* [PATCH] ext2fs: fix integer overflow in rb_get_bmap_range
@ 2014-12-09 19:30 Dmitry Monakhov
2014-12-09 19:48 ` Dmitry Monakhov
2014-12-11 22:58 ` Theodore Ts'o
0 siblings, 2 replies; 3+ messages in thread
From: Dmitry Monakhov @ 2014-12-09 19:30 UTC (permalink / raw)
To: linux-ext4; +Cc: Dmitry Monakhov
bmap_rb_extent is defined as __u64:blk __u64:count. So count can exceed INT_MAX on
populated filesystems
TESTCASE: xfstest ext4/004
Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org>
---
lib/ext2fs/blkmap64_rb.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/lib/ext2fs/blkmap64_rb.c b/lib/ext2fs/blkmap64_rb.c
index 8d1778d..e290ade 100644
--- a/lib/ext2fs/blkmap64_rb.c
+++ b/lib/ext2fs/blkmap64_rb.c
@@ -733,7 +733,7 @@ static errcode_t rb_get_bmap_range(ext2fs_generic_bitmap bitmap,
struct rb_node *parent = NULL, *next, **n;
struct ext2fs_rb_private *bp;
struct bmap_rb_extent *ext;
- int count;
+ __u64 count;
__u64 pos;
bp = (struct ext2fs_rb_private *) bitmap->private;
@@ -765,9 +765,9 @@ static errcode_t rb_get_bmap_range(ext2fs_generic_bitmap bitmap,
if (pos >= start + num)
break;
if (pos < start) {
- count -= start - pos;
- if (count < 0)
+ if (pos + count < start)
continue;
+ count -= start - pos;
pos = start;
}
if (pos + count > start + num)
--
1.8.3.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] ext2fs: fix integer overflow in rb_get_bmap_range
2014-12-09 19:30 [PATCH] ext2fs: fix integer overflow in rb_get_bmap_range Dmitry Monakhov
@ 2014-12-09 19:48 ` Dmitry Monakhov
2014-12-11 22:58 ` Theodore Ts'o
1 sibling, 0 replies; 3+ messages in thread
From: Dmitry Monakhov @ 2014-12-09 19:48 UTC (permalink / raw)
To: linux-ext4, Theodore Ts'o
Dmitry Monakhov <dmonakhov@openvz.org> writes:
This is the patch for the issue which I complain you about prev
Friday. It takes longer than I expect, but now all my resize tests
succeeded. In fact issue may be triggered in real life situation
if someone use ballooning technique (consume space via fallocate)
> bmap_rb_extent is defined as __u64:blk __u64:count. So count can exceed INT_MAX on
> populated filesystems
>
> TESTCASE: xfstest ext4/004
>
> Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org>
> ---
> lib/ext2fs/blkmap64_rb.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/lib/ext2fs/blkmap64_rb.c b/lib/ext2fs/blkmap64_rb.c
> index 8d1778d..e290ade 100644
> --- a/lib/ext2fs/blkmap64_rb.c
> +++ b/lib/ext2fs/blkmap64_rb.c
> @@ -733,7 +733,7 @@ static errcode_t rb_get_bmap_range(ext2fs_generic_bitmap bitmap,
> struct rb_node *parent = NULL, *next, **n;
> struct ext2fs_rb_private *bp;
> struct bmap_rb_extent *ext;
> - int count;
> + __u64 count;
> __u64 pos;
>
> bp = (struct ext2fs_rb_private *) bitmap->private;
> @@ -765,9 +765,9 @@ static errcode_t rb_get_bmap_range(ext2fs_generic_bitmap bitmap,
> if (pos >= start + num)
> break;
> if (pos < start) {
> - count -= start - pos;
> - if (count < 0)
> + if (pos + count < start)
> continue;
> + count -= start - pos;
> pos = start;
> }
> if (pos + count > start + num)
> --
> 1.8.3.1
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] ext2fs: fix integer overflow in rb_get_bmap_range
2014-12-09 19:30 [PATCH] ext2fs: fix integer overflow in rb_get_bmap_range Dmitry Monakhov
2014-12-09 19:48 ` Dmitry Monakhov
@ 2014-12-11 22:58 ` Theodore Ts'o
1 sibling, 0 replies; 3+ messages in thread
From: Theodore Ts'o @ 2014-12-11 22:58 UTC (permalink / raw)
To: Dmitry Monakhov; +Cc: linux-ext4
On Tue, Dec 09, 2014 at 11:30:16PM +0400, Dmitry Monakhov wrote:
> bmap_rb_extent is defined as __u64:blk __u64:count. So count can exceed INT_MAX on
> populated filesystems
>
> TESTCASE: xfstest ext4/004
>
> Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org>
Applied, thanks.
- Ted
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2014-12-11 22:58 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-12-09 19:30 [PATCH] ext2fs: fix integer overflow in rb_get_bmap_range Dmitry Monakhov
2014-12-09 19:48 ` Dmitry Monakhov
2014-12-11 22:58 ` Theodore Ts'o
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).