Skip to contentSkip to conversation

ext4: off by one check in ext4_groupinfo_create_slab()

PATCH In review Dan Carpenter 3 participants 3 messages Feb 9, 2011 – Feb 11, 2011

Subsystems (2)
Kernel janitors ext4 file system
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 ext4: off by one check in ext4_groupinfo_create_slab()

If cache_index = NR_GRPINFO_CACHES then we read past the end of the ext4_groupinfo_caches[] array a couple lines later.

Signed-off-by Dan Carpenter <[email protected]>
fs/ext4/mballoc.c +1 -1
index 02cff4a..d1fe09a 100644
@@ -2438,7 +2438,7 @@ static int ext4_groupinfo_create_slab(size_t size)
 	int cache_index = blocksize_bits - EXT4_MIN_BLOCK_LOG_SIZE;
 	struct kmem_cache *cachep;
 
-	if (cache_index > NR_GRPINFO_CACHES)
+	if (cache_index >= NR_GRPINFO_CACHES)
 		return -EINVAL;
 
 	if (unlikely(cache_index < 0))
Reviewed-by on v1 1/1
#1 lore raw
Quoted 4 lines · Dan Carpenter

If cache_index = NR_GRPINFO_CACHES then we read past the end of the ext4_groupinfo_caches[] array a couple lines later.

Signed-off-by Dan Carpenter <[email protected]>

Argh, you'd think I could cut and paste from jbd2 better :(

Thanks,

Reviewed-by Eric Sandeen <[email protected]>
Quoted 17 lines
fs/ext4/mballoc.c +1 -2
index 02cff4a..d1fe09a 100644
@@ -2438,7 +2438,7 @@ static int ext4_groupinfo_create_slab(size_t size)
 	int cache_index = blocksize_bits - EXT4_MIN_BLOCK_LOG_SIZE;
 	struct kmem_cache *cachep;
 
-	if (cache_index > NR_GRPINFO_CACHES)
+	if (cache_index >= NR_GRPINFO_CACHES)
 		return -EINVAL;
 
 	if (unlikely(cache_index < 0))
--

To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html