From: Dan Carpenter <dan.carpenter@oracle.com>
To: dmonakhov@openvz.org
Cc: linux-ext4@vger.kernel.org
Subject: re: ext4: fix potential use after free during resize
Date: Sat, 6 Dec 2014 16:53:41 +0300 [thread overview]
Message-ID: <20141206135341.GC17278@mwanda> (raw)
Hello Dmitry Monakhov,
The patch fdfe07398761: "ext4: fix potential use after free during
resize" from Dec 2, 2014, leads to the following static checker
warning:
fs/ext4/balloc.c:300 ext4_get_group_desc()
warn: 'gd_bh' can't be NULL.
This is a false positive in Smatch, but I still had a question about the
code.
fs/ext4/balloc.c
295 group_desc = block_group >> EXT4_DESC_PER_BLOCK_BITS(sb);
296 offset = block_group & (EXT4_DESC_PER_BLOCK(sb) - 1);
297 rcu_read_lock();
298 gd_bh = *rcu_dereference(sbi->s_group_desc) + group_desc;
299 rcu_read_unlock();
300 if (!gd_bh) {
Are you sure you don't want to "*rcu_dereference(sbi->s_group_desc)"
separate from group_desc?
gd_bh = *rcu_dereference(sbi->s_group_desc);
rcu_read_unlock();
if (!gd_bh) {
...
}
gd_bh = (u8 *) + group_desc;
301 ext4_error(sb, "Group descriptor not loaded - "
302 "block_group = %u, group_desc = %u, desc = %u",
303 block_group, group_desc, offset);
^^^^^^^^^^
We already know this is zero.
304 return NULL;
305 }
306
307 desc = (struct ext4_group_desc *)(
308 (__u8 *)gd_bh->b_data + offset * EXT4_DESC_SIZE(sb));
309 if (bh)
310 *bh = gd_bh;
regards,
dan carpenter
reply other threads:[~2014-12-06 13:53 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20141206135341.GC17278@mwanda \
--to=dan.carpenter@oracle.com \
--cc=dmonakhov@openvz.org \
--cc=linux-ext4@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).