Messages in this thread | | | Date | Wed, 24 Oct 2007 18:26:26 +0200 | From | Adrian Bunk <> | Subject | gfs2_fh_to_parent() array overflow |
| |
The Coverity checker spotted the following array overflow caused by commit 34c0d154243dd913c5690ae6ceb9557017429b9c:
include/linux/exportfs.h contains:
<-- snip -->
... struct fid { ... __u32 raw[6]; }; };
<-- snip -->
fs/gfs2/ops_export.c contains:
<-- snip -->
... static struct dentry *gfs2_fh_to_parent(struct super_block *sb, struct fid *fid, int fh_len, int fh_type) { struct gfs2_inum_host parent; __be32 *fh = (__force __be32 *)fid->raw; <------------
switch (fh_type) { case GFS2_LARGE_FH_SIZE: case GFS2_OLD_FH_SIZE: parent.no_formal_ino = ((u64)be32_to_cpu(fh[4])) << 32; parent.no_formal_ino |= be32_to_cpu(fh[5]); parent.no_addr = ((u64)be32_to_cpu(fh[6])) << 32; ^^^^^ parent.no_addr |= be32_to_cpu(fh[7]); ... ^^^^^
<-- snip -->
cu Adrian
--
"Is there not promise of rain?" Ling Tan asked suddenly out of the darkness. There had been need of rain for many days. "Only a promise," Lao Er said. Pearl S. Buck - Dragon Seed
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |