Re: [PATCH] Btrfs: fix out of bounds array access while reading extent buffer

From: kbuild test robot <lkp@intel.com>
To: Liu Bo <bo.li.liu@oracle.com>
Cc: kbuild-all@01.org, linux-btrfs@vger.kernel.org
Subject: Re: [PATCH] Btrfs: fix out of bounds array access while reading extent buffer
Date: Sat, 12 Aug 2017 05:26:55 +0800	[thread overview]
Message-ID: <201708120558.XtAyXrI2%fengguang.wu@intel.com> (raw)
In-Reply-To: <20170807193903.9093-1-bo.li.liu@oracle.com>

[-- Attachment #1: Type: text/plain, Size: 2045 bytes --]

Hi Liu,

[auto build test WARNING on v4.13-rc4]
[also build test WARNING on next-20170811]
[cannot apply to btrfs/next]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]

url:    https://github.com/0day-ci/linux/commits/Liu-Bo/Btrfs-fix-out-of-bounds-array-access-while-reading-extent-buffer/20170810-235607
config: x86_64-randconfig-a0-08120433 (attached as .config)
compiler: gcc-4.4 (Debian 4.4.7-8) 4.4.7
reproduce:
        # save the attached .config to linux build tree
        make ARCH=x86_64 

All warnings (new ones prefixed by >>):

   fs//btrfs/extent_io.c: In function 'read_extent_buffer':
>> fs//btrfs/extent_io.c:5419: warning: unused variable 'num_pages'

vim +/num_pages +5419 fs//btrfs/extent_io.c

  5407	
  5408	void read_extent_buffer(struct extent_buffer *eb, void *dstv,
  5409				unsigned long start,
  5410				unsigned long len)
  5411	{
  5412		size_t cur;
  5413		size_t offset;
  5414		struct page *page;
  5415		char *kaddr;
  5416		char *dst = (char *)dstv;
  5417		size_t start_offset = eb->start & ((u64)PAGE_SIZE - 1);
  5418		unsigned long i = (start_offset + start) >> PAGE_SHIFT;
> 5419		unsigned long num_pages = num_extent_pages(eb->start, eb->len);
  5420	
  5421		if (start + len > eb->len) {
  5422			WARN(1, KERN_ERR "btrfs bad mapping eb start %llu len %lu, wanted %lu %lu\n",
  5423			     eb->start, eb->len, start, len);
  5424			memset(dst, 0, len);
  5425			return;
  5426		}
  5427	
  5428		offset = (start_offset + start) & (PAGE_SIZE - 1);
  5429	
  5430		while (len > 0) {
  5431			ASSERT(i < num_pages);
  5432			page = eb->pages[i];
  5433	
  5434			cur = min(len, (PAGE_SIZE - offset));
  5435			kaddr = page_address(page);
  5436			memcpy(dst, kaddr + offset, cur);
  5437	
  5438			dst += cur;
  5439			len -= cur;
  5440			offset = 0;
  5441			i++;
  5442		}
  5443	}
  5444	

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation

[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 29010 bytes --]