From: Greg Kroah-Hartman Date: Fri, 15 May 2015 01:57:26 +0000 (-0700) Subject: 3.10-stable patches X-Git-Tag: v3.10.79~27 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f83c3543decbc7748cb909ff09af3e27d5a7e3d6;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: nilfs2-fix-sanity-check-of-btree-level-in-nilfs_btree_root_broken.patch --- diff --git a/queue-3.10/nilfs2-fix-sanity-check-of-btree-level-in-nilfs_btree_root_broken.patch b/queue-3.10/nilfs2-fix-sanity-check-of-btree-level-in-nilfs_btree_root_broken.patch new file mode 100644 index 00000000000..e99d3f10266 --- /dev/null +++ b/queue-3.10/nilfs2-fix-sanity-check-of-btree-level-in-nilfs_btree_root_broken.patch @@ -0,0 +1,54 @@ +From d8fd150fe3935e1692bf57c66691e17409ebb9c1 Mon Sep 17 00:00:00 2001 +From: Ryusuke Konishi +Date: Tue, 5 May 2015 16:24:00 -0700 +Subject: nilfs2: fix sanity check of btree level in nilfs_btree_root_broken() + +From: Ryusuke Konishi + +commit d8fd150fe3935e1692bf57c66691e17409ebb9c1 upstream. + +The range check for b-tree level parameter in nilfs_btree_root_broken() +is wrong; it accepts the case of "level == NILFS_BTREE_LEVEL_MAX" even +though the level is limited to values in the range of 0 to +(NILFS_BTREE_LEVEL_MAX - 1). + +Since the level parameter is read from storage device and used to index +nilfs_btree_path array whose element count is NILFS_BTREE_LEVEL_MAX, it +can cause memory overrun during btree operations if the boundary value +is set to the level parameter on device. + +This fixes the broken sanity check and adds a comment to clarify that +the upper bound NILFS_BTREE_LEVEL_MAX is exclusive. + +Signed-off-by: Ryusuke Konishi +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nilfs2/btree.c | 2 +- + include/linux/nilfs2_fs.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/nilfs2/btree.c ++++ b/fs/nilfs2/btree.c +@@ -388,7 +388,7 @@ static int nilfs_btree_root_broken(const + nchildren = nilfs_btree_node_get_nchildren(node); + + if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN || +- level > NILFS_BTREE_LEVEL_MAX || ++ level >= NILFS_BTREE_LEVEL_MAX || + nchildren < 0 || + nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) { + pr_crit("NILFS: bad btree root (inode number=%lu): level = %d, flags = 0x%x, nchildren = %d\n", +--- a/include/linux/nilfs2_fs.h ++++ b/include/linux/nilfs2_fs.h +@@ -458,7 +458,7 @@ struct nilfs_btree_node { + /* level */ + #define NILFS_BTREE_LEVEL_DATA 0 + #define NILFS_BTREE_LEVEL_NODE_MIN (NILFS_BTREE_LEVEL_DATA + 1) +-#define NILFS_BTREE_LEVEL_MAX 14 ++#define NILFS_BTREE_LEVEL_MAX 14 /* Max level (exclusive) */ + + /** + * struct nilfs_palloc_group_desc - block group descriptor diff --git a/queue-3.10/series b/queue-3.10/series index 30531c6f700..f535084d8d4 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -1 +1,2 @@ ocfs2-dlm-fix-race-between-purge-and-get-lock-resource.patch +nilfs2-fix-sanity-check-of-btree-level-in-nilfs_btree_root_broken.patch