Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit de0bb97a authored by Al Viro's avatar Al Viro Committed by Linus Torvalds
Browse files

[PATCH] forgotten ->b_data in memcpy() call in ext3/resize.c (oopsable) 



sbi->s_group_desc is an array of pointers to buffer_head.  memcpy() of
buffer size from address of buffer_head is a bad idea - it will generate
junk in any case, may oops if buffer_head is close to the end of slab
page and next page is not mapped and isn't what was intended there.
IOW, ->b_data is missing in that call.  Fortunately, result doesn't go
into the primary on-disk data structures, so only backup ones get crap
written to them; that had allowed this bug to remain unnoticed until
now.

Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent c82ffb07

fs/ext3/resize.c

+1 −1
Original line number Diff line number Diff line
@@ -213,7 +213,7 @@ static int setup_new_group_blocks(struct super_block *sb, 
			goto exit_bh;

		}

		lock_buffer(bh);

		memcpy(gdb->b_data, sbi->s_group_desc[i], bh->b_size);

		memcpy(gdb->b_data, sbi->s_group_desc[i]->b_data, bh->b_size);

		set_buffer_uptodate(gdb);

		unlock_buffer(bh);

		ext3_journal_dirty_metadata(handle, gdb);