From: Zhihao Cheng <chengzhihao1@huawei.com>
To: <linux-mtd@lists.infradead.org>, <linux-kernel@vger.kernel.org>
Cc: richard@nod.at, liu.song11@zte.com.cn, yi.zhang@huawei.com
Subject: [PATCH RFC 2/5] Revert "ubifs: Fix out-of-bounds memory access caused by abnormal value of node_len"
Date: Tue, 16 Jun 2020 15:11:43 +0800 [thread overview]
Message-ID: <20200616071146.2607061-3-chengzhihao1@huawei.com> (raw)
In-Reply-To: <20200616071146.2607061-1-chengzhihao1@huawei.com>
This reverts commit acc5af3efa303d5f36cc8c0f61716161f6ca1384.
No need to avoid memory oob in dumping for data node alone. Later, node
length will be passed into function 'ubifs_dump_node()' which replaces
all node dumping places.
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
---
fs/ubifs/io.c | 16 ++--------------
1 file changed, 2 insertions(+), 14 deletions(-)
diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c
index 7e4bfaf2871f..8ceb51478800 100644
--- a/fs/ubifs/io.c
+++ b/fs/ubifs/io.c
@@ -225,7 +225,7 @@ int ubifs_is_mapped(const struct ubifs_info *c, int lnum)
int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum,
int offs, int quiet, int must_chk_crc)
{
- int err = -EINVAL, type, node_len, dump_node = 1;
+ int err = -EINVAL, type, node_len;
uint32_t crc, node_crc, magic;
const struct ubifs_ch *ch = buf;
@@ -278,22 +278,10 @@ int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum,
out_len:
if (!quiet)
ubifs_err(c, "bad node length %d", node_len);
- if (type == UBIFS_DATA_NODE && node_len > UBIFS_DATA_NODE_SZ)
- dump_node = 0;
out:
if (!quiet) {
ubifs_err(c, "bad node at LEB %d:%d", lnum, offs);
- if (dump_node) {
- ubifs_dump_node(c, buf);
- } else {
- int safe_len = min3(node_len, c->leb_size - offs,
- (int)UBIFS_MAX_DATA_NODE_SZ);
- pr_err("\tprevent out-of-bounds memory access\n");
- pr_err("\ttruncated data node length %d\n", safe_len);
- pr_err("\tcorrupted data node:\n");
- print_hex_dump(KERN_ERR, "\t", DUMP_PREFIX_OFFSET, 32, 1,
- buf, safe_len, 0);
- }
+ ubifs_dump_node(c, buf);
dump_stack();
}
return err;
--
2.25.4
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
next prev parent reply other threads:[~2020-06-16 7:11 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-16 7:11 [PATCH RFC 0/5] ubifs: Prevent memory oob accessing while dumping node Zhihao Cheng
2020-06-16 7:11 ` [PATCH RFC 1/5] ubifs: Limit dumping length by size of memory which is allocated for the node Zhihao Cheng
2020-06-16 7:11 ` Zhihao Cheng [this message]
2020-06-16 7:11 ` [PATCH RFC 3/5] ubifs: Pass node length in all node dumping callers Zhihao Cheng
2020-06-16 7:11 ` [PATCH RFC 4/5] ubifs: ubifs_dump_sleb: Remove unused function Zhihao Cheng
2020-06-16 7:11 ` [PATCH RFC 5/5] ubifs: ubifs_dump_node: Dump all branches of the index node Zhihao Cheng
2020-10-19 3:05 ` [PATCH RFC 0/5] ubifs: Prevent memory oob accessing while dumping node Zhihao Cheng
2020-10-31 21:13 ` Richard Weinberger
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200616071146.2607061-3-chengzhihao1@huawei.com \
--to=chengzhihao1@huawei.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mtd@lists.infradead.org \
--cc=liu.song11@zte.com.cn \
--cc=richard@nod.at \
--cc=yi.zhang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).