diff mbox

[U-Boot,v2,5/5] ext4: optimize direntlen loops

Message ID 1471940862-6663-6-git-send-email-michael@walle.cc
State Superseded
Delegated to: Tom Rini
Headers show

Commit Message

Michael Walle Aug. 23, 2016, 8:27 a.m. UTC 
direntlen is always >= 8. Therefore, the loop condition is always true.

Signed-off-by: Michael Walle <michael@walle.cc>
Suggested-by: Stefan Brüns <stefan.bruens@rwth-aachen.de>
---
 fs/ext4/ext4_common.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

Comments

Stefan Brüns Aug. 28, 2016, 8:55 p.m. UTC | #1 
On Dienstag, 23. August 2016 10:27:42 CEST Michael Walle wrote:
> direntlen is always >= 8. Therefore, the loop condition is always true.
> 
> Signed-off-by: Michael Walle <michael@walle.cc>
> Suggested-by: Stefan Brüns <stefan.bruens@rwth-aachen.de>

Thinking again about it, direntlen is read from disk, and as any outside data 
should be untrusted. In case the direntlen is 0, we get an infinite loop here.

Also see commit 54d68e9333ff65d135faac68fa01be4276f1371f :
fs: ext4: Prevent infinite loop in ext4fs_iterate_dir

So better drop this patch.

Kind regards,

Stefan
diff mbox

Patch

diff --git a/fs/ext4/ext4_common.c b/fs/ext4/ext4_common.c
index 4a003cf..9430a3b 100644
--- a/fs/ext4/ext4_common.c
+++ b/fs/ext4/ext4_common.c
@@ -420,7 +420,7 @@  restart:
 		goto fail;
 	dir = (struct ext2_dirent *)root_first_block_buffer;
 	totalbytes = 0;
-	while (le16_to_cpu(dir->direntlen) > 0) {
+	while (true) {
 		/*
 		 * blocksize-totalbytes because last directory length
 		 * i.e. dir->direntlen is free availble space in the
@@ -560,7 +560,7 @@  static int search_dir(struct ext2_inode *parent_inode, char *dirname)
 		dir = (struct ext2_dirent *)block_buffer;
 		ptr = (char *)dir;
 		totalbytes = 0;
-		while (le16_to_cpu(dir->direntlen) >= 0) {
+		while (true) {
 			/*
 			 * blocksize-totalbytes because last directory
 			 * length i.e.,*dir->direntlen is free availble
@@ -806,7 +806,7 @@  static int check_filename(char *filename, unsigned int blknr)
 	dir = (struct ext2_dirent *)root_first_block_buffer;
 	ptr = (char *)dir;
 	totalbytes = 0;
-	while (le16_to_cpu(dir->direntlen) >= 0) {
+	while (true) {
 		/*
 		 * blocksize-totalbytes because last
 		 * directory length i.e., *dir->direntlen