[PATCH] fs/ext[23]/xattr.c pointer arithmetic fix

From: Andreas Gruenbacher <agruen@suse.de>

64-bit pointer arithmetic bug in xattr code

The int offset is not enought to hold the difference between arbitraty
pointers on 64-bit machines.  Compute the offset of here and last inside
HDR(bh) instead.

diff --git a/fs/ext2/xattr.c b/fs/ext2/xattr.c
index f1334adc62ede5237628a1684635ac8ee909a8b4..e53a39bc01eb71022574c68ee3f3d64a72dd1464 100644 (file)
--- a/fs/ext2/xattr.c
+++ b/fs/ext2/xattr.c
@@ -617,9 +617,11 @@ bad_block:         ext2_error(sb, "ext2_xattr_set",
                                goto cleanup;
                        memcpy(header, HDR(bh), bh->b_size);
                        header->h_refcount = cpu_to_le32(1);
-                       offset = (char *)header - bh->b_data;
-                       here = ENTRY((char *)here + offset);
-                       last = ENTRY((char *)last + offset);
+
+                       offset = (char *)here - bh->b_data;
+                       here = ENTRY((char *)header + offset);
+                       offset = (char *)last - bh->b_data;
+                       last = ENTRY((char *)header + offset);
                }
        } else {
                /* Allocate a buffer where we construct the new block. */

diff --git a/fs/ext3/xattr.c b/fs/ext3/xattr.c
index b60885711a3d3ed6510d1b4aea2b9ca7806e81ee..323e79729b9a1dce9560a6bb615c782678b70d18 100644 (file)
--- a/fs/ext3/xattr.c
+++ b/fs/ext3/xattr.c
@@ -629,9 +629,10 @@ bad_block:         ext3_error(sb, "ext3_xattr_set",
                                goto cleanup;
                        memcpy(header, HDR(bh), bh->b_size);
                        header->h_refcount = cpu_to_le32(1);
-                       offset = (char *)header - bh->b_data;
-                       here = ENTRY((char *)here + offset);
-                       last = ENTRY((char *)last + offset);
+                       offset = (char *)here - bh->b_data;
+                       here = ENTRY((char *)header + offset);
+                       offset = (char *)last - bh->b_data;
+                       last = ENTRY((char *)header + offset);
                }
        } else {
                /* Allocate a buffer where we construct the new block. */