Seg fault during xfs repair (segmentation fault / segv)

[Eric Sandeen]

Eric Sandeen wrote:

> Ok, from a metadump image Jesse provided (thanks!) it's dying in here:
> 
>                 bno = be32_to_cpu(agfl->agfl_bno[i]);
>                 printf("agfl at %p i is %d agfl_bno[i] %u bno is %u\n",
> agfl, i, agfl->agfl_bno[i], bno);
>                 if (verify_agbno(mp, be32_to_cpu(agf->agf_seqno), bno))
>                         set_agbno_state(mp, be32_to_cpu(agf->agf_seqno),
>                                         bno, XR_E_FREE);
> 
> agfl_bno looks corrupt, and bno is coming out to be huge.
> 
> set_agbno_state() does:
> 
> *(ba_bmap[(agno)] + (ag_blockno)/XR_BB_NUM) = ....
> 
> where ag_blockno is that bno above; this wanders us off into bad memory
> and boom.  I'll see what we can do to fix it up.

Ok patch sent, but now I hit:

junking entry "soh " in directory inode 128
entry ".nsr" in shortform directory 128 references invalid inode 210397
junking entry ".nsr" in directory inode 128
bogus .. inode number (128) in directory inode 128, clearing inode number
xfs_repair: dir2.c:2123: process_dir2: Assertion `(ino !=
mp->m_sb.sb_rootino && ino != *parent) || (ino == mp->m_sb.sb_rootino &&
(ino == *parent || need_root_dotdot == 1))' failed.
Aborted

that's one crunchy filesystem you've got there; what happened to it?

-Eric