diff mbox

[3/4] Fixing unaligned memory accesses.

Message ID 1411261282-26831-3-git-send-email-xnox@debian.org (mailing list archive)
State New, archived
Headers show

Commit Message

Dimitri John Ledkov Sept. 21, 2014, 1:01 a.m. UTC
From: Shawn Landen <shawnlandden@gmail.com>

Bug-Debian: http://bugs.debian.org/656955
Signed-off-by: Dimitri John Ledkov <xnox@debian.org>
---
 ctree.h   | 18 ++++++++++++++----
 volumes.c |  5 +++--
 2 files changed, 17 insertions(+), 6 deletions(-)

Comments

David Sterba Sept. 22, 2014, 1:03 p.m. UTC | #1
On Sun, Sep 21, 2014 at 02:01:21AM +0100, Dimitri John Ledkov wrote:
> From: Shawn Landen <shawnlandden@gmail.com>
> 
> Bug-Debian: http://bugs.debian.org/656955

The bug seems old (2012) and agains 0.19. We've fixed a few unaligned
access bugs in the meantime. Can you please retest with 3.16?

> --- a/ctree.h
> +++ b/ctree.h
> @@ -19,6 +19,8 @@
>  #ifndef __BTRFS__
>  #define __BTRFS__
>  
> +#include <stdint.h>
> +
>  #if BTRFS_FLAT_INCLUDES
>  #include "list.h"
>  #include "kerncompat.h"
> @@ -1191,13 +1193,17 @@ struct btrfs_root {
>  static inline u##bits btrfs_##name(const struct extent_buffer *eb)	\
>  {									\
>  	const struct btrfs_header *h = (struct btrfs_header *)eb->data;	\
> -	return le##bits##_to_cpu(h->member);				\
> +	uint##bits##_t t;						\
> +	memcpy(&t, &h->member, sizeof(h->member));			\
> +	return le##bits##_to_cpu(t);					\

The change to memcpy is safe, the compiler is smart enough to not emit
any memcpy call for x86_64 and there's no change to the leXX_to_cpu
macros.

However, I'd like to check first if this is really necessary due to the
old version in the bugreport. I'd prefer using the u8/.../u64 types
instead of the stdint.h ones, for sake of consistency with the rest of
the codebase.

> --- a/volumes.c
> +++ b/volumes.c
> @@ -472,10 +472,11 @@ static int find_next_chunk(struct btrfs_root *root, u64 objectid, u64 *offset)
>  		if (found_key.objectid != objectid)
>  			*offset = 0;
>  		else {
> +			u64 t;
>  			chunk = btrfs_item_ptr(path->nodes[0], path->slots[0],
>  					       struct btrfs_chunk);
> -			*offset = found_key.offset +
> -				btrfs_chunk_length(path->nodes[0], chunk);
> +			t = found_key.offset + btrfs_chunk_length(path->nodes[0], chunk);
> +			memcpy(offset, &t, sizeof(found_key.offset));

That's not enough, there are more direct assignments to *offset in that
function. The preferred way is to add 'put_unaligned' helper into
kerncompat.h and use it.
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/ctree.h b/ctree.h
index fa73c4a..92c6ad3 100644
--- a/ctree.h
+++ b/ctree.h
@@ -19,6 +19,8 @@ 
 #ifndef __BTRFS__
 #define __BTRFS__
 
+#include <stdint.h>
+
 #if BTRFS_FLAT_INCLUDES
 #include "list.h"
 #include "kerncompat.h"
@@ -1191,13 +1193,17 @@  struct btrfs_root {
 static inline u##bits btrfs_##name(const struct extent_buffer *eb)	\
 {									\
 	const struct btrfs_header *h = (struct btrfs_header *)eb->data;	\
-	return le##bits##_to_cpu(h->member);				\
+	uint##bits##_t t;						\
+	memcpy(&t, &h->member, sizeof(h->member));			\
+	return le##bits##_to_cpu(t);					\
 }									\
 static inline void btrfs_set_##name(struct extent_buffer *eb,		\
 				    u##bits val)			\
 {									\
 	struct btrfs_header *h = (struct btrfs_header *)eb->data;	\
-	h->member = cpu_to_le##bits(val);				\
+	uint##bits##_t t;						\
+	t = cpu_to_le##bits(val);					\
+	memcpy(&h->member, &t, sizeof(h->member));			\
 }
 
 #define BTRFS_SETGET_FUNCS(name, type, member, bits)			\
@@ -1219,11 +1225,15 @@  static inline void btrfs_set_##name(struct extent_buffer *eb,		\
 #define BTRFS_SETGET_STACK_FUNCS(name, type, member, bits)		\
 static inline u##bits btrfs_##name(const type *s)			\
 {									\
-	return le##bits##_to_cpu(s->member);				\
+	uint##bits##_t t;						\
+	memcpy(&t, &s->member, sizeof(s->member));			\
+	return le##bits##_to_cpu(t);					\
 }									\
 static inline void btrfs_set_##name(type *s, u##bits val)		\
 {									\
-	s->member = cpu_to_le##bits(val);				\
+	uint##bits##_t t;						\
+	t = cpu_to_le##bits(val);					\
+	memcpy(&s->member, &t, sizeof(s->member));			\
 }
 
 BTRFS_SETGET_FUNCS(device_type, struct btrfs_dev_item, type, 64);
diff --git a/volumes.c b/volumes.c
index 388c94e..102380b 100644
--- a/volumes.c
+++ b/volumes.c
@@ -472,10 +472,11 @@  static int find_next_chunk(struct btrfs_root *root, u64 objectid, u64 *offset)
 		if (found_key.objectid != objectid)
 			*offset = 0;
 		else {
+			u64 t;
 			chunk = btrfs_item_ptr(path->nodes[0], path->slots[0],
 					       struct btrfs_chunk);
-			*offset = found_key.offset +
-				btrfs_chunk_length(path->nodes[0], chunk);
+			t = found_key.offset + btrfs_chunk_length(path->nodes[0], chunk);
+			memcpy(offset, &t, sizeof(found_key.offset));
 		}
 	}
 	ret = 0;