From: Fox Chen <foxhlchen@gmail.com>
To: Andrew Price <anprice@redhat.com>
Cc: rpeterso@redhat.com, agruenba@redhat.com,
cluster-devel@redhat.com, Greg KH <gregkh@linuxfoundation.org>,
linux-kernel@vger.kernel.org
Subject: Re: [Cluster-devel] [PATCH] gfs2: gfs2_read_sb: put gfs2_assert inside the loop
Date: Mon, 5 Oct 2020 22:08:04 +0800 [thread overview]
Message-ID: <CAC2o3D+X48sR4kFi9nS_atpTuSRWDnX92RD3uCUeh9AHXGnaNw@mail.gmail.com> (raw)
In-Reply-To: <ca694fc8-5f1b-ebf0-b891-c9a20225704f@redhat.com>
On Mon, Oct 5, 2020 at 9:23 PM Andrew Price <anprice@redhat.com> wrote:
>
> On 03/10/2020 07:31, Fox Chen wrote:
> > for (x = 2;; x++) {
> > ...
> > gfs2_assert(sdp, x <= GFS2_MAX_META_HEIGHT); <--- after
> > ...
> > if (d != sdp->sd_heightsize[x - 1] || m)
> > break;
> > sdp->sd_heightsize[x] = space;
> > }
> >
> > sdp->sd_max_height = x
> > gfs2_assert(sdp, sdp->sd_max_height <= GFS2_MAX_META_HEIGHT) <--- before
> >
> > Before this patch, gfs2_assert is put outside of the loop of
> > sdp->sd_heightsize[x] calculation. When something goes wrong,
>
> So this looks related to one of the recent syzbot reports, where the
> "something goes wrong" is the block size in the on-disk superblock was
> zeroed and that leads eventually to this out-of-bounds write. The
> correct fix in that case would be to add a validity check for the block
> size in gfs2_check_sb().
>
Yes, I saw this bug from the syzbot report and I though instead of
KASAN gfs2_assert should be able to catch it so I proposed this patch.
:)
thank you both for your comments.
fox
prev parent reply other threads:[~2020-10-05 14:08 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-03 6:31 [PATCH] gfs2: gfs2_read_sb: put gfs2_assert inside the loop Fox Chen
2020-10-05 12:59 ` Andreas Gruenbacher
2020-10-05 13:23 ` [Cluster-devel] " Andrew Price
2020-10-05 14:08 ` Fox Chen [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAC2o3D+X48sR4kFi9nS_atpTuSRWDnX92RD3uCUeh9AHXGnaNw@mail.gmail.com \
--to=foxhlchen@gmail.com \
--cc=agruenba@redhat.com \
--cc=anprice@redhat.com \
--cc=cluster-devel@redhat.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=rpeterso@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).