From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752814AbcHLN0x (ORCPT ); Fri, 12 Aug 2016 09:26:53 -0400 Received: from mga14.intel.com ([192.55.52.115]:19966 "EHLO mga14.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751982AbcHLN0v (ORCPT ); Fri, 12 Aug 2016 09:26:51 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.28,510,1464678000"; d="scan'208";a="1034456563" From: =?UTF-8?q?Vincent=20Stehl=C3=A9?= To: linux-mtd@lists.infradead.org Cc: linux-kernel@vger.kernel.org, =?UTF-8?q?Vincent=20Stehl=C3=A9?= , Artem Bityutskiy Subject: [PATCH] UBIFS: fix assertion in layout_in_gaps() Date: Fri, 12 Aug 2016 15:26:30 +0200 Message-Id: <1471008390-19227-1-git-send-email-vincent.stehle@intel.com> X-Mailer: git-send-email 2.8.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org An assertion in layout_in_gaps() verifies that the gap_lebs pointer is below the maximum bound. When computing this maximum bound the idx_lebs count is multiplied by sizeof(int), while C pointers arithmetic does take into account the size of the pointed elements implicitly already. Remove the multiplication to fix the assertion. Fixes: 1e51764a3c2ac05a ("UBIFS: add new flash file system") Signed-off-by: Vincent Stehlé Cc: Artem Bityutskiy --- fs/ubifs/tnc_commit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/ubifs/tnc_commit.c b/fs/ubifs/tnc_commit.c index b45345d..51157da 100644 --- a/fs/ubifs/tnc_commit.c +++ b/fs/ubifs/tnc_commit.c @@ -370,7 +370,7 @@ static int layout_in_gaps(struct ubifs_info *c, int cnt) p = c->gap_lebs; do { - ubifs_assert(p < c->gap_lebs + sizeof(int) * c->lst.idx_lebs); + ubifs_assert(p < c->gap_lebs + c->lst.idx_lebs); written = layout_leb_in_gaps(c, p); if (written < 0) { err = written; -- 2.8.1