All of lore.kernel.org
 help / color / mirror / Atom feed
From: Eric Biggers <ebiggers@kernel.org>
To: Theodore Ts'o <tytso@mit.edu>
Cc: Ext4 Developers List <linux-ext4@vger.kernel.org>, stable@kernel.org
Subject: Re: [PATCH] ext4: fix signed vs unsigned comparison in ext4_valid_extent()
Date: Tue, 22 Oct 2019 22:44:47 -0700	[thread overview]
Message-ID: <20191023054447.GE361298@sol.localdomain> (raw)
In-Reply-To: <20191023013112.18809-1-tytso@mit.edu>

On Tue, Oct 22, 2019 at 09:31:12PM -0400, Theodore Ts'o wrote:
> Due to a signed vs unsigned comparison, an invalid extent where
> ee_block (the logical block) is so large that lblk + len overflow
> wasn't getting flagged as invalid.
> 
> As a result, we tripped the BUG_ON(end < lblk) in
> ext4_es_cache_extent() when trying to mount a file system with a
> corrupted journal inode was corrupted.
> 
> https://bugzilla.kernel.org/show_bug.cgi?id=205197
> 
> Signed-off-by: Theodore Ts'o <tytso@mit.edu>
> Cc: stable@kernel.org
> ---
>  fs/ext4/extents.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
> index fb0f99dc8c22..d12bc287abdc 100644
> --- a/fs/ext4/extents.c
> +++ b/fs/ext4/extents.c
> @@ -367,7 +367,7 @@ ext4_ext_max_entries(struct inode *inode, int depth)
>  static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext)
>  {
>  	ext4_fsblk_t block = ext4_ext_pblock(ext);
> -	int len = ext4_ext_get_actual_len(ext);
> +	unsigned int len = ext4_ext_get_actual_len(ext);
>  	ext4_lblk_t lblock = le32_to_cpu(ext->ee_block);
>  
>  	/*
> -- 
> 2.23.0
> 

This patch can't be fixing anything because the comparison is unsigned both
before and after this patch.

- Eric

  reply	other threads:[~2019-10-23  5:44 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-10-23  1:31 [PATCH] ext4: fix signed vs unsigned comparison in ext4_valid_extent() Theodore Ts'o
2019-10-23  5:44 ` Eric Biggers [this message]
2019-10-23 13:15   ` Theodore Y. Ts'o
2019-10-23 18:43     ` Ira Weiny
2019-10-23 19:46       ` Theodore Y. Ts'o

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20191023054447.GE361298@sol.localdomain \
    --to=ebiggers@kernel.org \
    --cc=linux-ext4@vger.kernel.org \
    --cc=stable@kernel.org \
    --cc=tytso@mit.edu \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.