openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

[LogFS] Plug 8 byte information leak 

Within each journal segment, 8 bytes at offset 24 would remain
uninitialized.

Signed-off-by: Joern Engel <joern@logfs.org>
This commit is contained in:
Joern Engel 2010-04-13 17:54:27 +02:00
parent 032d8f7268
commit d3a03f8031
1 changed files with 14 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
fs/logfs/journal.c
View File

@ -388,7 +388,10 @@ static void journal_get_erase_count(struct logfs_area *area)
static int journal_erase_segment(struct logfs_area *area) static int journal_erase_segment(struct logfs_area *area)
{ {
struct super_block *sb = area->a_sb; struct super_block *sb = area->a_sb;
struct logfs_segment_header sh; union {
struct logfs_segment_header sh;
unsigned char c[ALIGN(sizeof(struct logfs_segment_header), 16)];
} u;
u64 ofs; u64 ofs;
int err; int err;
@ -396,20 +399,21 @@ static int journal_erase_segment(struct logfs_area *area)
if (err) if (err)
return err; return err;
sh.pad = 0; memset(&u, 0, sizeof(u));
sh.type = SEG_JOURNAL; u.sh.pad = 0;
sh.level = 0; u.sh.type = SEG_JOURNAL;
sh.segno = cpu_to_be32(area->a_segno); u.sh.level = 0;
sh.ec = cpu_to_be32(area->a_erase_count); u.sh.segno = cpu_to_be32(area->a_segno);
sh.gec = cpu_to_be64(logfs_super(sb)->s_gec); u.sh.ec = cpu_to_be32(area->a_erase_count);
sh.crc = logfs_crc32(&sh, sizeof(sh), 4); u.sh.gec = cpu_to_be64(logfs_super(sb)->s_gec);
u.sh.crc = logfs_crc32(&u.sh, sizeof(u.sh), 4);
/* This causes a bug in segment.c. Not yet. */ /* This causes a bug in segment.c. Not yet. */
//logfs_set_segment_erased(sb, area->a_segno, area->a_erase_count, 0); //logfs_set_segment_erased(sb, area->a_segno, area->a_erase_count, 0);
ofs = dev_ofs(sb, area->a_segno, 0); ofs = dev_ofs(sb, area->a_segno, 0);
area->a_used_bytes = ALIGN(sizeof(sh), 16); area->a_used_bytes = sizeof(u);
logfs_buf_write(area, ofs, &sh, sizeof(sh)); logfs_buf_write(area, ofs, &u, sizeof(u));
return 0; return 0;
} }