From: Andreas Gruenbacher <agruen@suse.de>
To: Andrew Morton <akpm@zip.com.au>
Cc: "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: [PATCH] fs/ext[23]/xattr.c pointer arithmetic fix
Date: Thu, 13 Nov 2003 16:55:21 +0100 [thread overview]
Message-ID: <1068738920.7227.43.camel@E136.suse.de> (raw)
[-- Attachment #1: Type: text/plain, Size: 246 bytes --]
Hello,
we just found a 64-bit pointer arithmetic bug in the ext2 and ext3
extended attributes code. The fix is attached; could you please apply...
Thanks,
--
Andreas Gruenbacher <agruen@suse.de>
SuSE Labs, SuSE Linux AG <http://www.suse.de/>
[-- Attachment #2: xattr-pointer-arith --]
[-- Type: text/plain, Size: 1792 bytes --]
64-bit pointer arithmetic bug in xattr code
The int offset is not enought to hold the difference between
arbitraty pointers on 64-bit machines. Compute the offset of
here and last inside HDR(bh) instead.
Index: linux-2.6.0-test9/fs/ext2/xattr.c
===================================================================
--- linux-2.6.0-test9.orig/fs/ext2/xattr.c 2003-10-25 20:43:58.000000000 +0200
+++ linux-2.6.0-test9/fs/ext2/xattr.c 2003-11-13 14:31:02.649956273 +0100
@@ -617,9 +617,11 @@ bad_block: ext2_error(sb, "ext2_xattr_s
goto cleanup;
memcpy(header, HDR(bh), bh->b_size);
header->h_refcount = cpu_to_le32(1);
- offset = (char *)header - bh->b_data;
- here = ENTRY((char *)here + offset);
- last = ENTRY((char *)last + offset);
+
+ offset = (char *)here - bh->b_data;
+ here = ENTRY((char *)header + offset);
+ offset = (char *)last - bh->b_data;
+ last = ENTRY((char *)header + offset);
}
} else {
/* Allocate a buffer where we construct the new block. */
Index: linux-2.6.0-test9/fs/ext3/xattr.c
===================================================================
--- linux-2.6.0-test9.orig/fs/ext3/xattr.c 2003-10-25 20:43:50.000000000 +0200
+++ linux-2.6.0-test9/fs/ext3/xattr.c 2003-11-13 14:31:23.932352979 +0100
@@ -629,9 +629,10 @@ bad_block: ext3_error(sb, "ext3_xattr_s
goto cleanup;
memcpy(header, HDR(bh), bh->b_size);
header->h_refcount = cpu_to_le32(1);
- offset = (char *)header - bh->b_data;
- here = ENTRY((char *)here + offset);
- last = ENTRY((char *)last + offset);
+ offset = (char *)here - bh->b_data;
+ here = ENTRY((char *)header + offset);
+ offset = (char *)last - bh->b_data;
+ last = ENTRY((char *)header + offset);
}
} else {
/* Allocate a buffer where we construct the new block. */
reply other threads:[~2003-11-13 15:56 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1068738920.7227.43.camel@E136.suse.de \
--to=agruen@suse.de \
--cc=akpm@zip.com.au \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome