ext4: prevent very high s_inode_readahead_blks

Message ID 20190211184459.GB22106@kadam
State New
Headers show
Series
  • ext4: prevent very high s_inode_readahead_blks
Related show

Commit Message

Dan Carpenter Feb. 11, 2019, 6:44 p.m.
My static checker complains that "arg" can be negative.  That does seem
possible.  I don't know if it causes an issue at run time but it seems
safest to allow negatives.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 fs/ext4/super.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Andreas Dilger Feb. 11, 2019, 8:38 p.m. | #1
On Feb 11, 2019, at 11:44 AM, Dan Carpenter <dan.carpenter@oracle.com> wrote:
> 
> My static checker complains that "arg" can be negative.  That does seem
> possible.  I don't know if it causes an issue at run time but it seems
> safest to allow negatives.

The option declaration requires that "arg" be greater than zero:

        {Opt_inode_readahead_blks, 2, MOPT_GTE0},

and this is checked earlier in handle_mount_opt():

        if (args->from && (m->flags & MOPT_GTE0) && (arg < 0))
                return -1;

but I agree that having false static checking warnings is annoying
and potentially also hides other issues.

> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> fs/ext4/super.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/ext4/super.c b/fs/ext4/super.c
> index 60da0a6e4d86..4e0845708c52 100644
> --- a/fs/ext4/super.c
> +++ b/fs/ext4/super.c
> @@ -1838,7 +1838,7 @@ static int handle_mount_opt(struct super_block *sb,
> 	} else if (token == Opt_min_batch_time) {
> 		sbi->s_min_batch_time = arg;
> 	} else if (token == Opt_inode_readahead_blks) {
> -		if (arg && (arg > (1 << 30) || !is_power_of_2(arg))) {
> +		if (arg && (arg > (1U << 30) || !is_power_of_2(arg))) {

This may "fix" the problem by virtue of implicitly forcing an unsigned
comparison, but doesn't necessarily make the issue more obvious to the
reader.

That said, it doesn't look like _any_ use of "arg" allows a negative
value, regardless of whether MOPT_GTE0 is set or not, so we should
just declare arg as an unsigned int or explicitly refuse all negatives:

	if (args->from && !(m->flags & MOPT_STRING)) {
		if (match_int(args, &arg))
			return -1;
		if (arg < 0)
			return -1;
	}

This should keep the static checker happy, since the only place that
"arg" is set away from zero it is also verified not to be negative.
At that point it would also be possible to remove MOPT_GTE0 completely.

Cheers, Andreas

Patch

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 60da0a6e4d86..4e0845708c52 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1838,7 +1838,7 @@  static int handle_mount_opt(struct super_block *sb, char *opt, int token,
 	} else if (token == Opt_min_batch_time) {
 		sbi->s_min_batch_time = arg;
 	} else if (token == Opt_inode_readahead_blks) {
-		if (arg && (arg > (1 << 30) || !is_power_of_2(arg))) {
+		if (arg && (arg > (1U << 30) || !is_power_of_2(arg))) {
 			ext4_msg(sb, KERN_ERR,
 				 "EXT4-fs: inode_readahead_blks must be "
 				 "0 or a power of 2 smaller than 2^31");