linux-ext4 - Re: [PATCH] [e2fsprogs] e2fsck: fix segmentation fault when block size is greater than 8192

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20090102233046.GF4758@mit.edu>
Date:	Fri, 2 Jan 2009 18:30:46 -0500
From:	Theodore Tso <tytso@....edu>
To:	Miao Xie <miaox@...fujitsu.com>
Cc:	linux-ext4@...r.kernel.org
Subject: Re: [PATCH] [e2fsprogs] e2fsck: fix segmentation fault when block
	size is greater than 8192

On Wed, Dec 17, 2008 at 04:58:12PM +0800, Miao Xie wrote:
> When I did fsck a filesystem with large blocksize(greater than 8192),
> segmentation fault occured. The cause is the size of b_data array that is
> defined as a fixed size in buffer_head structure.

Here's a better patch which avoids the need for two calls to malloc
for each buffer_head strcture.

						- Ted

commit e35d548b59e24af9f7fc18396e8880df96d1bc51
Author: Theodore Ts'o <tytso@....edu>
Date:   Fri Jan 2 18:14:42 2009 -0500

    e2fsck: Fix journal replay for block sizes greater than 8k
    
    E2fsck was using a fixed-size 8k buffer for replaying blocks from the
    journal.  So attempts to replay a journal on filesystems greater than
    8k would cause e2fsck to crash with a segfault.
    
    Thanks to Miao Xie <miaox@...fujitsu.com> for reporting this problem.
    
    Signed-off-by: "Theodore Ts'o" <tytso@....edu>

diff --git a/e2fsck/jfs_user.h b/e2fsck/jfs_user.h
index 0e4f951..60cc682 100644
--- a/e2fsck/jfs_user.h
+++ b/e2fsck/jfs_user.h
@@ -15,7 +15,6 @@
 #include "e2fsck.h"
 
 struct buffer_head {
-	char		b_data[8192];
 	e2fsck_t	b_ctx;
 	io_channel 	b_io;
 	int	 	b_size;
@@ -23,6 +22,7 @@ struct buffer_head {
 	int	 	b_dirty;
 	int	 	b_uptodate;
 	int	 	b_err;
+	char		b_data[1024];
 };
 
 struct inode {
diff --git a/e2fsck/journal.c b/e2fsck/journal.c
index 10f5095..adbd3db 100644
--- a/e2fsck/journal.c
+++ b/e2fsck/journal.c
@@ -68,8 +68,10 @@ int journal_bmap(journal_t *journal, blk_t block, unsigned long *phys)
 struct buffer_head *getblk(kdev_t kdev, blk_t blocknr, int blocksize)
 {
 	struct buffer_head *bh;
+	int bufsize = sizeof(*bh) + kdev->k_ctx->fs->blocksize -
+		sizeof(bh->b_data);
 
-	bh = e2fsck_allocate_memory(kdev->k_ctx, sizeof(*bh), "block buffer");
+	bh = e2fsck_allocate_memory(kdev->k_ctx, bufsize, "block buffer");
 	if (!bh)
 		return NULL;
 
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html