From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Chen Jie <chenjie6@huawei.com>,
Andrew Morton <akpm@linux-foundation.org>,
David Woodhouse <David.Woodhouse@intel.com>
Subject: [PATCH 3.10 51/53] jffs2: fix handling of corrupted summary length
Date: Tue, 3 Mar 2015 22:06:54 -0800 [thread overview]
Message-ID: <20150304054618.321143946@linuxfoundation.org> (raw)
In-Reply-To: <20150304054609.869052846@linuxfoundation.org>
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Jie <chenjie6@huawei.com>
commit 164c24063a3eadee11b46575c5482b2f1417be49 upstream.
sm->offset maybe wrong but magic maybe right, the offset do not have CRC.
Badness at c00c7580 [verbose debug info unavailable]
NIP: c00c7580 LR: c00c718c CTR: 00000014
REGS: df07bb40 TRAP: 0700 Not tainted (2.6.34.13-WR4.3.0.0_standard)
MSR: 00029000 <EE,ME,CE> CR: 22084f84 XER: 00000000
TASK = df84d6e0[908] 'mount' THREAD: df07a000
GPR00: 00000001 df07bbf0 df84d6e0 00000000 00000001 00000000 df07bb58 00000041
GPR08: 00000041 c0638860 00000000 00000010 22084f88 100636c8 df814ff8 00000000
GPR16: df84d6e0 dfa558cc c05adb90 00000048 c0452d30 00000000 000240d0 000040d0
GPR24: 00000014 c05ae734 c05be2e0 00000000 00000001 00000000 00000000 c05ae730
NIP [c00c7580] __alloc_pages_nodemask+0x4d0/0x638
LR [c00c718c] __alloc_pages_nodemask+0xdc/0x638
Call Trace:
[df07bbf0] [c00c718c] __alloc_pages_nodemask+0xdc/0x638 (unreliable)
[df07bc90] [c00c7708] __get_free_pages+0x20/0x48
[df07bca0] [c00f4a40] __kmalloc+0x15c/0x1ec
[df07bcd0] [c01fc880] jffs2_scan_medium+0xa58/0x14d0
[df07bd70] [c01ff38c] jffs2_do_mount_fs+0x1f4/0x6b4
[df07bdb0] [c020144c] jffs2_do_fill_super+0xa8/0x260
[df07bdd0] [c020230c] jffs2_fill_super+0x104/0x184
[df07be00] [c0335814] get_sb_mtd_aux+0x9c/0xec
[df07be20] [c033596c] get_sb_mtd+0x84/0x1e8
[df07be60] [c0201ed0] jffs2_get_sb+0x1c/0x2c
[df07be70] [c0103898] vfs_kern_mount+0x78/0x1e8
[df07bea0] [c0103a58] do_kern_mount+0x40/0x100
[df07bec0] [c011fe90] do_mount+0x240/0x890
[df07bf10] [c0120570] sys_mount+0x90/0xd8
[df07bf40] [c00110d8] ret_from_syscall+0x0/0x4
=== Exception: c01 at 0xff61a34
LR = 0x100135f0
Instruction dump:
38800005 38600000 48010f41 4bfffe1c 4bfc2d15 4bfffe8c 72e90200 4082fc28
3d20c064 39298860 8809000d 68000001 <0f000000> 2f800000 419efc0c 38000001
mount: mounting /dev/mtdblock3 on /common failed: Input/output error
Signed-off-by: Chen Jie <chenjie6@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/jffs2/scan.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/fs/jffs2/scan.c
+++ b/fs/jffs2/scan.c
@@ -510,6 +510,10 @@ static int jffs2_scan_eraseblock (struct
sumlen = c->sector_size - je32_to_cpu(sm->offset);
sumptr = buf + buf_size - sumlen;
+ /* sm->offset maybe wrong but MAGIC maybe right */
+ if (sumlen > c->sector_size)
+ goto full_scan;
+
/* Now, make sure the summary itself is available */
if (sumlen > buf_size) {
/* Need to kmalloc for this. */
@@ -544,6 +548,7 @@ static int jffs2_scan_eraseblock (struct
}
}
+full_scan:
buf_ofs = jeb->offset;
if (!buf_size) {
next prev parent reply other threads:[~2015-03-04 6:14 UTC|newest]
Thread overview: 58+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-03-04 6:06 [PATCH 3.10 00/53] 3.10.71-stable review Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 01/53] Bluetooth: ath3k: workaround the compatibility issue with xHCI controller Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 02/53] xfs: ensure buffer types are set correctly Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 03/53] xfs: inode unlink does not set AGI buffer type Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 04/53] xfs: set superblock buffer type correctly Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 05/53] fsnotify: fix handling of renames in audit Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 06/53] iwlwifi: pcie: disable the SCD_BASE_ADDR when we resume from WoWLAN Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 07/53] iwlwifi: mvm: validate tid and sta_id in ba_notif Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 08/53] iwlwifi: mvm: fix failure path when power_update fails in add_interface Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 09/53] iwlwifi: mvm: always use mac color zero Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 10/53] HID: i2c-hid: Limit reads to wMaxInputLength bytes for input events Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 11/53] PCI: Generate uppercase hex for modalias var in uevent Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 14/53] [media] lmedm04: Fix usb_submit_urb BOGUS urb xfer, pipe 1 != type 3 in interrupt urb Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 15/53] ALSA: off by one bug in snd_riptide_joystick_probe() Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 16/53] ALSA: hdspm - Constrain periods to 2 on older cards Greg Kroah-Hartman
2015-03-04 10:03 ` Adrian Knoth
2015-03-04 18:19 ` Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 17/53] power_supply: 88pm860x: Fix leaked power supply on probe fail Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 18/53] mmc: sdhci-pxav3: fix setting of pdata->clk_delay_cycles Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 19/53] nfs: dont call blocking operations while !TASK_RUNNING Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 20/53] MIPS: KVM: Deliver guest interrupts after local_irq_disable() Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 21/53] tracing: Fix unmapping loop in tracing_mark_write Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 22/53] ARM: 8284/1: sa1100: clear RCSR_SMR on resume Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 23/53] tpm_tis: verify interrupt during init Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 24/53] tpm: Fix NULL return in tpm_ibmvtpm_get_desired_dma Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 25/53] tpm/tpm_i2c_stm_st33: Fix potential bug in tpm_stm_i2c_send Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 26/53] Added Little Endian support to vtpm module Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 27/53] NFSv4.1: Fix a kfree() of uninitialised pointers in decode_cb_sequence_args Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 28/53] iscsi-target: Drop problematic active_ts_list usage Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 29/53] cfq-iosched: handle failure of cfq group allocation Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 30/53] cfq-iosched: fix incorrect filing of rt async cfqq Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 31/53] axonram: Fix bug in direct_access Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 32/53] tty: Prevent untrappable signals from malicious program Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 33/53] USB: cp210x: add ID for RUGGEDCOM USB Serial Console Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 34/53] USB: fix use-after-free bug in usb_hcd_unlink_urb() Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 35/53] usb: core: buffer: smallest buffer should start at ARCH_DMA_MINALIGN Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 36/53] vt: provide notifications on selection changes Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 37/53] ARM: pxa: add regulator_has_full_constraints to corgi board file Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 38/53] ARM: pxa: add regulator_has_full_constraints to poodle " Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 39/53] kdb: fix incorrect counts in KDB summary command output Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 40/53] ntp: Fixup adjtimex freq validation on 32-bit systems Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 41/53] ARC: fix page address calculation if PAGE_OFFSET != LINUX_LINK_BASE Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 42/53] KVM: s390: floating irqs: fix user triggerable endless loop Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 43/53] KVM: MIPS: Dont leak FPU/DSP to guest Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 44/53] KVM: x86: update masterclock values on TSC writes Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 45/53] hx4700: regulator: declare full constraints Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 46/53] arm64: compat Fix siginfo_t -> compat_siginfo_t conversion on big endian Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 47/53] gpio: tps65912: fix wrong container_of arguments Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 48/53] metag: Fix KSTK_EIP() and KSTK_ESP() macros Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 49/53] md/raid5: Fix livelock when array is both resyncing and degraded Greg Kroah-Hartman
2015-03-04 14:09 ` Jes Sorensen
2015-03-04 6:06 ` Greg Kroah-Hartman [this message]
2015-03-04 6:06 ` [PATCH 3.10 52/53] blk-throttle: check stats_cpu before reading it from sysfs Greg Kroah-Hartman
2015-03-04 6:06 ` [PATCH 3.10 53/53] x86, mm/ASLR: Fix stack randomization on 64-bit systems Greg Kroah-Hartman
2015-03-04 14:08 ` [PATCH 3.10 00/53] 3.10.71-stable review Guenter Roeck
2015-03-04 14:20 ` Luis Henriques
2015-03-04 18:16 ` Greg Kroah-Hartman
2015-03-04 23:40 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150304054618.321143946@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=David.Woodhouse@intel.com \
--cc=akpm@linux-foundation.org \
--cc=chenjie6@huawei.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome