linux/fs/nilfs2
Ryusuke Konishi 957ed60b53 nilfs2: fix potential memory overrun on inode
Each inode of nilfs2 stores a root node of a b-tree, and it turned out to
have a memory overrun issue:

Each b-tree node of nilfs2 stores a set of key-value pairs and the number
of them (in "bn_nchildren" member of nilfs_btree_node struct), as well as
a few other "bn_*" members.

Since the value of "bn_nchildren" is used for operations on the key-values
within the b-tree node, it can cause memory access overrun if a large
number is incorrectly set to "bn_nchildren".

For instance, nilfs_btree_node_lookup() function determines the range of
binary search with it, and too large "bn_nchildren" leads
nilfs_btree_node_get_key() in that function to overrun.

As for intermediate b-tree nodes, this is prevented by a sanity check
performed when each node is read from a drive, however, no sanity check
has been done for root nodes stored in inodes.

This patch fixes the issue by adding missing sanity check against b-tree
root nodes so that it's called when on-memory inodes are read from ifile,
inode metadata file.

Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2015-02-28 09:57:51 -08:00
..
alloc.c nilfs2: implement calculation of free inodes count 2013-07-03 16:08:01 -07:00
alloc.h nilfs2: implement calculation of free inodes count 2013-07-03 16:08:01 -07:00
bmap.c nilfs2: get rid of NILFS_I_NILFS 2011-05-10 22:21:56 +09:00
bmap.h nilfs2: add omitted comments for different structures in driver implementation 2012-07-30 17:25:19 -07:00
btnode.c nilfs2: use mark_buffer_dirty to mark btnode or meta data dirty 2011-05-10 22:21:57 +09:00
btnode.h nilfs2: add omitted comments for different structures in driver implementation 2012-07-30 17:25:19 -07:00
btree.c nilfs2: fix potential memory overrun on inode 2015-02-28 09:57:51 -08:00
btree.h nilfs2: get rid of nilfs_bmap_union 2010-07-23 10:02:14 +09:00
cpfile.c nilfs2: verify metadata sizes read from disk 2014-04-03 16:21:26 -07:00
cpfile.h nilfs2: use iget for all metadata files 2010-10-23 09:24:38 +09:00
dat.c nilfs2: verify metadata sizes read from disk 2014-04-03 16:21:26 -07:00
dat.h nilfs2: use iget for all metadata files 2010-10-23 09:24:38 +09:00
dir.c [readdir] convert nilfs2 2013-06-29 12:56:36 +04:00
direct.c nilfs2: record used amount of each checkpoint in checkpoint list 2011-03-08 14:58:31 +09:00
direct.h nilfs2: get rid of nilfs_bmap_union 2010-07-23 10:02:14 +09:00
export.h nilfs2: add omitted comments for different structures in driver implementation 2012-07-30 17:25:19 -07:00
file.c mm: drop vm_ops->remap_pages and generic_file_remap_pages() stub 2015-02-10 14:30:30 -08:00
gcinode.c fs: remove mapping->backing_dev_info 2015-01-20 14:03:05 -07:00
ifile.c ] nilfs2: use atomic64_t type for inodes_count and blocks_count fields in nilfs_root struct 2013-07-03 16:08:01 -07:00
ifile.h nilfs2: implement calculation of free inodes count 2013-07-03 16:08:01 -07:00
inode.c nilfs2: fix the nilfs_iget() vs. nilfs_new_inode() races 2014-12-10 17:41:16 -08:00
ioctl.c nilfs2: add missing blkdev_issue_flush() to nilfs_sync_fs() 2014-10-14 02:18:20 +02:00
Kconfig fs/nilfs2: remove depends on CONFIG_EXPERIMENTAL 2013-01-11 11:39:04 -08:00
Makefile nilfs2: integrate sysfs support into driver 2014-08-08 15:57:21 -07:00
mdt.c fs: remove mapping->backing_dev_info 2015-01-20 14:03:05 -07:00
mdt.h nilfs2: add omitted comments for different structures in driver implementation 2012-07-30 17:25:19 -07:00
namei.c nilfs2: fix the nilfs_iget() vs. nilfs_new_inode() races 2014-12-10 17:41:16 -08:00
nilfs.h nilfs2: fix deadlock of segment constructor over I_SYNC flag 2015-02-05 13:35:29 -08:00
page.c fs: remove mapping->backing_dev_info 2015-01-20 14:03:05 -07:00
page.h fs: remove mapping->backing_dev_info 2015-01-20 14:03:05 -07:00
recovery.c nilfs2: drop vmtruncate 2012-12-20 18:40:54 -05:00
segbuf.c block: Abstract out bvec iterator 2013-11-23 22:33:47 -08:00
segbuf.h nilfs2: get rid of macros for segment summary information 2010-07-23 10:02:09 +09:00
segment.c nilfs2: fix deadlock of segment constructor over I_SYNC flag 2015-02-05 13:35:29 -08:00
segment.h nilfs2: fix deadlock of segment constructor over I_SYNC flag 2015-02-05 13:35:29 -08:00
sufile.c nilfs2: verify metadata sizes read from disk 2014-04-03 16:21:26 -07:00
sufile.h nilfs2: add nilfs_sufile_trim_fs to trim clean segs 2014-04-03 16:21:25 -07:00
super.c fs: remove mapping->backing_dev_info 2015-01-20 14:03:05 -07:00
sysfs.c nilfs2: integrate sysfs support into driver 2014-08-08 15:57:21 -07:00
sysfs.h nilfs2: add /sys/fs/nilfs2/<device>/mounted_snapshots/<snapshot> group 2014-08-08 15:57:21 -07:00
the_nilfs.c nilfs2: deletion of an unnecessary check before the function call "iput" 2014-12-10 17:41:16 -08:00
the_nilfs.h nilfs2: add missing blkdev_issue_flush() to nilfs_sync_fs() 2014-10-14 02:18:20 +02:00