Received-SPF: pass (google.com: domain of linux-ext4-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Andreas Dilger <adilger@dilger.ca>
Message-Id: <9322DADB-8C6F-4595-AB6E-A92F627CDC82@dilger.ca>
Content-Type: multipart/signed;
 boundary="Apple-Mail=_A4FC813E-9D6C-4F8A-A294-89BD4933F8E2";
 protocol="application/pgp-signature"; micalg=pgp-sha256
Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\))
Subject: Re: [PATCH 1/1] ext4: fix potential negative array index in
 do_split()
Date:   Thu, 18 Jun 2020 18:33:50 -0600
In-Reply-To: <f53e246b-647c-64bb-16ec-135383c70ad7@redhat.com>
Cc:     "linux-ext4@vger.kernel.org" <linux-ext4@vger.kernel.org>
To:     Eric Sandeen <sandeen@redhat.com>
References: <d08d63e9-8f74-b571-07c7-828b9629ce6a@redhat.com>
 <f53e246b-647c-64bb-16ec-135383c70ad7@redhat.com>
Sender: linux-ext4-owner@vger.kernel.org
Precedence: bulk


--Apple-Mail=_A4FC813E-9D6C-4F8A-A294-89BD4933F8E2
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii

On Jun 17, 2020, at 1:19 PM, Eric Sandeen <sandeen@redhat.com> wrote:
>=20
> If for any reason a directory passed to do_split() does not have =
enough
> active entries to exceed half the size of the block, we can end up
> iterating over all "count" entries without finding a split point.
>=20
> In this case, count =3D=3D move, and split will be zero, and we will
> attempt a negative index into map[].
>=20
> Guard against this by detecting this case, and falling back to
> split-to-half-of-count instead; in this case we will still have
> plenty of space (> half blocksize) in each split block.
>=20
> Fixes: ef2b02d3e617 ("ext34: ensure do_split leaves enough free space =
in both blocks")
> Signed-off-by: Eric Sandeen <sandeen@redhat.com>

Reviewed-by: Andreas Dilger <adilger@dilger.ca>

> ---
>=20
> diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
> index a8aca4772aaa..8b60881f07ee 100644
> --- a/fs/ext4/namei.c
> +++ b/fs/ext4/namei.c
> @@ -1858,7 +1858,7 @@ static struct ext4_dir_entry_2 =
*do_split(handle_t *handle, struct inode *dir,
> 			     blocksize, hinfo, map);
> 	map -=3D count;
> 	dx_sort_map(map, count);
> -	/* Split the existing block in the middle, size-wise */
> +	/* Ensure that neither split block is over half full */
> 	size =3D 0;
> 	move =3D 0;
> 	for (i =3D count-1; i >=3D 0; i--) {
> @@ -1868,8 +1868,18 @@ static struct ext4_dir_entry_2 =
*do_split(handle_t *handle, struct inode *dir,
> 		size +=3D map[i].size;
> 		move++;
> 	}
> -	/* map index at which we will split */
> -	split =3D count - move;
> +	/*
> +	 * map index at which we will split
> +	 *
> +	 * If the sum of active entries didn't exceed half the block =
size, just
> +	 * split it in half by count; each resulting block will have at =
least
> +	 * half the space free.
> +	 */
> +	if (i > 0)
> +		split =3D count - move;
> +	else
> +		split =3D count/2;
> +
> 	hash2 =3D map[split].hash;
> 	continued =3D hash2 =3D=3D map[split - 1].hash;
> 	dxtrace(printk(KERN_INFO "Split block %lu at %x, %i/%i\n",
>=20
>=20


Cheers, Andreas


--Apple-Mail=_A4FC813E-9D6C-4F8A-A294-89BD4933F8E2
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP

-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org

iQIzBAEBCAAdFiEEDb73u6ZejP5ZMprvcqXauRfMH+AFAl7sB+4ACgkQcqXauRfM
H+Aw5Q//V2VVirDRQx+jHGVeKywFA/brLzxEyJKfMT3E7Txi3Nv16HM4iPGpWTif
lzplhl/H5aHn6DyvW5rVAnMzSiq9SLFctfzpX1UYZYhNvsq1rd9f5dX3iLy4AVPl
UCJnp2EPjKd6WYBndj0w5hNa/P+goRZFERTOJH8NnG22+FnVrDnDZaSZqgWqWX+G
JZ4Ozx98fWsjbpUXff8pI5rvJKzWlOE9eN5uGYi7phGOszWpG28KIOzM8LDLiEBM
HJD+Acc9rkMzjN7/6+mG8Le7F26VnZ+wgFltRvvMrf92pYaZRfqZccOzO37MHmbi
L+6TULvXd7FGLROXdeAJp7J8ARyY+a/YOraf9xH/oekwn2DwZnbl1i/OWL5ppyuR
hCniZCICDooaBEwQEP0STI2YJtS9ABWiv+dwCsod3rOIupH7ARPEpDe87TJ7L+Su
60YPIdchYKs03WVC8OBkEEWkfgQie9Bzh79ves65Xp84sfwGlseWiqovIac/CcCo
Fl9EZML6HBqY1Q7Yz0moGWhwDJhywdzGs1jF0ZLlibXJIcazEt/CaReGDjNsvbS0
Pya3PMHPhEQQOGpTs2LAFS8JR25cTSCShuKX0IiRq4XHbX++sg3q1r6iRdVe+hZ6
mdc85nPKuhiLY1bJHKb0mOZ4oilNEIvAca8LPn75DqpqHt44qFw=
=MUns
-----END PGP SIGNATURE-----

--Apple-Mail=_A4FC813E-9D6C-4F8A-A294-89BD4933F8E2--