBSD: progress.c,v 1.5 2009/04/11 06:48:36 lukem Exp $
     $NetBSD: vfs_wapbl.c,v 1.61 2014/10/18 08:33:29 snj Exp $
     $NetBSD: wapbl.c,v 1.5 2010/03/06 11:31:40 mlelstv Exp $
     $NetBSD: crtend.S,v 1.1 2010/08/07 18:01:34 joerg Exp $
     $NetBSD: crtn.S,v 1.1 2010/08/07 18:01:35 joerg Exp $

>Description:
When trying to run fsck on a FFS filesystem that has been created with 4k sectors, mounted with -o log and then not cleanly unmounted, 
fsck_ffs fails when it's replaying the journal and tries to write wrong blocks off the device end:

fsck_ffs  -d -d /dev/rvnd0a 
** /dev/rvnd0a
wapbl_replay_start: vp=0x0 off=91808 count=8192 blksize=4096
wapbl_read: 8192 bytes at block 91808 on fd 0x3
wapbl_replay: head=5332992 tail=5095424 off=8192 len=33546240 used=237568
wapbl_read: 4096 bytes at block 93052 on fd 0x3
wapbl_read: 4096 bytes at block 93108 on fd 0x3
wapbl_read: 4096 bytes at block 93109 on fd 0x3
** File system is journaled; replaying journal
wapbl_read: 4096 bytes at block 93092 on fd 0x3
wapbl_write: 4096 bytes at block 367616 on fd 0x4

CANNOT WRITE: BLK 367616
CONTINUE? [yn] n

Looks like it's trying to replay journal into blocks
that lie off the device ends. I suppose that it can
corrupt file system as well when wrong blocks to be written
lie within device boundaries.

Details of the device and filesystem above:

device created with:
vnconfig -c vnd0 ./diskimg.bin 4096/50/20/100

dumpfs -s /dev/rvnd0a:

file system: /dev/rvnd0a
format  FFSv1
endian  little-endian
magic   11954           time    Sun Jul 26 21:16:49 2015
superblock location     8192    id      [ 55b51630 27fdad44 ]
cylgrp  dynamic inodes  4.4BSD  sblock  FFSv2   fslevel 4
nbfree  11377   ndir    1       nifree  22522   nffree  11
ncg     4       size    91808   blocks  91031
bsize   32768   shift   15      mask    0xffff8000
fsize   4096    shift   12      mask    0xfffff000
frag    8       shift   3       fsbtodb 0
bpg     2869    fpg     22952   ipg     5632
minfree 5%      optim   time    maxcontig 2     maxbpg  8192
symlinklen 60   contigsumsize 2
maxfilesize 0x004002001005ffff
nindir  8192    inopb   256
avgfilesize 16384       avgfpdir 64
sblkno  8       cblkno  16      iblkno  24      dblkno  200
sbsize  4096    cgsize  8192
csaddr  200     cssize  4096
cgrotor 0       fmod    0       ronly   0       clean   0x02
wapbl version 0x1       location 1      flags 0x0
wapbl loc0 91808        loc1 8192       loc2 4096       loc3 0
flags   wapbl 
fsmnt   /mnt/test_fsck
volname         swuid   0

>How-To-Repeat:
Create an FFS filesystem on 4k system disk or with -S 4096 option

Mount with -o log

Crash

fsck /dev/{DEVNAME}

I've been able to reproduce problem on both real and vnode
devices. On the other hand kernel can replay journal 
on such filesystems without errors. 


>Fix: