linux-ext4 - Re: [RFC PATCH 10/17] signed int -> blk64_t to fix bugs at 2^31

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20081114035456.GJ20637@shell>
Date:	Thu, 13 Nov 2008 22:54:56 -0500
From:	Valerie Aurora Henson <vaurora@...hat.com>
To:	Eric Sandeen <sandeen@...hat.com>
Cc:	Andreas Dilger <adilger@....com>, "Theodore Ts'o" <tytso@....edu>,
	linux-ext4@...r.kernel.org
Subject: Re: [RFC PATCH 10/17] signed int -> blk64_t to fix bugs at 2^31 - 2^32 blocks

On Thu, Nov 13, 2008 at 09:42:52PM -0600, Eric Sandeen wrote:
> Valerie Aurora Henson wrote:
> > On Thu, Nov 13, 2008 at 12:57:42PM -0700, Andreas Dilger wrote:
> >> On Nov 11, 2008  19:43 -0800, Valerie Aurora Henson wrote:
> >>> diff --git a/lib/ext2fs/alloc_tables.c b/lib/ext2fs/alloc_tables.c
> >>> index 7235f7d..71ad445 100644
> >>> --- a/lib/ext2fs/alloc_tables.c
> >>> +++ b/lib/ext2fs/alloc_tables.c
> >>> @@ -147,7 +147,7 @@ errcode_t ext2fs_allocate_group_table(ext2_filsys fs, dgrp_t group,
> >>> -		int prev_block = 0;
> >>> +		blk64_t prev_block = 0;
> >>> @@ -178,7 +178,7 @@ errcode_t ext2fs_allocate_group_table(ext2_filsys fs, dgrp_t group,
> >>>  	if (flexbg_size) {
> >>> -		int prev_block = 0;
> >>> +		blk64_t prev_block = 0;
> >> These appear to be defects in the base code and should be landed ASAP
> >> (as int -> blk_t) independently of this patch series.
> > 
> > Agreed.  Ted, is this a good format for you or do you want me to
> > regenerate against something?
> 
> Is it?
> 
>         if (flexbg_size) {
>                 int prev_block = 0;
>                 if (group && fs->group_desc[group-1].bg_block_bitmap)
>                         prev_block =
> fs->group_desc[group-1].bg_block_bitmap;
>                 start_blk = flexbg_offset(fs, group, prev_block, bmap,
>                                                  0, rem_grps, 1);
>                 last_blk = ext2fs_group_last_block(fs, last_grp);
>         }
> 
> bg_block_bitmap is only a __u32, and that's what we assign to prev_block.

It's a signed/unsigned bug (int vs. blk_t) - it shows up at > 2^31
blocks.

> Just a quick scan, but isn't this just a relative block in the group?

I double-checked and it's relative to the beginning of the file system.

-VAL
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html