Re: [PATCH] btrfs: fix out of bounds array access while reading extent buffer

On 2019/6/14 下午7:51, Young Xiao wrote: > There is a corner case that slips through the checkers in functions > reading extent buffer, ie. > > if (start < eb->len) and (start + len > eb->len), then: > the checkers in read_extent_buffer_to_user(), and memcmp_extent_buffer() > WARN_ON(start > eb->l

[PATCH] btrfs: fix out of bounds array access while reading extent buffer

There is a corner case that slips through the checkers in functions reading extent buffer, ie. if (start < eb->len) and (start + len > eb->len), then: the checkers in read_extent_buffer_to_user(), and memcmp_extent_buffer() WARN_ON(start > eb->len) and WARN_ON(start + len > eb->start + eb->len), b

Re: [PATCH] Btrfs: fix out of bounds array access while reading extent buffer

Hi Liu, [auto build test WARNING on v4.13-rc4] [also build test WARNING on next-20170811] [cannot apply to btrfs/next] [if your patch is applied to the wrong git tree, please drop us a note to help improve the system] url: https://github.com/0day-ci/linux/commits/Liu-Bo/Btrfs-fix-out-of-boun

Re: [PATCH] Btrfs: fix out of bounds array access while reading extent buffer

On Tue, Aug 8, 2017 at 6:05 PM, Liu Bo wrote: > Hi Filipe, > > On Tue, Aug 08, 2017 at 09:47:21AM +0100, Filipe Manana wrote: >> On Mon, Aug 7, 2017 at 8:39 PM, Liu Bo wrote: >> > There is a cornel case that slip through the checkers in functions >> > reading extent buffer, ie. >> > >> > if (star

Re: [PATCH] Btrfs: fix out of bounds array access while reading extent buffer

Hi Filipe, On Tue, Aug 08, 2017 at 09:47:21AM +0100, Filipe Manana wrote: > On Mon, Aug 7, 2017 at 8:39 PM, Liu Bo wrote: > > There is a cornel case that slip through the checkers in functions > > reading extent buffer, ie. > > > > if (start < eb->len) and (start + len > eb->len), > > then > > >

Re: [PATCH] Btrfs: fix out of bounds array access while reading extent buffer

On Mon, Aug 7, 2017 at 8:39 PM, Liu Bo wrote: > There is a cornel case that slip through the checkers in functions > reading extent buffer, ie. > > if (start < eb->len) and (start + len > eb->len), > then > > a) map_private_extent_buffer() returns immediately because > it's thinking the range span

[PATCH] Btrfs: fix out of bounds array access while reading extent buffer

There is a cornel case that slip through the checkers in functions reading extent buffer, ie. if (start < eb->len) and (start + len > eb->len), then a) map_private_extent_buffer() returns immediately because it's thinking the range spans across two pages, b) and the checkers in read_extent_buffe