summaryrefslogtreecommitdiffstats
path: root/fs/ext4
diff options
context:
space:
mode:
authorChandan Rajendra <chandan@linux.vnet.ibm.com>2016-11-14 21:26:26 -0500
committerTheodore Ts'o <tytso@mit.edu>2016-11-14 21:26:26 -0500
commit30a9d7afe70ed6bd9191d3000e2ef1a34fb58493 (patch)
tree9c8c589c6c34e4846d06b2967a5392f32a479831 /fs/ext4
parent69e43e8cc971a79dd1ee5d4343d8e63f82725123 (diff)
downloadlinux-30a9d7afe70ed6bd9191d3000e2ef1a34fb58493.tar.gz
linux-30a9d7afe70ed6bd9191d3000e2ef1a34fb58493.tar.bz2
linux-30a9d7afe70ed6bd9191d3000e2ef1a34fb58493.zip
ext4: fix stack memory corruption with 64k block size
The number of 'counters' elements needed in 'struct sg' is super_block->s_blocksize_bits + 2. Presently we have 16 'counters' elements in the array. This is insufficient for block sizes >= 32k. In such cases the memcpy operation performed in ext4_mb_seq_groups_show() would cause stack memory corruption. Fixes: c9de560ded61f Signed-off-by: Chandan Rajendra <chandan@linux.vnet.ibm.com> Signed-off-by: Theodore Ts'o <tytso@mit.edu> Reviewed-by: Jan Kara <jack@suse.cz> Cc: stable@vger.kernel.org
Diffstat (limited to 'fs/ext4')
-rw-r--r--fs/ext4/mballoc.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index a937ac7ef99f..7ae43c59bc79 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -2287,7 +2287,7 @@ static int ext4_mb_seq_groups_show(struct seq_file *seq, void *v)
struct ext4_group_info *grinfo;
struct sg {
struct ext4_group_info info;
- ext4_grpblk_t counters[16];
+ ext4_grpblk_t counters[EXT4_MAX_BLOCK_LOG_SIZE + 2];
} sg;
group--;