Skip to contentSkip to conversation

ocfs2: fix recent memory corruption bug

PATCH New Dan Carpenter 2 participants 6 messages Aug 1, 2013 – Aug 2, 2013 OCFS2

lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 ocfs2: fix recent memory corruption bug

The pointer math in 6fdf3af1d2 "ocfs2: fix null pointer dereference in ocfs2_dir_foreach_blk_id()" isn't correct so it will zero out the wrong memory.

Signed-off-by Dan Carpenter <[email protected]>

---
Static checker stuff.

fs/ocfs2/dir.c +1 -2
index c91d986..6942c22 100644
@@ -2157,8 +2157,7 @@ int ocfs2_empty_dir(struct inode *inode)
 		.ctx.pos = 0,
 	};
 
-	memset(&priv + sizeof(struct dir_context), 0,
-	       sizeof(priv) - sizeof(struct dir_context));
+	memset(&priv.seen_dot, 0, sizeof(priv) - sizeof(struct dir_context));
 
 	if (ocfs2_dir_indexed(inode)) {
 		ret = ocfs2_empty_dir_dx(inode, &priv);
author
#1 lore raw

PATCH 1/1 ocfs2: fix recent memory corruption bug

Quoted 4 lines · Dan Carpenter

The pointer math in 6fdf3af1d2 "ocfs2: fix null pointer dereference in ocfs2_dir_foreach_blk_id()" isn't correct so it will zero out the wrong memory.

I sent this patch prematurely... Really the memset is not needed because the values are already initialized to zero. Let me send a v2 patch that removes the memset.

Sorry, I just wanted to fix this right away because of the memory corruption.

regards,
dan carpenter

author
#2 lore raw

PATCH v2 1/1 ocfs2: fix recent memory corruption bug

The pointer math in 6fdf3af1d2 "ocfs2: fix null pointer dereference in ocfs2_dir_foreach_blk_id()" isn't correct so it will zero out the wrong memory. In fact, the memset isn't needed because the initializer will set all these values to zero.

Signed-off-by Dan Carpenter <[email protected]>

---
v2: remove the memset

fs/ocfs2/dir.c +0 -3
index c91d986..b1748cd 100644
@@ -2157,9 +2157,6 @@ int ocfs2_empty_dir(struct inode *inode)
 		.ctx.pos = 0,
 	};
 
-	memset(&priv + sizeof(struct dir_context), 0,
-	       sizeof(priv) - sizeof(struct dir_context));
-
 	if (ocfs2_dir_indexed(inode)) {
 		ret = ocfs2_empty_dir_dx(inode, &priv);
 		if (ret)
#3 lore raw

PATCH v2 1/1 ocfs2: fix recent memory corruption bug

Quoted 14 lines · Dan Carpenter

The pointer math in 6fdf3af1d2 "ocfs2: fix null pointer dereference in ocfs2_dir_foreach_blk_id()" isn't correct so it will zero out the wrong memory. In fact, the memset isn't needed because the initializer will set all these values to zero.

Signed-off-by Dan Carpenter <[email protected]>

---
v2: remove the memset

fs/ocfs2/dir.c +0 -0
index c91d986..b1748cd 100644

fs/ocfs2/dir.c int ocfs2_empty_dir(struct inode *inode) · line 2157

Quoted 1 line
fs/ocfs2/dir.c +0 -0
@@ -2157,9 +2157,6 @@ int ocfs2_empty_dir(struct inode *inode)
 		.ctx.pos = 0,

Umm, so above line could be removed as well.

Thanks,
-Jeff

Quoted 8 lines
fs/ocfs2/dir.c +0 -3
 	};
 
-	memset(&priv + sizeof(struct dir_context), 0,
-	       sizeof(priv) - sizeof(struct dir_context));
-
 	if (ocfs2_dir_indexed(inode)) {
 		ret = ocfs2_empty_dir_dx(inode, &priv);
 		if (ret)
author
#4 lore raw

PATCH v3 1/1 ocfs2: ocfs2: fix recent memory corruption bug

The pointer math in 6fdf3af1d2 "ocfs2: fix null pointer dereference in ocfs2_dir_foreach_blk_id()" isn't correct so it will zero out the wrong memory. In fact, the memset isn't needed because the initializer will set all these values to zero.

This patch also removes the "ctx.pos = 0" initialization because that will be zeroed automatically as well.

Signed-off-by Dan Carpenter <[email protected]>

---
v2: remove the memset
v3: remove the ctx.pos = 0.

fs/ocfs2/dir.c +0 -4
index c91d986..30544ce 100644
@@ -2154,12 +2154,8 @@ int ocfs2_empty_dir(struct inode *inode)
 	int ret;
 	struct ocfs2_empty_dir_priv priv = {
 		.ctx.actor = ocfs2_empty_dir_filldir,
-		.ctx.pos = 0,
 	};
 
-	memset(&priv + sizeof(struct dir_context), 0,
-	       sizeof(priv) - sizeof(struct dir_context));
-
 	if (ocfs2_dir_indexed(inode)) {
 		ret = ocfs2_empty_dir_dx(inode, &priv);
 		if (ret)
#5 lore raw

PATCH v3 1/1 ocfs2: ocfs2: fix recent memory corruption bug

Quoted 7 lines · Dan Carpenter

The pointer math in 6fdf3af1d2 "ocfs2: fix null pointer dereference in ocfs2_dir_foreach_blk_id()" isn't correct so it will zero out the wrong memory. In fact, the memset isn't needed because the initializer will set all these values to zero.

This patch also removes the "ctx.pos = 0" initialization because that will be zeroed automatically as well.

Looks good, thank you for correcting my previous mistake.

Acked-by Jie Liu <[email protected]>
Quoted 23 lines
Signed-off-by Dan Carpenter <[email protected]>

---
v2: remove the memset
v3: remove the ctx.pos = 0.

fs/ocfs2/dir.c +0 -4
index c91d986..30544ce 100644
@@ -2154,12 +2154,8 @@ int ocfs2_empty_dir(struct inode *inode)
 	int ret;
 	struct ocfs2_empty_dir_priv priv = {
 		.ctx.actor = ocfs2_empty_dir_filldir,
-		.ctx.pos = 0,
 	};
 
-	memset(&priv + sizeof(struct dir_context), 0,
-	       sizeof(priv) - sizeof(struct dir_context));
-
 	if (ocfs2_dir_indexed(inode)) {
 		ret = ocfs2_empty_dir_dx(inode, &priv);
 		if (ret)