Al Viro de0bb97aff [PATCH] forgotten ->b_data in memcpy() call in ext3/resize.c (oopsable)
sbi->s_group_desc is an array of pointers to buffer_head.  memcpy() of
buffer size from address of buffer_head is a bad idea - it will generate
junk in any case, may oops if buffer_head is close to the end of slab
page and next page is not mapped and isn't what was intended there.
IOW, ->b_data is missing in that call.  Fortunately, result doesn't go
into the primary on-disk data structures, so only backup ones get crap
written to them; that had allowed this bug to remain unnoticed until
now.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-04-26 07:52:21 -07:00
..
2006-04-11 06:18:41 -07:00
2006-03-31 12:18:51 -08:00
2006-04-01 01:15:35 +02:00
2006-04-19 12:43:47 -04:00
2006-03-31 12:18:55 -08:00
2006-03-24 07:33:19 -08:00
2006-04-19 09:13:51 -07:00
2006-04-22 09:19:53 -07:00
2006-04-01 01:16:26 +02:00
2006-04-02 13:39:21 +02:00
2006-04-02 13:40:13 +02:00
2006-03-31 12:18:55 -08:00
2006-01-11 18:42:13 -08:00
2006-01-10 08:01:25 -08:00
2006-04-02 13:36:13 +02:00
2006-01-08 20:12:40 -08:00
2006-04-02 13:37:19 +02:00
2006-04-11 13:53:33 +02:00
2005-10-30 17:37:32 -08:00
2006-04-02 13:38:18 +02:00
2006-01-11 18:42:13 -08:00
2006-01-11 18:42:13 -08:00
2006-04-19 09:13:51 -07:00
2006-03-31 12:18:54 -08:00
2006-03-28 09:16:08 -08:00
2006-03-24 07:33:19 -08:00
2006-03-24 07:33:24 -08:00
2005-11-07 18:18:11 -08:00
2006-03-23 07:38:11 -08:00
2006-03-23 07:38:11 -08:00
2006-03-23 07:38:12 -08:00
2006-02-11 21:41:10 -08:00
2006-03-26 08:56:55 -08:00