| Message ID | 20141025205655.532.5784.stgit@birch.djwong.org |
|---|---|
| State | Accepted, archived |
| Headers | show |
On Sat, Oct 25, 2014 at 01:56:55PM -0700, Darrick J. Wong wrote: > Sami Liedes found a scenario where we could memcpy incorrectly: > > If a block read fails during an e2fsck run, the UNIX IO manager will > call the io->read_error routine with a pointer to the internal block > cache. The e2fsck read error handler immediately tries to write the > buffer back out to disk(!), at which point the block write code will > try to copy the buffer contents back into the block cache. Normally > this is fine, but not when the write buffer is the cache itself! > > So, plumb in a trivial check for this condition. A more thorough > solution would pass a duplicated buffer to the IO error handlers, but > I don't know if that happens frequently enough to be worth the extra > point of failure. > > Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> > Reported-by: Sami Liedes <sami.liedes@iki.fi> Applied, thanks. - Ted -- To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/lib/ext2fs/unix_io.c b/lib/ext2fs/unix_io.c index 189adce..c3a8ea5 100644 --- a/lib/ext2fs/unix_io.c +++ b/lib/ext2fs/unix_io.c @@ -823,7 +823,8 @@ static errcode_t unix_write_blk64(io_channel channel, unsigned long long block, cache = reuse; reuse_cache(channel, data, cache, block); } - memcpy(cache->buf, cp, channel->block_size); + if (cache->buf != cp) + memcpy(cache->buf, cp, channel->block_size); cache->dirty = !writethrough; count--; block++;
Sami Liedes found a scenario where we could memcpy incorrectly: If a block read fails during an e2fsck run, the UNIX IO manager will call the io->read_error routine with a pointer to the internal block cache. The e2fsck read error handler immediately tries to write the buffer back out to disk(!), at which point the block write code will try to copy the buffer contents back into the block cache. Normally this is fine, but not when the write buffer is the cache itself! So, plumb in a trivial check for this condition. A more thorough solution would pass a duplicated buffer to the IO error handlers, but I don't know if that happens frequently enough to be worth the extra point of failure. Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> Reported-by: Sami Liedes <sami.liedes@iki.fi> --- lib/ext2fs/unix_io.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html