mail archive of the barebox mailing list
 help / color / mirror / Atom feed
* [PATCH] fs: fix NULL pointer dereference in ramfs_truncate
@ 2018-10-03 11:42 Marcin Niestroj
  2018-10-08  7:54 ` Sascha Hauer
  0 siblings, 1 reply; 2+ messages in thread
From: Marcin Niestroj @ 2018-10-03 11:42 UTC (permalink / raw)
  To: barebox; +Cc: Marcin Niestroj

This patch fixes lately introduced speed improvement of ramfs_truncate
function. Number of chunks were passed to ramfs_find_chunk function,
which returned NULL as result. Chunks are indexed from 0, hence we
need to pass (number_of_chunks - 1) to get pointer to the last chunk.

Fixes: d49dd1d840d7 ("fs: improve ramfs_truncate speed")
Signed-off-by: Marcin Niestroj <m.niestroj@grinn-global.com>
---
Hi,

Just few words to clarify where this bug come from.

We are fixing now patch [1], which was rebased on top of patch [2].
Simple file transfer using fastboot protocol worked fine in such
configuration. However it turned out that [2] had bug (`newchunks = 1`
instead of `oldchunks = 1`). After [2] was fixed it turned out that
[1] has also bug, which results in NULL pointer dereference during
file upload with fastboot protocol.

Patch tested on `next` branch.

[1] http://lists.infradead.org/pipermail/barebox/2018-September/034859.html
[2] http://lists.infradead.org/pipermail/barebox/2018-September/034855.html

 fs/ramfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ramfs.c b/fs/ramfs.c
index bad126c65..84ecfa0dd 100644
--- a/fs/ramfs.c
+++ b/fs/ramfs.c
@@ -380,7 +380,7 @@ static int ramfs_truncate(struct device_d *dev, FILE *f, ulong size)
 
 	if (newchunks > oldchunks) {
 		if (data) {
-			data = ramfs_find_chunk(node, oldchunks);
+			data = ramfs_find_chunk(node, oldchunks - 1);
 		} else {
 			node->data = ramfs_get_chunk();
 			if (!node->data)
-- 
2.19.0


_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2018-10-08  7:54 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-10-03 11:42 [PATCH] fs: fix NULL pointer dereference in ramfs_truncate Marcin Niestroj
2018-10-08  7:54 ` Sascha Hauer

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox