Re: Static overrun in reiser3

[Hans Reiser <reiser@namesys.com>]

Jeff Mahoney wrote:

>
> Hi Hans -
>
> I've been playing around with the Coverity code checker, and while I
> think it still sees a few too many false positives, it's a good tool.

Thanks for doing that work!  If you could do it for V4, that would be
great too.  If not, maybe Edward could do it.

>
> Anyway, one of the potential bugs it came up with in reiserfs was this
> one:
>
> struct tree_balance contains a number of arrays of size MAX_HEIGHT (5).
> In fix_nodes(), line 2502, we see:
>                         p_s_tb->insert_size[n_h + 1] =
>                             (DC_SIZE + KEY_SIZE) * (p_s_tb->blknum[n_h]
> - 1);
>
> I haven't run a thorough analysis, but is it possible for n_h to be 4
> there, and then n_h + 1 would be 5, overrunning into the next field of
> struct tree_balance? The tool seems to think so, but it also thought
> that not checking that dentry->d_inode != NULL after calling
> inode->i_op->mkdir was invalid, even though a successful return value
> implies that dentry->d_inode != NULL.

I'll let vs answer this.

>
> -Jeff
>
> --
> Jeff Mahoney
> SUSE Labs