Clang (22.1.8 on the host, 14.0.6 in the Debian VM) now builds the tree
warning-free with --enable-warnings, in-tree and out-of-tree, with -j, and
the full VM battery passes with CC=clang: 12/12. ASan/UBSan builds run the
real tool paths (mkfs, check, tune, resize, rollback save/restore/reject)
with halt_on_error and report zero errors. Documented in tests/vm/RESULTS.md;
the CI gained clang+warnings, out-of-tree and sanitizer jobs.
Fixes found by this work:
- reiserfscore/Makefile.am: reiserfs_err.c and reiserfs_err.h shared one
recipe. With -j, make runs the recipe once per stale target, so two
compile_et invocations race: one deletes reiserfs_err.c ("no input
files") while another job compiles it. Attached the recipe to
reiserfs_err.c only; reiserfs_err.h merely depends on it. Reproduced
with clang+ASan, stable across 5 clang / 3 asan / 3 gcc parallel builds.
- reiserfscore/Makefile.am: the rule read the source-local
reiserfs_err.et, so VPATH builds could not find it. Use $(srcdir)/.
make distcheck now passes.
- reiserfscore/reiserfslib.c: reiserfs_close() did fsync(fs->fs_dev) after
reiserfs_free() released fs -- a 4-byte heap-use-after-free, flagged
exactly at reiserfslib.c:406/407 by ASan (found by clang+ASan; gcc never
caught it because the freed heap usually still holds the old value).
Moved fsync before the free; reiserfs_flush() has already written
journal and dirty buffers at that point and free_buffers() never
writes, so the ordering preserves durability semantics.
- fsck/semantic_check.c, fsck/semantic_rebuild.c: three %K arguments passed
&tmp_deh->deh2_dir_id where a struct reiserfs_key * is expected. It
printed the right values only because deh2_dir_id sits at offset 4 and
the key is read from the pointer as if dir_id sat at offset 0. Build a
proper local key with set_key_dirid()/set_key_objectid() (the same
idiom debugreiserfs/scan.c already uses). Verified -Waddress-of-packed-
member (clang-only) is gone and output is unchanged.
- reiserfscore/hashes.c: four unreachable *(int *)0 = 0 stores (guarded by
len >= 16/12/8/4 tests that cannot hold after the while (len >= 16)
loop, len <= 15). Removed; clang's -Wnull-dereference goes quiet.
Behavior verified: keyed_hash/yura_hash/r5_hash outputs for 16 inputs
from 0 to 17 bytes are byte-identical before and after.
run_in_vm.sh: propagate CC into the guest, force a remount of /mnt/data
(the host rewrites the backing file under the guest), exclude generated
reiserfs_err.[ch] from the source tar. run_tests.sh: report which compiler
the battery actually used.
Build: add --enable-warnings (-Wall -Wextra); the tree is now warning-free
with it, so distributions can opt in without risking a surprise -Werror
breakage from a future compiler.
Real bugs fixed (each verified by a reproducer):
- lib/io.c: open_rollback_file() read 28 bytes into char[28] with no NUL
and then strcmp()'d it against a 28-character magic, reading one byte
past the array. The condition was also inverted, so a *valid* rollback
file was rejected -- but only sometimes: the missing NUL made the result
depend on stack garbage (verified: -O0 rejects, -O2 accepts). The whole
--save-rollback/--rollback-changes path was unreliable. Now the buffer is
sized for the terminator, zeroed, and the comparison is `!= 0`.
Verified end to end: save -> reopen -> restore reports "2 blocks
restored, 0 skipped"; a random file is rejected.
- reiserfscore/reiserfslib.c, reiserfscore/journal.c: asprintf() was
called with &fs->fs_file_name / &fs->fs_j_file_name, but those fields
are `char *`, not `char **`. Passing a `char **` where `char *` is
expected wrote through the wrong pointer -- silent memory corruption on
any allocation. Fixed by using the new checked helper.
- reiserfscore/node_formats.c: `code < 0` on an unsigned parameter was
dead code; the guard never fired.
- resize_reiserfs: missing `break` after -j made -j fall into -f, so
"-j dev" silently also forced the operation. Sign-compare on the
count_blocks() ternary and on count + blocks.
- lib/misc.c: strncat with bound == strlen(src) (equivalent to strcat) into
char[256] from a char[256] dirent name -- up to 261 bytes. Replaced with
snprintf plus an explicit fit check.
- lib/misc.c: die() used vsprintf into a fixed 1024-byte buffer.
- strncpy with bound == destination size (mkreiserfs, tune, progbar) never
terminated; replaced with snprintf.
Allocator: drop the homegrown magic-header allocator. It wrote "_mem_begin_"
/ "mem_end" through strcpy inside the allocation, kept the size in an
`int`, and its only safety check (checkmem) was never called -- every call
site is commented out. Replaced with a size_t header that is over-aligned
via max_align_t, so malloc alignment guarantees still hold. expandmem()
now takes the old size from the header instead of a caller-supplied value
that could disagree with it.
Warnings: annotate the deliberate fallthroughs (fsck pass cascade, unit
suffix parsing, percentage parsing), fix the remaining sign-compare and
missing-field-initializer sites, and compute addresses of packed members
via char* + offsetof instead of &member.
Portability: asm/types.h -> linux/types.h, malloc.h and sys/vfs.h dropped
from includes.h (nothing used them), sys/vfs.h -> sys/statfs.h for
statfs(2).
Version: reiserfsprogs.spec said 3.6.23 while configure.ac said 3.6.25.
Remove the dead `#if 0` main() from hashes.c.
Add .github/workflows/build.yml: gcc, clang, --enable-warnings and
--enable-io-failure-emulation, each followed by a format/check/inspect
smoke test on a real image.
Verified: ./autogen.sh && ./configure --enable-warnings && make is clean
from scratch (0 warnings, 51 compile/link steps). mkreiserfs, reiserfsck
--check, debugreiserfs -S, reiserfstune -l and a real resize_reiserfs
128M -> 256M all succeed, and fsck reports the resized image clean.
Over the years, the reiserfs kernel code has been gradually cleaned up
to be more readable. This patch does the same to the progs code.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
lgcosta
Jeff Mahoney