Eric Sandeen wrote:
> I've been tearing my hair out all day on this and not getting anywhere
> yet, so punting to the list ;)
>
>
>
Well, here's one problem. I'm waiting for the reporter to confirm
whether it fixes the bug. I think it likely does but will report
back tomorrow. Anyway patch follows, thanks valgrind!
libext2fs: write only core inode in update_path()
The ext2_extent_handle only has a struct ext2_inode allocated on
it, and the same amount copied into it in that same function,
but in update_path() we're possibly writing out more than that -
for example 256 bytes, from that address. This causes uninitialized
memory to get written to disk, overwriting the parts of the
inode past the osd2 member (the end of the smaller structure).
Signed-off-by: Eric Sandeen <sandeen@xxxxxxxxxx>
---
diff --git a/lib/ext2fs/extent.c b/lib/ext2fs/extent.c
index b7eb617..0dfee62 100644
--- a/lib/ext2fs/extent.c
+++ b/lib/ext2fs/extent.c
@@ -547,7 +547,7 @@ static errcode_t update_path(ext2_extent_handle_t handle)
if (handle->level == 0) {
retval = ext2fs_write_inode_full(handle->fs, handle->ino,
- handle->inode, EXT2_INODE_SIZE(handle->fs->super));
+ handle->inode, sizeof(struct ext2_inode));
} else {
ix = handle->path[handle->level - 1].curr;
blk = ext2fs_le32_to_cpu(ix->ei_leaf) +
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
