ext4: fix header check in ext4_ext_search_right() for deep extent trees.

Bug #346194 reported by Tim Gardner
16
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Fix Released
Medium
Tim Gardner

Bug Description

 The ext4_ext_search_right() function is confusing; it uses a
    "depth" variable which is 0 at the root and maximum at the leaves,
    but the on-disk metadata uses a "depth" (actually eh_depth) which
    is opposite: maximum at the root, and 0 at the leaves.

    The ext4_ext_check_header() function is given a depth and checks
    the header agaisnt that depth; it expects the on-disk semantics,
    but we are giving it the opposite in the while loop in this
    function. We should be giving it the on-disk notion of "depth"
    which we can get from (p_depth - depth) - and if you look, the last
    (more commonly hit) call to ext4_ext_check_header() does just this.

    Sending in the wrong depth results in (incorrect) messages
    about corruption:

    EXT4-fs error (device sdb1): ext4_ext_search_right: bad header
    in inode #2621457: unexpected eh_depth - magic f30a, entries 340,
    max 340(0), depth 1(2)

Revision history for this message
Tim Gardner (timg-tpi) wrote :
Changed in linux (Ubuntu):
assignee: nobody → timg-tpi
importance: Undecided → Medium
milestone: none → ubuntu-9.04-beta
status: New → Fix Committed
Revision history for this message
Tim Gardner (timg-tpi) wrote :
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package linux - 2.6.28-11.37

---------------
linux (2.6.28-11.37) jaunty; urgency=low

  [ Alex Deucher ]

  * SAUCE: radeon: add some new pci ids
    - LP: #334101

  [ Amit Kucheria ]

  * Updating configs - rip out orion5x and mv78xx0 flavours

  [ Andy Whitcroft ]

  * SAUCE: tone down the synaptics warning to avoid triggering kerneloops
    - LP: #330606

  [ Upstream Kernel Changes ]

  * ext4: fix header check in ext4_ext_search_right() for deep extent
    trees.
    - LP: #346194
  * eCryptfs: NULL crypt_stat dereference during lookup
    - LP: #345766
  * eCryptfs: Allocate a variable number of pages for file headers
    (CVE-2009-0787)
    - LP: #345544

 -- Tim Gardner <email address hidden> Mon, 23 Mar 2009 09:24:32 -0600

Changed in linux:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.