From: Jiri Slaby <jslaby@suse.cz>
To: stable@vger.kernel.org
Cc: linux-kernel@vger.kernel.org,
Ajesh Kunhipurayil Vijayan <ajesh@broadcom.com>,
Kamlakant Patel <kamlakant.patel@broadcom.com>,
Brian Norris <computersforpeace@gmail.com>,
Jiri Slaby <jslaby@suse.cz>
Subject: [PATCH 3.12 43/50] jffs2: Fix crash due to truncation of csize
Date: Mon, 5 May 2014 14:43:25 +0200 [thread overview]
Message-ID: <0bf18cba4210dd3ae4a63cc961c8973c54045a62.1399292849.git.jslaby@suse.cz> (raw)
In-Reply-To: <7d4f4737432af6216e86975e587331b9d8b08063.1399292849.git.jslaby@suse.cz>
In-Reply-To: <cover.1399292849.git.jslaby@suse.cz>
From: Ajesh Kunhipurayil Vijayan <ajesh@broadcom.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit 41bf1a24c1001f4d0d41a78e1ac575d2f14789d7 upstream.
mounting JFFS2 partition sometimes crashes with this call trace:
[ 1322.240000] Kernel bug detected[#1]:
[ 1322.244000] Cpu 2
[ 1322.244000] $ 0 : 0000000000000000 0000000000000018 000000003ff00070 0000000000000001
[ 1322.252000] $ 4 : 0000000000000000 c0000000f3980150 0000000000000000 0000000000010000
[ 1322.260000] $ 8 : ffffffffc09cd5f8 0000000000000001 0000000000000088 c0000000ed300de8
[ 1322.268000] $12 : e5e19d9c5f613a45 ffffffffc046d464 0000000000000000 66227ba5ea67b74e
[ 1322.276000] $16 : c0000000f1769c00 c0000000ed1e0200 c0000000f3980150 0000000000000000
[ 1322.284000] $20 : c0000000f3a80000 00000000fffffffc c0000000ed2cfbd8 c0000000f39818f0
[ 1322.292000] $24 : 0000000000000004 0000000000000000
[ 1322.300000] $28 : c0000000ed2c0000 c0000000ed2cfab8 0000000000010000 ffffffffc039c0b0
[ 1322.308000] Hi : 000000000000023c
[ 1322.312000] Lo : 000000000003f802
[ 1322.316000] epc : ffffffffc039a9f8 check_tn_node+0x88/0x3b0
[ 1322.320000] Not tainted
[ 1322.324000] ra : ffffffffc039c0b0 jffs2_do_read_inode_internal+0x1250/0x1e48
[ 1322.332000] Status: 5400f8e3 KX SX UX KERNEL EXL IE
[ 1322.336000] Cause : 00800034
[ 1322.340000] PrId : 000c1004 (Netlogic XLP)
[ 1322.344000] Modules linked in:
[ 1322.348000] Process jffs2_gcd_mtd7 (pid: 264, threadinfo=c0000000ed2c0000, task=c0000000f0e68dd8, tls=0000000000000000)
[ 1322.356000] Stack : c0000000f1769e30 c0000000ed010780 c0000000ed010780 c0000000ed300000
c0000000f1769c00 c0000000f3980150 c0000000f3a80000 00000000fffffffc
c0000000ed2cfbd8 ffffffffc039c0b0 ffffffffc09c6340 0000000000001000
0000000000000dec ffffffffc016c9d8 c0000000f39805a0 c0000000f3980180
0000008600000000 0000000000000000 0000000000000000 0000000000000000
0001000000000dec c0000000f1769d98 c0000000ed2cfb18 0000000000010000
0000000000010000 0000000000000044 c0000000f3a80000 c0000000f1769c00
c0000000f3d207a8 c0000000f1769d98 c0000000f1769de0 ffffffffc076f9c0
0000000000000009 0000000000000000 0000000000000000 ffffffffc039cf90
0000000000000017 ffffffffc013fbdc 0000000000000001 000000010003e61c
...
[ 1322.424000] Call Trace:
[ 1322.428000] [<ffffffffc039a9f8>] check_tn_node+0x88/0x3b0
[ 1322.432000] [<ffffffffc039c0b0>] jffs2_do_read_inode_internal+0x1250/0x1e48
[ 1322.440000] [<ffffffffc039cf90>] jffs2_do_crccheck_inode+0x70/0xd0
[ 1322.448000] [<ffffffffc03a1b80>] jffs2_garbage_collect_pass+0x160/0x870
[ 1322.452000] [<ffffffffc03a392c>] jffs2_garbage_collect_thread+0xdc/0x1f0
[ 1322.460000] [<ffffffffc01541c8>] kthread+0xb8/0xc0
[ 1322.464000] [<ffffffffc0106d18>] kernel_thread_helper+0x10/0x18
[ 1322.472000]
[ 1322.472000]
Code: 67bd0050 94a4002c 2c830001 <00038036> de050218 2403fffc 0080a82d 00431824 24630044
[ 1322.480000] ---[ end trace b052bb90e97dfbf5 ]---
The variable csize in structure jffs2_tmp_dnode_info is of type uint16_t, but it
is used to hold the compressed data length(csize) which is declared as uint32_t.
So, when the value of csize exceeds 16bits, it gets truncated when assigned to
tn->csize. This is causing a kernel BUG.
Changing the definition of csize in jffs2_tmp_dnode_info to uint32_t fixes the issue.
Signed-off-by: Ajesh Kunhipurayil Vijayan <ajesh@broadcom.com>
Signed-off-by: Kamlakant Patel <kamlakant.patel@broadcom.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
fs/jffs2/nodelist.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/jffs2/nodelist.h b/fs/jffs2/nodelist.h
index e4619b00f7c5..fa35ff79ab35 100644
--- a/fs/jffs2/nodelist.h
+++ b/fs/jffs2/nodelist.h
@@ -231,7 +231,7 @@ struct jffs2_tmp_dnode_info
uint32_t version;
uint32_t data_crc;
uint32_t partial_crc;
- uint16_t csize;
+ uint32_t csize;
uint16_t overlapped;
};
--
1.9.2
next prev parent reply other threads:[~2014-05-05 12:47 UTC|newest]
Thread overview: 52+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-05-05 12:28 [PATCH 3.12 00/50] 3.12.19-stable review Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 01/50] openvswitch: fix vport-netdev unregister Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 02/50] brcmsmac: fix deadlock on missing firmware Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 03/50] /dev/mem: handle out-of-bounds read/write Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 04/50] drivers/net: tulip_remove_one needs to call pci_disable_device() Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 05/50] Bluetooth: Add support for Intel Bluetooth device [8087:0a2a] Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 06/50] iommu/amd: Fix PASID format in INVALIDATE_IOTLB_PAGES command Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 07/50] usbatm: Fix dynamic_debug / ratelimited atm_dbg and atm_rldbg macros Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 08/50] printk: pr_debug_ratelimited: check state first to reduce "callbacks suppressed" messages Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 09/50] dcache: restore error on restart in prepend_path Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 10/50] __dentry_path() fixes Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 11/50] i2c: i801: enable Intel BayTrail SMBUS Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 12/50] e1000e: Fix no connectivity when driver loaded with cable out Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 13/50] ACPI / EC: Process rather than discard events in acpi_ec_clear Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 14/50] ARM: 7840/1: LPAE: don't reject mapping /dev/mem above 4GB Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 15/50] x86/quirks: Add workaround for AMD F16h Erratum792 Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 16/50] amd64_edac: Fix logic to determine channel for F15 M30h processors Jiri Slaby
2014-05-05 12:42 ` [PATCH 3.12 17/50] backing_dev: fix hung task on sync Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 18/50] bdi: avoid oops on device removal Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 19/50] virtio_balloon: don't softlockup on huge balloon changes Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 20/50] ipmi: Fix a race restarting the timer Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 21/50] KVM: ioapic: fix assignment of ioapic->rtc_status.pending_eoi (CVE-2014-0155) Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 22/50] net: ipv4: current group_info should be put after using Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 24/50] powerpc/8xx: mfspr SPRN_TBRx in lieu of mftb/mftbu is not supported Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 25/50] ACPI / sleep: remove panic in case hardware has changed after S4 Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 26/50] user namespace: fix incorrect memory barriers Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 27/50] x86: Adjust irq remapping quirk for older revisions of 5500/5520 chipsets Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 28/50] PCI: designware: Fix RC BAR to be single 64-bit non-prefetchable memory BAR Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 29/50] PCI: designware: Fix iATU programming for cfg1, io and mem viewport Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 30/50] ACPI / button: Add ACPI Button event via netlink routine Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 31/50] staging: comedi: 8255_pci: initialize MITE data window Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 32/50] tty: Set correct tty name in 'active' sysfs attribute Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 33/50] tty: Fix low_latency BUG Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 35/50] Bluetooth: Fix removing Long Term Key Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 36/50] xfs: fix directory hash ordering bug Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 37/50] Btrfs: skip submitting barrier for missing device Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 38/50] Btrfs: fix deadlock with nested trans handles Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 39/50] ext4: fix error return from ext4_ext_handle_uninitialized_extents() Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 40/50] ext4: fix partial cluster handling for bigalloc file systems Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 41/50] ext4: fix premature freeing of partial clusters split across leaf blocks Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 42/50] jffs2: Fix segmentation fault found in stress test Jiri Slaby
2014-05-05 12:43 ` Jiri Slaby [this message]
2014-05-05 12:43 ` [PATCH 3.12 44/50] jffs2: avoid soft-lockup in jffs2_reserve_space_gc() Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 45/50] jffs2: remove from wait queue after schedule() Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 46/50] sparc32: fix build failure for arch_jump_label_transform Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 47/50] sparc64: don't treat 64-bit syscall return codes as 32-bit Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 48/50] sparc64: Make sure %pil interrupts are enabled during hypervisor yield Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 49/50] wait: fix reparent_leader() vs EXIT_DEAD->EXIT_ZOMBIE race Jiri Slaby
2014-05-05 12:43 ` [PATCH 3.12 50/50] exit: call disassociate_ctty() before exit_task_namespaces() Jiri Slaby
2014-05-05 15:45 ` [PATCH 3.12 00/50] 3.12.19-stable review Guenter Roeck
2014-05-06 14:57 ` Shuah Khan
2014-05-09 8:32 ` Jiri Slaby
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0bf18cba4210dd3ae4a63cc961c8973c54045a62.1399292849.git.jslaby@suse.cz \
--to=jslaby@suse.cz \
--cc=ajesh@broadcom.com \
--cc=computersforpeace@gmail.com \
--cc=kamlakant.patel@broadcom.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).