Re: kern/60746: kernel diagnostic assertion "ino >= LFS_IFILE_INUM" failed: file "../../../../ufs/lfs/lfs_vfsops.c", line 1800

["Konrad Schroder via gnats" <gnats-admin%NetBSD.org@localhost>]

The following reply was made to PR kern/60746; it has been noted by GNATS.

From: Konrad Schroder <perseant%hhhh.org@localhost>
To: gnats-bugs%netbsd.org@localhost, clare%csel.org@localhost
Cc: 
Subject: Re: kern/60746: kernel diagnostic assertion "ino >= LFS_IFILE_INUM"
 failed: file "../../../../ufs/lfs/lfs_vfsops.c", line 1800
Date: Mon, 21 Sep 2026 16:27:57 -0700

 This is a multi-part message in MIME format.
 --------------S5OxQ1zD4Ww8Jw0oBfhZgK93
 Content-Type: text/plain; charset=UTF-8; format=flowed
 Content-Transfer-Encoding: 8bit
 
 On 9/19/2026 9:35 PM, Shinichi Doyashiki via gnats wrote:
 >   [  65.9236610] panic: kernel diagnostic assertion "(ino >= LFS_IFILE_INUM)" failed: file "../../../../ufs/lfs/lfs_kclean.c", line 619 nonpositive inum: 0 at offset 0x8bd (seg 34)
 
 Oh, I missed the obvious.  Those inode blocks are padded with zero and 
 should ignore the appearance of inode zero.  It will still panic, 
 however, at the FNFO with inode zero, which is more interesting.  Please 
 try this patch instead (also attached) and give me the dumplfs of that 
 segment:
 
 Index: sys/ufs/lfs/lfs_kclean.c
 ===================================================================
 RCS file: /cvsroot/src/sys/ufs/lfs/lfs_kclean.c,v
 retrieving revision 1.4
 diff -u -r1.4 lfs_kclean.c
 --- sys/ufs/lfs/lfs_kclean.c    5 Jan 2026 05:02:47 -0000  1.4
 +++ sys/ufs/lfs/lfs_kclean.c    21 Sep 2026 23:26:37 -0000
 @@ -616,9 +616,19 @@
  Â  Â  Â  Â  for (i = num; i-- > 0; ) {
  Â  Â  Â  Â  Â  Â  Â  Â  dip = DINO_IN_BLOCK(fs, dbp->b_data, i);
  Â  Â  Â  Â  Â  Â  Â  Â  ino = lfs_dino_getinumber(fs, dip);
 -Â  Â  Â  Â  Â  Â  Â  Â if (ino == LFS_IFILE_INUM) {
 +Â  Â  Â  Â  Â  Â  Â  Â if (ino == 0) {
 +Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â /* The last inode block is zero-padded. Ignore 
 this. */
 +Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â continue;
 +Â  Â  Â  Â  Â  Â  Â  Â } else if (ino == LFS_IFILE_INUM) {
  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  /* Check address against superblock */
  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  true_addr = lfs_sb_getidaddr(fs);
 +Â  Â  Â  Â  Â  Â  Â  Â } else if (ino >= LFS_MAXINO(fs)) {
 +Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â /*
 +Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  * An inode greater than we have must be from a
 +Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  * previous allocation that was not rolled forward.
 +Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  * For our purposes, it does not exist.
 +Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  */
 +Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â continue;
  Â  Â  Â  Â  Â  Â  Â  Â  } else {
                          /* Not ifile.  Check address against ifile. */
  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  LFS_IENTRY(ifp, fs, ino, ibp);
 @@ -655,6 +665,18 @@
  Â  Â  Â  Â  /* Get the inode and check its version. */
  Â  Â  Â  Â  ino = lfs_fi_getino(fs, fip);
  Â  Â  Â  Â  gen = lfs_fi_getversion(fs, fip);
 +
 +Â  Â  Â  Â KASSERTMSG((lfs_fi_getnblocks(fs, fip) > 0 && ino >= 
 LFS_IFILE_INUM),
 +Â  Â  Â  Â  Â  Â  Â  Â "bad FINFO count=%d inum=%lld at offset 0x%lx (seg %ld)\n",
 +Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â (int)lfs_fi_getnblocks(fs, fip),
 +Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â (long long)ino,
 +Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â (unsigned long)*offsetp,
 +Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â  Â (long)lfs_dtosn(fs, *offsetp));
 +
 +Â  Â  Â  Â /* We can safely ignore this; see comment in ino_func_checkempty. */
 +Â  Â  Â  Â if (ino >= LFS_MAXINO(fs))
 +Â  Â  Â  Â  Â  Â  Â  Â return 0;
 +
  Â  Â  Â  Â  error = VFS_VGET(fs->lfs_ivnode->v_mount, ino, 
 LK_EXCLUSIVE|LK_NOWAIT, &vp);
 
  Â  Â  Â  Â  /*
 
 I'm especially interested in the dumplfs output of the segment that has 
 the FINFO reporting a non-positive inode number.
 
 Thanks,
 
 -- 
 --
 Konrad Schroder
 perseant%hhhh.org@localhost
 
 --------------S5OxQ1zD4Ww8Jw0oBfhZgK93
 Content-Type: text/plain; charset=UTF-8; name="60746c.diff"
 Content-Disposition: attachment; filename="60746c.diff"
 Content-Transfer-Encoding: base64
 
 SW5kZXg6IHN5cy91ZnMvbGZzL2xmc19rY2xlYW4uYwo9PT09PT09PT09PT09PT09PT09PT09
 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09ClJDUyBmaWxl
 OiAvY3Zzcm9vdC9zcmMvc3lzL3Vmcy9sZnMvbGZzX2tjbGVhbi5jLHYKcmV0cmlldmluZyBy
 ZXZpc2lvbiAxLjQKZGlmZiAtdSAtcjEuNCBsZnNfa2NsZWFuLmMKLS0tIHN5cy91ZnMvbGZz
 L2xmc19rY2xlYW4uYwk1IEphbiAyMDI2IDA1OjAyOjQ3IC0wMDAwCTEuNAorKysgc3lzL3Vm
 cy9sZnMvbGZzX2tjbGVhbi5jCTIxIFNlcCAyMDI2IDIzOjI2OjM3IC0wMDAwCkBAIC02MTYs
 OSArNjE2LDE5IEBACiAJZm9yIChpID0gbnVtOyBpLS0gPiAwOyApIHsKIAkJZGlwID0gRElO
 T19JTl9CTE9DSyhmcywgZGJwLT5iX2RhdGEsIGkpOwogCQlpbm8gPSBsZnNfZGlub19nZXRp
 bnVtYmVyKGZzLCBkaXApOwotCQlpZiAoaW5vID09IExGU19JRklMRV9JTlVNKSB7CisJCWlm
 IChpbm8gPT0gMCkgeworCQkJLyogVGhlIGxhc3QgaW5vZGUgYmxvY2sgaXMgemVyby1wYWRk
 ZWQuIElnbm9yZSB0aGlzLiAqLworCQkJY29udGludWU7CisJCX0gZWxzZSBpZiAoaW5vID09
 IExGU19JRklMRV9JTlVNKSB7CiAJCQkvKiBDaGVjayBhZGRyZXNzIGFnYWluc3Qgc3VwZXJi
 bG9jayAqLwogCQkJdHJ1ZV9hZGRyID0gbGZzX3NiX2dldGlkYWRkcihmcyk7CisJCX0gZWxz
 ZSBpZiAoaW5vID49IExGU19NQVhJTk8oZnMpKSB7CisJCQkvKgorCQkJICogQW4gaW5vZGUg
 Z3JlYXRlciB0aGFuIHdlIGhhdmUgbXVzdCBiZSBmcm9tIGEKKwkJCSAqIHByZXZpb3VzIGFs
 bG9jYXRpb24gdGhhdCB3YXMgbm90IHJvbGxlZCBmb3J3YXJkLgorCQkJICogRm9yIG91ciBw
 dXJwb3NlcywgaXQgZG9lcyBub3QgZXhpc3QuCisJCQkgKi8KKwkJCWNvbnRpbnVlOwogCQl9
 IGVsc2UgewogCQkJLyogTm90IGlmaWxlLiAgQ2hlY2sgYWRkcmVzcyBhZ2FpbnN0IGlmaWxl
 LiAqLwogCQkJTEZTX0lFTlRSWShpZnAsIGZzLCBpbm8sIGlicCk7CkBAIC02NTUsNiArNjY1
 LDE4IEBACiAJLyogR2V0IHRoZSBpbm9kZSBhbmQgY2hlY2sgaXRzIHZlcnNpb24uICovCiAJ
 aW5vID0gbGZzX2ZpX2dldGlubyhmcywgZmlwKTsKIAlnZW4gPSBsZnNfZmlfZ2V0dmVyc2lv
 bihmcywgZmlwKTsKKworCUtBU1NFUlRNU0coKGxmc19maV9nZXRuYmxvY2tzKGZzLCBmaXAp
 ID4gMCAmJiBpbm8gPj0gTEZTX0lGSUxFX0lOVU0pLAorCQkiYmFkIEZJTkZPIGNvdW50PSVk
 IGludW09JWxsZCBhdCBvZmZzZXQgMHglbHggKHNlZyAlbGQpXG4iLAorCQkJKGludClsZnNf
 ZmlfZ2V0bmJsb2NrcyhmcywgZmlwKSwKKwkJCShsb25nIGxvbmcpaW5vLAorCQkJKHVuc2ln
 bmVkIGxvbmcpKm9mZnNldHAsCisJCQkobG9uZylsZnNfZHRvc24oZnMsICpvZmZzZXRwKSk7
 CisKKwkvKiBXZSBjYW4gc2FmZWx5IGlnbm9yZSB0aGlzOyBzZWUgY29tbWVudCBpbiBpbm9f
 ZnVuY19jaGVja2VtcHR5LiAqLworCWlmIChpbm8gPj0gTEZTX01BWElOTyhmcykpCisJCXJl
 dHVybiAwOworCiAJZXJyb3IgPSBWRlNfVkdFVChmcy0+bGZzX2l2bm9kZS0+dl9tb3VudCwg
 aW5vLCBMS19FWENMVVNJVkV8TEtfTk9XQUlULCAmdnApOwogCiAJLyoK
 
 --------------S5OxQ1zD4Ww8Jw0oBfhZgK93--