* Re: [PATCH] jffs2: check dstlen for jffs2_zlib_compress()
[not found] <201903201046335762775@zte.com.cn>
@ 2019-03-20 21:06 ` Richard Weinberger
0 siblings, 0 replies; 7+ messages in thread
From: Richard Weinberger @ 2019-03-20 21:06 UTC (permalink / raw)
To: yang.yang29, dwmw2; +Cc: linux-mtd, linux-kernel
Am Mittwoch, 20. März 2019, 03:46:33 CET schrieb yang.yang29@zte.com.cn:
> Hi Richard:
>
>
>
> Is the patch make any progress ?
Well, you ignored my questions.
Can you please check my last mail?
Thanks,
//richard
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] jffs2: check dstlen for jffs2_zlib_compress()
@ 2019-03-20 21:06 ` Richard Weinberger
0 siblings, 0 replies; 7+ messages in thread
From: Richard Weinberger @ 2019-03-20 21:06 UTC (permalink / raw)
To: yang.yang29, dwmw2; +Cc: linux-mtd, linux-kernel
Am Mittwoch, 20. März 2019, 03:46:33 CET schrieb yang.yang29@zte.com.cn:
> Hi Richard:
>
>
>
> Is the patch make any progress ?
Well, you ignored my questions.
Can you please check my last mail?
Thanks,
//richard
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] jffs2: check dstlen for jffs2_zlib_compress()
[not found] <201901211659107381808@zte.com.cn>
@ 2019-01-21 11:35 ` Richard Weinberger
0 siblings, 0 replies; 7+ messages in thread
From: Richard Weinberger @ 2019-01-21 11:35 UTC (permalink / raw)
To: yang.yang29
Cc: richard.weinberger, dwmw2, wang.yi59, linux-mtd, linux-kernel,
xue.zhihong
Am Montag, 21. Januar 2019, 09:59:10 CET schrieb yang.yang29@zte.com.cn:
> Thanks for reply.
> But I think if (*dstlen < 2) is not good enough.
Not enough in terms of what?
My patch does what the commit message says, it fixes the out of bound access.
What do I miss?
> Because if the length of data_in is equals to 2, the length of output compressed data is also 2.
> So there's no meaning to do all the compress calculates.
>
> And I had do an experiment:
> If dstlen equals to 3, and data_in has 3 same bytes, the length of output compressed data will be 2.
> Which means compress is effective.
This is a different issue and a possible further optimization.
Thanks,
//richard
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] jffs2: check dstlen for jffs2_zlib_compress()
@ 2019-01-21 11:35 ` Richard Weinberger
0 siblings, 0 replies; 7+ messages in thread
From: Richard Weinberger @ 2019-01-21 11:35 UTC (permalink / raw)
To: yang.yang29
Cc: wang.yi59, richard.weinberger, linux-kernel, linux-mtd,
xue.zhihong, dwmw2
Am Montag, 21. Januar 2019, 09:59:10 CET schrieb yang.yang29@zte.com.cn:
> Thanks for reply.
> But I think if (*dstlen < 2) is not good enough.
Not enough in terms of what?
My patch does what the commit message says, it fixes the out of bound access.
What do I miss?
> Because if the length of data_in is equals to 2, the length of output compressed data is also 2.
> So there's no meaning to do all the compress calculates.
>
> And I had do an experiment:
> If dstlen equals to 3, and data_in has 3 same bytes, the length of output compressed data will be 2.
> Which means compress is effective.
This is a different issue and a possible further optimization.
Thanks,
//richard
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] jffs2: check dstlen for jffs2_zlib_compress()
2019-01-21 0:21 Yang Yang
@ 2019-01-21 8:04 ` Richard Weinberger
0 siblings, 0 replies; 7+ messages in thread
From: Richard Weinberger @ 2019-01-21 8:04 UTC (permalink / raw)
To: Yang Yang; +Cc: David Woodhouse, wang.yi59, linux-mtd, LKML, xue.zhihong
On Mon, Jan 21, 2019 at 1:21 AM Yang Yang <yang.yang29@zte.com.cn> wrote:
>
> KASAN reports a BUG when download file in jffs2 filesystem.
> The board name is nxp-ls1043ardb-ls1043a.
> It is because when dstlen == 1, cpage_out will write array out of bounds.
> Actually, there's no meaning for jffs2_zlib_compress() to compress
> any data with length less than 3.
> In that case, data will not be compressed.
I sent already a patch for this:
https://patchwork.ozlabs.org/patch/1013958/
> [ 393.799778] BUG: KASAN: slab-out-of-bounds in jffs2_rtime_compress+0x214/0x2f0 at addr ffff800062e3b281
> [ 393.809166] Write of size 1 by task tftp/2918
> [ 393.813526] CPU: 3 PID: 2918 Comm: tftp Tainted: G B 4.9.115-rt93-EMBSYS-CGEL-6.1.R6-dirty #1
> [ 393.823173] Hardware name: LS1043A RDB Board (DT)
> [ 393.827870] Call trace:
> [ 393.830322] [<ffff20000808c700>] dump_backtrace+0x0/0x2f0
> [ 393.835721] [<ffff20000808ca04>] show_stack+0x14/0x20
> [ 393.840774] [<ffff2000086ef700>] dump_stack+0x90/0xb0
> [ 393.845829] [<ffff20000827b19c>] kasan_object_err+0x24/0x80
> [ 393.851402] [<ffff20000827b404>] kasan_report_error+0x1b4/0x4d8
> [ 393.857323] [<ffff20000827bae8>] kasan_report+0x38/0x40
> [ 393.862548] [<ffff200008279d44>] __asan_store1+0x4c/0x58
> [ 393.867859] [<ffff2000084ce2ec>] jffs2_rtime_compress+0x214/0x2f0
> [ 393.873955] [<ffff2000084bb3b0>] jffs2_selected_compress+0x178/0x2a0
> [ 393.880308] [<ffff2000084bb530>] jffs2_compress+0x58/0x478
> [ 393.885796] [<ffff2000084c5b34>] jffs2_write_inode_range+0x13c/0x450
> [ 393.892150] [<ffff2000084be0b8>] jffs2_write_end+0x2a8/0x4a0
> [ 393.897811] [<ffff2000081f3008>] generic_perform_write+0x1c0/0x280
> [ 393.903990] [<ffff2000081f5074>] __generic_file_write_iter+0x1c4/0x228
> [ 393.910517] [<ffff2000081f5210>] generic_file_write_iter+0x138/0x288
> [ 393.916870] [<ffff20000829ec1c>] __vfs_write+0x1b4/0x238
> [ 393.922181] [<ffff20000829ff00>] vfs_write+0xd0/0x238
> [ 393.927232] [<ffff2000082a1ba8>] SyS_write+0xa0/0x110
> [ 393.932283] [<ffff20000808429c>] __sys_trace_return+0x0/0x4
> [ 393.937851] Object at ffff800062e3b280, in cache kmalloc-64 size: 64
> [ 393.944197] Allocated:
> [ 393.946552] PID = 2918
> [ 393.948913] save_stack_trace_tsk+0x0/0x220
> [ 393.953096] save_stack_trace+0x18/0x20
> [ 393.956932] kasan_kmalloc+0xd8/0x188
> [ 393.960594] __kmalloc+0x144/0x238
> [ 393.963994] jffs2_selected_compress+0x48/0x2a0
> [ 393.968524] jffs2_compress+0x58/0x478
> [ 393.972273] jffs2_write_inode_range+0x13c/0x450
> [ 393.976889] jffs2_write_end+0x2a8/0x4a0
> [ 393.980810] generic_perform_write+0x1c0/0x280
> [ 393.985251] __generic_file_write_iter+0x1c4/0x228
> [ 393.990040] generic_file_write_iter+0x138/0x288
> [ 393.994655] __vfs_write+0x1b4/0x238
> [ 393.998228] vfs_write+0xd0/0x238
> [ 394.001543] SyS_write+0xa0/0x110
> [ 394.004856] __sys_trace_return+0x0/0x4
> [ 394.008684] Freed:
> [ 394.010691] PID = 2918
> [ 394.013051] save_stack_trace_tsk+0x0/0x220
> [ 394.017233] save_stack_trace+0x18/0x20
> [ 394.021069] kasan_slab_free+0x88/0x188
> [ 394.024902] kfree+0x6c/0x1d8
> [ 394.027868] jffs2_sum_write_sumnode+0x2c4/0x880
> [ 394.032486] jffs2_do_reserve_space+0x198/0x598
> [ 394.037016] jffs2_reserve_space+0x3f8/0x4d8
> [ 394.041286] jffs2_write_inode_range+0xf0/0x450
> [ 394.045816] jffs2_write_end+0x2a8/0x4a0
> [ 394.049737] generic_perform_write+0x1c0/0x280
> [ 394.054179] __generic_file_write_iter+0x1c4/0x228
> [ 394.058968] generic_file_write_iter+0x138/0x288
> [ 394.063583] __vfs_write+0x1b4/0x238
> [ 394.067157] vfs_write+0xd0/0x238
> [ 394.070470] SyS_write+0xa0/0x110
> [ 394.073783] __sys_trace_return+0x0/0x4
> [ 394.077612] Memory state around the buggy address:
> [ 394.082404] ffff800062e3b180: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
> [ 394.089623] ffff800062e3b200: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
> [ 394.096842] >ffff800062e3b280: 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 394.104056] ^
> [ 394.107283] ffff800062e3b300: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> [ 394.114502] ffff800062e3b380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> [ 394.121718] ==================================================================
>
> Signed-off-by: Yang Yang <yang.yang29@zte.com.cn>
> ---
> fs/jffs2/compr_rtime.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/fs/jffs2/compr_rtime.c b/fs/jffs2/compr_rtime.c
> index 406d9cc..c69f01e 100644
> --- a/fs/jffs2/compr_rtime.c
> +++ b/fs/jffs2/compr_rtime.c
> @@ -36,6 +36,8 @@ static int jffs2_rtime_compress(unsigned char *data_in,
> unsigned short positions[256];
> int outpos = 0;
> int pos=0;
> + if (*dstlen <= 3)
> + return -1;
>
> memset(positions,0,sizeof(positions));
>
> --
> 2.15.2
>
>
> ______________________________________________________
> Linux MTD discussion mailing list
> http://lists.infradead.org/mailman/listinfo/linux-mtd/
--
Thanks,
//richard
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] jffs2: check dstlen for jffs2_zlib_compress()
@ 2019-01-21 8:04 ` Richard Weinberger
0 siblings, 0 replies; 7+ messages in thread
From: Richard Weinberger @ 2019-01-21 8:04 UTC (permalink / raw)
To: Yang Yang; +Cc: wang.yi59, linux-mtd, David Woodhouse, LKML, xue.zhihong
On Mon, Jan 21, 2019 at 1:21 AM Yang Yang <yang.yang29@zte.com.cn> wrote:
>
> KASAN reports a BUG when download file in jffs2 filesystem.
> The board name is nxp-ls1043ardb-ls1043a.
> It is because when dstlen == 1, cpage_out will write array out of bounds.
> Actually, there's no meaning for jffs2_zlib_compress() to compress
> any data with length less than 3.
> In that case, data will not be compressed.
I sent already a patch for this:
https://patchwork.ozlabs.org/patch/1013958/
> [ 393.799778] BUG: KASAN: slab-out-of-bounds in jffs2_rtime_compress+0x214/0x2f0 at addr ffff800062e3b281
> [ 393.809166] Write of size 1 by task tftp/2918
> [ 393.813526] CPU: 3 PID: 2918 Comm: tftp Tainted: G B 4.9.115-rt93-EMBSYS-CGEL-6.1.R6-dirty #1
> [ 393.823173] Hardware name: LS1043A RDB Board (DT)
> [ 393.827870] Call trace:
> [ 393.830322] [<ffff20000808c700>] dump_backtrace+0x0/0x2f0
> [ 393.835721] [<ffff20000808ca04>] show_stack+0x14/0x20
> [ 393.840774] [<ffff2000086ef700>] dump_stack+0x90/0xb0
> [ 393.845829] [<ffff20000827b19c>] kasan_object_err+0x24/0x80
> [ 393.851402] [<ffff20000827b404>] kasan_report_error+0x1b4/0x4d8
> [ 393.857323] [<ffff20000827bae8>] kasan_report+0x38/0x40
> [ 393.862548] [<ffff200008279d44>] __asan_store1+0x4c/0x58
> [ 393.867859] [<ffff2000084ce2ec>] jffs2_rtime_compress+0x214/0x2f0
> [ 393.873955] [<ffff2000084bb3b0>] jffs2_selected_compress+0x178/0x2a0
> [ 393.880308] [<ffff2000084bb530>] jffs2_compress+0x58/0x478
> [ 393.885796] [<ffff2000084c5b34>] jffs2_write_inode_range+0x13c/0x450
> [ 393.892150] [<ffff2000084be0b8>] jffs2_write_end+0x2a8/0x4a0
> [ 393.897811] [<ffff2000081f3008>] generic_perform_write+0x1c0/0x280
> [ 393.903990] [<ffff2000081f5074>] __generic_file_write_iter+0x1c4/0x228
> [ 393.910517] [<ffff2000081f5210>] generic_file_write_iter+0x138/0x288
> [ 393.916870] [<ffff20000829ec1c>] __vfs_write+0x1b4/0x238
> [ 393.922181] [<ffff20000829ff00>] vfs_write+0xd0/0x238
> [ 393.927232] [<ffff2000082a1ba8>] SyS_write+0xa0/0x110
> [ 393.932283] [<ffff20000808429c>] __sys_trace_return+0x0/0x4
> [ 393.937851] Object at ffff800062e3b280, in cache kmalloc-64 size: 64
> [ 393.944197] Allocated:
> [ 393.946552] PID = 2918
> [ 393.948913] save_stack_trace_tsk+0x0/0x220
> [ 393.953096] save_stack_trace+0x18/0x20
> [ 393.956932] kasan_kmalloc+0xd8/0x188
> [ 393.960594] __kmalloc+0x144/0x238
> [ 393.963994] jffs2_selected_compress+0x48/0x2a0
> [ 393.968524] jffs2_compress+0x58/0x478
> [ 393.972273] jffs2_write_inode_range+0x13c/0x450
> [ 393.976889] jffs2_write_end+0x2a8/0x4a0
> [ 393.980810] generic_perform_write+0x1c0/0x280
> [ 393.985251] __generic_file_write_iter+0x1c4/0x228
> [ 393.990040] generic_file_write_iter+0x138/0x288
> [ 393.994655] __vfs_write+0x1b4/0x238
> [ 393.998228] vfs_write+0xd0/0x238
> [ 394.001543] SyS_write+0xa0/0x110
> [ 394.004856] __sys_trace_return+0x0/0x4
> [ 394.008684] Freed:
> [ 394.010691] PID = 2918
> [ 394.013051] save_stack_trace_tsk+0x0/0x220
> [ 394.017233] save_stack_trace+0x18/0x20
> [ 394.021069] kasan_slab_free+0x88/0x188
> [ 394.024902] kfree+0x6c/0x1d8
> [ 394.027868] jffs2_sum_write_sumnode+0x2c4/0x880
> [ 394.032486] jffs2_do_reserve_space+0x198/0x598
> [ 394.037016] jffs2_reserve_space+0x3f8/0x4d8
> [ 394.041286] jffs2_write_inode_range+0xf0/0x450
> [ 394.045816] jffs2_write_end+0x2a8/0x4a0
> [ 394.049737] generic_perform_write+0x1c0/0x280
> [ 394.054179] __generic_file_write_iter+0x1c4/0x228
> [ 394.058968] generic_file_write_iter+0x138/0x288
> [ 394.063583] __vfs_write+0x1b4/0x238
> [ 394.067157] vfs_write+0xd0/0x238
> [ 394.070470] SyS_write+0xa0/0x110
> [ 394.073783] __sys_trace_return+0x0/0x4
> [ 394.077612] Memory state around the buggy address:
> [ 394.082404] ffff800062e3b180: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
> [ 394.089623] ffff800062e3b200: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
> [ 394.096842] >ffff800062e3b280: 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 394.104056] ^
> [ 394.107283] ffff800062e3b300: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> [ 394.114502] ffff800062e3b380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> [ 394.121718] ==================================================================
>
> Signed-off-by: Yang Yang <yang.yang29@zte.com.cn>
> ---
> fs/jffs2/compr_rtime.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/fs/jffs2/compr_rtime.c b/fs/jffs2/compr_rtime.c
> index 406d9cc..c69f01e 100644
> --- a/fs/jffs2/compr_rtime.c
> +++ b/fs/jffs2/compr_rtime.c
> @@ -36,6 +36,8 @@ static int jffs2_rtime_compress(unsigned char *data_in,
> unsigned short positions[256];
> int outpos = 0;
> int pos=0;
> + if (*dstlen <= 3)
> + return -1;
>
> memset(positions,0,sizeof(positions));
>
> --
> 2.15.2
>
>
> ______________________________________________________
> Linux MTD discussion mailing list
> http://lists.infradead.org/mailman/listinfo/linux-mtd/
--
Thanks,
//richard
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH] jffs2: check dstlen for jffs2_zlib_compress()
@ 2019-01-21 0:21 Yang Yang
2019-01-21 8:04 ` Richard Weinberger
0 siblings, 1 reply; 7+ messages in thread
From: Yang Yang @ 2019-01-21 0:21 UTC (permalink / raw)
To: dwmw2; +Cc: wang.yi59, Yang Yang, linux-mtd, linux-kernel, xue.zhihong
KASAN reports a BUG when download file in jffs2 filesystem.
The board name is nxp-ls1043ardb-ls1043a.
It is because when dstlen == 1, cpage_out will write array out of bounds.
Actually, there's no meaning for jffs2_zlib_compress() to compress
any data with length less than 3.
In that case, data will not be compressed.
[ 393.799778] BUG: KASAN: slab-out-of-bounds in jffs2_rtime_compress+0x214/0x2f0 at addr ffff800062e3b281
[ 393.809166] Write of size 1 by task tftp/2918
[ 393.813526] CPU: 3 PID: 2918 Comm: tftp Tainted: G B 4.9.115-rt93-EMBSYS-CGEL-6.1.R6-dirty #1
[ 393.823173] Hardware name: LS1043A RDB Board (DT)
[ 393.827870] Call trace:
[ 393.830322] [<ffff20000808c700>] dump_backtrace+0x0/0x2f0
[ 393.835721] [<ffff20000808ca04>] show_stack+0x14/0x20
[ 393.840774] [<ffff2000086ef700>] dump_stack+0x90/0xb0
[ 393.845829] [<ffff20000827b19c>] kasan_object_err+0x24/0x80
[ 393.851402] [<ffff20000827b404>] kasan_report_error+0x1b4/0x4d8
[ 393.857323] [<ffff20000827bae8>] kasan_report+0x38/0x40
[ 393.862548] [<ffff200008279d44>] __asan_store1+0x4c/0x58
[ 393.867859] [<ffff2000084ce2ec>] jffs2_rtime_compress+0x214/0x2f0
[ 393.873955] [<ffff2000084bb3b0>] jffs2_selected_compress+0x178/0x2a0
[ 393.880308] [<ffff2000084bb530>] jffs2_compress+0x58/0x478
[ 393.885796] [<ffff2000084c5b34>] jffs2_write_inode_range+0x13c/0x450
[ 393.892150] [<ffff2000084be0b8>] jffs2_write_end+0x2a8/0x4a0
[ 393.897811] [<ffff2000081f3008>] generic_perform_write+0x1c0/0x280
[ 393.903990] [<ffff2000081f5074>] __generic_file_write_iter+0x1c4/0x228
[ 393.910517] [<ffff2000081f5210>] generic_file_write_iter+0x138/0x288
[ 393.916870] [<ffff20000829ec1c>] __vfs_write+0x1b4/0x238
[ 393.922181] [<ffff20000829ff00>] vfs_write+0xd0/0x238
[ 393.927232] [<ffff2000082a1ba8>] SyS_write+0xa0/0x110
[ 393.932283] [<ffff20000808429c>] __sys_trace_return+0x0/0x4
[ 393.937851] Object at ffff800062e3b280, in cache kmalloc-64 size: 64
[ 393.944197] Allocated:
[ 393.946552] PID = 2918
[ 393.948913] save_stack_trace_tsk+0x0/0x220
[ 393.953096] save_stack_trace+0x18/0x20
[ 393.956932] kasan_kmalloc+0xd8/0x188
[ 393.960594] __kmalloc+0x144/0x238
[ 393.963994] jffs2_selected_compress+0x48/0x2a0
[ 393.968524] jffs2_compress+0x58/0x478
[ 393.972273] jffs2_write_inode_range+0x13c/0x450
[ 393.976889] jffs2_write_end+0x2a8/0x4a0
[ 393.980810] generic_perform_write+0x1c0/0x280
[ 393.985251] __generic_file_write_iter+0x1c4/0x228
[ 393.990040] generic_file_write_iter+0x138/0x288
[ 393.994655] __vfs_write+0x1b4/0x238
[ 393.998228] vfs_write+0xd0/0x238
[ 394.001543] SyS_write+0xa0/0x110
[ 394.004856] __sys_trace_return+0x0/0x4
[ 394.008684] Freed:
[ 394.010691] PID = 2918
[ 394.013051] save_stack_trace_tsk+0x0/0x220
[ 394.017233] save_stack_trace+0x18/0x20
[ 394.021069] kasan_slab_free+0x88/0x188
[ 394.024902] kfree+0x6c/0x1d8
[ 394.027868] jffs2_sum_write_sumnode+0x2c4/0x880
[ 394.032486] jffs2_do_reserve_space+0x198/0x598
[ 394.037016] jffs2_reserve_space+0x3f8/0x4d8
[ 394.041286] jffs2_write_inode_range+0xf0/0x450
[ 394.045816] jffs2_write_end+0x2a8/0x4a0
[ 394.049737] generic_perform_write+0x1c0/0x280
[ 394.054179] __generic_file_write_iter+0x1c4/0x228
[ 394.058968] generic_file_write_iter+0x138/0x288
[ 394.063583] __vfs_write+0x1b4/0x238
[ 394.067157] vfs_write+0xd0/0x238
[ 394.070470] SyS_write+0xa0/0x110
[ 394.073783] __sys_trace_return+0x0/0x4
[ 394.077612] Memory state around the buggy address:
[ 394.082404] ffff800062e3b180: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[ 394.089623] ffff800062e3b200: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[ 394.096842] >ffff800062e3b280: 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 394.104056] ^
[ 394.107283] ffff800062e3b300: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 394.114502] ffff800062e3b380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 394.121718] ==================================================================
Signed-off-by: Yang Yang <yang.yang29@zte.com.cn>
---
fs/jffs2/compr_rtime.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/jffs2/compr_rtime.c b/fs/jffs2/compr_rtime.c
index 406d9cc..c69f01e 100644
--- a/fs/jffs2/compr_rtime.c
+++ b/fs/jffs2/compr_rtime.c
@@ -36,6 +36,8 @@ static int jffs2_rtime_compress(unsigned char *data_in,
unsigned short positions[256];
int outpos = 0;
int pos=0;
+ if (*dstlen <= 3)
+ return -1;
memset(positions,0,sizeof(positions));
--
2.15.2
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
^ permalink raw reply related [flat|nested] 7+ messages in thread
end of thread, other threads:[~2019-03-20 21:07 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <201903201046335762775@zte.com.cn>
2019-03-20 21:06 ` [PATCH] jffs2: check dstlen for jffs2_zlib_compress() Richard Weinberger
2019-03-20 21:06 ` Richard Weinberger
[not found] <201901211659107381808@zte.com.cn>
2019-01-21 11:35 ` Richard Weinberger
2019-01-21 11:35 ` Richard Weinberger
2019-01-21 0:21 Yang Yang
2019-01-21 8:04 ` Richard Weinberger
2019-01-21 8:04 ` Richard Weinberger
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.