[PATCH] UBIFS: fix assertion in layout_in_gaps()

Path	csiph.com!eternal-september.org!feeder.eternal-september.org!aioe.org!gothmog.csi.it!bofh.it!news.nic.it!robomod
From	Vincent Stehlé <vincent.stehle@intel.com>
Newsgroups	linux.kernel
Subject	[PATCH] UBIFS: fix assertion in layout_in_gaps()
Date	Fri, 12 Aug 2016 15:30:01 +0200
Message-ID	<s5kH7-2ca-5@gated-at.bofh.it> (permalink)
X-Extloop1	1
X-Ironport-Av	E=Sophos;i="5.28,510,1464678000"; d="scan'208";a="1034456563"
X-Mailer	git-send-email 2.8.1
MIME-Version	1.0
Content-Type	text/plain; charset=UTF-8
Content-Transfer-Encoding	8bit
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	28
Organization	linux.* mail to news gateway
X-Original-Cc	linux-kernel@vger.kernel.org, Vincent Stehlé <vincent.stehle@intel.com>, Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
X-Original-Date	Fri, 12 Aug 2016 15:26:30 +0200
X-Original-Message-ID	<1471008390-19227-1-git-send-email-vincent.stehle@intel.com>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1461176

Show key headers only | View raw

An assertion in layout_in_gaps() verifies that the gap_lebs pointer is
below the maximum bound. When computing this maximum bound the idx_lebs
count is multiplied by sizeof(int), while C pointers arithmetic does take
into account the size of the pointed elements implicitly already. Remove
the multiplication to fix the assertion.

Fixes: 1e51764a3c2ac05a ("UBIFS: add new flash file system")
Signed-off-by: Vincent Stehlé <vincent.stehle@intel.com>
Cc: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
---
 fs/ubifs/tnc_commit.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ubifs/tnc_commit.c b/fs/ubifs/tnc_commit.c
index b45345d..51157da 100644
--- a/fs/ubifs/tnc_commit.c
+++ b/fs/ubifs/tnc_commit.c
@@ -370,7 +370,7 @@ static int layout_in_gaps(struct ubifs_info *c, int cnt)
 
 	p = c->gap_lebs;
 	do {
-		ubifs_assert(p < c->gap_lebs + sizeof(int) * c->lst.idx_lebs);
+		ubifs_assert(p < c->gap_lebs + c->lst.idx_lebs);
 		written = layout_leb_in_gaps(c, p);
 		if (written < 0) {
 			err = written;
-- 
2.8.1

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[PATCH] UBIFS: fix assertion in layout_in_gaps() Vincent Stehlé <vincent.stehle@intel.com> - 2016-08-12 15:30 +0200
  Re: [PATCH] UBIFS: fix assertion in layout_in_gaps() Artem Bityutskiy <artem.bityutskiy@linux.intel.com> - 2016-08-12 17:50 +0200
  Re: [PATCH] UBIFS: fix assertion in layout_in_gaps() Richard Weinberger <richard.weinberger@gmail.com> - 2016-08-14 11:10 +0200
    Re: [PATCH] UBIFS: fix assertion in layout_in_gaps() Vincent Stehlé <vincent.stehle@intel.com> - 2016-08-16 09:40 +0200

csiph-web