Clang (22.1.8 on the host, 14.0.6 in the Debian VM) now builds the tree
warning-free with --enable-warnings, in-tree and out-of-tree, with -j, and
the full VM battery passes with CC=clang: 12/12. ASan/UBSan builds run the
real tool paths (mkfs, check, tune, resize, rollback save/restore/reject)
with halt_on_error and report zero errors. Documented in tests/vm/RESULTS.md;
the CI gained clang+warnings, out-of-tree and sanitizer jobs.
Fixes found by this work:
- reiserfscore/Makefile.am: reiserfs_err.c and reiserfs_err.h shared one
recipe. With -j, make runs the recipe once per stale target, so two
compile_et invocations race: one deletes reiserfs_err.c ("no input
files") while another job compiles it. Attached the recipe to
reiserfs_err.c only; reiserfs_err.h merely depends on it. Reproduced
with clang+ASan, stable across 5 clang / 3 asan / 3 gcc parallel builds.
- reiserfscore/Makefile.am: the rule read the source-local
reiserfs_err.et, so VPATH builds could not find it. Use $(srcdir)/.
make distcheck now passes.
- reiserfscore/reiserfslib.c: reiserfs_close() did fsync(fs->fs_dev) after
reiserfs_free() released fs -- a 4-byte heap-use-after-free, flagged
exactly at reiserfslib.c:406/407 by ASan (found by clang+ASan; gcc never
caught it because the freed heap usually still holds the old value).
Moved fsync before the free; reiserfs_flush() has already written
journal and dirty buffers at that point and free_buffers() never
writes, so the ordering preserves durability semantics.
- fsck/semantic_check.c, fsck/semantic_rebuild.c: three %K arguments passed
&tmp_deh->deh2_dir_id where a struct reiserfs_key * is expected. It
printed the right values only because deh2_dir_id sits at offset 4 and
the key is read from the pointer as if dir_id sat at offset 0. Build a
proper local key with set_key_dirid()/set_key_objectid() (the same
idiom debugreiserfs/scan.c already uses). Verified -Waddress-of-packed-
member (clang-only) is gone and output is unchanged.
- reiserfscore/hashes.c: four unreachable *(int *)0 = 0 stores (guarded by
len >= 16/12/8/4 tests that cannot hold after the while (len >= 16)
loop, len <= 15). Removed; clang's -Wnull-dereference goes quiet.
Behavior verified: keyed_hash/yura_hash/r5_hash outputs for 16 inputs
from 0 to 17 bytes are byte-identical before and after.
run_in_vm.sh: propagate CC into the guest, force a remount of /mnt/data
(the host rewrites the backing file under the guest), exclude generated
reiserfs_err.[ch] from the source tar. run_tests.sh: report which compiler
the battery actually used.
Build: add --enable-warnings (-Wall -Wextra); the tree is now warning-free
with it, so distributions can opt in without risking a surprise -Werror
breakage from a future compiler.
Real bugs fixed (each verified by a reproducer):
- lib/io.c: open_rollback_file() read 28 bytes into char[28] with no NUL
and then strcmp()'d it against a 28-character magic, reading one byte
past the array. The condition was also inverted, so a *valid* rollback
file was rejected -- but only sometimes: the missing NUL made the result
depend on stack garbage (verified: -O0 rejects, -O2 accepts). The whole
--save-rollback/--rollback-changes path was unreliable. Now the buffer is
sized for the terminator, zeroed, and the comparison is `!= 0`.
Verified end to end: save -> reopen -> restore reports "2 blocks
restored, 0 skipped"; a random file is rejected.
- reiserfscore/reiserfslib.c, reiserfscore/journal.c: asprintf() was
called with &fs->fs_file_name / &fs->fs_j_file_name, but those fields
are `char *`, not `char **`. Passing a `char **` where `char *` is
expected wrote through the wrong pointer -- silent memory corruption on
any allocation. Fixed by using the new checked helper.
- reiserfscore/node_formats.c: `code < 0` on an unsigned parameter was
dead code; the guard never fired.
- resize_reiserfs: missing `break` after -j made -j fall into -f, so
"-j dev" silently also forced the operation. Sign-compare on the
count_blocks() ternary and on count + blocks.
- lib/misc.c: strncat with bound == strlen(src) (equivalent to strcat) into
char[256] from a char[256] dirent name -- up to 261 bytes. Replaced with
snprintf plus an explicit fit check.
- lib/misc.c: die() used vsprintf into a fixed 1024-byte buffer.
- strncpy with bound == destination size (mkreiserfs, tune, progbar) never
terminated; replaced with snprintf.
Allocator: drop the homegrown magic-header allocator. It wrote "_mem_begin_"
/ "mem_end" through strcpy inside the allocation, kept the size in an
`int`, and its only safety check (checkmem) was never called -- every call
site is commented out. Replaced with a size_t header that is over-aligned
via max_align_t, so malloc alignment guarantees still hold. expandmem()
now takes the old size from the header instead of a caller-supplied value
that could disagree with it.
Warnings: annotate the deliberate fallthroughs (fsck pass cascade, unit
suffix parsing, percentage parsing), fix the remaining sign-compare and
missing-field-initializer sites, and compute addresses of packed members
via char* + offsetof instead of &member.
Portability: asm/types.h -> linux/types.h, malloc.h and sys/vfs.h dropped
from includes.h (nothing used them), sys/vfs.h -> sys/statfs.h for
statfs(2).
Version: reiserfsprogs.spec said 3.6.23 while configure.ac said 3.6.25.
Remove the dead `#if 0` main() from hashes.c.
Add .github/workflows/build.yml: gcc, clang, --enable-warnings and
--enable-io-failure-emulation, each followed by a format/check/inspect
smoke test on a real image.
Verified: ./autogen.sh && ./configure --enable-warnings && make is clean
from scratch (0 warnings, 51 compile/link steps). mkreiserfs, reiserfsck
--check, debugreiserfs -S, reiserfstune -l and a real resize_reiserfs
128M -> 256M all succeed, and fsck reports the resized image clean.
The autotools setup could not bootstrap with modern autoconf/libtool:
`autoreconf -fi` failed with "possibly undefined macro: AC_PROG_LIBTOOL",
and several other macros used here were removed or deprecated long ago.
configure.ac:
- AC_PROG_LIBTOOL -> LT_INIT (with AC_CONFIG_MACRO_DIRS/AC_CONFIG_AUX_DIR);
add AM_PROG_AR required by newer libtool/automake.
- AM_CONFIG_HEADER -> AC_CONFIG_HEADERS; AC_OUTPUT(files...) -> AC_OUTPUT
with an explicit AC_CONFIG_FILES list.
- AC_TRY_COMPILE -> AC_COMPILE_IFELSE; drop AC_HEADER_STDC,
AC_PROG_GCC_TRADITIONAL, AC_STRUCT_ST_RDEV, AC_C_CONST and AC_C_INLINE
(all obsolete or unconditionally available).
- Drop AC_FUNC_MEMCMP/STRFTIME/VPRINTF; the corresponding HAVE_* macros
were never referenced. Keep the register_printf_* check but test the
ac_cv_func_* names that AC_CHECK_FUNCS actually sets.
- Pin -std=gnu11 (the sources predate C99 and rely on implicit-int-era
behaviour that newer C standards reject) and fix the -Wuninitialized
probe, which never set its cache variable.
- off_t/blkcnt_t sizeof fallbacks 64 -> 8 (bytes, not bits).
reiserfscore.pc.in: substitute @PACKAGE_VERSION@; REISERFSPROGS_VERSION was
never defined, so the generated .pc always carried an empty Version.
lib/parse_time.c: define _GNU_SOURCE, not _XOPEN_SOURCE. The valueless
_XOPEN_SOURCE disables _DEFAULT_SOURCE, which hides loff_t in <sys/types.h>
and broke the build. Every other translation unit already uses _GNU_SOURCE.
reiserfscore/xattr.c: drop the unused <sys/acl.h> include; no libacl symbol
is used (the reiserfs_acl_* structs come from reiserfs_fs.h), and the header
is not a declared build dependency.
Add autogen.sh to regenerate the build system after a fresh clone, and
update .gitignore for the build-aux/m4 layout and generated artifacts.
Verified: ./autogen.sh && ./configure && make completes on gcc 16 /
automake 1.18 / autoconf 2.72. mkreiserfs, reiserfsck --check,
debugreiserfs -S and reiserfstune all run against a freshly formatted
64 MiB image.
We dump failure messages to the terminal regardless of whether the caller
wants them or not. This can be annoying when used as part of a general
tool that tests to see which file system is on a device by calling
its open routine.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
new_insert_key only makes any sense when it's associated with a
new_insert_ptr, which is initialized to NULL and changed to a
buffer_head when we also initialize new_insert_key. We can key off
of that to avoid the uninitialized warning.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
There are many cases where functions take pointers to keys, item heads,
paths, etc and don't modify them. Let's annotate them properly.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
There are many calls in which strings are passed as "char *" yet aren't
modified. This patch marks them const so callers can depend on it.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
This adds reiserfs_iterate_dir and reiserfs_iterate_file_data to
iterate over directories and file block/tail mapping.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
gcc with -Wall was complaining about defined but unused code. I've removed
the functions/variables that weren't used.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Initializing structures with little endian values requires a const
value. This means that the endian routines that are macro blocks
cause build failures.
This patch introduces constant_ macros that don't involve an
assignment. These can only be used with constant values or
unexpected results may occur.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
In order to use reiserfs functionality in external programs, we need to
make a shared library and includes available.
This converts both libmisc and libreiserfscore into shared libraries, and
links libmisc into libreiserfscore. We also export the includes and
a pkg-config file.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
By annotating structure members and other on-disk structures as little
endian, we can catch bugs more easily.
The code was already endian safe except for three minor spots:
1) The badblock list code was initializing its key in an endian-unsafe way.
2) Indirect block pointer sequence printing was treating cpu-order values
as little endian.
3) reiserfsck was trying to do endian switching on the lost+found key,
but it was before it was even initialized to anything, so we can
just remove that completely.
These issues were fixed as part of this commit.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
reiserfs_invalidate_buffer contains an argument to specify whether a block
should be freed after being invalidated. It is always passed as 1, so
let's just get rid of it.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
We open code buffer_info initialization all over the place. Let's
factor that out so we don't reproduce the code everywhere.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
This patch does a quick search and replace:
B_N_PITEM_HEAD() -> item_head()
B_N_PDELIM_KEY() -> internal_key()
B_N_PKEY() -> leaf_key()
B_N_PITEM() -> item_body()
And the item_head version:
B_I_PITEM() -> ih_item_body()
I_ENTRY_COUNT() -> ih_entry_count()
And the treepath variants:
get_ih() -> tp_item_head()
PATH_PITEM_HEAD() -> tp_item_head()
get_item() -> tp_item_body()
... which makes the code much easier on the eyes.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Over the years, the reiserfs kernel code has been gradually cleaned up
to be more readable. This patch does the same to the progs code.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
In order to convert reiserfscore into a externally-usable library,
we need to rename structures so they won't collide with other
namespaces.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
We have met a situation when reiserfsck segfaulted on one of our
partitions. I have performed a small research and the cause appeared
to be wrong detection of transaction count.
Our FS had only one journal transaction, however trans_count which was
passed to progbar_update() as maximum transaction value was detected
as (last_transaction - first_transaction) which in our case was 0.
Thus progbar_update() resulted in segmentation fault:
(gdb) bt
"Replaying journal", curr=1, max=0, dpynum=1) at progbar.c:80
Here is part of debugreiserfs -j output
Journal header (block #8210 of ./partition.bug):
j_last_flush_trans_id 0
j_first_unflushed_offset 0
j_mount_id 10
Device [0x0]
Magic [0x4f0a099e]
Size 8193 blocks (including 1 for journal header) (first block 18)
Max transaction length 1024 blocks
Max batch size 900 blocks
Max commit age 30
Mountid 10, transid 10, desc 18, length 2, commit 21
I successfully reproduced it on versions 3.6.21 (which we were using)
and 3.6.23 (which I believe is the latest).
Attaching patch. Let me know your opinion. If I am wrong, please
comment, if I am correct, feel free to include patch into sources.
Thanks.
Signed-off-by: Victor Leschuk <vleschuk@gmail.com>
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
register_printf_modifier is causing build warnings complaining that
it is deprecated. This patch adds support for register_printf_specifier
and uses it if it's present. Otherwise, it will fall back to
register_printf_modifier.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
This patch fixes the following warning:
prints.c:403:20: warning: ‘num’ may be used uninitialized in this function [-Wmaybe-uninitialized]
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
This patch fixes the following warnings:
pointer targets in passing argument 5 of ‘reiserfs_bin_search’ differ in signedness [-Wpointer-sign]
pointer targets in passing argument 2 of ‘init_rollback_file’ differ in signedness [-Wpointer-sign]
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
This patch fixes:
main.c:968:11: warning: format ‘%u’ expects argument of type ‘unsigned int’, but argument 3 has type ‘time_t’ [-Wformat]
prints.c:152:7: warning: format ‘%lu’ expects argument of type ‘long unsigned int’, but argument 3 has type ‘__u32’ [-Wformat]
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
These files change every time configure.in or Makefile.am is changed,
we can autogenerate them when exporting a tarball.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Now that we handle file systems > 8 TB, we end up printing large negative
numbers instead of actual block numbers. This patch fixes those places
to use unsigned ints for block numbers.
Signed-by: Jeff Mahoney <jeffm@suse.com>
lgcosta
Jeff Mahoney
Jeff Mahoney
Victor Leschuck