ubifs query

[David Oberhollenzer]

On 01/11/2016 04:07 PM, pavi1729 wrote:
> Hi,
>   I was looking at 'ubifs_lookup_level0' which is calling 'tnc_prev' function.
> 
> LINK: http://lxr.free-electrons.com/source/fs/ubifs/tnc.c?v=3.10#L1267
> 

The code you link to is _quite_ old (June 2013?). If you want to browse through the
source you might want to look at the current state from the git repo.

> FUNCTION: tnc_prev
> 'tnc_prev' could return a negative 'n' if znode->iip is 0.
> 
> LINK: http://lxr.free-electrons.com/source/fs/ubifs/tnc.c?v=3.10#L670
> 
> nn = znode->iip - 1;

No. Neither in the current version nor in the version your refered to. If nn is set
to a negative value, the branch below is skipped an the loop does not terminate, i.e.
goes into the next iteration where a new value for nn is computed. Assuming nn will
always come out negative, zp will eventually become NULL and the function returns -ENOENT.

At this point, ubifs_lookup_level0 detects an error, sets *n to -1 and returns 0.

> If n is negative then below code will do a negative indexing since
> this is the next line
> 
> if (keys_cmp(c, key, &znode->zbranch[*n].key)) {
> 
> LINK: http://lxr.free-electrons.com/source/fs/ubifs/tnc.c?v=3.10#L1275
> 
> 
> Is this a possibility ?

See above.


Sincerely,

David