linux-ext4 - Re: [PATCH 14/24] libext2fs: fix bounds check of the bitmap test range in get_free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140725111342.GE1865@thunk.org>
Date:	Fri, 25 Jul 2014 07:13:42 -0400
From:	Theodore Ts'o <tytso@....edu>
To:	"Darrick J. Wong" <darrick.wong@...cle.com>
Cc:	linux-ext4@...r.kernel.org
Subject: Re: [PATCH 14/24] libext2fs: fix bounds check of the bitmap test
 range in get_free_blocks2

On Fri, Jul 18, 2014 at 03:53:59PM -0700, Darrick J. Wong wrote:
> In the loop in ext2fs_get_free_blocks2, we ask the bitmap if there's a
> range of free blocks starting at "b" and ending at "b + num - 1".
> That quantity is the number of the last block in the range.  Since
> ext2fs_blocks_count() returns the number of blocks and not the number
> of the last block in the filesystem, the check is incorrect.
> 
> Put in a shortcut to exit the loop if finish > start, because in that
> case it's obvious that we don't need to reset to the beginning of the
> FS to continue the search for blocks.  This is needed to terminate the
> loop because the broken test meant that b could get large enough to
> equal finish, which would end the while loop.
> 
> The attached testcase shows that with the off by one error, it is
> possible to throw e2fsck into an infinite loop while it tries to
> find space for the inode table even though there's no space for one.
> 
> Signed-off-by: Darrick J. Wong <darrick.wong@...cle.com>

Thanks, applied.

					- Ted
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html