Skip to content

Fix lookup and overflow in simplefs_ext_search#86

Open
RoyWFHuang wants to merge 1 commit into
sysprog21:masterfrom
RoyWFHuang:bug/issue76
Open

Fix lookup and overflow in simplefs_ext_search#86
RoyWFHuang wants to merge 1 commit into
sysprog21:masterfrom
RoyWFHuang:bug/issue76

Conversation

@RoyWFHuang

@RoyWFHuang RoyWFHuang commented Jun 14, 2026

Copy link
Copy Markdown
Collaborator

The final hit check used 'iblock < end_len' instead of 'iblock < end_block + end_len', so a block in any extent not starting at block 0 was missed and returned as the unused 'boundary' slot (read as a hole, or overwritten on write).

Also, return -1 when the extent array is full, instead of returning the out-of-bounds, SIMPLEFS_MAX_EXTENTS

Actually, this code is never executed: simplefs_ext_search is only reachable through simplefs_file_get_block, which is wired into the page-cache aops (readahead/readpage/write_begin). Since read()/write() on master don't use the page cache at all, the buggy function is effectively dead code.

So if we really want to test this code, we can use "readahead" to reach it.

Here is an example:

  1. Create a file larger than 8*4096 bytes, e.g.:
head -c 36864 /dev/zero | tr '\0' 'A' | sudo tee data.test >/dev/null
  1. Use this code to read it:
#define _GNU_SOURCE
#include <fcntl.h>
#include <sys/stat.h>
#include <unistd.h>

int main(int argc, char **argv)
{
    int fd = open(argv[1], O_RDONLY);
    struct stat st;
    fstat(fd, &st);
    readahead(fd, 0, st.st_size);
    close(fd);
    return 0;
}

Close #76


Summary by cubic

Fix extent lookup and overflow in simplefs_ext_search to correctly match blocks within extents and avoid out-of-bounds indices. Prevents false holes and unintended overwrites. Fixes #76.

  • Bug Fixes
    • Use iblock < end_block + end_len to check final hit, instead of iblock < end_len.
    • Return -1 when the extent array is full, instead of SIMPLEFS_MAX_EXTENTS.

Written for commit 8895361. Summary will update on new commits.

Review in cubic

The final hit check used 'iblock < end_len' instead of
'iblock < end_block + end_len', so a block in any extent not
starting at block 0 was missed and returned as the unused
'boundary' slot (read as a hole, or overwritten on write).

Also return -1 when the extent array is full, instead of the
out-of-bounds 'boundary' == SIMPLEFS_MAX_EXTENTS.

Close sysprog21#76

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 1 file

Re-trigger cubic

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Incorrect boundary check in simplefs_ext_search()

1 participant