linux-ext4 - [Bug 14354] Bad corruption with 2.6.32-rc1 and upwards

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 8 Nov 2009 21:05:40 GMT
From:	bugzilla-daemon@...zilla.kernel.org
To:	linux-ext4@...r.kernel.org
Subject: [Bug 14354] Bad corruption with 2.6.32-rc1 and upwards

http://bugzilla.kernel.org/show_bug.cgi?id=14354





--- Comment #183 from Linus Torvalds <torvalds@...ux-foundation.org>  2009-11-08 21:05:37 ---
On Sun, 8 Nov 2009, bugzilla-daemon@...zilla.kernel.org wrote:
> 
> It's pretty simple to do this; in fact it's a one-line change in
> ext4_symlink() in fs/ext4/inode.c:
> 
>         /* clear the extent format for fast symlink */
>         EXT4_I(inode)->i_flags &= ~EXT4_EXTENTS_FL;
>         inode->i_op = &ext4_fast_symlink_inode_operations;
> -        memcpy((char *)&EXT4_I(inode)->i_data, symname, l);
> +        strcpy((char *)&EXT4_I(inode)->i_data, symname);
>         inode->i_size = l-1;

I think that's wrong.

First off, it's slower. Secondly, 'l' is already 'strlen+1', so it looks 
like ext4 _already_ copies the NUL terminating character.

So I suspect the debugging patch complained about writing a NUL to a 
location that was already NUL to begin with.

        Linus

-- 
Configure bugmail: http://bugzilla.kernel.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html