* [PATCH] jffs2: refactor csize in jffs2_do_read_inode_internal()
@ 2012-04-09 22:42 Xi Wang
2012-04-21 14:12 ` Artem Bityutskiy
2012-04-22 11:57 ` Artem Bityutskiy
0 siblings, 2 replies; 7+ messages in thread
From: Xi Wang @ 2012-04-09 22:42 UTC (permalink / raw)
To: David Woodhouse; +Cc: linux-mtd, Xi Wang
Replace the verbose `je32_to_cpu(latest_node->csize)' with a shorter
variable `csize'.
Also check for a bogus `csize' value 0xffffffff, which would turn the
subsequent kmalloc(cisze + 1, ...) into kmalloc(0, ...).
Signed-off-by: Xi Wang <xi.wang@gmail.com>
---
fs/jffs2/readinode.c | 17 +++++++++++------
1 files changed, 11 insertions(+), 6 deletions(-)
diff --git a/fs/jffs2/readinode.c b/fs/jffs2/readinode.c
index dc0437e..2be7a8e 100644
--- a/fs/jffs2/readinode.c
+++ b/fs/jffs2/readinode.c
@@ -1266,19 +1266,24 @@ static int jffs2_do_read_inode_internal(struct jffs2_sb_info *c,
/* Symlink's inode data is the target path. Read it and
* keep in RAM to facilitate quick follow symlink
* operation. */
- f->target = kmalloc(je32_to_cpu(latest_node->csize) + 1, GFP_KERNEL);
+ uint32_t csize = je32_to_cpu(latest_node->csize);
+ /* Avoid overflowing csize + 1. */
+ if (csize > INT_MAX)
+ f->target = 0;
+ else
+ f->target = kmalloc(csize + 1, GFP_KERNEL);
if (!f->target) {
- JFFS2_ERROR("can't allocate %d bytes of memory for the symlink target path cache\n", je32_to_cpu(latest_node->csize));
+ JFFS2_ERROR("can't allocate %u bytes of memory for the symlink target path cache\n", csize);
mutex_unlock(&f->sem);
jffs2_do_clear_inode(c, f);
return -ENOMEM;
}
ret = jffs2_flash_read(c, ref_offset(rii.latest_ref) + sizeof(*latest_node),
- je32_to_cpu(latest_node->csize), &retlen, (char *)f->target);
+ csize, &retlen, (char *)f->target);
- if (ret || retlen != je32_to_cpu(latest_node->csize)) {
- if (retlen != je32_to_cpu(latest_node->csize))
+ if (ret || retlen != csize) {
+ if (retlen != csize)
ret = -EIO;
kfree(f->target);
f->target = NULL;
@@ -1287,7 +1292,7 @@ static int jffs2_do_read_inode_internal(struct jffs2_sb_info *c,
return ret;
}
- f->target[je32_to_cpu(latest_node->csize)] = '\0';
+ f->target[csize] = '\0';
dbg_readinode("symlink's target '%s' cached\n", f->target);
}
--
1.7.5.4
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH] jffs2: refactor csize in jffs2_do_read_inode_internal()
2012-04-09 22:42 [PATCH] jffs2: refactor csize in jffs2_do_read_inode_internal() Xi Wang
@ 2012-04-21 14:12 ` Artem Bityutskiy
2012-04-21 16:44 ` Xi Wang
2012-04-22 11:57 ` Artem Bityutskiy
1 sibling, 1 reply; 7+ messages in thread
From: Artem Bityutskiy @ 2012-04-21 14:12 UTC (permalink / raw)
To: Xi Wang; +Cc: linux-mtd, David Woodhouse
On Mon, 2012-04-09 at 18:42 -0400, Xi Wang wrote:
> Replace the verbose `je32_to_cpu(latest_node->csize)' with a shorter
> variable `csize'.
>
> Also check for a bogus `csize' value 0xffffffff, which would turn the
> subsequent kmalloc(cisze + 1, ...) into kmalloc(0, ...).
>
> Signed-off-by: Xi Wang <xi.wang@gmail.com>
Looks good. I wonder, does it fix a real-life issue or you spotted this
place while reviewing/fixing warnings/other janitor type of work?
--
Best Regards,
Artem Bityutskiy
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] jffs2: refactor csize in jffs2_do_read_inode_internal()
2012-04-21 14:12 ` Artem Bityutskiy
@ 2012-04-21 16:44 ` Xi Wang
0 siblings, 0 replies; 7+ messages in thread
From: Xi Wang @ 2012-04-21 16:44 UTC (permalink / raw)
To: dedekind1; +Cc: linux-mtd, David Woodhouse
On Apr 21, 2012, at 10:12 AM, Artem Bityutskiy wrote:
> Looks good. I wonder, does it fix a real-life issue or you spotted this
> place while reviewing/fixing warnings/other janitor type of work?
Thanks for reviewing. ;-)
The patch tries to fix a warning issued by a homemade static analysis
tool that looks for integer overflows.
- xi
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] jffs2: refactor csize in jffs2_do_read_inode_internal()
2012-04-09 22:42 [PATCH] jffs2: refactor csize in jffs2_do_read_inode_internal() Xi Wang
2012-04-21 14:12 ` Artem Bityutskiy
@ 2012-04-22 11:57 ` Artem Bityutskiy
2012-04-23 5:43 ` Xi Wang
1 sibling, 1 reply; 7+ messages in thread
From: Artem Bityutskiy @ 2012-04-22 11:57 UTC (permalink / raw)
To: Xi Wang; +Cc: linux-mtd, David Woodhouse
[-- Attachment #1: Type: text/plain, Size: 588 bytes --]
On Mon, 2012-04-09 at 18:42 -0400, Xi Wang wrote:
> Replace the verbose `je32_to_cpu(latest_node->csize)' with a shorter
> variable `csize'.
>
> Also check for a bogus `csize' value 0xffffffff, which would turn the
> subsequent kmalloc(cisze + 1, ...) into kmalloc(0, ...).
>
> Signed-off-by: Xi Wang <xi.wang@gmail.com>
Please, introduce the variable in a separate patch.
WRT the csize check - you should compare it to something more sensible
than INT_MAX - try to dig the code and find out what is maximum value
JFFS2 expects.
--
Best Regards,
Artem Bityutskiy
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 836 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] jffs2: refactor csize in jffs2_do_read_inode_internal()
2012-04-22 11:57 ` Artem Bityutskiy
@ 2012-04-23 5:43 ` Xi Wang
2012-04-23 6:00 ` Artem Bityutskiy
0 siblings, 1 reply; 7+ messages in thread
From: Xi Wang @ 2012-04-23 5:43 UTC (permalink / raw)
To: dedekind1; +Cc: linux-mtd, David Woodhouse
On Apr 22, 2012, at 7:57 AM, Artem Bityutskiy wrote:
> Please, introduce the variable in a separate patch.
Okay.
> WRT the csize check - you should compare it to something more sensible
> than INT_MAX - try to dig the code and find out what is maximum value
> JFFS2 expects.
KMALLOC_MAX_SIZE - 1 is the smallest number I can find, since the code
calls `kmalloc(csize + 1)'. Does that look good?
- xi
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] jffs2: refactor csize in jffs2_do_read_inode_internal()
2012-04-23 5:43 ` Xi Wang
@ 2012-04-23 6:00 ` Artem Bityutskiy
2012-04-23 6:58 ` Xi Wang
0 siblings, 1 reply; 7+ messages in thread
From: Artem Bityutskiy @ 2012-04-23 6:00 UTC (permalink / raw)
To: Xi Wang; +Cc: linux-mtd, David Woodhouse
[-- Attachment #1: Type: text/plain, Size: 653 bytes --]
On Mon, 2012-04-23 at 01:43 -0400, Xi Wang wrote:
> On Apr 22, 2012, at 7:57 AM, Artem Bityutskiy wrote:
>
> > Please, introduce the variable in a separate patch.
>
> Okay.
>
> > WRT the csize check - you should compare it to something more sensible
> > than INT_MAX - try to dig the code and find out what is maximum value
> > JFFS2 expects.
>
> KMALLOC_MAX_SIZE - 1 is the smallest number I can find, since the code
> calls `kmalloc(csize + 1)'. Does that look good?
I think JFFS2 has its own limit on the maximum size of the symlink
target. Probably it is PAGE_CACHE_SIZE, but not sure.
--
Best Regards,
Artem Bityutskiy
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 836 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] jffs2: refactor csize in jffs2_do_read_inode_internal()
2012-04-23 6:00 ` Artem Bityutskiy
@ 2012-04-23 6:58 ` Xi Wang
0 siblings, 0 replies; 7+ messages in thread
From: Xi Wang @ 2012-04-23 6:58 UTC (permalink / raw)
To: dedekind1; +Cc: linux-mtd, David Woodhouse
On Apr 23, 2012, at 2:00 AM, Artem Bityutskiy wrote:
>
> I think JFFS2 has its own limit on the maximum size of the symlink
> target. Probably it is PAGE_CACHE_SIZE, but not sure.
Is it this one?
fs/jffs2/dir.c:297
static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char *target)
{
...
int targetlen = strlen(target);
/* FIXME: If you care. We'd need to use frags for the target
if it grows much more than this */
if (targetlen > 254)
return -ENAMETOOLONG;
...
}
I guess the magic value 254 is JFFS2_MAX_NAME_LEN defined in
include/linux/jffs2.h.
- xi
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2012-04-23 6:58 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-04-09 22:42 [PATCH] jffs2: refactor csize in jffs2_do_read_inode_internal() Xi Wang
2012-04-21 14:12 ` Artem Bityutskiy
2012-04-21 16:44 ` Xi Wang
2012-04-22 11:57 ` Artem Bityutskiy
2012-04-23 5:43 ` Xi Wang
2012-04-23 6:00 ` Artem Bityutskiy
2012-04-23 6:58 ` Xi Wang
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.