jbd2: fix r_count overflows leading to buffer overflow in journal recovery
authorDarrick J. Wong <darrick.wong@oracle.com>
Thu, 14 May 2015 23:11:50 +0000 (19:11 -0400)
committerTheodore Ts'o <tytso@mit.edu>
Thu, 14 May 2015 23:11:50 +0000 (19:11 -0400)
commite531d0bceb402e643a4499de40dd3fa39d8d2e43
treec5964d8337898f3fcb04a78adb7a5297d2ac8151
parent2f974865ffdfe7b9f46a9940836c8b167342563d
jbd2: fix r_count overflows leading to buffer overflow in journal recovery

The journal revoke block recovery code does not check r_count for
sanity, which means that an evil value of r_count could result in
the kernel reading off the end of the revoke table and into whatever
garbage lies beyond.  This could crash the kernel, so fix that.

However, in testing this fix, I discovered that the code to write
out the revoke tables also was not correctly checking to see if the
block was full -- the current offset check is fine so long as the
revoke table space size is a multiple of the record size, but this
is not true when either journal_csum_v[23] are set.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: stable@vger.kernel.org
fs/jbd2/recovery.c
fs/jbd2/revoke.c