forked from luck/tmp_suning_uos_patched
e531d0bceb
The journal revoke block recovery code does not check r_count for sanity, which means that an evil value of r_count could result in the kernel reading off the end of the revoke table and into whatever garbage lies beyond. This could crash the kernel, so fix that. However, in testing this fix, I discovered that the code to write out the revoke tables also was not correctly checking to see if the block was full -- the current offset check is fine so long as the revoke table space size is a multiple of the record size, but this is not true when either journal_csum_v[23] are set. Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Signed-off-by: Theodore Ts'o <tytso@mit.edu> Reviewed-by: Jan Kara <jack@suse.cz> Cc: stable@vger.kernel.org |
||
|---|---|---|
| .. | ||
| checkpoint.c | ||
| commit.c | ||
| journal.c | ||
| Kconfig | ||
| Makefile | ||
| recovery.c | ||
| revoke.c | ||
| transaction.c | ||