From: Dan Carpenter <dan.carpenter@oracle.com>
To: dmonakhov@openvz.org
Cc: linux-ext4@vger.kernel.org
Subject: re: ext4: fix potential use after free during resize
Date: Sat, 6 Dec 2014 16:53:41 +0300 [thread overview]
Message-ID: <20141206135341.GC17278@mwanda> (raw)
Hello Dmitry Monakhov,
The patch fdfe07398761: "ext4: fix potential use after free during
resize" from Dec 2, 2014, leads to the following static checker
warning:
fs/ext4/balloc.c:300 ext4_get_group_desc()
warn: 'gd_bh' can't be NULL.
This is a false positive in Smatch, but I still had a question about the
code.
fs/ext4/balloc.c
295 group_desc = block_group >> EXT4_DESC_PER_BLOCK_BITS(sb);
296 offset = block_group & (EXT4_DESC_PER_BLOCK(sb) - 1);
297 rcu_read_lock();
298 gd_bh = *rcu_dereference(sbi->s_group_desc) + group_desc;
299 rcu_read_unlock();
300 if (!gd_bh) {
Are you sure you don't want to "*rcu_dereference(sbi->s_group_desc)"
separate from group_desc?
gd_bh = *rcu_dereference(sbi->s_group_desc);
rcu_read_unlock();
if (!gd_bh) {
...
}
gd_bh = (u8 *) + group_desc;
301 ext4_error(sb, "Group descriptor not loaded - "
302 "block_group = %u, group_desc = %u, desc = %u",
303 block_group, group_desc, offset);
^^^^^^^^^^
We already know this is zero.
304 return NULL;
305 }
306
307 desc = (struct ext4_group_desc *)(
308 (__u8 *)gd_bh->b_data + offset * EXT4_DESC_SIZE(sb));
309 if (bh)
310 *bh = gd_bh;
regards,
dan carpenter
reply other threads:[~2014-12-06 13:53 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20141206135341.GC17278@mwanda \
--to=dan.carpenter@oracle.com \
--cc=dmonakhov@openvz.org \
--cc=linux-ext4@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.