lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 2 Jun 2008 14:29:48 +0530 From: "Aneesh Kumar K.V" <aneesh.kumar@...ux.vnet.ibm.com> To: Theodore Tso <tytso@....edu> Cc: cmm@...ibm.com, sandeen@...hat.com, linux-ext4@...r.kernel.org, alex@...sterfs.com, adilger@....com Subject: Re: [PATCH] ext4: Fix use of uninitialized data On Sun, Jun 01, 2008 at 08:08:42PM -0400, Theodore Tso wrote: > On Thu, May 15, 2008 at 12:17:11AM +0530, Aneesh Kumar K.V wrote: > > @@ -3134,8 +3135,7 @@ static void ext4_mb_use_inode_pa(struct ext4_allocation_context *ac, > > static void ext4_mb_use_group_pa(struct ext4_allocation_context *ac, > > struct ext4_prealloc_space *pa) > > { > > - unsigned len = ac->ac_o_ex.fe_len; > > - > > + unsigned int len = ac->ac_o_ex.fe_len; > > ext4_get_group_no_and_offset(ac->ac_sb, pa->pa_pstart, > > &ac->ac_b_ex.fe_group, > > &ac->ac_b_ex.fe_start); > > -- > > This change had nothing to do with fixing the use of unitialized data, > but when I started looking more closely, it raised a potential signed > vs. unsigned issue: ac_o_ex is a struct ext4_free_extent, and fe_len > is an int. > > So here we are assigning an int to an unsigned int. Later, len is > assigned to ac_b_ex.len, which means assigning an unsigned int to an > int. In other places, fe_len (an int) is compared against pa_free > (which is an unsigned short), and fe_len gets assined to pa_free, once > again mixing signed and unsigned. > > Can someone who is really familiar with this code check this out? I > think the following pseudo-patch to mballoc.h might be in order: > > struct ext4_free_extent { > ext4_lblk_t fe_logical; > ext4_grpblk_t fe_start; > ext4_group_t fe_group; > - int fe_len; > + unsigned int fe_len; > }; > Looks correct. We have some BUG_ON that is doing fe_len <= 0. May be we need to remove the < part. -aneesh -- To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists