xfs
[Top] [All Lists]

[PATCH 4/4] xfs_repair: fix left-shift overflows

To: xfs@xxxxxxxxxxx
Subject: [PATCH 4/4] xfs_repair: fix left-shift overflows
From: Eric Sandeen <sandeen@xxxxxxxxxxx>
Date: Thu, 8 Oct 2015 19:27:21 -0500
Delivered-to: xfs@xxxxxxxxxxx
In-reply-to: <56170906.5090301@xxxxxxxxxx>
References: <56170906.5090301@xxxxxxxxxx>
User-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:38.0) Gecko/20100101 Thunderbird/38.3.0
pmask in struct parent_list is a __uint64_t, but in some places
we populated it with "1LL << shift" where shift could be up
to 63; this really needs to be a 1ULL type for this to be correct.

Also spotted by libubsan...

The code in prefetch.c has another issue with large fs blocks
(32 or 64k) because it shifts by up to 128 bits, but that's left
for later...

Signed-off-by: Eric Sandeen <sandeen@xxxxxxxxxx>
---
 repair/incore_ino.c |   14 +++++++-------
 repair/prefetch.c   |    2 +-
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/repair/incore_ino.c b/repair/incore_ino.c
index 32d7678..1898257 100644
--- a/repair/incore_ino.c
+++ b/repair/incore_ino.c
@@ -625,7 +625,7 @@ set_inode_parent(
                else
                        irec->ino_un.plist = ptbl;
 
-               ptbl->pmask = 1LL << offset;
+               ptbl->pmask = 1ULL << offset;
                ptbl->pentries = (xfs_ino_t*)memalign(sizeof(xfs_ino_t),
                                                        sizeof(xfs_ino_t));
                if (!ptbl->pentries)
@@ -638,8 +638,8 @@ set_inode_parent(
                return;
        }
 
-       if (ptbl->pmask & (1LL << offset))  {
-               bitmask = 1LL;
+       if (ptbl->pmask & (1ULL << offset))  {
+               bitmask = 1ULL;
                target = 0;
 
                for (i = 0; i < offset; i++)  {
@@ -655,7 +655,7 @@ set_inode_parent(
                return;
        }
 
-       bitmask = 1LL;
+       bitmask = 1ULL;
        cnt = target = 0;
 
        for (i = 0; i < XFS_INODES_PER_CHUNK; i++)  {
@@ -691,7 +691,7 @@ set_inode_parent(
        ptbl->cnt++;
 #endif
        ptbl->pentries[target] = parent;
-       ptbl->pmask |= (1LL << offset);
+       ptbl->pmask |= (1ULL << offset);
 }
 
 xfs_ino_t
@@ -707,8 +707,8 @@ get_inode_parent(ino_tree_node_t *irec, int offset)
        else
                ptbl = irec->ino_un.plist;
 
-       if (ptbl->pmask & (1LL << offset))  {
-               bitmask = 1LL;
+       if (ptbl->pmask & (1ULL << offset))  {
+               bitmask = 1ULL;
                target = 0;
 
                for (i = 0; i < offset; i++)  {
diff --git a/repair/prefetch.c b/repair/prefetch.c
index 52238ca..b11dcb3 100644
--- a/repair/prefetch.c
+++ b/repair/prefetch.c
@@ -762,7 +762,7 @@ pf_queuing_worker(
                         * sparse state in cluster sized chunks as cluster size
                         * is the min. granularity of sparse irec regions.
                         */
-                       if ((sparse & ((1 << inodes_per_cluster) - 1)) == 0)
+                       if ((sparse & ((1ULL << inodes_per_cluster) - 1)) == 0)
                                pf_queue_io(args, &map, 1,
                                            (cur_irec->ino_isa_dir != 0) ?
                                             B_DIR_INODE : B_INODE);
-- 
1.7.1

<Prev in Thread] Current Thread [Next in Thread>