| Message ID | 20110209232412.GC4384@bicker |
|---|---|
| State | Accepted, archived |
| Headers | show |
On 2/9/11 5:24 PM, Dan Carpenter wrote: > If cache_index == NR_GRPINFO_CACHES then we read past the end of the > ext4_groupinfo_caches[] array a couple lines later. > > Signed-off-by: Dan Carpenter <error27@gmail.com> Argh, you'd think I could cut and paste from jbd2 better :( Thanks, Reviewed-by: Eric Sandeen <sandeen@redhat.com> > diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c > index 02cff4a..d1fe09a 100644 > --- a/fs/ext4/mballoc.c > +++ b/fs/ext4/mballoc.c > @@ -2438,7 +2438,7 @@ static int ext4_groupinfo_create_slab(size_t size) > int cache_index = blocksize_bits - EXT4_MIN_BLOCK_LOG_SIZE; > struct kmem_cache *cachep; > > - if (cache_index > NR_GRPINFO_CACHES) > + if (cache_index >= NR_GRPINFO_CACHES) > return -EINVAL; > > if (unlikely(cache_index < 0)) > -- > To unsubscribe from this list: send the line "unsubscribe linux-ext4" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Thu, Feb 10, 2011 at 02:24:12AM +0300, Dan Carpenter wrote: > If cache_index == NR_GRPINFO_CACHES then we read past the end of the > ext4_groupinfo_caches[] array a couple lines later. > > Signed-off-by: Dan Carpenter <error27@gmail.com> Oops, thanks for pointing that out! Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> - Ted -- To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index 02cff4a..d1fe09a 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -2438,7 +2438,7 @@ static int ext4_groupinfo_create_slab(size_t size) int cache_index = blocksize_bits - EXT4_MIN_BLOCK_LOG_SIZE; struct kmem_cache *cachep; - if (cache_index > NR_GRPINFO_CACHES) + if (cache_index >= NR_GRPINFO_CACHES) return -EINVAL; if (unlikely(cache_index < 0))
If cache_index == NR_GRPINFO_CACHES then we read past the end of the ext4_groupinfo_caches[] array a couple lines later. Signed-off-by: Dan Carpenter <error27@gmail.com> -- To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html