Skip to contentSkip to conversation

FAILED: patch "[PATCH] ubifs: Check data node size before truncate" failed to apply to 3.18-stable tree

PATCH [email protected] 1 participant 1 message Sep 7, 2018

Subsystems (2)
Stable branch UBI file system (UBIFS)
lore
Share & tools
lore

[email protected]

author maintainer
#0 lore raw

The patch below does not apply to the 3.18-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

Quoted 1 line

From 95a22d2084d72ea067d8323cc85677dba5d97cae Mon Sep 17 00:00:00 2001

From: Richard Weinberger <[email protected]>
Date: Sun, 1 Jul 2018 23:20:51 +0200
Subject: [PATCH] ubifs: Check data node size before truncate

Check whether the size is within bounds before using it. If the size is not correct, abort and dump the bad data node.

Cc Kees Cook <[email protected]>
Cc Silvio Cesare <[email protected]>
Cc [email protected]
Fixes 1e51764a3c2ac ("UBIFS: add new flash file system")
Reported-by Silvio Cesare <[email protected]>
Signed-off-by Richard Weinberger <[email protected]>
Reviewed-by Kees Cook <[email protected]>
Signed-off-by Richard Weinberger <[email protected]>
fs/ubifs/journal.c +10 -1
index 1406765c3ef9..cef0d76d490a 100644
@@ -1393,7 +1393,16 @@ int ubifs_jnl_truncate(struct ubifs_info *c, const struct inode *inode,
 		else if (err)
 			goto out_free;
 		else {
-			if (le32_to_cpu(dn->size) <= dlen)
+			int dn_len = le32_to_cpu(dn->size);
+
+			if (dn_len <= 0 || dn_len > UBIFS_BLOCK_SIZE) {
+				ubifs_err(c, "bad data node (block %u, inode %lu)",
+					  blk, inode->i_ino);
+				ubifs_dump_node(c, dn);
+				goto out_free;
+			}
+
+			if (dn_len <= dlen)
 				dlen = 0; /* Nothing to do */
 			else {
 				err = truncate_data_node(c, inode, blk, dn, &dlen);