From patchwork Tue Apr 23 13:00:42 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Theodore Ts'o X-Patchwork-Id: 238904 Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 900322C016A for ; Tue, 23 Apr 2013 23:00:54 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755535Ab3DWNAx (ORCPT ); Tue, 23 Apr 2013 09:00:53 -0400 Received: from li9-11.members.linode.com ([67.18.176.11]:43844 "EHLO imap.thunk.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755187Ab3DWNAw (ORCPT ); Tue, 23 Apr 2013 09:00:52 -0400 Received: from root (helo=closure.thunk.org) by imap.thunk.org with local-esmtp (Exim 4.80) (envelope-from ) id 1UUcqV-0006vR-At; Tue, 23 Apr 2013 13:01:19 +0000 Received: by closure.thunk.org (Postfix, from userid 15806) id 0D22658245C; Tue, 23 Apr 2013 09:00:42 -0400 (EDT) Date: Tue, 23 Apr 2013 09:00:42 -0400 From: Theodore Ts'o To: Linus Torvalds Cc: Ingo Molnar , "H. Peter Anvin" , Thomas Gleixner , David Miller , Linux Kernel Mailing List , the arch/x86 maintainers , Network Development , "linux-ext4@vger.kernel.org" Subject: Re: Unsigned widening casts of binary "not" operations.. Message-ID: <20130423130041.GB31170@thunk.org> Mail-Followup-To: Theodore Ts'o , Linus Torvalds , Ingo Molnar , "H. Peter Anvin" , Thomas Gleixner , David Miller , Linux Kernel Mailing List , the arch/x86 maintainers , Network Development , "linux-ext4@vger.kernel.org" References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) X-SA-Exim-Connect-IP: X-SA-Exim-Mail-From: tytso@thunk.org X-SA-Exim-Scanned: No (on imap.thunk.org); SAEximRunCond expanded to false Sender: linux-ext4-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-ext4@vger.kernel.org On Mon, Apr 22, 2013 at 05:15:19PM -0700, Linus Torvalds wrote: > Here's a ext4 code snippet that looks like an actual bug (but seems to only > hit read-ahead): > > ext4_fsblk_t b, block; > > b = block & ~(EXT4_SB(sb)->s_inode_readahead_blks-1); > > where "b" actually ends up having the upper bits cleared, because the > s_inode_readahead_blks thing is an unsigned int, so you're masking off not > just the low bits, but the high bits too. Ted? Of course, it's just > read-ahead, so it probably doesn't matter, but. Yep, it's a bug alright. Thanks for catching it! - Ted From 0d606e2c9fccdd4e67febf1e2da500e1bfe9e045 Mon Sep 17 00:00:00 2001 From: Theodore Ts'o Date: Tue, 23 Apr 2013 08:59:35 -0400 Subject: [PATCH] ext4: fix type-widening bug in inode table readahead code Due to a missing cast, the high 32-bits of a 64-bit block number used when calculating the readahead block for inode tables can get lost. This means we can end up fetching the wrong blocks for readahead for file systems > 16TB. Linus found this when experimenting with an enhacement to the sparse static code checker which checks for missing widening casts before binary "not" operators. Reported-by: Linus Torvalds Signed-off-by: "Theodore Ts'o" --- fs/ext4/inode.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index d7518e2..793d44b 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -4011,13 +4011,14 @@ make_io: if (EXT4_SB(sb)->s_inode_readahead_blks) { ext4_fsblk_t b, end, table; unsigned num; + __u32 ra_blks = EXT4_SB(sb)->s_inode_readahead_blks; table = ext4_inode_table(sb, gdp); /* s_inode_readahead_blks is always a power of 2 */ - b = block & ~(EXT4_SB(sb)->s_inode_readahead_blks-1); + b = block & ~((ext4_fsblk_t) ra_blks - 1); if (table > b) b = table; - end = b + EXT4_SB(sb)->s_inode_readahead_blks; + end = b + ra_blks; num = EXT4_INODES_PER_GROUP(sb); if (ext4_has_group_desc_csum(sb)) num -= ext4_itable_unused_count(sb, gdp);