From: Andreas Dilger <adilger@dilger.ca> To: Dan Carpenter <dan.carpenter@oracle.com> Cc: Theodore Ts'o <tytso@mit.edu>, Ext4 Developers List <linux-ext4@vger.kernel.org>, kernel-janitors@vger.kernel.org Subject: Re: [PATCH] ext4: prevent very high s_inode_readahead_blks Date: Mon, 11 Feb 2019 13:38:59 -0700 [thread overview] Message-ID: <A695FC57-D150-42A9-9E55-32DC8D1AED76@dilger.ca> (raw) In-Reply-To: <20190211184459.GB22106@kadam> [-- Attachment #1: Type: text/plain, Size: 1948 bytes --] On Feb 11, 2019, at 11:44 AM, Dan Carpenter <dan.carpenter@oracle.com> wrote: > > My static checker complains that "arg" can be negative. That does seem > possible. I don't know if it causes an issue at run time but it seems > safest to allow negatives. The option declaration requires that "arg" be greater than zero: {Opt_inode_readahead_blks, 2, MOPT_GTE0}, and this is checked earlier in handle_mount_opt(): if (args->from && (m->flags & MOPT_GTE0) && (arg < 0)) return -1; but I agree that having false static checking warnings is annoying and potentially also hides other issues. > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > --- > fs/ext4/super.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/fs/ext4/super.c b/fs/ext4/super.c > index 60da0a6e4d86..4e0845708c52 100644 > --- a/fs/ext4/super.c > +++ b/fs/ext4/super.c > @@ -1838,7 +1838,7 @@ static int handle_mount_opt(struct super_block *sb, > } else if (token == Opt_min_batch_time) { > sbi->s_min_batch_time = arg; > } else if (token == Opt_inode_readahead_blks) { > - if (arg && (arg > (1 << 30) || !is_power_of_2(arg))) { > + if (arg && (arg > (1U << 30) || !is_power_of_2(arg))) { This may "fix" the problem by virtue of implicitly forcing an unsigned comparison, but doesn't necessarily make the issue more obvious to the reader. That said, it doesn't look like _any_ use of "arg" allows a negative value, regardless of whether MOPT_GTE0 is set or not, so we should just declare arg as an unsigned int or explicitly refuse all negatives: if (args->from && !(m->flags & MOPT_STRING)) { if (match_int(args, &arg)) return -1; if (arg < 0) return -1; } This should keep the static checker happy, since the only place that "arg" is set away from zero it is also verified not to be negative. At that point it would also be possible to remove MOPT_GTE0 completely. Cheers, Andreas [-- Attachment #2: Message signed with OpenPGP --] [-- Type: application/pgp-signature, Size: 873 bytes --]
WARNING: multiple messages have this Message-ID (diff)
From: Andreas Dilger <adilger@dilger.ca> To: Dan Carpenter <dan.carpenter@oracle.com> Cc: Theodore Ts'o <tytso@mit.edu>, Ext4 Developers List <linux-ext4@vger.kernel.org>, kernel-janitors@vger.kernel.org Subject: Re: [PATCH] ext4: prevent very high s_inode_readahead_blks Date: Mon, 11 Feb 2019 20:38:59 +0000 [thread overview] Message-ID: <A695FC57-D150-42A9-9E55-32DC8D1AED76@dilger.ca> (raw) In-Reply-To: <20190211184459.GB22106@kadam> [-- Attachment #1: Type: text/plain, Size: 1948 bytes --] On Feb 11, 2019, at 11:44 AM, Dan Carpenter <dan.carpenter@oracle.com> wrote: > > My static checker complains that "arg" can be negative. That does seem > possible. I don't know if it causes an issue at run time but it seems > safest to allow negatives. The option declaration requires that "arg" be greater than zero: {Opt_inode_readahead_blks, 2, MOPT_GTE0}, and this is checked earlier in handle_mount_opt(): if (args->from && (m->flags & MOPT_GTE0) && (arg < 0)) return -1; but I agree that having false static checking warnings is annoying and potentially also hides other issues. > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > --- > fs/ext4/super.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/fs/ext4/super.c b/fs/ext4/super.c > index 60da0a6e4d86..4e0845708c52 100644 > --- a/fs/ext4/super.c > +++ b/fs/ext4/super.c > @@ -1838,7 +1838,7 @@ static int handle_mount_opt(struct super_block *sb, > } else if (token == Opt_min_batch_time) { > sbi->s_min_batch_time = arg; > } else if (token == Opt_inode_readahead_blks) { > - if (arg && (arg > (1 << 30) || !is_power_of_2(arg))) { > + if (arg && (arg > (1U << 30) || !is_power_of_2(arg))) { This may "fix" the problem by virtue of implicitly forcing an unsigned comparison, but doesn't necessarily make the issue more obvious to the reader. That said, it doesn't look like _any_ use of "arg" allows a negative value, regardless of whether MOPT_GTE0 is set or not, so we should just declare arg as an unsigned int or explicitly refuse all negatives: if (args->from && !(m->flags & MOPT_STRING)) { if (match_int(args, &arg)) return -1; if (arg < 0) return -1; } This should keep the static checker happy, since the only place that "arg" is set away from zero it is also verified not to be negative. At that point it would also be possible to remove MOPT_GTE0 completely. Cheers, Andreas [-- Attachment #2: Message signed with OpenPGP --] [-- Type: application/pgp-signature, Size: 873 bytes --]
next prev parent reply other threads:[~2019-02-11 20:39 UTC|newest] Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-02-11 18:44 [PATCH] ext4: prevent very high s_inode_readahead_blks Dan Carpenter 2019-02-11 18:44 ` Dan Carpenter 2019-02-11 20:38 ` Andreas Dilger [this message] 2019-02-11 20:38 ` Andreas Dilger
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=A695FC57-D150-42A9-9E55-32DC8D1AED76@dilger.ca \ --to=adilger@dilger.ca \ --cc=dan.carpenter@oracle.com \ --cc=kernel-janitors@vger.kernel.org \ --cc=linux-ext4@vger.kernel.org \ --cc=tytso@mit.edu \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.