From: Eric Sandeen <sandeen@redhat.com>
To: "Darrick J. Wong" <darrick.wong@oracle.com>
Cc: linux-xfs@vger.kernel.org
Subject: Re: [PATCH 04/10] xfs_repair: fix bag memory overwrite problems
Date: Thu, 26 Oct 2017 19:49:17 -0500 [thread overview]
Message-ID: <ebe28b54-c095-a2d2-ffb7-95f2e7017455@redhat.com> (raw)
In-Reply-To: <150905611939.28563.11849739851792896762.stgit@magnolia>
On 10/26/17 5:15 PM, Darrick J. Wong wrote:
> From: Darrick J. Wong <darrick.wong@oracle.com>
>
> There's an off by one error in the bag_remove code such that we end up
> copying memory from beyond the end of the array into the array. Not a
> serious problem since we have counters to prevent us from reading that
> garbage, but AddressSanitizer complained so let's fix it.
>
> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eric Sandeen <sandeen@redhat.com>
> ---
> repair/slab.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>
> diff --git a/repair/slab.c b/repair/slab.c
> index 8609270..d47448a 100644
> --- a/repair/slab.c
> +++ b/repair/slab.c
> @@ -469,7 +469,7 @@ bag_remove(
> {
> ASSERT(nr < bag->bg_inuse);
> memmove(&bag->bg_ptrs[nr], &bag->bg_ptrs[nr + 1],
> - (bag->bg_inuse - nr) * sizeof(void *));
> + (bag->bg_inuse - nr - 1) * sizeof(void *));
> bag->bg_inuse--;
> return 0;
> }
>
next prev parent reply other threads:[~2017-10-27 0:49 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-10-26 22:14 [PATCH 00/10] xfsprogs: 4.14 rollup Darrick J. Wong
2017-10-26 22:14 ` [PATCH 01/10] db: increase metadump's default overly long extent discard threshold Darrick J. Wong
2017-10-27 0:03 ` Eric Sandeen
2017-10-27 0:12 ` Darrick J. Wong
2017-10-26 22:15 ` [PATCH 02/10] xfsprogs: explicitly cast troublesome types to match printf format specifiers Darrick J. Wong
2017-10-27 0:06 ` Eric Sandeen
2017-10-26 22:15 ` [PATCH 03/10] xfs_io: add new error injection knobs to inject command Darrick J. Wong
2017-10-27 0:09 ` Eric Sandeen
2017-10-26 22:15 ` [PATCH 04/10] xfs_repair: fix bag memory overwrite problems Darrick J. Wong
2017-10-27 0:49 ` Eric Sandeen [this message]
2017-10-26 22:15 ` [PATCH 05/10] xfs_repair: clear DAX flag from non-file inodes Darrick J. Wong
2017-10-27 2:01 ` Eric Sandeen
2017-10-26 22:15 ` [PATCH 06/10] xfs_repair: fix cowextsize field checking and repairing Darrick J. Wong
2017-10-27 2:06 ` Eric Sandeen
2017-10-27 16:17 ` Darrick J. Wong
2017-10-27 16:27 ` Eric Sandeen
2017-10-26 22:15 ` [PATCH 07/10] misc: enable ubsan if it's available Darrick J. Wong
2017-10-26 22:23 ` [PATCH v2] misc: enable ubsan if the builder wants it Darrick J. Wong
2017-10-26 22:15 ` [PATCH 08/10] misc: enable gcc/clang address sanitizer Darrick J. Wong
2017-10-26 22:24 ` [PATCH v2 " Darrick J. Wong
2017-10-26 22:15 ` [PATCH 09/10] misc: enable thread Darrick J. Wong
2017-10-26 22:24 ` [PATCH v2 09/10] misc: enable thread sanitizer if requested Darrick J. Wong
2017-10-26 22:15 ` [PATCH 10/10] misc: fix ubsan warnings Darrick J. Wong
2017-10-27 13:48 ` Eric Sandeen
2017-10-27 16:14 ` Darrick J. Wong
2017-10-27 16:24 ` Eric Sandeen
2017-10-27 16:19 ` [PATCH v2 " Darrick J. Wong
2017-10-26 22:32 ` [PATCH 00/10] xfsprogs: 4.14 rollup Goldwyn Rodrigues
2017-10-27 0:01 ` Eric Sandeen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ebe28b54-c095-a2d2-ffb7-95f2e7017455@redhat.com \
--to=sandeen@redhat.com \
--cc=darrick.wong@oracle.com \
--cc=linux-xfs@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox