• Darrick J. Wong's avatar
    jbd2: fix r_count overflows leading to buffer overflow in journal recovery · e531d0bc
    Darrick J. Wong authored
    The journal revoke block recovery code does not check r_count for
    sanity, which means that an evil value of r_count could result in
    the kernel reading off the end of the revoke table and into whatever
    garbage lies beyond.  This could crash the kernel, so fix that.
    
    However, in testing this fix, I discovered that the code to write
    out the revoke tables also was not correctly checking to see if the
    block was full -- the current offset check is fine so long as the
    revoke table space size is a multiple of the record size, but this
    is not true when either journal_csum_v[23] are set.
    Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
    Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
    Reviewed-by: default avatarJan Kara <jack@suse.cz>
    Cc: stable@vger.kernel.org
    e531d0bc
revoke.c 22.3 KB