3.10-stable patches

added patches:
	nilfs2-fix-sanity-check-of-btree-level-in-nilfs_btree_root_broken.patch

diff --git a/queue-3.10/nilfs2-fix-sanity-check-of-btree-level-in-nilfs_btree_root_broken.patch b/queue-3.10/nilfs2-fix-sanity-check-of-btree-level-in-nilfs_btree_root_broken.patch
new file mode 100644 (file)
index 0000000..e99d3f1
--- /dev/null
+++ b/queue-3.10/nilfs2-fix-sanity-check-of-btree-level-in-nilfs_btree_root_broken.patch
@@ -0,0 +1,54 @@
+From d8fd150fe3935e1692bf57c66691e17409ebb9c1 Mon Sep 17 00:00:00 2001
+From: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Date: Tue, 5 May 2015 16:24:00 -0700
+Subject: nilfs2: fix sanity check of btree level in nilfs_btree_root_broken()
+
+From: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+
+commit d8fd150fe3935e1692bf57c66691e17409ebb9c1 upstream.
+
+The range check for b-tree level parameter in nilfs_btree_root_broken()
+is wrong; it accepts the case of "level == NILFS_BTREE_LEVEL_MAX" even
+though the level is limited to values in the range of 0 to
+(NILFS_BTREE_LEVEL_MAX - 1).
+
+Since the level parameter is read from storage device and used to index
+nilfs_btree_path array whose element count is NILFS_BTREE_LEVEL_MAX, it
+can cause memory overrun during btree operations if the boundary value
+is set to the level parameter on device.
+
+This fixes the broken sanity check and adds a comment to clarify that
+the upper bound NILFS_BTREE_LEVEL_MAX is exclusive.
+
+Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nilfs2/btree.c         |    2 +-
+ include/linux/nilfs2_fs.h |    2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/nilfs2/btree.c
++++ b/fs/nilfs2/btree.c
+@@ -388,7 +388,7 @@ static int nilfs_btree_root_broken(const
+       nchildren = nilfs_btree_node_get_nchildren(node);
+ 
+       if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN ||
+-                   level > NILFS_BTREE_LEVEL_MAX ||
++                   level >= NILFS_BTREE_LEVEL_MAX ||
+                    nchildren < 0 ||
+                    nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) {
+               pr_crit("NILFS: bad btree root (inode number=%lu): level = %d, flags = 0x%x, nchildren = %d\n",
+--- a/include/linux/nilfs2_fs.h
++++ b/include/linux/nilfs2_fs.h
+@@ -458,7 +458,7 @@ struct nilfs_btree_node {
+ /* level */
+ #define NILFS_BTREE_LEVEL_DATA          0
+ #define NILFS_BTREE_LEVEL_NODE_MIN      (NILFS_BTREE_LEVEL_DATA + 1)
+-#define NILFS_BTREE_LEVEL_MAX           14
++#define NILFS_BTREE_LEVEL_MAX           14    /* Max level (exclusive) */
+ 
+ /**
+  * struct nilfs_palloc_group_desc - block group descriptor

diff --git a/queue-3.10/series b/queue-3.10/series
index 30531c6f700afa5faaa2248c302c32566a89b292..f535084d8d40ae1d6158e5fe641a57826625e39f 100644 (file)
--- a/queue-3.10/series
+++ b/queue-3.10/series
@@ -1 +1,2 @@
 ocfs2-dlm-fix-race-between-purge-and-get-lock-resource.patch
+nilfs2-fix-sanity-check-of-btree-level-in-nilfs_btree_root_broken.patch