diff options
author | Igor Opaniuk <igor.opaniuk@toradex.com> | 2020-11-17 14:38:38 +0200 |
---|---|---|
committer | Igor Opaniuk <igor.opaniuk@toradex.com> | 2020-11-17 14:38:38 +0200 |
commit | 8bb9d758833ea1d0622277981b5225980ba0a42d (patch) | |
tree | 2281499b2970e563f522db7ebc9d03bebfda4bfa /fs/ubifs/io.c | |
parent | 0316046d152a1817bd0b4faff8e34c212a936a5e (diff) | |
parent | 3b59d4725be760cd276094079b4fbe7bd44e1464 (diff) |
Merge branch 'toradex_5.4-2.1.x-imx' into HEAD
Diffstat (limited to 'fs/ubifs/io.c')
-rw-r--r-- | fs/ubifs/io.c | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c index 8ceb51478800..7e4bfaf2871f 100644 --- a/fs/ubifs/io.c +++ b/fs/ubifs/io.c @@ -225,7 +225,7 @@ int ubifs_is_mapped(const struct ubifs_info *c, int lnum) int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum, int offs, int quiet, int must_chk_crc) { - int err = -EINVAL, type, node_len; + int err = -EINVAL, type, node_len, dump_node = 1; uint32_t crc, node_crc, magic; const struct ubifs_ch *ch = buf; @@ -278,10 +278,22 @@ int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum, out_len: if (!quiet) ubifs_err(c, "bad node length %d", node_len); + if (type == UBIFS_DATA_NODE && node_len > UBIFS_DATA_NODE_SZ) + dump_node = 0; out: if (!quiet) { ubifs_err(c, "bad node at LEB %d:%d", lnum, offs); - ubifs_dump_node(c, buf); + if (dump_node) { + ubifs_dump_node(c, buf); + } else { + int safe_len = min3(node_len, c->leb_size - offs, + (int)UBIFS_MAX_DATA_NODE_SZ); + pr_err("\tprevent out-of-bounds memory access\n"); + pr_err("\ttruncated data node length %d\n", safe_len); + pr_err("\tcorrupted data node:\n"); + print_hex_dump(KERN_ERR, "\t", DUMP_PREFIX_OFFSET, 32, 1, + buf, safe_len, 0); + } dump_stack(); } return err; |