linux-kernel - Re: fs/jffs2/readinode.c:189: faulty logic ?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1485270700.4044.89.camel@infinera.com>
Date:   Tue, 24 Jan 2017 15:11:41 +0000
From:   Joakim Tjernlund <Joakim.Tjernlund@...inera.com>
To:     "linux-mtd@...ts.infradead.org" <linux-mtd@...ts.infradead.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "marek.vasut@...il.com" <marek.vasut@...il.com>,
        "dwmw2@...radead.org" <dwmw2@...radead.org>,
        "dcb314@...mail.com" <dcb314@...mail.com>
Subject: Re: fs/jffs2/readinode.c:189: faulty logic ?

On Tue, 2017-01-24 at 15:52 +0100, Marek Vasut wrote:
> On 01/24/2017 09:15 AM, David Binderman wrote:
> > Hello there,
> > 
> > fs/jffs2/readinode.c:189]: (style) Condition 'tn.fn.ofs>=offset' is always true
> > 
> > Source code is
> > 
> >         if (tn->fn->ofs < offset)
> >             next = tn->rb.rb_right;
> >         else if (tn->fn->ofs >= offset)
> >             next = tn->rb.rb_left;
> >         else
> >             break;
> > 
> > Maybe better code
> > 
> >         if (tn->fn->ofs < offset)
> >             next = tn->rb.rb_right;
> >         else if (tn->fn->ofs > offset)
> >             next = tn->rb.rb_left;
> >         else
> >             break;
> 
> This changes the logic of the code for equality case, please elaborate
> why this is OK.

There is something odd with current code:
	next = tn_root->rb_node;

	while (next) {
		tn = rb_entry(next, struct jffs2_tmp_dnode_info, rb);

		if (tn->fn->ofs < offset)
			next = tn->rb.rb_right;
		else if (tn->fn->ofs >= offset)
			next = tn->rb.rb_left;
		else
			break;
	}

The else break; is never reached so the above change makes the break work for ==
Weather this is correct or not I cannot say.

 Jocke