linux-ext4 - [RFC] ext4: off by one check in ext4_ext_convert_to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20120623091520.GB26923@elgon.mountain>
Date:	Sat, 23 Jun 2012 12:15:20 +0300
From:	Dan Carpenter <dan.carpenter@...cle.com>
To:	"Theodore Ts'o" <tytso@....edu>
Cc:	Andreas Dilger <adilger.kernel@...ger.ca>,
	linux-ext4@...r.kernel.org, kernel-janitors@...r.kernel.org,
	Yongqiang Yang <xiaoqiangnk@...il.com>
Subject: [RFC] ext4: off by one check in ext4_ext_convert_to_initialized()

I am not very familiar with this code, but I think that we should be
using "<= EXT4_EXT_ZERO_LEN" here instead of "< EXT4_EXT_ZERO_LEN".

1)  The other comparisons with EXT4_EXT_ZERO_LEN use "<=".

2)  On the first side of the if else statement we do:
	if (allocated <= EXT4_EXT_ZERO_LEN ...
		split_map.m_len = allocated;
    On this side, it would match to do:
	if (map->m_lblk - ee_block + map->m_len <= EXT4_EXT_ZERO_LEN ...
		split_map.m_len = map->m_lblk - ee_block + map->m_len;

It's not the most air tight of arguments, so I've submitted this with a
big warning message.

Signed-off-by: Dan Carpenter <dan.carpenter@...cle.com>

diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 91341ec..2df32a4 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -3208,7 +3208,7 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
 				goto out;
 			split_map.m_lblk = map->m_lblk;
 			split_map.m_len = allocated;
-		} else if ((map->m_lblk - ee_block + map->m_len <
+		} else if ((map->m_lblk - ee_block + map->m_len <=
 			   EXT4_EXT_ZERO_LEN) &&
 			   (EXT4_EXT_MAY_ZEROOUT & split_flag)) {
 			/* case 2 */
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html