Oops in xfs_dir2_block_lookup_int from storage corruption [2.6.33]

[Christoph Hellwig]

On Sun, Apr 04, 2010 at 01:16:57AM -0700, Simon Kirby wrote:
>         /*
>          * Loop doing a binary search for our hash value.
>          * Find our entry, ENOENT if it's not there.
>          */
>         for (low = 0, high = be32_to_cpu(btp->count) - 1; ; ) {
>                 ASSERT(low <= high);
>                 mid = (low + high) >> 1;
> ======>         if ((hash = be32_to_cpu(blp[mid].hashval)) == args->hashval)
>                         break;
> 
> blp is 8 bytes which matches the multiplication of the array index in the
> instruction.  So, this means that blp[mid] pointed to 0xffff8800f674bf00,
> and mid was 0x0000000015c6535e.  That sounds kind of high...?

Yes. Looks like btp->count was corrupted.  It counts the number of
xfs_dir2_leaf_entry in the directory block, which is 16 bytes larger.
So with 4k directory blocks that you're using we could only pack 256
entries in one block, and that's already disconting the head and tail
headers we have in the block format.

I'll add some more error checking to the directory code when I get
time for it.