linux-kernel - Re: fs/jffs2/readinode.c:189: faulty logic ?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1485300620.4727.72.camel@infradead.org>
Date:   Tue, 24 Jan 2017 23:30:20 +0000
From:   David Woodhouse <dwmw2@...radead.org>
To:     David Binderman <dcb314@...mail.com>,
        "linux-mtd@...ts.infradead.org" <linux-mtd@...ts.infradead.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: fs/jffs2/readinode.c:189: faulty logic ?

On Tue, 2017-01-24 at 08:15 +0000, David Binderman wrote:
> Hello there,
> 
> fs/jffs2/readinode.c:189]: (style) Condition 'tn.fn.ofs>=offset' is
> always true
> 
> Source code is
> 
>         if (tn->fn->ofs < offset)
>             next = tn->rb.rb_right;
>         else if (tn->fn->ofs >= offset)
>             next = tn->rb.rb_left;
>         else
>             break;
> 
> Maybe better code
> 
>         if (tn->fn->ofs < offset)
>             next = tn->rb.rb_right;
>         else if (tn->fn->ofs > offset)
>             next = tn->rb.rb_left;
>         else
>             break;

Thanks for pointing this out; it looks like a correct fix at first.

However, it might expose a bug, if the 'break' case isn't particularly
well-tested. The existing bug is probably fairly harmless, while the
hypothetical new one isn't. So we need to take a closer look at the
surrounding code and ideally test it...

-- 
dwmw2
Download attachment "smime.p7s" of type "application/x-pkcs7-signature" (4938 bytes)