[PATCH] fs: fix NULL pointer dereference in ramfs_truncate

[PATCH] fs: fix NULL pointer dereference in ramfs_truncate

[Marcin Niestroj]

This patch fixes lately introduced speed improvement of ramfs_truncate
function. Number of chunks were passed to ramfs_find_chunk function,
which returned NULL as result. Chunks are indexed from 0, hence we
need to pass (number_of_chunks - 1) to get pointer to the last chunk.

Fixes: d49dd1d840d7 ("fs: improve ramfs_truncate speed")
Signed-off-by: Marcin Niestroj <m.niestroj@grinn-global.com>
---
Hi,

Just few words to clarify where this bug come from.

We are fixing now patch [1], which was rebased on top of patch [2].
Simple file transfer using fastboot protocol worked fine in such
configuration. However it turned out that [2] had bug (`newchunks = 1`
instead of `oldchunks = 1`). After [2] was fixed it turned out that
[1] has also bug, which results in NULL pointer dereference during
file upload with fastboot protocol.

Patch tested on `next` branch.

[1] http://lists.infradead.org/pipermail/barebox/2018-September/034859.html
[2] http://lists.infradead.org/pipermail/barebox/2018-September/034855.html

 fs/ramfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ramfs.c b/fs/ramfs.c
index bad126c65..84ecfa0dd 100644
--- a/fs/ramfs.c
+++ b/fs/ramfs.c
@@ -380,7 +380,7 @@ static int ramfs_truncate(struct device_d *dev, FILE *f, ulong size)
 
 	if (newchunks > oldchunks) {
 		if (data) {
-			data = ramfs_find_chunk(node, oldchunks);
+			data = ramfs_find_chunk(node, oldchunks - 1);
 		} else {
 			node->data = ramfs_get_chunk();
 			if (!node->data)
-- 
2.19.0


_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox

Re: [PATCH] fs: fix NULL pointer dereference in ramfs_truncate

[Sascha Hauer]

On Wed, Oct 03, 2018 at 01:42:16PM +0200, Marcin Niestroj wrote:
> This patch fixes lately introduced speed improvement of ramfs_truncate
> function. Number of chunks were passed to ramfs_find_chunk function,
> which returned NULL as result. Chunks are indexed from 0, hence we
> need to pass (number_of_chunks - 1) to get pointer to the last chunk.
> 
> Fixes: d49dd1d840d7 ("fs: improve ramfs_truncate speed")
> Signed-off-by: Marcin Niestroj <m.niestroj@grinn-global.com>
> ---
> Hi,
> 
> Just few words to clarify where this bug come from.
> 
> We are fixing now patch [1], which was rebased on top of patch [2].
> Simple file transfer using fastboot protocol worked fine in such
> configuration. However it turned out that [2] had bug (`newchunks = 1`
> instead of `oldchunks = 1`). After [2] was fixed it turned out that
> [1] has also bug, which results in NULL pointer dereference during
> file upload with fastboot protocol.
> 
> Patch tested on `next` branch.
> 
> [1] http://lists.infradead.org/pipermail/barebox/2018-September/034859.html
> [2] http://lists.infradead.org/pipermail/barebox/2018-September/034855.html
> 
>  fs/ramfs.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/ramfs.c b/fs/ramfs.c
> index bad126c65..84ecfa0dd 100644
> --- a/fs/ramfs.c
> +++ b/fs/ramfs.c
> @@ -380,7 +380,7 @@ static int ramfs_truncate(struct device_d *dev, FILE *f, ulong size)
>  
>  	if (newchunks > oldchunks) {
>  		if (data) {
> -			data = ramfs_find_chunk(node, oldchunks);
> +			data = ramfs_find_chunk(node, oldchunks - 1);

Ok, makes sense. I squashed this into the original commit.

Thanks
  Sascha

-- 
Pengutronix e.K.                           |                             |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox