linux-kernel - [bug report] f2fs: off by one in garbage collection functions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 18 Jan 2013 16:29:49 +0300
From:	Dan Carpenter <dan.carpenter@...cle.com>
To:	jaegeuk.kim@...sung.com
Cc:	linux-f2fs-devel@...ts.sourceforge.net,
	linux-kernel@...r.kernel.org
Subject: [bug report] f2fs: off by one in garbage collection functions

Hello Jaegeuk Kim,

The patch 7bc0900347e0: "f2fs: add garbage collection functions" from 
Nov 2, 2012, has an off-by-one bug.

   429  block_t start_bidx_of_node(unsigned int node_ofs)
   430  {
   431          unsigned int indirect_blks = 2 * NIDS_PER_BLOCK + 4;
   432          unsigned int bidx;
   433  
   434          if (node_ofs == 0)
   435                  return 0;
   436  
   437          if (node_ofs <= 2) {
   438                  bidx = node_ofs - 1;
   439          } else if (node_ofs <= indirect_blks) {
   440                  int dec = (node_ofs - 4) / (NIDS_PER_BLOCK + 1);

If node_ofs == 3 here then (node_ofs - 4) is a very high positive
number.  We divide by 1019 and we get another still very high number but
not so high that it is negative when cast as an int.

   441                  bidx = node_ofs - 2 - dec;

It means that bidx is much higher than intended here (4290752413).

I thought maybe there is an off by one somewhere.  Perhaps the 4 should
be a 3.

   442          } else {
   443                  int dec = (node_ofs - indirect_blks - 3) / (NIDS_PER_BLOCK + 1);
   444                  bidx = node_ofs - 5 - dec;
   445          }
   446          return bidx * ADDRS_PER_BLOCK + ADDRS_PER_INODE;
   447  }

regards,
dan carpenter

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/