On Thu, 2011-06-23 at 13:35 -0400, Paul Gortmaker wrote: > From: Dan Rosenberg <[email protected]> > > ------------------- > This is a commit scheduled for the next v2.6.34 longterm release. > If you see a problem with using this for longterm, please comment. > ------------------- > > commit 3a3675b7f23f83ca8c67c9c2b6edf707fd28d1ba upstream. > > The FSGEOMETRY_V1 ioctl (and its compat equivalent) calls out to > xfs_fs_geometry() with a version number of 3. This code path does not > fill in the logsunit member of the passed xfs_fsop_geom_t, leading to > the leaking of four bytes of uninitialized stack data to potentially > unprivileged callers. > > v2 switches to memset() to avoid future issues if structure members > change, on suggestion of Dave Chinner. > > Signed-off-by: Dan Rosenberg <[email protected]> > Reviewed-by: Eugene Teo <[email protected]> > Signed-off-by: Alex Elder <[email protected]> > Signed-off-by: Paul Gortmaker <[email protected]> > --- > fs/xfs/xfs_fsops.c | 3 +++ > 1 files changed, 3 insertions(+), 0 deletions(-) > > diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c > index 37a6f62..4e7f02b 100644 > --- a/fs/xfs/xfs_fsops.c > +++ b/fs/xfs/xfs_fsops.c > @@ -57,6 +57,9 @@ xfs_fs_geometry( > xfs_fsop_geom_t *geo, > int new_version) > { > + > + memset(geo, 0, sizeof(*geo)); > + > geo->blocksize = mp->m_sb.sb_blocksize; > geo->rtextsize = mp->m_sb.sb_rextsize; > geo->agblocks = mp->m_sb.sb_agblocks; > -- > 1.7.4.4
This introduced a regression which was fixed by commit af24ee9ea8d532e16883251a6684dfa1be8eec29. -Dan _______________________________________________ stable mailing list [email protected] http://linux.kernel.org/mailman/listinfo/stable
