Skip to content

Commit 2251588

Browse files
Shigeru Yoshidabrauner
authored andcommitted
reiserfs: Replace 1-element array with C99 style flex-array
UBSAN found the following issue: ================================================================================ UBSAN: array-index-out-of-bounds in fs/reiserfs/journal.c:4166:22 index 1 is out of range for type '__le32 [1]' This is because struct reiserfs_journal_desc uses 1-element array for dynamically sized array member, j_realblock. This patch fixes this issue by replacing the 1-element array member with C99 style flex-array. This patch also fixes the same issue in struct reiserfs_journal_commit as the same manner. Fixes: f466c6f ("move private bits of reiserfs_fs.h to fs/reiserfs/reiserfs.h") Signed-off-by: Shigeru Yoshida <syoshida@redhat.com> Message-Id: <20230821043312.1444068-1-syoshida@redhat.com> Signed-off-by: Christian Brauner <brauner@kernel.org>
1 parent 0bb80ec commit 2251588

1 file changed

Lines changed: 3 additions & 3 deletions

File tree

fs/reiserfs/reiserfs.h

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2699,7 +2699,7 @@ struct reiserfs_iget_args {
26992699
#define get_journal_desc_magic(bh) (bh->b_data + bh->b_size - 12)
27002700

27012701
#define journal_trans_half(blocksize) \
2702-
((blocksize - sizeof (struct reiserfs_journal_desc) + sizeof (__u32) - 12) / sizeof (__u32))
2702+
((blocksize - sizeof(struct reiserfs_journal_desc) - 12) / sizeof(__u32))
27032703

27042704
/* journal.c see journal.c for all the comments here */
27052705

@@ -2711,7 +2711,7 @@ struct reiserfs_journal_desc {
27112711
__le32 j_len;
27122712

27132713
__le32 j_mount_id; /* mount id of this trans */
2714-
__le32 j_realblock[1]; /* real locations for each block */
2714+
__le32 j_realblock[]; /* real locations for each block */
27152715
};
27162716

27172717
#define get_desc_trans_id(d) le32_to_cpu((d)->j_trans_id)
@@ -2726,7 +2726,7 @@ struct reiserfs_journal_desc {
27262726
struct reiserfs_journal_commit {
27272727
__le32 j_trans_id; /* must match j_trans_id from the desc block */
27282728
__le32 j_len; /* ditto */
2729-
__le32 j_realblock[1]; /* real locations for each block */
2729+
__le32 j_realblock[]; /* real locations for each block */
27302730
};
27312731

27322732
#define get_commit_trans_id(c) le32_to_cpu((c)->j_trans_id)

0 commit comments

Comments
 (0)