uninitialized journal data written in SU+J ?

From: <takehara.mikihito_at_jp.panasonic.com>
Date: Tue, 22 Apr 2014 16:21:43 +0900
Hello,


I'm testing UFS with SU+J. But it seems sometimes broken journal data has written.

In softdep_process_journal (ffs_softdep.c), there is a while code to build jsegrec and each entry.
But by my test, sometimes there is no entry then break this while code without building jsegrec.
If this happens, bp->b_data is not initialized but this bp is written, I think.

I checked this behavior by following patch.
============================================================================================
diff --git a/sys/ufs/ffs/ffs_softdep.c b/sys/ufs/ffs/ffs_softdep.c
index 585af50..2d4939c 100644
--- a/sys/ufs/ffs/ffs_softdep.c
+++ b/sys/ufs/ffs/ffs_softdep.c
_at__at_ -3421,6 +3421,15 _at__at_ softdep_process_journal(mp, needwk, flags)
                        data = bp->b_data + off;
                        cnt--;
                }
+
+#if 1
+               if (off == 0) {
+                       struct jsegrec *tmp = (struct jsegrec*)bp->b_data;
+                       if (tmp->jsr_seq != jseg->js_seq) {
+                               panic("test test");
+                       }
+               }
+#endif
                /*
                 * Write this one buffer and continue.
                 */
============================================================================================

If uninitialized data is "valid" by fsck suj, this may result filesystem corruption, I think.
I think it's better to clear b_data before using it.
Received on Tue Apr 22 2014 - 05:37:42 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:40:48 UTC