NTFS: 2.0.5 release. Major buffer overflow fix in extent inode handling.

Upgrade is imperative!

diff --git a/fs/ntfs/ChangeLog b/fs/ntfs/ChangeLog
index 47d0894da3a4274f4e31b20855deed9336d77089..b6243c47d7557eae11601edd34275e764b9074e2 100644 (file)
--- a/fs/ntfs/ChangeLog
+++ b/fs/ntfs/ChangeLog
@@ -27,6 +27,18 @@ ToDo:
          quite big. Modularising them a bit, e.g. a-la get_block(), will make
          them cleaner and make code reuse easier.
 
+2.0.5 - Major bugfix. Buffer overflow in extent inode handling.
+
+       - No need to set old blocksize in super.c::ntfs_fill_super() as the
+         VFS does so via invocation of deactivate_super() calling
+         fs->fill_super() calling block_kill_super() which does it.
+       - BKL moved from VFS into dir.c::ntfs_readdir(). (Linus Torvalds)
+         -> Do we really need it? I don't think so as we have exclusion on
+         the directory ntfs_inode rw_semaphore mrec_lock. We mmight have to
+         move the ->f_pos accesses under the mrec_lock though. Check this...
+       - Fix really, really, really stupid buffer overflow in extent inode
+         handling in mft.c::map_extent_mft_record().
+
 2.0.4 - Cleanups and updates for kernel 2.5.11.
 
        - Add documentation on how to use the MD driver to be able to use NTFS
@@ -35,7 +47,7 @@ ToDo:
        Remove all uses of kdev_t in favour of struct block_device *:
        - Change compress.c::ntfs_file_read_compressed_block() to use
          sb_getblk() instead of getblk().
-       - Change super.c::ntfs_fill_suoer() to use bdev_hardsect_size() instead
+       - Change super.c::ntfs_fill_super() to use bdev_hardsect_size() instead
          of get_hardsect_size().
        - No need to get old blocksize in super.c::ntfs_fill_super() as
          fs/super.c::get_sb_bdev() already does this.

diff --git a/fs/ntfs/Makefile b/fs/ntfs/Makefile
index b78f732ae7340a5a4d30f8d29523d6e08a32fee7..e158bc7d287418a725cab9f34d59b41a3f241373 100644 (file)
--- a/fs/ntfs/Makefile
+++ b/fs/ntfs/Makefile
@@ -7,7 +7,7 @@ obj-y   := aops.o attrib.o compress.o debug.o dir.o file.o inode.o mft.o \
 
 obj-m   := $(O_TARGET)
 
-EXTRA_CFLAGS = -DNTFS_VERSION=\"2.0.4\"
+EXTRA_CFLAGS = -DNTFS_VERSION=\"2.0.5\"
 
 ifeq ($(CONFIG_NTFS_DEBUG),y)
 EXTRA_CFLAGS += -DDEBUG

diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
index 01605418109407efc414964ef52976a1dbfb66ed..d7c7177c98022d5447e4d879b41951d2e0f2abab 100644 (file)
--- a/fs/ntfs/mft.c
+++ b/fs/ntfs/mft.c
@@ -459,7 +459,7 @@ map_err_out:
                goto unm_err_out;
        }
        /* Attach extent inode to base inode, reallocating memory if needed. */
-       if (!(base_ni->nr_extents & ~3)) {
+       if (!(base_ni->nr_extents & 3)) {
                ntfs_inode **tmp;
                int new_size = (base_ni->nr_extents + 4) * sizeof(ntfs_inode *);