• Stuart Swales's avatar
    adfs: fix E+/F+ dir size > 2048 crashing kernel · 2f09719a
    Stuart Swales authored
    Kernel crashes in fs/adfs module when accessing directories with a large
    number of objects on mounted Acorn ADFS E+/F+ format discs (or images) as
    the existing code writes off the end of the fixed array of struct
    buffer_head pointers.
    
    Additionally, each directory access that didn't crash would leak a buffer
    as nr_buffers was not adjusted correctly for E+/F+ discs (was always left
    as one less than required).
    
    The patch fixes this by allocating a dynamically-sized set of struct
    buffer_head pointers if necessary for the E+/F+ case (many directories
    still do in fact fit in 2048 bytes) and sets the correct nr_buffers so
    that all buffers are released.
    
    Addresses https://bugzilla.kernel.org/show_bug.cgi?id=26072
    
    Tested by tar'ing the contents of my RISC PC's E+ format 20Gb HDD which
    contains a number of large directories that previously crashed the kernel.
    Signed-off-by: default avatarStuart Swales <stuart.swales.croftnuisk@gmail.com>
    Cc: Russell King <rmk@arm.linux.org.uk>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    2f09719a
adfs.h 5.04 KB