From: Artem Bityutskiy <dedekind@infradead.org>
To: linux-fsdevel@vger.kernel.org
Cc: Adrian Hunter <ext-adrian.hunter@nokia.com>,
linux-kernel@vger.kernel.org, linux-mtd@lists.infradead.org
Subject: [PATCH] UBIFS: check buffer length when scanning for LPT nodes
Date: Tue, 30 Sep 2008 12:19:18 +0300 [thread overview]
Message-ID: <1222766358-21886-23-git-send-email-dedekind@infradead.org> (raw)
In-Reply-To: <1222766358-21886-1-git-send-email-dedekind@infradead.org>
From: Adrian Hunter <ext-adrian.hunter@nokia.com>
'is_a_node()' function was reading from a buffer before
checking the buffer length, resulting in an OOPS as
follows:
BUG: unable to handle kernel paging request at f8f74002
IP: [<f8f9783f>] :ubifs:ubifs_unpack_bits+0xca/0x233
*pde = 19e95067 *pte = 00000000
Oops: 0000 [#1] PREEMPT SMP
Modules linked in: ubifs ubi mtdchar bio2mtd mtd brd video output
[last unloaded: mtd]
Pid: 6414, comm: integck Not tainted (2.6.27-rc6ubifs34 #23)
EIP: 0060:[<f8f9783f>] EFLAGS: 00010246 CPU: 0
EIP is at ubifs_unpack_bits+0xca/0x233 [ubifs]
EAX: 00000000 EBX: f6090630 ECX: d9badcfc EDX: 00000000
ESI: 00000004 EDI: f8f74002 EBP: d9badcec ESP: d9badcc0
DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
Process integck (pid: 6414, ti=d9bac000 task=f727dae0 task.ti=d9bac000)
Stack: 00000006 f7306240 00000002 00000000 d9badcfc d9badd00 0000001c 00000000
f6090630 f6090630 f8f74000 d9badd10 f8fa1cc9 00000000 f8f74002 00000000
f8f74002 f60fe128 f6090630 f8f74000 d9badd68 f8fa1e46 00000000 0001e000
Call Trace:
[<f8fa1cc9>] ? is_a_node+0x30/0x90 [ubifs]
[<f8fa1e46>] ? dbg_check_ltab+0x11d/0x5bd [ubifs]
[<f8fa388f>] ? ubifs_lpt_start_commit+0x42/0xed3 [ubifs]
[<c038e76a>] ? mutex_unlock+0x8/0xa
[<f8f9625d>] ? ubifs_tnc_start_commit+0x1c8/0xedb [ubifs]
[<f8f8d90b>] ? do_commit+0x187/0x523 [ubifs]
[<c038e76a>] ? mutex_unlock+0x8/0xa
[<f8f7ca17>] ? bud_wbuf_callback+0x22/0x28 [ubifs]
[<f8f8dd1d>] ? ubifs_run_commit+0x76/0xc0 [ubifs]
[<f8f8032c>] ? ubifs_sync_fs+0xd2/0xe6 [ubifs]
[<c01a2e97>] ? vfs_quota_sync+0x0/0x17e
[<c01a5ba6>] ? quota_sync_sb+0x26/0xbb
[<c01a2e97>] ? vfs_quota_sync+0x0/0x17e
[<c01a5c5d>] ? sync_dquots+0x22/0x12c
[<c0173d1b>] ? __fsync_super+0x19/0x68
[<c0173d75>] ? fsync_super+0xb/0x19
[<c0174065>] ? generic_shutdown_super+0x22/0xe7
[<c01a31fc>] ? vfs_quota_off+0x0/0x5fd
[<f8f7cf4d>] ? ubifs_kill_sb+0x31/0x35 [ubifs]
[<c01741f9>] ? deactivate_super+0x5e/0x71
[<c0187610>] ? mntput_no_expire+0x82/0xe4
[<c0187905>] ? sys_umount+0x4c/0x2f6
[<c0187bc8>] ? sys_oldumount+0x19/0x1b
[<c0103b71>] ? sysenter_do_call+0x12/0x25
=======================
Code: c1 f8 03 8d 04 07 8b 4d e8 89 01 8b 45 e4 89 10 89 d8 89 f1 d3 e8 85 c0
74 07 29 d6 83 fe 20 75 2a 89 d8 83 c4 20 5b 5e 5f 5d
EIP: [<f8f9783f>] ubifs_unpack_bits+0xca/0x233 [ubifs] SS:ESP 0068:d9badcc0
---[ end trace 1f02572436518c13 ]---
Signed-off-by: Adrian Hunter <ext-adrian.hunter@nokia.com>
---
fs/ubifs/lpt_commit.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/fs/ubifs/lpt_commit.c b/fs/ubifs/lpt_commit.c
index 8546865..eed5a00 100644
--- a/fs/ubifs/lpt_commit.c
+++ b/fs/ubifs/lpt_commit.c
@@ -1089,6 +1089,8 @@ static int is_a_node(struct ubifs_info *c, uint8_t *buf, int len)
int pos = 0, node_type, node_len;
uint16_t crc, calc_crc;
+ if (len < UBIFS_LPT_CRC_BYTES + (UBIFS_LPT_TYPE_BITS + 7) / 8)
+ return 0;
node_type = ubifs_unpack_bits(&addr, &pos, UBIFS_LPT_TYPE_BITS);
if (node_type == UBIFS_LPT_NOT_A_NODE)
return 0;
--
1.5.4.1
prev parent reply other threads:[~2008-09-30 7:43 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-09-30 9:18 What is in ubifs-2.6.git Artem Bityutskiy
2008-09-30 7:56 ` Artem Bityutskiy
2008-09-30 8:55 ` Amit Kumar Sharma
2008-09-30 9:02 ` Artem Bityutskiy
2008-09-30 9:18 ` [PATCH] UBIFS: add a print, fix comments and more minor stuff Artem Bityutskiy
2008-09-30 9:18 ` [PATCH] UBIFS: remove unneeded unlikely() Artem Bityutskiy
2008-09-30 9:18 ` [PATCH] UBIFS: inline one-line functions Artem Bityutskiy
2008-09-30 9:19 ` [PATCH] UBIFS: use an IS_ERR test rather than a NULL test Artem Bityutskiy
2008-09-30 9:19 ` [PATCH] UBIFS: add bulk-read facility Artem Bityutskiy
2008-09-30 9:19 ` [PATCH] UBIFS: add no_chk_data_crc mount option Artem Bityutskiy
2008-09-30 9:19 ` [PATCH] UBIFS: improve znode splitting rules Artem Bityutskiy
2008-09-30 9:19 ` [PATCH] UBIFS: check data CRC when in error state Artem Bityutskiy
2008-09-30 9:19 ` [PATCH] UBIFS: use bit-fields when possible Artem Bityutskiy
2008-09-30 9:19 ` [PATCH] UBIFS: correct key comparison Artem Bityutskiy
2008-09-30 9:19 ` [PATCH] UBIFS: ensure data read beyond i_size is zeroed out correctly Artem Bityutskiy
2008-09-30 9:19 ` [PATCH] UBIFS: fix races in bit-fields Artem Bityutskiy
2008-09-30 9:19 ` [PATCH] UBIFS: fix commentary Artem Bityutskiy
2008-09-30 9:19 ` [PATCH] UBIFS: update dbg_dump_inode Artem Bityutskiy
2008-09-30 9:19 ` [PATCH] UBIFS: correct comment for commit_on_unmount Artem Bityutskiy
2008-09-30 9:19 ` [PATCH] UBIFS: commit on sync_fs Artem Bityutskiy
2008-09-30 9:19 ` [PATCH] UBIFS: allow for sync_fs when read-only Artem Bityutskiy
2008-09-30 9:19 ` [PATCH] UBIFS: improve garbage collection Artem Bityutskiy
2008-09-30 9:19 ` [PATCH] UBIFS: fix bulk-read handling uptodate pages Artem Bityutskiy
2008-09-30 9:19 ` [PATCH] UBIFS: add more debugging messages for LPT Artem Bityutskiy
2008-09-30 9:19 ` [PATCH] UBIFS: correct condition to eliminate unecessary assignment Artem Bityutskiy
2008-09-30 9:19 ` Artem Bityutskiy [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1222766358-21886-23-git-send-email-dedekind@infradead.org \
--to=dedekind@infradead.org \
--cc=ext-adrian.hunter@nokia.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mtd@lists.infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®