svn commit: r325386 - head/sys/kern

[Bruce Evans]

On Sun, 5 Nov 2017, Konstantin Belousov wrote:

> On Sun, Nov 05, 2017 at 11:42:51AM -0700, Warner Losh wrote:
>> On Sun, Nov 5, 2017 at 11:32 AM, Conrad Meyer <cem at freebsd.org> wrote:
>>
>>> E.g.,
>>>
>>> --- a/sys/ufs/ffs/ffs_alloc.c
>>> +++ b/sys/ufs/ffs/ffs_alloc.c
>>> @@ -304,8 +304,7 @@ retry:
>>>         }
>>>
>>>         if (bp->b_blkno == bp->b_lblkno) {
>>> -               if (lbprev >= UFS_NDADDR)
>>> -                       panic("ffs_realloccg: lbprev out of range");
>>> +               ASSERT(lbprev < UFS_NDADDR, "ffs_realloccg: lbprev out
>>> of range");
>>>                 bp->b_blkno = fsbtodb(fs, bprev);
>>>         }
>>>
>>
>> Just a side point: All these should be programming errors. The bogus data

This certainly is a programming error.  It has 2 style bugs:
- it obfuscates a simple test and panic.  This is only 4 bytes shorter
- it misformats the new version using a long line.

>> that comes or could come from the FS itself should remain always-on panics.
>> Well, actually, they should transition from always-on panics to some sort
>> of degraded mount that would be more resilient in the face of such
>> corruption. But failing that, they should remain always-on panics :)
>
> This is what I said in my reply before the last.
>
> I still have no idea what is the point cem tries to express.

As described in other replies, it is to obfuscate panic() using a macro
in cases where the panic is not controlled by INVARIANTS.

> Nor I know what should the ASSERT() macro do in the kernel. If the
> patch above really about replacing panic() with _K_ASSERT, then I most
> likely agree with it, since the error catched is not due to the on-disk
> metadata corruption.

KASSERT() can be used in this case.

It is unclear which case applies.  lbprev is the second parameter and
it is unclear if it ever comes directly from the disk or has already
been checked by callers when it did.  The third parameter bprev often
does come directly from the disk.  A typical call is ffs_realloccg(
ip, nb, dp->db[nb], ...).  For this call, undefined behaviour has already
occurred if nb is out of bounds, so KASSERT() is good enough, but if nb
is really insane then the KASSERT() is unreachale since the invalid array
access already paniced.

Bruce