From: Sascha Hauer <s.hauer@pengutronix.de>
To: Marcin Niestroj <m.niestroj@grinn-global.com>
Cc: barebox@lists.infradead.org
Subject: Re: [PATCH] fs: fix NULL pointer dereference in ramfs_truncate
Date: Mon, 8 Oct 2018 09:54:10 +0200 [thread overview]
Message-ID: <20181008075410.zhrm5qbzadsmafiw@pengutronix.de> (raw)
In-Reply-To: <20181003114216.22102-1-m.niestroj@grinn-global.com>
On Wed, Oct 03, 2018 at 01:42:16PM +0200, Marcin Niestroj wrote:
> This patch fixes lately introduced speed improvement of ramfs_truncate
> function. Number of chunks were passed to ramfs_find_chunk function,
> which returned NULL as result. Chunks are indexed from 0, hence we
> need to pass (number_of_chunks - 1) to get pointer to the last chunk.
>
> Fixes: d49dd1d840d7 ("fs: improve ramfs_truncate speed")
> Signed-off-by: Marcin Niestroj <m.niestroj@grinn-global.com>
> ---
> Hi,
>
> Just few words to clarify where this bug come from.
>
> We are fixing now patch [1], which was rebased on top of patch [2].
> Simple file transfer using fastboot protocol worked fine in such
> configuration. However it turned out that [2] had bug (`newchunks = 1`
> instead of `oldchunks = 1`). After [2] was fixed it turned out that
> [1] has also bug, which results in NULL pointer dereference during
> file upload with fastboot protocol.
>
> Patch tested on `next` branch.
>
> [1] http://lists.infradead.org/pipermail/barebox/2018-September/034859.html
> [2] http://lists.infradead.org/pipermail/barebox/2018-September/034855.html
>
> fs/ramfs.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/ramfs.c b/fs/ramfs.c
> index bad126c65..84ecfa0dd 100644
> --- a/fs/ramfs.c
> +++ b/fs/ramfs.c
> @@ -380,7 +380,7 @@ static int ramfs_truncate(struct device_d *dev, FILE *f, ulong size)
>
> if (newchunks > oldchunks) {
> if (data) {
> - data = ramfs_find_chunk(node, oldchunks);
> + data = ramfs_find_chunk(node, oldchunks - 1);
Ok, makes sense. I squashed this into the original commit.
Thanks
Sascha
--
Pengutronix e.K. | |
Industrial Linux Solutions | http://www.pengutronix.de/ |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox
prev parent reply other threads:[~2018-10-08 7:54 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-10-03 11:42 Marcin Niestroj
2018-10-08 7:54 ` Sascha Hauer [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181008075410.zhrm5qbzadsmafiw@pengutronix.de \
--to=s.hauer@pengutronix.de \
--cc=barebox@lists.infradead.org \
--cc=m.niestroj@grinn-global.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox