linux-kernel - Re: [bug report] f2fs: off by one in garbage collection functions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-id: <1358729895.8234.147.camel@kjgkr>
Date:	Mon, 21 Jan 2013 09:58:15 +0900
From:	Jaegeuk Kim <jaegeuk.kim@...sung.com>
To:	Dan Carpenter <dan.carpenter@...cle.com>
Cc:	linux-f2fs-devel@...ts.sourceforge.net,
	linux-kernel@...r.kernel.org
Subject: Re: [bug report] f2fs: off by one in garbage collection functions

Hi,

2013-01-18 (금), 16:29 +0300, Dan Carpenter:
> Hello Jaegeuk Kim,
> 
> The patch 7bc0900347e0: "f2fs: add garbage collection functions" from 
> Nov 2, 2012, has an off-by-one bug.
> 
>    429  block_t start_bidx_of_node(unsigned int node_ofs)
>    430  {
>    431          unsigned int indirect_blks = 2 * NIDS_PER_BLOCK + 4;
>    432          unsigned int bidx;
>    433  
>    434          if (node_ofs == 0)
>    435                  return 0;
>    436  
>    437          if (node_ofs <= 2) {
>    438                  bidx = node_ofs - 1;
>    439          } else if (node_ofs <= indirect_blks) {
>    440                  int dec = (node_ofs - 4) / (NIDS_PER_BLOCK + 1);
> 
> If node_ofs == 3 here then (node_ofs - 4) is a very high positive
> number.  We divide by 1019 and we get another still very high number but
> not so high that it is negative when cast as an int.

If the node_ofs is equal to 3, then it's a run-time bug on its caller,
gc_data_segment(), not here itself.

In gc_data_segment(),
1. check_dnode(&nofs);
2. start_bidx_of_node(nofs);

Here, it means that we don't care about indirect node pages whose node
offsets are 3, 3+1018+1, (3+1018+1)+1018+1, and so on.
(Ref. *Index Structure* in Document/filesystems/f2fs.txt)
Instead, we just check direct node pages only.

But, anyway, I'd better write comments to make it clear.
Thank you for reviewing.

-- 
Jaegeuk Kim
Samsung

Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)