lkml.org 
[lkml]   [2013]   [Jan]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [bug report] f2fs: off by one in garbage collection functions
From
Date
Hi,

2013-01-18 (금), 16:29 +0300, Dan Carpenter:
> Hello Jaegeuk Kim,
>
> The patch 7bc0900347e0: "f2fs: add garbage collection functions" from
> Nov 2, 2012, has an off-by-one bug.
>
> 429 block_t start_bidx_of_node(unsigned int node_ofs)
> 430 {
> 431 unsigned int indirect_blks = 2 * NIDS_PER_BLOCK + 4;
> 432 unsigned int bidx;
> 433
> 434 if (node_ofs == 0)
> 435 return 0;
> 436
> 437 if (node_ofs <= 2) {
> 438 bidx = node_ofs - 1;
> 439 } else if (node_ofs <= indirect_blks) {
> 440 int dec = (node_ofs - 4) / (NIDS_PER_BLOCK + 1);
>
> If node_ofs == 3 here then (node_ofs - 4) is a very high positive
> number. We divide by 1019 and we get another still very high number but
> not so high that it is negative when cast as an int.

If the node_ofs is equal to 3, then it's a run-time bug on its caller,
gc_data_segment(), not here itself.

In gc_data_segment(),
1. check_dnode(&nofs);
2. start_bidx_of_node(nofs);

Here, it means that we don't care about indirect node pages whose node
offsets are 3, 3+1018+1, (3+1018+1)+1018+1, and so on.
(Ref. *Index Structure* in Document/filesystems/f2fs.txt)
Instead, we just check direct node pages only.

But, anyway, I'd better write comments to make it clear.
Thank you for reviewing.

--
Jaegeuk Kim
Samsung
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2013-01-21 02:41    [W:0.039 / U:1.204 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site