diff options
| author | Zhihao Cheng <chengzhihao1@huawei.com> | 2020-06-16 10:11:43 +0300 |
|---|---|---|
| committer | Richard Weinberger <richard@nod.at> | 2020-12-14 00:11:51 +0300 |
| commit | c8be097530a82e004f98378c3afc5cd35efc4f57 (patch) | |
| tree | 41a9fff4efb4f47d8df3bfed65c51af6c8700ad7 /fs/ubifs/io.c | |
| parent | c4c0d19d39d26c5f58633f8fcca75f03b2854fc0 (diff) | |
| download | linux-c8be097530a82e004f98378c3afc5cd35efc4f57.tar.xz | |
Revert "ubifs: Fix out-of-bounds memory access caused by abnormal value of node_len"
This reverts commit acc5af3efa30 ("ubifs: Fix out-of-bounds memory access caused by abnormal value of node_len")
No need to avoid memory oob in dumping for data node alone. Later, node
length will be passed into function 'ubifs_dump_node()' which replaces
all node dumping places.
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Diffstat (limited to 'fs/ubifs/io.c')
| -rw-r--r-- | fs/ubifs/io.c | 16 |
1 files changed, 2 insertions, 14 deletions
diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c index a9cabb3fa64c..be50cb598a38 100644 --- a/fs/ubifs/io.c +++ b/fs/ubifs/io.c @@ -225,7 +225,7 @@ int ubifs_is_mapped(const struct ubifs_info *c, int lnum) int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum, int offs, int quiet, int must_chk_crc) { - int err = -EINVAL, type, node_len, dump_node = 1; + int err = -EINVAL, type, node_len; uint32_t crc, node_crc, magic; const struct ubifs_ch *ch = buf; @@ -278,22 +278,10 @@ int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum, out_len: if (!quiet) ubifs_err(c, "bad node length %d", node_len); - if (type == UBIFS_DATA_NODE && node_len > UBIFS_DATA_NODE_SZ) - dump_node = 0; out: if (!quiet) { ubifs_err(c, "bad node at LEB %d:%d", lnum, offs); - if (dump_node) { - ubifs_dump_node(c, buf); - } else { - int safe_len = min3(node_len, c->leb_size - offs, - (int)UBIFS_MAX_DATA_NODE_SZ); - pr_err("\tprevent out-of-bounds memory access\n"); - pr_err("\ttruncated data node length %d\n", safe_len); - pr_err("\tcorrupted data node:\n"); - print_hex_dump(KERN_ERR, "\t", DUMP_PREFIX_OFFSET, 32, 1, - buf, safe_len, 0); - } + ubifs_dump_node(c, buf); dump_stack(); } return err; |