linux-ext4 - Re: [PATCH] ext4: Fix use of uninitialized data

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 02 Jun 2008 08:42:24 -0500
From:	Eric Sandeen <sandeen@...hat.com>
To:	Theodore Tso <tytso@....edu>
CC:	"Aneesh Kumar K.V" <aneesh.kumar@...ux.vnet.ibm.com>,
	cmm@...ibm.com, linux-ext4@...r.kernel.org, alex@...sterfs.com,
	adilger@....com
Subject: Re: [PATCH] ext4: Fix use of uninitialized data

Theodore Tso wrote:
> On Thu, May 15, 2008 at 12:17:11AM +0530, Aneesh Kumar K.V wrote:
>> @@ -3134,8 +3135,7 @@ static void ext4_mb_use_inode_pa(struct ext4_allocation_context *ac,
>>  static void ext4_mb_use_group_pa(struct ext4_allocation_context *ac,
>>  				struct ext4_prealloc_space *pa)
>>  {
>> -	unsigned len = ac->ac_o_ex.fe_len;
>> -
>> +	unsigned int len = ac->ac_o_ex.fe_len;
>>  	ext4_get_group_no_and_offset(ac->ac_sb, pa->pa_pstart,
>>  					&ac->ac_b_ex.fe_group,
>>  					&ac->ac_b_ex.fe_start);
>> -- 
> 
> This change had nothing to do with fixing the use of unitialized data,
> but when I started looking more closely, it raised a potential signed
> vs. unsigned issue: ac_o_ex is a struct ext4_free_extent, and fe_len
> is an int.
> 
> So here we are assigning an int to an unsigned int.  Later, len is
> assigned to ac_b_ex.len, which means assigning an unsigned int to an
> int.  In other places, fe_len (an int) is compared against pa_free
> (which is an unsigned short), and fe_len gets assined to pa_free, once
> again mixing signed and unsigned.
> 
> Can someone who is really familiar with this code check this out?  I
> think the following pseudo-patch to mballoc.h might be in order:
> 
>  struct ext4_free_extent {
>  	ext4_lblk_t fe_logical;
>  	ext4_grpblk_t fe_start;
>  	ext4_group_t fe_group;
> -	int fe_len;
> +	unsigned int fe_len;
>  };

Hm, ok, so what's going on here:

ext4_mb_normalize_group_request()
{
...
        if (EXT4_SB(sb)->s_stripe)
                ac->ac_g_ex.fe_len = EXT4_SB(sb)->s_stripe;
        else
                ac->ac_g_ex.fe_len = EXT4_SB(sb)->s_mb_group_prealloc;
...
}

and that's a long:

        unsigned long s_mb_group_prealloc;

Oh, but that's only ever assigned as

        sbi->s_mb_group_prealloc = MB_DEFAULT_GROUP_PREALLOC;

which is

/*
 * default group prealloc size 512 blocks
 */
#define MB_DEFAULT_GROUP_PREALLOC       512


so it's fine... but why are we carrying around a field in the sbi to
hold a constant that cannot be changed runtime?

-Eric
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html