From patchwork Wed Jun 17 00:57:59 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Sandeen X-Patchwork-Id: 28752 Return-Path: X-Original-To: patchwork-incoming@bilbo.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from ozlabs.org (ozlabs.org [203.10.76.45]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "mx.ozlabs.org", Issuer "CA Cert Signing Authority" (verified OK)) by bilbo.ozlabs.org (Postfix) with ESMTPS id E4458B71A1 for ; Wed, 17 Jun 2009 10:58:20 +1000 (EST) Received: by ozlabs.org (Postfix) id D4F3BDDDA0; Wed, 17 Jun 2009 10:58:20 +1000 (EST) Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by ozlabs.org (Postfix) with ESMTP id 61C4EDDD1B for ; Wed, 17 Jun 2009 10:58:20 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751324AbZFQA57 (ORCPT ); Tue, 16 Jun 2009 20:57:59 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1759150AbZFQA57 (ORCPT ); Tue, 16 Jun 2009 20:57:59 -0400 Received: from mx2.redhat.com ([66.187.237.31]:49200 "EHLO mx2.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751324AbZFQA56 (ORCPT ); Tue, 16 Jun 2009 20:57:58 -0400 Received: from int-mx2.corp.redhat.com (int-mx2.corp.redhat.com [172.16.27.26]) by mx2.redhat.com (8.13.8/8.13.8) with ESMTP id n5H0w1JU029281 for ; Tue, 16 Jun 2009 20:58:01 -0400 Received: from ns3.rdu.redhat.com (ns3.rdu.redhat.com [10.11.255.199]) by int-mx2.corp.redhat.com (8.13.1/8.13.1) with ESMTP id n5H0w0E9025953 for ; Tue, 16 Jun 2009 20:58:01 -0400 Received: from liberator.sandeen.net (sebastian-int.corp.redhat.com [172.16.52.221]) by ns3.rdu.redhat.com (8.13.8/8.13.8) with ESMTP id n5H0vxVs027267 for ; Tue, 16 Jun 2009 20:58:00 -0400 Message-ID: <4A383F97.1080002@redhat.com> Date: Tue, 16 Jun 2009 19:57:59 -0500 From: Eric Sandeen User-Agent: Thunderbird 2.0.0.21 (Macintosh/20090302) MIME-Version: 1.0 To: ext4 development Subject: [PATCH] libext2fs: write only core inode in update_path() References: <4A381EC8.4010202@redhat.com> In-Reply-To: <4A381EC8.4010202@redhat.com> X-Scanned-By: MIMEDefang 2.58 on 172.16.27.26 Sender: linux-ext4-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-ext4@vger.kernel.org Eric Sandeen wrote: > I've been tearing my hair out all day on this and not getting anywhere > yet, so punting to the list ;) > > > Well, here's one problem. I'm waiting for the reporter to confirm whether it fixes the bug. I think it likely does but will report back tomorrow. Anyway patch follows, thanks valgrind! libext2fs: write only core inode in update_path() The ext2_extent_handle only has a struct ext2_inode allocated on it, and the same amount copied into it in that same function, but in update_path() we're possibly writing out more than that - for example 256 bytes, from that address. This causes uninitialized memory to get written to disk, overwriting the parts of the inode past the osd2 member (the end of the smaller structure). Signed-off-by: Eric Sandeen --- -- To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/lib/ext2fs/extent.c b/lib/ext2fs/extent.c index b7eb617..0dfee62 100644 --- a/lib/ext2fs/extent.c +++ b/lib/ext2fs/extent.c @@ -547,7 +547,7 @@ static errcode_t update_path(ext2_extent_handle_t handle) if (handle->level == 0) { retval = ext2fs_write_inode_full(handle->fs, handle->ino, - handle->inode, EXT2_INODE_SIZE(handle->fs->super)); + handle->inode, sizeof(struct ext2_inode)); } else { ix = handle->path[handle->level - 1].curr; blk = ext2fs_le32_to_cpu(ix->ei_leaf) +