From patchwork Mon Aug 6 20:05:53 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jim Keniston X-Patchwork-Id: 175445 Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 705542C0087 for ; Tue, 7 Aug 2012 06:08:56 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754216Ab2HFUIy (ORCPT ); Mon, 6 Aug 2012 16:08:54 -0400 Received: from e7.ny.us.ibm.com ([32.97.182.137]:40466 "EHLO e7.ny.us.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752121Ab2HFUIy (ORCPT ); Mon, 6 Aug 2012 16:08:54 -0400 Received: from /spool/local by e7.ny.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 6 Aug 2012 16:08:52 -0400 Received: from d01dlp01.pok.ibm.com (9.56.250.166) by e7.ny.us.ibm.com (192.168.1.107) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Mon, 6 Aug 2012 16:08:09 -0400 Received: from d01relay03.pok.ibm.com (d01relay03.pok.ibm.com [9.56.227.235]) by d01dlp01.pok.ibm.com (Postfix) with ESMTP id 26DAE38C80C0 for ; Mon, 6 Aug 2012 16:05:57 -0400 (EDT) Received: from d01av03.pok.ibm.com (d01av03.pok.ibm.com [9.56.224.217]) by d01relay03.pok.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id q76K5uP8340204 for ; Mon, 6 Aug 2012 16:05:56 -0400 Received: from d01av03.pok.ibm.com (loopback [127.0.0.1]) by d01av03.pok.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id q76K5tYC027625 for ; Mon, 6 Aug 2012 17:05:55 -0300 Received: from localhost.localdomain ([9.47.28.73]) by d01av03.pok.ibm.com (8.14.4/8.13.1/NCO v10.0 AVin) with ESMTP id q76K5r7f026765; Mon, 6 Aug 2012 17:05:53 -0300 From: Jim Keniston Subject: [PATCH] e2fsprogs: e2fsck_handle_read_error - pass along negative count To: tytso@mit.edu, linux-ext4@vger.kernel.org Cc: ddstreet@us.ibm.com, mcao@us.ibm.com, alexfr@il.ibm.com Date: Mon, 06 Aug 2012 13:05:53 -0700 Message-ID: <20120806200553.9312.52751.stgit@localhost.localdomain> User-Agent: StGIT/0.14.3 MIME-Version: 1.0 X-Content-Scanned: Fidelis XPS MAILER x-cbid: 12080620-5806-0000-0000-00001815E707 Sender: linux-ext4-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-ext4@vger.kernel.org When passed a negative count (indicating a byte count rather than a block count) e2fsck_handle_read_error() treats the data as a full block, causing unix_write_blk64() (which can handle negative counts just fine) to try to write too much. Given a faulty block device, this resulted in a SEGV when unix_write_blk64() read past the bottom of the stack copying the data to cache. (check_backup_super_block -> unix_read_blk64 -> raw_read_blk -> e2fsck_handle_read_error) Signed-off-by: Jim Keniston Signed-off-by: Dan Streetman Reviewed-by: Mingming Cao Reported-by: Alex Friedman --- e2fsck/ehandler.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/e2fsck/ehandler.c b/e2fsck/ehandler.c index 6eecf33..6dddf9c 100644 --- a/e2fsck/ehandler.c +++ b/e2fsck/ehandler.c @@ -60,7 +60,7 @@ static errcode_t e2fsck_handle_read_error(io_channel channel, preenhalt(ctx); if (ask(ctx, _("Ignore error"), 1)) { if (ask(ctx, _("Force rewrite"), 1)) - io_channel_write_blk64(channel, block, 1, data); + io_channel_write_blk64(channel, block, count, data); return 0; }