Messages in this thread | | | Subject | Re: [bug report] f2fs: off by one in garbage collection functions | From | Jaegeuk Kim <> | Date | Mon, 21 Jan 2013 09:58:15 +0900 |
| |
Hi,
2013-01-18 (금), 16:29 +0300, Dan Carpenter: > Hello Jaegeuk Kim, > > The patch 7bc0900347e0: "f2fs: add garbage collection functions" from > Nov 2, 2012, has an off-by-one bug. > > 429 block_t start_bidx_of_node(unsigned int node_ofs) > 430 { > 431 unsigned int indirect_blks = 2 * NIDS_PER_BLOCK + 4; > 432 unsigned int bidx; > 433 > 434 if (node_ofs == 0) > 435 return 0; > 436 > 437 if (node_ofs <= 2) { > 438 bidx = node_ofs - 1; > 439 } else if (node_ofs <= indirect_blks) { > 440 int dec = (node_ofs - 4) / (NIDS_PER_BLOCK + 1); > > If node_ofs == 3 here then (node_ofs - 4) is a very high positive > number. We divide by 1019 and we get another still very high number but > not so high that it is negative when cast as an int.
If the node_ofs is equal to 3, then it's a run-time bug on its caller, gc_data_segment(), not here itself.
In gc_data_segment(), 1. check_dnode(&nofs); 2. start_bidx_of_node(nofs);
Here, it means that we don't care about indirect node pages whose node offsets are 3, 3+1018+1, (3+1018+1)+1018+1, and so on. (Ref. *Index Structure* in Document/filesystems/f2fs.txt) Instead, we just check direct node pages only.
But, anyway, I'd better write comments to make it clear. Thank you for reviewing.
-- Jaegeuk Kim Samsung [unhandled content-type:application/pgp-signature] | |