LinuxLists.cc - [PATCH] fix array index out of bound exception

2021-08-11 13:16:54

Subject: [PATCH] fix array index out of bound exception

From: "F.A.Sulaiman" <[email protected]>

Array index out of bound exception occurs when the 'part' variable is passed into the freeSpactTable array,
this can be avoided using pointer arithmetic.

Signed-off-by: F.A. SULAIMAN <[email protected]>
---
fs/udf/super.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/udf/super.c b/fs/udf/super.c
index 2f83c1204e20..d330c7162c3a 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -2522,7 +2522,7 @@ static unsigned int udf_count_free(struct super_block *sb)
sbi->s_lvid_bh->b_data;
if (le32_to_cpu(lvid->numOfPartitions) > part) {
accum = le32_to_cpu(
- lvid->freeSpaceTable[part]);
+ (lvid->freeSpaceTable + part));
if (accum == 0xFFFFFFFF)
accum = 0;
}
--
2.17.1

2021-08-11 15:01:51

by Jan Kara

[permalink] [raw]

Subject: Re: [PATCH] fix array index out of bound exception

On Wed 11-08-21 18:41:50, F.A. SULAIMAN wrote:
> From: "F.A.Sulaiman" <[email protected]>
>
> Array index out of bound exception occurs when the 'part' variable is
> passed into the freeSpactTable array, this can be avoided using pointer
> arithmetic.
>
> Signed-off-by: F.A. SULAIMAN <[email protected]>

I'm sorry but this doesn't even compile and the change is obviously
bogus...

Honza

> ---
> fs/udf/super.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/udf/super.c b/fs/udf/super.c
> index 2f83c1204e20..d330c7162c3a 100644
> --- a/fs/udf/super.c
> +++ b/fs/udf/super.c
> @@ -2522,7 +2522,7 @@ static unsigned int udf_count_free(struct super_block *sb)
> sbi->s_lvid_bh->b_data;
> if (le32_to_cpu(lvid->numOfPartitions) > part) {
> accum = le32_to_cpu(
> - lvid->freeSpaceTable[part]);
> + (lvid->freeSpaceTable + part));
> if (accum == 0xFFFFFFFF)
> accum = 0;
> }
> --
> 2.17.1
>
--
Jan Kara <[email protected]>
SUSE Labs, CR

2021-08-11 16:41:45

by kernel test robot

[permalink] [raw]

Subject: Re: [PATCH] fix array index out of bound exception

Attachments:

(No filename) (6.02 kB)
.config.gz (35.50 kB)
Download all attachments

2021-08-11 17:25:43

by kernel test robot

[permalink] [raw]

Subject: Re: [PATCH] fix array index out of bound exception

Attachments:

(No filename) (6.74 kB)
.config.gz (33.93 kB)
Download all attachments

2021-08-11 17:28:00

by kernel test robot

[permalink] [raw]

Subject: Re: [PATCH] fix array index out of bound exception

Hi SULAIMAN",

Thank you for the patch! Perhaps something to improve:

[auto build test WARNING on linus/master]
[also build test WARNING on v5.14-rc5 next-20210811]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url: https://github.com/0day-ci/linux/commits/F-A-SULAIMAN/fix-array-index-out-of-bound-exception/20210811-211453
base: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 761c6d7ec820f123b931e7b8ef7ec7c8564e450f
config: sparc64-randconfig-r026-20210811 (attached as .config)
compiler: sparc64-linux-gcc (GCC) 10.3.0
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://github.com/0day-ci/linux/commit/3c70bc4978e0cb74c7ba5189c093ecccf4564925
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review F-A-SULAIMAN/fix-array-index-out-of-bound-exception/20210811-211453
git checkout 3c70bc4978e0cb74c7ba5189c093ecccf4564925
# save the attached .config to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-10.3.0 make.cross ARCH=sparc64

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <[email protected]>

All warnings (new ones prefixed by >>):

In file included from include/linux/swab.h:5,
from include/uapi/linux/byteorder/big_endian.h:13,
from include/linux/byteorder/big_endian.h:5,
from arch/sparc/include/uapi/asm/byteorder.h:5,
from arch/sparc/include/asm/bitops_64.h:16,
from arch/sparc/include/asm/bitops.h:5,
from include/linux/bitops.h:32,
from include/linux/kernel.h:12,
from include/linux/list.h:9,
from include/linux/wait.h:7,
from include/linux/wait_bit.h:8,
from include/linux/fs.h:6,
from fs/udf/udfdecl.h:10,
from fs/udf/super.c:41:
fs/udf/super.c: In function 'udf_count_free':
>> include/uapi/linux/byteorder/big_endian.h:34:50: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast]
34 | #define __le32_to_cpu(x) __swab32((__force __u32)(__le32)(x))
| ^
include/uapi/linux/swab.h:118:32: note: in definition of macro '__swab32'
118 | (__builtin_constant_p((__u32)(x)) ? \
| ^
include/linux/byteorder/generic.h:89:21: note: in expansion of macro '__le32_to_cpu'
89 | #define le32_to_cpu __le32_to_cpu
| ^~~~~~~~~~~~~
fs/udf/super.c:2524:12: note: in expansion of macro 'le32_to_cpu'
2524 | accum = le32_to_cpu(
| ^~~~~~~~~~~
>> include/uapi/linux/byteorder/big_endian.h:34:50: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast]
34 | #define __le32_to_cpu(x) __swab32((__force __u32)(__le32)(x))
| ^
include/uapi/linux/swab.h:19:12: note: in definition of macro '___constant_swab32'
19 | (((__u32)(x) & (__u32)0x000000ffUL) << 24) | \
| ^
include/uapi/linux/byteorder/big_endian.h:34:26: note: in expansion of macro '__swab32'
34 | #define __le32_to_cpu(x) __swab32((__force __u32)(__le32)(x))
| ^~~~~~~~
include/linux/byteorder/generic.h:89:21: note: in expansion of macro '__le32_to_cpu'
89 | #define le32_to_cpu __le32_to_cpu
| ^~~~~~~~~~~~~
fs/udf/super.c:2524:12: note: in expansion of macro 'le32_to_cpu'
2524 | accum = le32_to_cpu(
| ^~~~~~~~~~~
>> include/uapi/linux/byteorder/big_endian.h:34:50: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast]
34 | #define __le32_to_cpu(x) __swab32((__force __u32)(__le32)(x))
| ^
include/uapi/linux/swab.h:20:12: note: in definition of macro '___constant_swab32'
20 | (((__u32)(x) & (__u32)0x0000ff00UL) << 8) | \
| ^
include/uapi/linux/byteorder/big_endian.h:34:26: note: in expansion of macro '__swab32'
34 | #define __le32_to_cpu(x) __swab32((__force __u32)(__le32)(x))
| ^~~~~~~~
include/linux/byteorder/generic.h:89:21: note: in expansion of macro '__le32_to_cpu'
89 | #define le32_to_cpu __le32_to_cpu
| ^~~~~~~~~~~~~
fs/udf/super.c:2524:12: note: in expansion of macro 'le32_to_cpu'
2524 | accum = le32_to_cpu(
| ^~~~~~~~~~~
>> include/uapi/linux/byteorder/big_endian.h:34:50: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast]
34 | #define __le32_to_cpu(x) __swab32((__force __u32)(__le32)(x))
| ^
include/uapi/linux/swab.h:21:12: note: in definition of macro '___constant_swab32'
21 | (((__u32)(x) & (__u32)0x00ff0000UL) >> 8) | \
| ^
include/uapi/linux/byteorder/big_endian.h:34:26: note: in expansion of macro '__swab32'
34 | #define __le32_to_cpu(x) __swab32((__force __u32)(__le32)(x))
| ^~~~~~~~
include/linux/byteorder/generic.h:89:21: note: in expansion of macro '__le32_to_cpu'
89 | #define le32_to_cpu __le32_to_cpu
| ^~~~~~~~~~~~~
fs/udf/super.c:2524:12: note: in expansion of macro 'le32_to_cpu'
2524 | accum = le32_to_cpu(
| ^~~~~~~~~~~
>> include/uapi/linux/byteorder/big_endian.h:34:50: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast]
34 | #define __le32_to_cpu(x) __swab32((__force __u32)(__le32)(x))
| ^
include/uapi/linux/swab.h:22:12: note: in definition of macro '___constant_swab32'
22 | (((__u32)(x) & (__u32)0xff000000UL) >> 24)))
| ^
include/uapi/linux/byteorder/big_endian.h:34:26: note: in expansion of macro '__swab32'
34 | #define __le32_to_cpu(x) __swab32((__force __u32)(__le32)(x))
| ^~~~~~~~
include/linux/byteorder/generic.h:89:21: note: in expansion of macro '__le32_to_cpu'
89 | #define le32_to_cpu __le32_to_cpu
| ^~~~~~~~~~~~~
fs/udf/super.c:2524:12: note: in expansion of macro 'le32_to_cpu'
2524 | accum = le32_to_cpu(
| ^~~~~~~~~~~
>> include/uapi/linux/byteorder/big_endian.h:34:50: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast]
34 | #define __le32_to_cpu(x) __swab32((__force __u32)(__le32)(x))
| ^
include/uapi/linux/swab.h:120:12: note: in definition of macro '__swab32'
120 | __fswab32(x))
| ^
include/linux/byteorder/generic.h:89:21: note: in expansion of macro '__le32_to_cpu'
89 | #define le32_to_cpu __le32_to_cpu
| ^~~~~~~~~~~~~
fs/udf/super.c:2524:12: note: in expansion of macro 'le32_to_cpu'
2524 | accum = le32_to_cpu(
| ^~~~~~~~~~~

vim +34 include/uapi/linux/byteorder/big_endian.h

5921e6f8809b16 David Howells 2012-10-13 14
5921e6f8809b16 David Howells 2012-10-13 15 #define __constant_htonl(x) ((__force __be32)(__u32)(x))
5921e6f8809b16 David Howells 2012-10-13 16 #define __constant_ntohl(x) ((__force __u32)(__be32)(x))
5921e6f8809b16 David Howells 2012-10-13 17 #define __constant_htons(x) ((__force __be16)(__u16)(x))
5921e6f8809b16 David Howells 2012-10-13 18 #define __constant_ntohs(x) ((__force __u16)(__be16)(x))
5921e6f8809b16 David Howells 2012-10-13 19 #define __constant_cpu_to_le64(x) ((__force __le64)___constant_swab64((x)))
5921e6f8809b16 David Howells 2012-10-13 20 #define __constant_le64_to_cpu(x) ___constant_swab64((__force __u64)(__le64)(x))
5921e6f8809b16 David Howells 2012-10-13 21 #define __constant_cpu_to_le32(x) ((__force __le32)___constant_swab32((x)))
5921e6f8809b16 David Howells 2012-10-13 22 #define __constant_le32_to_cpu(x) ___constant_swab32((__force __u32)(__le32)(x))
5921e6f8809b16 David Howells 2012-10-13 23 #define __constant_cpu_to_le16(x) ((__force __le16)___constant_swab16((x)))
5921e6f8809b16 David Howells 2012-10-13 24 #define __constant_le16_to_cpu(x) ___constant_swab16((__force __u16)(__le16)(x))
5921e6f8809b16 David Howells 2012-10-13 25 #define __constant_cpu_to_be64(x) ((__force __be64)(__u64)(x))
5921e6f8809b16 David Howells 2012-10-13 26 #define __constant_be64_to_cpu(x) ((__force __u64)(__be64)(x))
5921e6f8809b16 David Howells 2012-10-13 27 #define __constant_cpu_to_be32(x) ((__force __be32)(__u32)(x))
5921e6f8809b16 David Howells 2012-10-13 28 #define __constant_be32_to_cpu(x) ((__force __u32)(__be32)(x))
5921e6f8809b16 David Howells 2012-10-13 29 #define __constant_cpu_to_be16(x) ((__force __be16)(__u16)(x))
5921e6f8809b16 David Howells 2012-10-13 30 #define __constant_be16_to_cpu(x) ((__force __u16)(__be16)(x))
5921e6f8809b16 David Howells 2012-10-13 31 #define __cpu_to_le64(x) ((__force __le64)__swab64((x)))
5921e6f8809b16 David Howells 2012-10-13 32 #define __le64_to_cpu(x) __swab64((__force __u64)(__le64)(x))
5921e6f8809b16 David Howells 2012-10-13 33 #define __cpu_to_le32(x) ((__force __le32)__swab32((x)))
5921e6f8809b16 David Howells 2012-10-13 @34 #define __le32_to_cpu(x) __swab32((__force __u32)(__le32)(x))
5921e6f8809b16 David Howells 2012-10-13 35 #define __cpu_to_le16(x) ((__force __le16)__swab16((x)))
5921e6f8809b16 David Howells 2012-10-13 36 #define __le16_to_cpu(x) __swab16((__force __u16)(__le16)(x))
5921e6f8809b16 David Howells 2012-10-13 37 #define __cpu_to_be64(x) ((__force __be64)(__u64)(x))
5921e6f8809b16 David Howells 2012-10-13 38 #define __be64_to_cpu(x) ((__force __u64)(__be64)(x))
5921e6f8809b16 David Howells 2012-10-13 39 #define __cpu_to_be32(x) ((__force __be32)(__u32)(x))
5921e6f8809b16 David Howells 2012-10-13 40 #define __be32_to_cpu(x) ((__force __u32)(__be32)(x))
5921e6f8809b16 David Howells 2012-10-13 41 #define __cpu_to_be16(x) ((__force __be16)(__u16)(x))
5921e6f8809b16 David Howells 2012-10-13 42 #define __be16_to_cpu(x) ((__force __u16)(__be16)(x))
5921e6f8809b16 David Howells 2012-10-13 43

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/[email protected]

Attachments:

(No filename) (10.80 kB)
.config.gz (32.91 kB)
Download all attachments