* Integer truncation in fs/xfs/libxfs/xfs_da_btree.c
@ 2015-12-20 12:36 Kristian
2015-12-20 19:29 ` Dave Chinner
0 siblings, 1 reply; 2+ messages in thread
From: Kristian @ 2015-12-20 12:36 UTC (permalink / raw)
To: xfs
Hello,
there is an integer truncation in
fs/xfs/libxfs/xfs_da_btree.c +2081
/* account for newly allocated blocks in reserved blocks total */
args->total -= dp->i_d.di_nblocks - nblks;
with the types: uint32 -= uint64 - uint64
On a hardened kernel with grsecurity enabled, this leads to a fault.
https://forums.grsecurity.net/viewtopic.php?f=3&t=4346&sid=3200600c0faaab4bf8779a95c549a737
Is this intentional and safe?
Regards
Kristian
_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Integer truncation in fs/xfs/libxfs/xfs_da_btree.c
2015-12-20 12:36 Integer truncation in fs/xfs/libxfs/xfs_da_btree.c Kristian
@ 2015-12-20 19:29 ` Dave Chinner
0 siblings, 0 replies; 2+ messages in thread
From: Dave Chinner @ 2015-12-20 19:29 UTC (permalink / raw)
To: Kristian; +Cc: xfs
On Sun, Dec 20, 2015 at 01:36:22PM +0100, Kristian wrote:
> Hello,
>
> there is an integer truncation in
>
> fs/xfs/libxfs/xfs_da_btree.c +2081
>
> /* account for newly allocated blocks in reserved blocks total */
> args->total -= dp->i_d.di_nblocks - nblks;
>
> with the types: uint32 -= uint64 - uint64
>
> On a hardened kernel with grsecurity enabled, this leads to a fault.
>
> https://forums.grsecurity.net/viewtopic.php?f=3&t=4346&sid=3200600c0faaab4bf8779a95c549a737
>
> Is this intentional and safe?
Yes and yes. We can be, at most, asking for 128 blocks to be
allocated in this function, so that "uint64 - uint64" will
typically have a value of 1 or 2. the worst case is about 130 in the
most extreme, never-used-but-still-possible filesystem
configuration.
Cheers,
Dave.
--
Dave Chinner
david@fromorbit.com
_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2015-12-20 19:30 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-12-20 12:36 Integer truncation in fs/xfs/libxfs/xfs_da_btree.c Kristian
2015-12-20 19:29 ` Dave Chinner
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.