NetBSD-Bugs archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: kern/60746: kernel diagnostic assertion "ino >= LFS_IFILE_INUM" failed: file "../../../../ufs/lfs/lfs_vfsops.c", line 1800

The following reply was made to PR kern/60746; it has been noted by GNATS.

From: Konrad Schroder <perseant%hhhh.org@localhost>
To: Shinichi Doyashiki <clare%csel.org@localhost>, gnats-bugs%NetBSD.org@localhost
Cc: 
Subject: Re: kern/60746: kernel diagnostic assertion "ino >= LFS_IFILE_INUM"
 failed: file "../../../../ufs/lfs/lfs_vfsops.c", line 1800
Date: Tue, 22 Sep 2026 12:51:21 -0700

 This is a multi-part message in MIME format.
 --------------u0HeqkxN6fjAV2Zf7RhI059f
 Content-Type: text/plain; charset=UTF-8; format=flowed
 Content-Transfer-Encoding: 8bit
 
 Thank you for the disk image, that made debugging this much easier.  
 There were two bugs: the loop through partial-segments wasn't 
 terminating when it encountered a live block, so it appeared to the next 
 iteration that there were more FINFOs to go when in fact there were 
 not.  Also, lfs_checkempty() was not bounds-checking correctly, so it 
 was not checking only the segment in question but every segment written 
 after that ... some of which were bound to have live blocks in them.
 
 Please try this patch (also attached) which addresses both issues.
 
 Index: sys/ufs/lfs/lfs_kclean.c
 ===================================================================
 RCS file: /cvsroot/src/sys/ufs/lfs/lfs_kclean.c,v
 retrieving revision 1.4
 diff -u -r1.4 lfs_kclean.c
 --- sys/ufs/lfs/lfs_kclean.c    5 Jan 2026 05:02:47 -0000  1.4
 +++ sys/ufs/lfs/lfs_kclean.c    22 Sep 2026 19:27:51 -0000
 @@ -616,9 +618,19 @@
          for (i = num; i-- > 0; ) {
                  dip = DINO_IN_BLOCK(fs, dbp->b_data, i);
                  ino = lfs_dino_getinumber(fs, dip);
 -               if (ino == LFS_IFILE_INUM) {
 +               if (ino == 0) {
 +                       /* The last inode block is zero-padded. Ignore 
 this. */
 +                       continue;
 +               } else if (ino == LFS_IFILE_INUM) {
                          /* Check address against superblock */
                          true_addr = lfs_sb_getidaddr(fs);
 +               } else if (ino >= LFS_MAXINO(fs)) {
 +                       /*
 +                        * An inode greater than we have must be from a
 +                        * previous allocation that was not rolled forward.
 +                        * For our purposes, it does not exist.
 +                        */
 +                       continue;
                  } else {
                          /* Not ifile.  Check address against ifile. */
                          LFS_IENTRY(ifp, fs, ino, ibp);
 @@ -655,6 +667,18 @@
          /* Get the inode and check its version. */
          ino = lfs_fi_getino(fs, fip);
          gen = lfs_fi_getversion(fs, fip);
 +
 +       KASSERTMSG((lfs_fi_getnblocks(fs, fip) > 0 && ino >= 
 LFS_IFILE_INUM),
 +               "bad FINFO count=%d inum=%lld at offset 0x%lx (seg %ld)\n",
 +                       (int)lfs_fi_getnblocks(fs, fip),
 +                       (long long)ino,
 +                       (unsigned long)*offsetp,
 +                       (long)lfs_dtosn(fs, *offsetp));
 +
 +       /* We can safely ignore this; see comment in ino_func_checkempty. */
 +       if (ino >= LFS_MAXINO(fs))
 +               return 0;
 +
          error = VFS_VGET(fs->lfs_ivnode->v_mount, ino, 
 LK_EXCLUSIVE|LK_NOWAIT, &vp);
 
          /*
 @@ -713,16 +749,16 @@
   int
   lfs_checkempty(struct lfs *fs, int sn, kauth_cred_t cred, struct lwp *l)
   {
 -       daddr_t offset, endpseg;
 +       daddr_t offset, ooffset, endpseg;
          int error;
 
          ASSERT_SEGLOCK(fs);
 
 -       offset = lfs_sntod(fs, sn);
 +       offset = ooffset = lfs_sntod(fs, sn);
          lfs_skip_superblock(fs, &offset);
          endpseg = lfs_sntod(fs, sn + 1);
 
 -       while (offset > 0 && offset < endpseg) {
 +       while (offset >= ooffset && offset < endpseg) {
                  error = lfs_parse_pseg(fs, &offset, 0, cred, NULL, l,
                                       ino_func_checkempty,
                                       finfo_func_checkempty,
 Index: sys/ufs/lfs/lfs_rfw.c
 ===================================================================
 RCS file: /cvsroot/src/sys/ufs/lfs/lfs_rfw.c,v
 retrieving revision 1.46
 diff -u -r1.46 lfs_rfw.c
 --- sys/ufs/lfs/lfs_rfw.c       19 Sep 2026 18:25:11 -0000 1.46
 +++ sys/ufs/lfs/lfs_rfw.c       22 Sep 2026 19:27:51 -0000
 @@ -840,7 +844,11 @@
                  } else if (finfo_func != NULL) {
                          lffa.offsetp = &offset;
                          lffa.finfop = fip;
 -                       (*finfo_func)(&lffa);
 +                       error = (*finfo_func)(&lffa);
 +                       if (error == ESTALE)
 +                               error = 0;
 +                       if (error)
 +                               goto err;
                  } else {
                          int n = lfs_fi_getnblocks(fs, fip);
                          size = lfs_fi_getlastlength(fs, fip);
 @@ -900,7 +912,7 @@
          free(buf, M_SEGMENT);
 
          *offsetp = offset;
 -       return 0;
 +       return error;
   }
 
   /*
 
 Thanks,
 
 --
 Konrad Schroder
 perseant%hhhh.org@localhost
 
 --------------u0HeqkxN6fjAV2Zf7RhI059f
 Content-Type: text/plain; charset=UTF-8; name="60746e.diff"
 Content-Disposition: attachment; filename="60746e.diff"
 Content-Transfer-Encoding: base64
 
 SW5kZXg6IHN5cy91ZnMvbGZzL2xmc19rY2xlYW4uYwo9PT09PT09PT09PT09PT09PT09PT09
 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09ClJDUyBmaWxl
 OiAvY3Zzcm9vdC9zcmMvc3lzL3Vmcy9sZnMvbGZzX2tjbGVhbi5jLHYKcmV0cmlldmluZyBy
 ZXZpc2lvbiAxLjQKZGlmZiAtdSAtcjEuNCBsZnNfa2NsZWFuLmMKLS0tIHN5cy91ZnMvbGZz
 L2xmc19rY2xlYW4uYwk1IEphbiAyMDI2IDA1OjAyOjQ3IC0wMDAwCTEuNAorKysgc3lzL3Vm
 cy9sZnMvbGZzX2tjbGVhbi5jCTIyIFNlcCAyMDI2IDE5OjI3OjUxIC0wMDAwCkBAIC02MTYs
 OSArNjE4LDE5IEBACiAJZm9yIChpID0gbnVtOyBpLS0gPiAwOyApIHsKIAkJZGlwID0gRElO
 T19JTl9CTE9DSyhmcywgZGJwLT5iX2RhdGEsIGkpOwogCQlpbm8gPSBsZnNfZGlub19nZXRp
 bnVtYmVyKGZzLCBkaXApOwotCQlpZiAoaW5vID09IExGU19JRklMRV9JTlVNKSB7CisJCWlm
 IChpbm8gPT0gMCkgeworCQkJLyogVGhlIGxhc3QgaW5vZGUgYmxvY2sgaXMgemVyby1wYWRk
 ZWQuIElnbm9yZSB0aGlzLiAqLworCQkJY29udGludWU7CisJCX0gZWxzZSBpZiAoaW5vID09
 IExGU19JRklMRV9JTlVNKSB7CiAJCQkvKiBDaGVjayBhZGRyZXNzIGFnYWluc3Qgc3VwZXJi
 bG9jayAqLwogCQkJdHJ1ZV9hZGRyID0gbGZzX3NiX2dldGlkYWRkcihmcyk7CisJCX0gZWxz
 ZSBpZiAoaW5vID49IExGU19NQVhJTk8oZnMpKSB7CisJCQkvKgorCQkJICogQW4gaW5vZGUg
 Z3JlYXRlciB0aGFuIHdlIGhhdmUgbXVzdCBiZSBmcm9tIGEKKwkJCSAqIHByZXZpb3VzIGFs
 bG9jYXRpb24gdGhhdCB3YXMgbm90IHJvbGxlZCBmb3J3YXJkLgorCQkJICogRm9yIG91ciBw
 dXJwb3NlcywgaXQgZG9lcyBub3QgZXhpc3QuCisJCQkgKi8KKwkJCWNvbnRpbnVlOwogCQl9
 IGVsc2UgewogCQkJLyogTm90IGlmaWxlLiAgQ2hlY2sgYWRkcmVzcyBhZ2FpbnN0IGlmaWxl
 LiAqLwogCQkJTEZTX0lFTlRSWShpZnAsIGZzLCBpbm8sIGlicCk7CkBAIC02NTUsNiArNjY3
 LDE4IEBACiAJLyogR2V0IHRoZSBpbm9kZSBhbmQgY2hlY2sgaXRzIHZlcnNpb24uICovCiAJ
 aW5vID0gbGZzX2ZpX2dldGlubyhmcywgZmlwKTsKIAlnZW4gPSBsZnNfZmlfZ2V0dmVyc2lv
 bihmcywgZmlwKTsKKworCUtBU1NFUlRNU0coKGxmc19maV9nZXRuYmxvY2tzKGZzLCBmaXAp
 ID4gMCAmJiBpbm8gPj0gTEZTX0lGSUxFX0lOVU0pLAorCQkiYmFkIEZJTkZPIGNvdW50PSVk
 IGludW09JWxsZCBhdCBvZmZzZXQgMHglbHggKHNlZyAlbGQpXG4iLAorCQkJKGludClsZnNf
 ZmlfZ2V0bmJsb2NrcyhmcywgZmlwKSwKKwkJCShsb25nIGxvbmcpaW5vLAorCQkJKHVuc2ln
 bmVkIGxvbmcpKm9mZnNldHAsCisJCQkobG9uZylsZnNfZHRvc24oZnMsICpvZmZzZXRwKSk7
 CisKKwkvKiBXZSBjYW4gc2FmZWx5IGlnbm9yZSB0aGlzOyBzZWUgY29tbWVudCBpbiBpbm9f
 ZnVuY19jaGVja2VtcHR5LiAqLworCWlmIChpbm8gPj0gTEZTX01BWElOTyhmcykpCisJCXJl
 dHVybiAwOworCiAJZXJyb3IgPSBWRlNfVkdFVChmcy0+bGZzX2l2bm9kZS0+dl9tb3VudCwg
 aW5vLCBMS19FWENMVVNJVkV8TEtfTk9XQUlULCAmdnApOwogCiAJLyoKQEAgLTcxMywxNiAr
 NzQ5LDE2IEBACiBpbnQKIGxmc19jaGVja2VtcHR5KHN0cnVjdCBsZnMgKmZzLCBpbnQgc24s
 IGthdXRoX2NyZWRfdCBjcmVkLCBzdHJ1Y3QgbHdwICpsKQogewotCWRhZGRyX3Qgb2Zmc2V0
 LCBlbmRwc2VnOworCWRhZGRyX3Qgb2Zmc2V0LCBvb2Zmc2V0LCBlbmRwc2VnOwogCWludCBl
 cnJvcjsKIAogCUFTU0VSVF9TRUdMT0NLKGZzKTsKIAotCW9mZnNldCA9IGxmc19zbnRvZChm
 cywgc24pOworCW9mZnNldCA9IG9vZmZzZXQgPSBsZnNfc250b2QoZnMsIHNuKTsKIAlsZnNf
 c2tpcF9zdXBlcmJsb2NrKGZzLCAmb2Zmc2V0KTsKIAllbmRwc2VnID0gbGZzX3NudG9kKGZz
 LCBzbiArIDEpOwogCQotCXdoaWxlIChvZmZzZXQgPiAwICYmIG9mZnNldCA8IGVuZHBzZWcp
 IHsKKwl3aGlsZSAob2Zmc2V0ID49IG9vZmZzZXQgJiYgb2Zmc2V0IDwgZW5kcHNlZykgewog
 CQllcnJvciA9IGxmc19wYXJzZV9wc2VnKGZzLCAmb2Zmc2V0LCAwLCBjcmVkLCBOVUxMLCBs
 LAogCQkJCSAgICAgaW5vX2Z1bmNfY2hlY2tlbXB0eSwKIAkJCQkgICAgIGZpbmZvX2Z1bmNf
 Y2hlY2tlbXB0eSwKSW5kZXg6IHN5cy91ZnMvbGZzL2xmc19yZncuYwo9PT09PT09PT09PT09
 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
 ClJDUyBmaWxlOiAvY3Zzcm9vdC9zcmMvc3lzL3Vmcy9sZnMvbGZzX3Jmdy5jLHYKcmV0cmll
 dmluZyByZXZpc2lvbiAxLjQ2CmRpZmYgLXUgLXIxLjQ2IGxmc19yZncuYwotLS0gc3lzL3Vm
 cy9sZnMvbGZzX3Jmdy5jCTE5IFNlcCAyMDI2IDE4OjI1OjExIC0wMDAwCTEuNDYKKysrIHN5
 cy91ZnMvbGZzL2xmc19yZncuYwkyMiBTZXAgMjAyNiAxOToyNzo1MSAtMDAwMApAQCAtODQw
 LDcgKzg0NCwxMSBAQAogCQl9IGVsc2UgaWYgKGZpbmZvX2Z1bmMgIT0gTlVMTCkgewogCQkJ
 bGZmYS5vZmZzZXRwID0gJm9mZnNldDsKIAkJCWxmZmEuZmluZm9wID0gZmlwOwotCQkJKCpm
 aW5mb19mdW5jKSgmbGZmYSk7CisJCQllcnJvciA9ICgqZmluZm9fZnVuYykoJmxmZmEpOwor
 CQkJaWYgKGVycm9yID09IEVTVEFMRSkKKwkJCQllcnJvciA9IDA7CisJCQlpZiAoZXJyb3Ip
 CisJCQkJZ290byBlcnI7CiAJCX0gZWxzZSB7CiAJCQlpbnQgbiA9IGxmc19maV9nZXRuYmxv
 Y2tzKGZzLCBmaXApOwogCQkJc2l6ZSA9IGxmc19maV9nZXRsYXN0bGVuZ3RoKGZzLCBmaXAp
 OwpAQCAtOTAwLDcgKzkxMiw3IEBACiAJZnJlZShidWYsIE1fU0VHTUVOVCk7CiAJCiAJKm9m
 ZnNldHAgPSBvZmZzZXQ7Ci0JcmV0dXJuIDA7CisJcmV0dXJuIGVycm9yOwogfQogCiAvKgo=
 
 
 --------------u0HeqkxN6fjAV2Zf7RhI059f--
Home | Main Index | Thread Index | Old Index