Ryusuke Konishi 63c3723947 nilfs2: fix sanity check of btree level in nilfs_btree_root_broken() ... commit d8fd150fe3 upstream. The range check for b-tree level parameter in nilfs_btree_root_broken() is wrong; it accepts the case of "level == NILFS_BTREE_LEVEL_MAX" even though the level is limited to values in the range of 0 to (NILFS_BTREE_LEVEL_MAX - 1). Since the level parameter is read from storage device and used to index nilfs_btree_path array whose element count is NILFS_BTREE_LEVEL_MAX, it can cause memory overrun during btree operations if the boundary value is set to the level parameter on device. This fixes the broken sanity check and adds a comment to clarify that the upper bound NILFS_BTREE_LEVEL_MAX is exclusive. Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2015-05-17 09:53:49 -07:00
..
acpi	ACPICA: Utilities: split IO address types from data type models.	2015-05-06 21:59:18 +02:00
asm-generic	nosave: consolidate __nosave_{begin,end} in <asm/sections.h>	2015-05-06 21:59:21 +02:00
clocksource	…
crypto	…
drm	drm/radeon: remove invalid pci id	2014-11-14 09:00:12 -08:00
dt-bindings	pinctrl: dra: dt-bindings: Fix output pull up/down	2014-11-21 09:23:02 -08:00
keys	…
kvm	…
linux	nilfs2: fix sanity check of btree level in nilfs_btree_root_broken()	2015-05-17 09:53:49 -07:00
math-emu	…
media	media: vb2: fix VBI/poll regression	2014-10-09 12:21:27 -07:00
memory	…
misc	…
net	ipv6: protect skb->sk accesses from recursive dereference inside the stack	2015-04-29 10:31:46 +02:00
pcmcia	…
ras	…
rdma	…
rxrpc	…
scsi	scsi: do not issue SCSI RSOC command to Promise Vtrak E610f	2014-09-17 09:19:14 -07:00
sound	ASoC: dapm: Enable autodisable on SOC_DAPM_SINGLE_TLV_AUTODISABLE	2015-05-13 05:16:56 -07:00
target	target: Fix COMPARE_AND_WRITE with SG_TO_MEM_NOALLOC handling	2015-05-06 21:59:17 +02:00
trace	mm: when stealing freepages, also take pages created by splitting buddy page	2015-03-18 13:31:23 +01:00
uapi	in6: fix conflict with glibc	2015-01-27 08:18:53 -08:00
video	…
xen	…
Kbuild	…