uninitialized journal data written in SU+J ?

[takehara . mikihito]

Hello,


I'm testing UFS with SU+J. But it seems sometimes broken journal data has 
written.

In softdep_process_journal (ffs_softdep.c), there is a while code to build 
jsegrec and each entry.
But by my test, sometimes there is no entry then break this while code without 
building jsegrec.
If this happens, bp-b_data is not initialized but this bp is written, I think.

I checked this behavior by following patch.

diff --git a/sys/ufs/ffs/ffs_softdep.c b/sys/ufs/ffs/ffs_softdep.c
index 585af50..2d4939c 100644
--- a/sys/ufs/ffs/ffs_softdep.c
+++ b/sys/ufs/ffs/ffs_softdep.c
@@ -3421,6 +3421,15 @@ softdep_process_journal(mp, needwk, flags)
data = bp-b_data + off;
cnt--;
}
+
+#if 1
+   if (off == 0) {
+   struct jsegrec *tmp = (struct jsegrec*)bp-b_data;
+   if (tmp-jsr_seq != jseg-js_seq) {
+   panic(test test);
+   }
+   }
+#endif
/*
 * Write this one buffer and continue.
 */


If uninitialized data is valid by fsck suj, this may result filesystem 
corruption, I think.
I think it's better to clear b_data before using it.

___
freebsd-current@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-current
To unsubscribe, send any mail to freebsd-current-unsubscr...@freebsd.org

UFS SU+J bug? (Re: uninitialized journal data written in SU+J ?)

[Kohji Okuno]

Hi,

If you use UFS SU+J, could you check your `.sujournal'?
(For example: strings .sujournal)
You will find memory that already has been released.

In addition, unfotunately, if the memory was used for journal is
re-used, although the journal is incorrect, fsck will missunderstand it.

What do you think about this?

Regards,
 Kohji Okuno

From: takehara.mikih...@jp.panasonic.com
Subject: uninitialized journal data written in SU+J ?
Date: Tue, 22 Apr 2014 16:21:43 +0900
 Hello,
 
 
 I'm testing UFS with SU+J. But it seems sometimes broken journal data has 
 written.
 
 In softdep_process_journal (ffs_softdep.c), there is a while code to build 
 jsegrec and each entry.
 But by my test, sometimes there is no entry then break this while code 
 without building jsegrec.
 If this happens, bp-b_data is not initialized but this bp is written, I 
 think.
 
 I checked this behavior by following patch.
 
 diff --git a/sys/ufs/ffs/ffs_softdep.c b/sys/ufs/ffs/ffs_softdep.c
 index 585af50..2d4939c 100644
 --- a/sys/ufs/ffs/ffs_softdep.c
 +++ b/sys/ufs/ffs/ffs_softdep.c
 @@ -3421,6 +3421,15 @@ softdep_process_journal(mp, needwk, flags)
 data = bp-b_data + off;
 cnt--;
 }
 +
 +#if 1
 +   if (off == 0) {
 +   struct jsegrec *tmp = (struct jsegrec*)bp-b_data;
 +   if (tmp-jsr_seq != jseg-js_seq) {
 +   panic(test test);
 +   }
 +   }
 +#endif
 /*
  * Write this one buffer and continue.
  */
 
 
 If uninitialized data is valid by fsck suj, this may result filesystem 
 corruption, I think.
 I think it's better to clear b_data before using it.
 
 ___
 freebsd-current@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/freebsd-current
 To unsubscribe, send any mail to freebsd-current-unsubscr...@freebsd.org
___
freebsd-current@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-current
To unsubscribe, send any mail to freebsd-current-unsubscr...@freebsd.org