From: Dave Chinner <david@fromorbit.com>
To: Lukas Czerner <lczerner@redhat.com>
Cc: xfs@oss.sgi.com
Subject: Re: [PATCH] xfs: avoid underflow in xfs_ioc_trim()
Date: Wed, 10 Oct 2012 06:39:08 +1100 [thread overview]
Message-ID: <20121009193908.GI23644@dastard> (raw)
In-Reply-To: <1349784945-28399-1-git-send-email-lczerner@redhat.com>
On Tue, Oct 09, 2012 at 02:15:45PM +0200, Lukas Czerner wrote:
> Currently if len argument in xfs_ioc_trim() is smaller than one BB
> (basic block) the 'end' variable underflow. Avoid that by bailing out if
> len is smaller than BB.
>
> Signed-off-by: Lukas Czerner <lczerner@redhat.com>
> ---
> fs/xfs/xfs_discard.c | 7 ++++++-
> 1 files changed, 6 insertions(+), 1 deletions(-)
>
> diff --git a/fs/xfs/xfs_discard.c b/fs/xfs/xfs_discard.c
> index 69cf4fc..54dc58a 100644
> --- a/fs/xfs/xfs_discard.c
> +++ b/fs/xfs/xfs_discard.c
> @@ -183,8 +183,12 @@ xfs_ioc_trim(
> range.minlen > XFS_FSB_TO_B(mp, XFS_ALLOC_AG_MAX_USABLE(mp)))
> return -XFS_ERROR(EINVAL);
>
> + end = BTOBBT(range.len);
> + if (0 == end)
> + goto out;
Uggh. "if (end == 0)", please.
> +
> start = BTOBB(range.start);
> - end = start + BTOBBT(range.len) - 1;
> + end += start - 1;
Better would be to check if end <= start. That way it also catches
start+len overflows.
> minlen = BTOBB(max_t(u64, granularity, range.minlen));
>
> if (end > XFS_FSB_TO_BB(mp, mp->m_sb.sb_dblocks) - 1)
> @@ -203,6 +207,7 @@ xfs_ioc_trim(
> if (last_error)
> return last_error;
>
> +out:
> range.len = XFS_FSB_TO_B(mp, blocks_trimmed);
> if (copy_to_user(urange, &range, sizeof(range)))
> return -XFS_ERROR(EFAULT);
I think it should return EINVAL, not silently do nothing. If the
user application uses a loop that increments start/len based on the
returned amount of blocks trimmed, returning zero could send it into
an endless loop.
Cheers,
Dave.
--
Dave Chinner
david@fromorbit.com
_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs
next prev parent reply other threads:[~2012-10-09 19:37 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-10-09 12:15 [PATCH] xfs: avoid underflow in xfs_ioc_trim() Lukas Czerner
2012-10-09 13:42 ` Carlos Maiolino
2012-10-09 19:39 ` Dave Chinner [this message]
2012-10-10 7:50 ` Lukáš Czerner
2012-10-10 23:22 ` Dave Chinner
2012-10-11 6:05 ` Lukáš Czerner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20121009193908.GI23644@dastard \
--to=david@fromorbit.com \
--cc=lczerner@redhat.com \
--cc=xfs@oss.sgi.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox